Scribd Logo
Upload

Welcome to Scribd!

  • 600 views

    Reverse Engineering Cheat Sheet

    Uploaded by

    Torve Trog
    This document provides a cheat sheet for reverse engineering malware. It outlines the general malware analysis process and includes useful tips for tools like OllyDbg and IDA Pro. The process involves behavioral analysis, static code analysis, dynamic code analysis, and potentially unpacking malware. Specific tips are given for bypassing malware defenses, locating important code locations like the original entry point, and understanding common CPU register uses.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd

    Reverse Engineering Cheat Sheet

    Uploaded by

    Torve Trog
    600 views3 pages
    This document provides a cheat sheet for reverse engineering malware. It outlines the general malware analysis process and includes useful tips for tools like OllyDbg and IDA Pro. The process involves behavioral analysis, static code analysis, dynamic code analysis, and potentially unpacking malware. Specific tips are given for bypassing malware defenses, locating important code locations like the original entry point, and understanding common CPU register uses.

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document provides a cheat sheet for reverse engineering malware. It outlines the general malware analysis process and includes useful tips for tools like OllyDbg and IDA Pro. The process involves behavioral analysis, static code analysis, dynamic code analysis, and potentially unpacking malware. Specific tips are given for bypassing malware defenses, locating important code locations like the original entry point, and understanding common CPU register uses.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    600 views3 pages

    Reverse Engineering Cheat Sheet

    Uploaded by

    Torve Trog
    This document provides a cheat sheet for reverse engineering malware. It outlines the general malware analysis process and includes useful tips for tools like OllyDbg and IDA Pro. The process involves behavioral analysis, static code analysis, dynamic code analysis, and potentially unpacking malware. Specific tips are given for bypassing malware defenses, locating important code locations like the original entry point, and understanding common CPU register uses.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 3
    At a glance
    Powered by AI
    The document outlines a process for analyzing malware that includes behavioral analysis, static and dynamic code analysis, unpacking if needed, and documenting findings. It also provides tips for tools like OllyDbg, IDA Pro, and reversing defenses.

    The general malware analysis process includes setting up an isolated lab, performing behavioral analysis, static code analysis, dynamic code analysis, unpacking if needed, and documenting findings.

    IDA Pro and OllyDbg are mentioned as tools for static and dynamic code analysis respectively. IDA Pro is used to examine code structure and flow, while OllyDbg allows stepping through and monitoring code execution.

    REVERSE ENGINEERING CHEAT SHEET

    By Lenny Zeltzer
    This cheat sheet of shortcuts and tips for reverse-engineering malware. It covers the general malware analysis process, as well as useful tips for OllyDbg, IDA Pro, and other tools. Feel free to customize it to your own needs. My reverse-engineering malware course explores these, and other useful techniques. General Approach 1. Set up a controlled, isolated laboratory in which to examine the malware specimen. 2. Perform behavioral analysis to examine the specimens interactions with its environment. 3. Perform static code analysis to further understand the specimens inner-workings. 4. Perform dynamic code analysis to understand the more difficult aspects of the code. 5. If necessary, unpack the specimen. 6. Repeat steps 2, 3, and 4 (order may vary) until sufficient analysis objectives are met. 7. Document findings and clean-up the laboratory for future analysis. Behavioral Analysis Be ready to revert to good state via dd, VMware snapshots, CoreRestore, Ghost, SteadyState, etc. Monitor local (Process Monitor, Process Explorer) and network (Wireshark, tcpdump) interactions. Detect major local changes (RegShot, Autoruns). Redirect network traffic (hosts file, DNS, Honeyd). Activate services (IRC, HTTP, SMTP, etc.) as needed to evoke new behavior from the specimen. IDA Pro for Static Code Analysis Text search Show strings window Show operand as hex value Insert comment Follow jump or call in view Return to previous view Go to next view Show names window Display function's flow chart Display graph of function calls Go to program's entry point
    Page 1 of 3

    Alt+T Shift+F12 Q : Enter Esc Ctrl+Enter Shift+F4 F12 Ctrl+F12 Ctrl+E


    Revised August 26, 2008

    REVERSE ENGINEERING CHEAT SHEET


    By Lenny Zeltzer
    Go to specific address Show listing of names Display listing of segments G Ctrl+L Ctrl+S

    Show cross-references to selected function Select function name Ctrl+X Show stack of current function OllyDbg for Dynamic Code Analysis Step into instruction Step over instruction Execute till next breakpoint Execute till next return Show previous executed instruction Show next executed instruction Return to previous view Show memory map Follow expression in view Insert comment Follow jump or call in view Show listing of names New binary search Next binary search result Show listing of software breakpoints Assemble instruction in place of selected one Edit data in memory or instruction opcode Show SEH chain Show patches Bypassing Malware Defenses To try unpacking quickly, infect the system and dump from memory via LordPE or OllyDump. For more surgical unpacking, locate the Original Entry Point (OEP) after the unpacker executes. If cannot unpack cleanly, examine the packed specimen via dynamic code analysis while it runs. When unpacking in OllyDbg, try SFX (bytewise) and OllyDump's "Find OEP by Section Hop".
    Page 2 of 3 Revised August 26, 2008

    Ctrl+K

    F7 F8 F9 Ctrl+F9 + * Alt+M Ctrl+G ; Enter Ctrl+N Ctrl+G Ctrl+L Alt+B Select instruction Spacebar Select data or instruction Ctrl+E View SEH chain Ctrl+P

    REVERSE ENGINEERING CHEAT SHEET


    By Lenny Zeltzer
    Conceal OllyDbg via HideOD and OllyAdvanced. A JMP or CALL to EAX may indicate the OEP, possibly preceded by POPA or POPAD. Look out for tricky jumps via SEH, RET, CALL, etc. If the packer uses SEH, anticipate OEP by tracking stack areas used to store the packers' handlers. Decode protected data by examining results of the decoding function via dynamic code analysis. Correct PE header problems with XPELister, LordPE, ImpREC, PEiD, etc. To get closer to OEP, try breaking on unpackers calls to LoadLibraryA or GetProcAddress. Common x86 Registers and Uses EAX ECX EBP ESP EIP EFLAGS Addition, multiplication, function results Counter Base for referencing function arguments (EBP+value) and local variables (EBP-value) Points to the current "top" of the stack; changes via PUSH, POP, and others Points to the next instruction Contains flags that store outcomes of computations (e.g., Zero and Carry flags)

    Page 3 of 3

    Revised August 26, 2008

    You might also like