Reverse Engineering in Computer Applications

Table of Contents 2 1. Introduction 5 1.1 About the Course and Notes 5 1.2 Definitions 5 1.3 Typical Examples 6 1.3.1 Hacking 7 1.3.2 Hiding Information from Public 7 1.3.3 Cell Phones 10 1.3.4 Computer Applications 10 1.4 Requirements 12 1.5 Scope 13 1.6 Ethics 13 1.7 Miscellaneous Information 14 2. Programming Processors 16 2.1 Programming Languages 16 2.2 Processor Arithmetic 18 2.3 Memory Structure 22 2.3.1 Variables 23 2.3.2 Unicode Strings 24 2.3.3 Pointers 24 3. Windows Anatomy 26 3.1 Windows API 26 3.2 File System 27 3.3 File Anatomy 28 3.3.1 File Header 29 3.3.2 Into PE Format 31 3.3.3 The PE Header 34 3.3.3.1 Image File Header 36 3.3.3.2 Image Optional Header 38 3.3.4 Section Table 43 3.3.5 Commonly Encountered Sections 51 3.3.6 PE File Imports 59 3.3.7 PE File Exports 62 4. Basic Concepts of Assembly 67 4.1 Registers 67 4.2 Flag 70 4.3 Memory 71 4.4 Stacks 73 4.5 Interrupts 74 5. Assembly Commands 76 5.1 CMP: Compare Two Operands 76 5.1.1 Description 76 5.1.2 Operation 76 5.1.3 Opcode Instruction Description 77 5.2 J cc: Jump if Condition Is Met 77 5.2.1 Description 77 5.2.2 Operation 79 5.2.3 Opcode Instruction Description 79 5.3 PUSH: Push Word or Doubleword Onto the Stack 81 5.3.1 Description 81 5.3.2 Operation 82 5.3.3 Opcode Instruction Description 83 5.4 POP: Pop a Value from the Stack 84 5.4.1 Description 84 5.4.2 Operation 85 5.4.3 Opcode Instruction Description 88 5.5 AND: Logical AND 88 5.5.1 Description 88 5.5.2 Operation and Example 88 5.5.3 Opcode Instruction Description 89 5.6 NOT: One's Complement Negation 90 5.6.1 Description 90 5.6.2 Operation and Example 90 5.6.3 Opcode Instruction Description 90 5.7 OR: Logical Inclusive OR 91 5.7.1 Description 91 5.7.2 Operation and Example 91 5.7.3 Opcode Instruction Description 92 5.8 XOR: Logical Exclusive OR 92 5.8.1 Description 92 5.8.2 Operation and Example 92 5.8.3 Opcode Instruction Description 93 5.9 Other instructions 94 5.9.1 CALL: Call Procedure 94 5.9.1.1 Near Call 94 5.9.1.2 Far Calls in Real-Address or Virtual-8086 Mode 95 5.9.1.3 Far Calls in Protected Mode 96 5.9.1.4 Mixing 16-Bit and 32-Bit Calls 98 5.9.2 ADD: Add 99 5.9.3 SUB: Subtract 99 5.9.4 MUL: Unsigned Multiply 99 5.9.5 DIV: Unsigned Divide 100 5.9.6 MOV: Move 100 6. SoftIce for Windows 103 6.1 Installing SoftIce 103 6.2 Configuring SoftIce 105 6.2.1 Resizing Panels 105 6.2.2 Panels 106 6.2.3 Other Useful Settings 107 6.2.4 SoftIce Window 107 6.2.5 Symbols 108 6.3 Breakpoints 109 6.3 Useful Functions 112 6.4 Navigation in SoftIce 112 7. Hackman Editor 114 7.1 String Manipulation 114 7.2 Version Stamp 116 7.3 Date Stamp 117 7.4 Icon Resources 118 7.5 Other Tools 119