Skip to Main Content
Mastering Reverse Engineering
book

Mastering Reverse Engineering

by Reginald Wong
October 2018
Beginner to intermediate content levelBeginner to intermediate
436 pages
9h 36m
English
Packt Publishing
Content preview from Mastering Reverse Engineering

Debugging

We will be using x86dbg for our debug session. Remember that we decompressed the file using UPX. It would be wise to open the decompressed version instead of the original whatami.exe file.  Opening the compressed will be fine but we will have to go through debugging the UPX packed code.

Unlike IDA Pro, x86dbg is not able to recognize the WinMain function where the real code starts. In addition, after opening the file, the instruction pointer may still be somewhere in the NTDLL memory space. And to avoid being in an NTDLL region during startup, we may need to make a short configuration change in x86dbg.

Select Options->Preference. Under the Events tab, uncheck System Breakpoint and TLS Callbacks. Click on the Save button and then ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Start your free trial

You might also like

Reversing: Secrets of Reverse Engineering

Reversing: Secrets of Reverse Engineering

Eldad Eilam
Understanding the Linux Kernel, 3rd Edition

Understanding the Linux Kernel, 3rd Edition

Daniel P. Bovet, Marco Cesati

Publisher Resources

ISBN: 9781788838849Supplemental Content