Programming Linux: Anti-Reversing Techniques

Description

Programming Linux Anti-Reversing Techniques teaches the reader how to code and analyze well known anti-reversing techniques for Linux. The book shows how a reverse engineer analyzes a binary using tools like IDA, Radare2, GDB, readelf, and more. The code is presented to the reader ready to compile and analyze on their own. Unlike many reverse engineering books, Programming Linux Anti-Reversing Techniques provides working code so that the reader can better understand how anti reverse engineering techniques are generated and analyzed. The code starts off as a very straight forward C bind shell that gets modified throughout the book. Each chapter shows the reader how a reverse engineer might look at a binary and how to frustrate that analysis. Preface Why Read This Book? Topics Not Covered Prerequisites Code and Command Output Chapter 1: Introductions Introducing “Trouble” Using CMake The Code Compiling Executing Accessing the Shell Chapter 2: Compiler Options -g Recovering the Bind Shell Password with Hexdump Recovering the Bind Shell Password with GDB The Debugging Information in IDA Removing the Debugging Information Case Study: XOR DDOS -s SYMTAB vs. DYNSYM Finding the Bind Shell Password Using .symtab Case Study: The FILE Symbol Examing Trouble After -s -fvisibility Looking at FUNC symbols Hiding FUNC symbols -O Corrected Block Tiny Encryption Algorithm (XXTEA) -Os -O3 -funroll-loops -static Resolving Functions at Runtime ltrace LD_PRELOAD Using musl Chapter 3: File Format Hacks The Strip Utility Removing the Section Headers Table Little Endian or Big Endian? The Sections Are a Lie Flipping the Executable Bit Lying with .init Hiding the Entry Point Mixing the Symbols Chapter 4: Fighting Off String Analysis Code Reorganization Stack Strings XOR Stack String Function Encryption Computing the Function’s Size Using a Linker Script Decryption Logic Encryption Logic Creating a Cryptor Implementing the Cryptor Analyzing the Cryptor Chapter 5: Obstructing Code Flow Analysis Indirect Function Calls Signals Early Return Jump Over an Invalid Byte Jump! Jump! Always Follow the Conditional Overlapping Instructions Chapter 6: Evading the Debugger Trace Me Trapping the Debugger Becoming Attached madvise prctl Detection Before main() Computing Function Checksums Conclusion: All That We Fall For Notes