反逆向工程揭密（试炼篇）


IT资讯	系统天下	网盟学院


硬件DIY	软件下载	网络安全

您现在的位置： ChinaBeta.cn 中文IT资讯 >> 网盟学院 >> 编程类 >> 其它编程程序 >> 网管技术正文

	让我穿过那道"墙"! 畅游网络应…		主动防御！瑞星杀毒2008抢先评…
	速度超快 Discuz! 6.0.0试用手…		奇虎举证:各杀毒软件均报CNNIC…
	Google Earth 4.2加入繁体中文…		专业防护！瑞星防火墙2008测试…
	挂载RAR文件从认识到爱上WinM…		让你冲浪随心所欲如何访问被封…
	轻装上阵！江民杀毒软件2008速…		VMware Fusion苹果版全程图解(…
	VMware Fusion苹果版全程图解(…		从菜鸟出发!征服高清详细评测全…
	VS2008和ASP.NET 3.5使用之初体…		[多图]Ubuntu 7.04 初体验
	东风吹战鼓擂下载软件你选谁?		若隐若现 Windows XP DirectX …
	GPRS上网全攻略		主流杀毒软件Vista兼容性横评
	基于IRF的网络管理和业务管理解…		83个美丽的Wordpress主题
	软交换网络中的关键路由技术详…		不只是换肤?Windows Mobile 6 …
	css教程–十步学会用css建站(全…		巧妙设置路由预防网络频繁掉线
	打造网络管理七大绝技		CorelDRAW X3 Service Pack 2 …
	重温经典:回归 Live Messenger…		Oracle数据库补丁分类、安装及…

反逆向工程揭密（试炼篇）

Www.ChinaBeta.Cn 更新时间：2006-7-25 阅读次数：

【ChinaBeta.Cn 网盟学院】

Abstract
Rather than doing another complete analysis of the binary, i will rather present the techniques i have used in the challenge, and how i have implemented them. The Scan of the Month 33 was released by the Honeynet Project in November 2004. I invite everyone to read the excellent submissions we received this month once they have read my paper. I am presenting the binary from the protection author point of view, while they presented it from the analyst point of view. You will learn the methods and techniques used to Protect
/ Unprotect a binary with this month's challenge. A lot of weaknesses were left on purpose in this binary and they will be presented here.
Keywords: Software Protection; Reverse Code Engineering; Linux; Anti-Debugging; Anti-Anti-Debugging

摘要：
有人偏爱详细的分析过程，而我却喜欢从技术和实现方法的层面上去探讨。2004年的11月，The Honeynet Project发布了The scan of the month 33。我推荐大家好好的研读一下。他们研究的就是前者。我除了对技术和实现方法进行研究外，大量的漏洞在我的文中也有披露。
关键词：软件保护；逆向工程；Linux;反调试；调试。

1. Introduction
This month's challenge is to analyze an unknown binary, in an effort to reinforce the value of reverse engineering, and improve (by learning from the security community) the methods, tools and procedures used to do it. This challenge is similar to SotM 32. However, this binary has mechanisms implemented to make the binary much harder to analyze, to protect against reverse engineering.

1.简介：
最新的month 33挑战了一段未知的二进制代码，这对于我们加深逆向印象、改进方法、了解工具的使用及其整个过程具有积极的作用。这与先前发布的The scan of the month 32是相同的。唯一不同的是，此二进制代码更加难于分析。

Skill Level: Advanced/Expert
All we are going to tell you about the binary is that it was 'found' on a WinXP system and has now be sent to you for analysis. You will have to analyse it in-depth and get as much information as possible about its inner working, and what is the goal of the binary. The main goal of this challenge is to teach people how to analyse heavily armored binaries. Such techniques could be used in the future, and its time to get used to them.
2. Identify and explain any techniques in the binary that protect it from being analyzed or reverse engineered

技术含量：中/高级
你将自己独立分析这些基于WinXP环境下的二进制代码。想完成挑战，你必须深刻的分析问题，搜集更多的信息去了解内部原理以及体会代码中包含
的目的。最终使你能够独立的分析一层又一层的代码。

[1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] 下一页