Reverse Engineering For Everyone
2024

@reverseengine

Native Function and Assembly Code Invocation

https://research.checkpoint.com/2022/native-function-and-assembly-code-invocation

@reverseengine

Reverse Engineering Android Spyware

https://www.youtube.com/live/aLCoyJof95Y

@reverseengine

Bytecode77//r77

https://github.com/bytecode77/r77-rootkit

@reverseengine

LayeredSyscall – Abusing VEH to Bypass EDRs

https://whiteknightlabs.com/2024/07/31/layeredsyscall-abusing-veh-to-bypass-edrs

@reverseengine

Learn Reverse Engineering for Beginners

https://v3nn00m.github.io

@reverseengine

Reverse Engineering 3011: Reversing C++ Binaries

https://p.ost2.fyi/courses/course-v1:OpenSecurityTraining2+RE3011_re_cpp+2022_v1/about?s=09

@reverseengine

Detecting Crypto-Ransomware in IoT Networks Based on Energy Consumption Footprint

https://www.researchgate.net/publication/319252402_Detecting_crypto-ransomware_in_IoT_networks_based_on_energy_consumption_footprint

@reverseengine

Racing bugs in Windows kernel

https://dannyodler.hashnode.dev/racing-bugs-in-windows-kernel

@reverseengine

Aiding Reverse Engineering with Rust and a local LLM

https://security.humanativaspa.it/aiding-reverse-engineering-with-rust-and-a-local-llm

@reverseengine

Reverse Engineering Android Apps for API Keys

https://pwn.guide/free/forensics/re-android

@reverseengine

Bypassing Windows Defender antivirus in 2025: Evasion Techniques Using Direct Syscalls and XOR Encryption

https://www.hackmosphere.fr/bypass-windows-defender-antivirus-2025

@reverseengine

Disassembling a Binary: linear Sweep and Recursive Traversal

https://nicolo.dev/en/blog/disassembling-binary-linear-recursive

@reverseengine

Analyzing ELF/Sshdinjector.A!tr with a Human and Artificial Analyst
https://www.fortinet.com/blog/threat-research/analyzing-elf-sshdinjector-with-a-human-and-artificial-analyst

@reverseengine

Ransomware Groups Exploiting Microsoft Teams

https://gosecure.ai/blog/2025/01/22/ransomware-groups-exploiting-microsoft-teams

@reverseengine

The Definitive Guide to Linux Process Injection

https://www.akamai.com/blog/security-research/the-definitive-guide-to-linux-process-injection

@reverseengine

Google-CTF 2025

https://github.com/google/google-ctf/tree/main/2025

@reverseengine

وقتی C با آرایه‌ها کار میکنه کامپایلر چی تولید میکنه و چطور ما از روی اسمبلی بفهمیم indexing دقیقا چکار میکنه

یک مثال ساده در C

int arr[4] = {10, 20, 30, 40};

int get(int i){
    return arr[i];
}

کامپایلر چی میکنه

آرایه روی دیتا سکشن ذخیره میشه و index تبدیل میشه به:

address = base + index * sizeof(element)

چون int = 4 بایت:

arr[i] → arr + i*4

اسمبلی get در x86-64 بدون بهینه‌ سازی زیاد

get:
    mov     eax, DWORD PTR               
arr[rax*4]   ; eax = arr[i]
    ret

نکات مهم:

معنی دستورات

rax
پارامتر i

arr آدرس ثابت آرایه

rax*4
چون int چهار بایته

mov eax, [...]
مقدار رو در eax برمیگردونه return value


مهم‌ترین قانون

هر وقت دیدید reg * 4, reg * 8, reg * 2  یعنی داره به آرایه دسترسی میده

پایین دستورات به ترتیب نوع داده سایز ضربدر رجیستر

char / int8_t 1    i*1

short / int16_t 2    i*2

int / float4  i*4

long / pointer / int64_t 8   i*8

What does the compiler produce when C works with arrays and how do we understand from the assembly what exactly indexing does

A simple example in C

int arr[4] = {10, 20, 30, 40};

int get(int i){
return arr[i];
}

What does the compiler do

The array is stored in the data section and the index becomes:

address = base + index * sizeof(element)

Since int = 4 bytes:

arr[i] → arr + i*4

Assembly get in x86-64 without much optimization

get:
mov eax, DWORD PTR
arr[rax*4] ; eax = arr[i]
ret

Important points:

Meaning of commands

rax Parameter i

arr array constant address

rax*4 Since int is four bytes

mov eax, [...] Returns the value in eax return value

The most important rule

Whenever you see reg * 4, reg * 8, reg * 2, it means that the array is being accessed

Below are the commands in order of data type size times register

char / int8_t 1 i*1

short / int16_t 2 i*2

int / float4 i*4

long / pointer / int64_t 8 i*8

@reverseengine

تحلیل پچ Patch Analysis


فهمیدن فرق دو نسخه از یک باینری: چه چیزی تغییر کرده کد کجا اصلاح شده ایا باگ فیکس شده یا رفتار جدیدی اضافه شده

مثال:
دو نسخه‌ی یک برنامه‌ی open-source یا نمونه قانونی رو با ابزار هایی مثل BinDiff/Diaphora مقایسه کنید و ببینید تو کد چه توابعی تغییر کردن بعد pseudocode اون توابع رو چک کنید تا دلیل تغییر مشخص بشه

دیتکشن

توابعی که signature یا آدرس‌شون تغییر کرده ولی اسم ندارن احتمالا patch مهمه

اضافه شدن یا حذف شدن چک‌ های ورودی یا شرط‌ ها


میتیگیشن

سازمان: همیشه patch ها رو اول توی محیط تست بررسی کنید برای نسخه‌ها changelog و hash نگه دارید

توسعه‌دهنده: Release note دقیق بنویسید و نماد signature/hash ارائه بدید تا کسی بتونه درستی فایل رو چک کنه



Patch Analysis

Understanding the difference between two versions of a binary: what has changed, where the code has been modified, whether a bug has been fixed, or new behavior has been added

Example:
Compare two versions of an open-source program or legal sample with tools like BinDiff/Diaphora and see what functions in the code have changed, then examine the pseudocode of those functions to determine the reason for the change

Detection

Functions that have changed signatures or addresses but no names are likely important patches

Added or removed input checks or conditions

Mitigation

Organization: Always test patches in a test environment first, keep a changelog and hash for the versions

Developer: Write a detailed release note and provide a signature/hash symbol so that someone can check the file for correctness

@reverseengine