x86 Software Reverse-Engineering, Cracking, and Counter-Measures

CHAPTER 16Advanced Techniques

Up to this point, this book has covered the core tools and skills used for reverse engineering and cracking. However, this is an evolving field, and new methods are being developed to make it faster and easier. This section describes at a high level some advanced techniques and tools on the cutting edge of reverse engineering. Our goal with this chapter is that if at this point you're still loving software cracking and looking to take it even further to the next level, we want to present you with a plethora of rabbit holes to go down. Depending on what interests you, we hope the following will point you in the right directions to go deeper.

Timeless Debugging

Timeless debugging is also known as reverse debugging. The core idea is: “what if we could go backwards when debugging?”

Consider the case where something went wrong while debugging. Maybe a patch failed, you missed an anti-debug check, you don't know how you got here, etc.

There are a few different tools designed for timeless debugging, including the following:

• Visual Studio Ultimate (.NET)
• rr
• gdb

To get started, check out George Hotz @ Enigma in his 2016 USENIX Enigma talk at www.youtube.com/watch?v=eGl6kpSajag.

Binary Instrumentation

Binary instrumentation is when you inject code to watch or modify a process as it executes. This can be useful for finding memory leaks, tracing key checks, performing anti-anti-debugging, etc.

Some tools for binary instrumentation include the following: ...