Skip to Main Content
Mastering Reverse Engineering
book

Mastering Reverse Engineering

by Reginald Wong
October 2018
Beginner to intermediate content levelBeginner to intermediate
436 pages
9h 36m
English
Packt Publishing
Content preview from Mastering Reverse Engineering

The unknown image

At this point, we have the memory dump opened in IDA Pro and have the same unknown image mapped into a Calculator process. We will work with both tools by using IDA Pro for viewing the disassembly code and x86dbg for debugging.

In x86dbg, we have placed a breakpoint at the WinMain address of the unknown image. However, the instruction pointer is still at an NTDLL address. Hit F9 to make it continue and bring us to our WinMain.

Taking a detailed look at the disassembly codes from WinMain, we will notice an SEH anti-debug here: 

call sub_4017CB goes to a subroutine that has a call $+5pop eax, and then a retn instruction.   ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Start your free trial

You might also like

Reversing: Secrets of Reverse Engineering

Reversing: Secrets of Reverse Engineering

Eldad Eilam
Understanding the Linux Kernel, 3rd Edition

Understanding the Linux Kernel, 3rd Edition

Daniel P. Bovet, Marco Cesati

Publisher Resources

ISBN: 9781788838849Supplemental Content