Practical Reverse Engineering 2 - Pg 35 Exercise 1 Sample J
Support us on Patreon: http://bit.ly/38mnveC
In this video I will teach you how to reverse engineer sample J, which is an executable file which calls CreateToolHelp32Snapshot() and loops through the running processes trying to find explorer.exe. I will show you how to reverse engineer it using IDA Pro for static analysis and x64dbg for dynamic analysis. I'll walk you thought each line of assembly and figure out what each instruction does. I will show you how I re-created this binary in assembly to get a better understanding of how it works. Practical Reverse Engineering is a great book that is still valuable today, not much in terms of core malware analysis and Windows API has changed. This reverse engineering tutorial is perfect for someone that wants to get more experience reverse engineering.
Discussion: https://bit.ly/30d6Wz1
IDT Tutorial: https://guidedhacking.com/threads/idtr-interrupt-descriptor-table-register-tutorial.15269/
Practical Reverse Engineering book: https://www.amazon.com/Practical-Reverse-Engineering-Reversing-Obfuscation/dp/1118787315
This video is made by Ismael Vasquez Jr:
Website - https://ismaelvazquezjr.com
Twitter - https://twitter.com/IsmaelVazquezJr
Facebook - https://facebook.com/vazquezjrismael
Github - https://github.com/ismaelvazquezjr
LinkedIn - https://linkedin.com/in/ismael-vazquez-jr-a6abb119b
Reverse engineering is the process of analyzing software and understanding it, without having access to the source code. Hackers are able to reverse engineer systems and exploit what they find with scary results. Now we can use the same tools to stop these threats. Practical Reverse Engineering goes under the hood of reverse engineering for security analysts, security engineers, system programmers, so they can learn how to use the same processes to stop hackers in their tracks.
- Offers a complete approach to understanding reverse engineering, with hands-on exercises and real-world examples
- Covers x86, x64, and advanced RISC machine (ARM) architectures as well as deobfuscation and virtual machine protection techniques
- Provides special coverage of Windows kernel-mode code (rootkits/drivers), a topic not often covered elsewhere, and explains how to analyze drivers
- Includes a bonus chapter on reverse engineering tools
- Practical Reverse Engineering: Using x86, x64, ARM, Windows Kernel, and Reversing Tools provides crucial, up-to-date guidance for a broad range of IT professionals.
The book covers x86, x64, and ARM (the first book to cover all three); Windows kernel-mode code rootkits and drivers; virtual machine protection techniques; and much more. Best of all, it offers a complete approach, with plenty of exercises and examples.
GH:
Donate on our Forum : http://bit.ly/2HkOco9
Support us on Patreon : http://bit.ly/38mnveC
Follow us on Facebook : http://bit.ly/2vvHfhk
Follow us on Twitter : http://bit.ly/3bC7J1i
Follow us on Twitch : http://bit.ly/39ywOZ2
Follow us on Reddit : http://bit.ly/3bvOB57
Follow us on GitHub : http://bit.ly/2HoNXIS
Follow us on Instagram : http://bit.ly/2SoDOlu