1. Reverse Engineering Workshop
Tip: simple SEO adjustments can make your presentation more discoverable. Read this PDF for best practices: 
Cathal Mullaney /
Alan Neville /

2. Agenda 1 Reverse Engineering in Security 2 PE File Format 3
Crash Course in Assembly 4
Tools 5
Challenges
Copyright © 2015 Symantec Corporation

3. Reverse Engineering in Security
Video Time!
Copyright © 2015 Symantec Corporation

4. A Peek at the PE File Format
Copyright © 2015 Symantec Corporation

5. Let’s start with an example..
9,216 bytes Simple.exe
Compiled in VS2015
1. Using Visual Studios, we can write a simple Hello, World! Example in C
2. We compile the code as an application.. This is what it looks like on disk – it takes up 9,216 bytes of space
3. Looking at the assembly code generated by the bytes-code – we have the following block
4. On the left side, you can see the op-codes that are generates. This is what the machine reads
5. And when we run the application, we get the output we expect
Copyright © 2015 Symantec Corporation

6. Inside Simple.exe C code translated into op-codes
Op-codes represented by bytes
Highlighted bytes represent the C code written for simple.exe
Only a total of 20 bytes!
But what’s all the other stuff?!
PE Format to save the day!
Copyright © 2015 Symantec Corporation

7. PE Format Layout Standard binary file format for Windows
Introduced in Windows NT 3.1
Win32 SDK contains file winnt.h
Describes the structure and variables used in PE files
File imagehlp.dll contains functions to manipulate PE files
PE files are broken into regions that can be examined
Developed by Mark Zbikowski at MS in 1990
Used to bridge gap between DOS and Windows executables
PE File
DOS Header
PE Header
Optional Header
Section Table
Sections
(code, data, imports)
Resources
Overlay
Copyright © 2015 Symantec Corporation

8. DOS Header First two letters always ‘MZ’ (0x4D5A) MS DOS header
Starts at offset 0x0
Aka “magic number” or File Signature
Determines the type of file
All file types use magic numbers
Java – 0xCAFEBABE
ZIP – 0x504B – “PK”
MS DOS header
Ensures backwards compatibility
If file executed in the wrong environment, error message is displayed
“This program cannot be run in DOS mode.”
Copyright © 2015 Symantec Corporation

9. PE Header Known as the ‘File Header’ Contains useful information
Machine
what architecture the file was compiled for
Number of sections
TimeDateStamp
when the file was compiled
SizeOfOptionalHeader
length of following header
Characteristics
0x02 – executable file
0x2000 – file is a DLL, not an EXE
Copyright © 2015 Symantec Corporation

10. Optional PE Header Despite it’s name, it is not optional 
Required in executable files, not COM files
Occurs directly after PE Header
Contains LOTS of information
Version info of the compiler
Size of the file
Checksum – ensure file integrity
And more!
AddressOfEntryPoint
Most important field here!
Copyright © 2015 Symantec Corporation

11. Section Table PE header defines a number of sections
Code is placed in these sections
Each section definition is 40 bytes in length
Section Name (.text, .data etc)
Size of the section once loaded into memory
Location of section (RVA)
Physical size of section on disk
Physical location etc
Resource named .rsrc
Import named .idata
Export named .edata
Flags used to describe the type of data in the section
PE File
DOS Header
PE Header
Optional Header
Section Table
Sections
(code, data, imports)
1..n
Resources
Overlay
Copyright © 2015 Symantec Corporation

12. Parsing the PE file structure yourself
Pefile – python module -
“multi-platform Python module to parse and work with PE files”
Self-contained – not dependencies!
Access PE header
Retrieve embedded data
Read strings
Identify malformed values
Explore all features of the PE format
Can be used to manipulate the PE structure
Allows writing to some of the fields
Experiment by changing the data – see how Windows reacts
Copyright © 2015 Symantec Corporation

13. Assembly Crash Course
Copyright © 2015 Symantec Corporation

14. Copyright © 2015 Symantec Corporation

15. What is assembly language?
HHL
(Java, C, C++ etc)
Assembly 
Op-codes
Machine Code
Copyright © 2015 Symantec Corporation

16. Registers EAX, EBX, ECX, EDX – all purpose registers
ESI, EDI – source and destination index pointers
ESP – stack pointer
EBP – base pointer, points to return address
Also important is EIP – instruction pointer, points to the next instruction to run
Copyright © 2015 Symantec Corporation

17. The Stack
Part of memory where program stores variables + function args
Last-in-first-out (LIFO)
Things are added to the top of the stack
push
Things are removed from the top of the stack
pop
It grows backwards
Grows from highest memory address to lowest
ESP + EBP – registers to work with stack
ESP points to top of stack
EBP points to local variables
Copyright © 2015 Symantec Corporation

18. The Stack – Example int a = 10 int b = 5 int c = 2 push 10 push 5
High address
int a = 10
int b = 5
int c = 2
C – esp+16
B – esp+12
push 10
push 5
push 2
call addNums
A – esp+8
EBP register
Points to top of the current frame
This is the same as your return address
EBP+4
Points to first argument passed into function
EBP-4
Points to first local variable
Usually the old value of EBP
Can use this to restore the prior frame
Return address
esp+4
saved ebp
ebp-4
EBP
result
ebp-8
ESP
addNums:
int result = a+b+c;
return result;
Low address
Copyright © 2015 Symantec Corporation

19. The Stack – Example push ebp This is the standard prologe.
mov ebp, esp
sub esp, X
This is the standard prologe.
X is the total size in bytes of variables used in the function
void myfunc() {
int a, b, c; … }
Local variables can be accessed by referencing ebp
e.g. mov eax, [ebp-8]
_myfunc:
push ebp
mov ebp, esp
sub esp, 12
Copyright © 2015 Symantec Corporation

20. Basic Instructions mov dst, src Data Movement mov, push, pop, lea
Copyright © 2015 Symantec Corporation

21. Basic Instructions mov eax, 0x3 Data Movement mov, push, pop, lea EAX00 03
Copyright © 2015 Symantec Corporation

22. Basic Instructions mov ebx, 0x40100000 mov eax, [ebx] Data Movement
mov, push, pop, lea
mov ebx, 0x
mov eax, [ebx]
EAX 00 6F 6C 65 68
Copyright © 2015 Symantec Corporation

23. Basic Instructions push 10 call myfunc Data Movement
mov, push, pop, lea
push 10
call myfunc
Copyright © 2015 Symantec Corporation

24. push offset aSimpleHello
Basic Instructions
Data Movement
mov, push, pop, lea
push offset aSimpleHello
call printf
Copyright © 2015 Symantec Corporation

25. Basic Instructions push 10 .. pop Data Movement mov, push, pop, lea
Copyright © 2015 Symantec Corporation

26. Basic Instructions mov eax, 5 push eax .. pop eax Data Movement
mov, push, pop, lea
mov eax, 5
push eax ..
pop eax
EAX 00 05
Copyright © 2015 Symantec Corporation

27. Basic Instructions lea ebx, [eax] call ebx Data Movement
mov, push, pop, lea
lea ebx, [eax]
call ebx
LEA – load effective address
Copyright © 2015 Symantec Corporation

28. Basic Instructions mov eax, 2 add eax, 2
Arithmetic and Logic Instructions
add, sub – integer addition and subtraction
inc, dec – increment, decrement
mul, div – integer multiplication and division
and, or, xor – bitwise logical and, or and exclusive or
not, neg – bitwise logical not and negate
shl, shr – shift left and shift right
mov eax, 2
add eax, 2
EAX 00 04
Copyright © 2015 Symantec Corporation

29. Basic Instructions mov eax, 65 mov ecx, 4 div ecx
Arithmetic and Logic Instructions
add, sub – integer addition and subtraction
inc, dec – increment, decrement
mul, div – integer multiplication and division
and, or, xor – bitwise logical and, or and exclusive or
not, neg – bitwise logical not and negate
shl, shr – shift left and shift right
mov eax, 65
mov ecx, 4
div ecx
EDX 00 01
Copyright © 2015 Symantec Corporation

30. Basic Instructions call myfunc cmp eax, 0 jnz fail ..continue..
Control Flow instructions
jmp – jump to location
j<condition> - jump to location when condition met
je, jne, jz, jg, jge, jl, jle
cmp – compare
call, ret – subroutine call and return
call myfunc
cmp eax, 0
jnz fail
..continue..
Copyright © 2015 Symantec Corporation

31. Basic Instructions mov eax, 3 incFunc: push eax push ebp call incFunc
Control Flow instructions
jmp – jump to location
j<condition> - jump to location when condition met
je, jne, jz, jg, jge, jl, jle
cmp – compare
call, ret – subroutine call and return
mov eax, 3
push eax
call incFunc
cmp eax
jz error
call printf
incFunc:
push ebp
mov ebp, esp
add eax, 1
mov esp, ebp
pop ebp
retn
Copyright © 2015 Symantec Corporation

32. Opcode map
Copyright © 2015 Symantec Corporation

33. Experiment Play around and experiment! Write programs, decompile them
Windows, Linux, Android
Other architectures – AMD, ARM
gdb./prog
disas main
Play around with other file formats
ELF, Mach-O, Java etc
Netwide Assembler for 80x86 - NASM
Adam Stanislav -
Lots of tutorials online!
Copyright © 2015 Symantec Corporation

34. Tools
Copyright © 2015 Symantec Corporation

35. Hiew Hex editor for windows. Curses based interface.
Understands and is capable of parsing the PE Format.
Easily allows you to navigate through the PE Format.
Allows simple manipulation of Hex bytes/opcodes, Assembly language and Ascii strings embedded in the binary.
A handy tool to quickly triage a new binary.
Copyright © 2015 Symantec Corporation

36. Hiew Contains three distinct views of the Binary.
Pure hex, with Ascii strings displayed on the RHS.
Disasembly view of the binary.
Binary presented in a plaintext view.
Looks old fashioned and ugly but very powerful and extremely fast.
Lots of nice features and great shortcuts.
Bind it to a shortcut key or in a context menu for ease of use.
Copyright © 2015 Symantec Corporation

37. Hiew
Copyright © 2015 Symantec Corporation

38. Ollydbg
OllyDbg is a 32-bit assembler level analysing debugger for Microsoft Windows.
Emphasis on binary code analysis makes it particularly useful in cases where source is unavailable.
A go to tool for malware analysis tool for reverse engineers.
Can be used to reverse engineer and debug all binaries for which you don’t have the original source code.
Immediately lets you see disassembly, registers, stack and arbitrary memory locations.
Allows you to rename functions, locations and add comments to the disassembly to ease analysis.
Allows you to add breakpoints directly to the disassembly.
Contains a number of very useful plugins which can ease malware analysis and prevent nasty tricks in the code.
“Smart” debugger that recognises loops, API calls, switches etc.
Allows you to debug tricky applications easily.
Copyright © 2015 Symantec Corporation

39. Disasm view
Displays disassembly, opcodes and some useful hints of the binary/executable.
Allows single stepping into (F7) or over (F8) commands or sequences of commands.
Allows setting breakpoints (F2) on “interesting” instructions you want execution to break at (breakpoints are highlighted in red).
Easily displays Jumps (highlighted in yellow) and function Calls (highlighted in turquoise).
Copyright © 2015 Symantec Corporation

40. Registers view
Displays the common x86 registers: EAX, EBX, ECX, EDX, ESI, EDI and allows direct modification of the registers.
Useful to modify the current program’s state during execution.
Can also be useful to redirect current instructions to point at new sections of memory.
Displays the X86 flag registers and allows toggling of the flags (can be used to control conditional jumps).
Copyright © 2015 Symantec Corporation

41. Stack View
Displays the current stack of the debugged program allows modification of entries in the stack.
Allows a user to easily track stack frames for current functions and procedures.
Can be used to modify stack frames and alter stack memory directly.
Copyright © 2015 Symantec Corporation

42. Memory View
Allows an arbitrary view of memory from the currently debugged program.
Allows a user to easily manipulate memory in the current program.
Can be used to quickly jump all over the program’s memory layout using CTRL-G and an address!
Copyright © 2015 Symantec Corporation

43. Frequently used shortcuts
Ctrl+F2
Restart program
Alt+F2
Close program F3
Open new program F5
Maximize/restore active window
Alt+F5
Make OllyDbg topmost F7
Step into (entering functions)
Ctrl+F7
Animate into (entering functions) F8
Step over (executing function calls at once)
Ctrl+F8
Animate over (executing function calls at once) F9
Run
Shift+F9
Pass exception to standard handler and run
Ctrl+F9
Execute till return
Alt+F9
Execute till user code
Ctrl+F11
Trace into
F12
Pause
Ctrl+F12
Trace over
Alt+B
Open Breakpoints window
Alt+C
Open CPU window
Alt+E
Open Modules window
Alt+L
Open Log window
Alt+M
Open Memory window
Alt+O
Open Options dialog
Ctrl+T
Set condition to pause Run trace
Alt+X
Close OllyDbg
Copyright © 2015 Symantec Corporation

44. Frequently used shortcuts
Toggle breakpoint
Shift+F2
Set conditional breakpoint F4
Run to selection
Alt+F7
Go to previous reference
Alt+F8
Go to next reference
Ctrl+A
Analyse code
Ctrl+B
Start binary search
Ctrl+C
Copy selection to clipboard
Ctrl+E
Edit selection in binary format
Ctrl+F
Search for a command
Ctrl+G
Follow expression
Ctrl+J
Show list of jumps to selected line
Ctrl+K
View call tree
Ctrl+L
Repeat last search
Ctrl+N
Open list of labels (names)
Ctrl+O
Scan object files
Ctrl+R
Find references to selected command
Ctrl+S
Search for a sequence of commands
Asterisk (*)
Origin
Enter
Follow jump or call
Plus (+)
Go to next location/next run trace item
Minus (-)
Go to previous location/previous run trace item
Space (  )
Assemble
Colon (:)
Add label
Semicolon (;)
Add comment
Copyright © 2015 Symantec Corporation

45. IDA Free Free version of the IDA program.
More emphasis on binary code analysis makes it particularly useful in cases where source is unavailable.
A go to tool for malware analysis tool for reverse engineers.
Can be used to reverse engineer and debug all binaries for which you don’t have the original source code.
Immediately lets you see disassembly, registers, stack and arbitrary memory locations.
Complicated program, lots of options (has an entire book devoted to it).
More of a static file analysis tool than Ollydbg, but contains a brilliant debugger that is well worth learning.
The free version is a slightly crippled but more than enough for our simple programs.
Has a lot more features for static analysis of programs than Olly, using Olly side by side with IDA is very powerful.
Use IDA as a database for all analysis performed with Olly.
Use Olly to fill in any “blanks” you may have while statically analysing programs with IDA.
Code that looks like gibberish with IDA will make more sense when executed with Olly.
Copyright © 2015 Symantec Corporation

46. Disasm View
Displays disassembly, opcodes and some useful hints of the binary/executable.
Has “smart” code recognition, helps to identify loops, stack variables, functions (including parameters) and return values.
Will track variables deep into assembly code allowing you to identify their use accurately.
Allows commenting of almost every line of code.
Has a number (loads) of shortcuts for: renaming code, setting bookmarks, getting cross references to specific parts of code and memory locations.
Copyright © 2015 Symantec Corporation

47. Copyright © 2015 Symantec Corporation

48. Overview Navigator
Represents a linear view of the whole address space of the loaded program.
Colour coded so you can quickly see interesting parts of memory.
Turquoise: Library function.
Blue: Regular function.
Red: Instruction.
Grey: Data Item.
Pink: External Symbol.
Allows you to jump to a part of memory with left click.
Allows you to zoom in with right click.
Copyright © 2015 Symantec Corporation

49. Strings View
Strings present in the binary and associated data section addresses.
Allows you to jump directly to the location where the string is defined.
Then allows you to take an Xref, by pressing shortcut X, to see where the string is referenced from.
Can be useful for tracking interesting parts of code.
Copyright © 2015 Symantec Corporation

50. Functions View All functions and associated address in the binary.
Useful for tracking interesting functions in the binary.
When used in conjunction with function renaming makes the binary simple to navigate.
Try using it to find the _main function in each of the challenges!
Once you find the _main function you can then set a breakpoint on the first instruction using Olly!
Copyright © 2015 Symantec Corporation

51. Challenges
Demo!
Copyright © 2015 Symantec Corporation

52. Copyright © 2015 Symantec Corporation

53. Alan Neville / anev@rb Cathal Mullaney / nemo@rb

54. Additional Resources
Campaign imagery, logos and enhanced slides are located here:
Alternate background pictures for Title slides and Transition slides are located on the Brand, Digital and Advertising site: ons/globalbrand/powerpoint-templates.asp
If you are interested in additional training, specifically designing visual messages in PowerPoint please contact The Presentation Company LLC
Copyright © 2015 Symantec Corporation