Reverse Engineering Contemporary Countermeasures By: Joshua Schwartz

What is RE? “Reverse Engineering is the process of extracting the knowledge or design blue-prints from anything man-made.” -Reversing, The Secrets of Reverse Engineering

Why RE? Legit Legacy Integration Security Research Malware Analysis Illegal Software Cracking Breaking DRM Writing Malware

Who’s affected? Software Developers Can your software be RE’d easily? Intellectual Property Holders Can your source code be stolen from your final product? Big money makers RE protection is important. Big money takers Corporate espionage? Maybe…

Software Scenario… You make some software It has trial mode and paid mode The full software and trail software is the same.exe If registered its good, if not then limit the features. You can code this right? What can the crafty Reverse Engineer do?

The attack Patch the.exe Somewhere is a line that jumps if equal Change this logic and now no one needs to pay for your software.

Types of Reversing Static Analysis Look at the executable line by line Never gets run by the CPU Like a book that you can read. Behavioral Analysis Run the program in a debugger Pause and play execution See what it does

Tools WinDBG OllyDbg IDA Pro Lord PE PEid

IDA Pro

OllyDbg

Anti Reversing Techniques Removing Symbolic Information Java keeps things like class names If it isn’t removed it can make Java very easy to reverse Obfuscation Modifies the program’s layout Doesn’t change the function Anti-debugger Code if debugger attached: crash and burn isDebuggerPresent API

More… Code Encryption Code is encrypted on disk A routine decrypts the code when loading into memory Packers Proprietary algorithms that rearrange/compress code Exe gets unpacked when run similar to encryption.

References Reversing, Secrets of Reverse Engineering – Book Engineering-Malware-Part4.html