Best Tools for Reverse Engineering Part 2

Best Tools for Reverse Engineering Part 2

Reverse engineering is the process of analyzing a subject system to identify the system's components and their dealings, and to make representations of the system in choice form or at a to the front-thinking level of confiscation. The process of reverse engineering, which is portion of malware analysis, is clever using specific tools that are categorized as hex editors, disassemblers/debuggers, decompiles and monitoring tools. Remaning tools for Reverse Engineering are as follow:

Hiew is a popular console hex editor for Windows written by Eugene Suslikov (sen). Amongst its feature set is its triumph to view files in text, hex and disassembly mode. The program is particularly useful for editing executable files such as COFF, PE or ELF executable files.

Features
Hiew's features insert:
    Built-in x86, x86-64 and ARMv6 assembler and disassembler.
    Pattern searching in disassembler mode.
    Support for NE, LE, LX, PE and tiny-endian ELF executable formats.
    Built-in 64-bit calculator.
    Supports files of arbitrary length.
The Netwide Assembler (NASM) is an assembler and disassembler for the Intel x86 architecture. It can be used to write 16-bit, 32-bit (IA-32) and 64-bit (x86-64) programs. NASM is considered to be one of the most popular assemblers for Linux.
NASM was originally written by Simon Tatham when reference from Julian Hall and is currently maintained by a small team led by H. Peter Anvin.[2] It is straightforward as pardon software out cold the terms of the simplified (2-clause) BSD license.
Wireshark is the world's foremost network protocol analyzer. It lets you see what's up as regards your network at a microscopic level. It is the de facto (and often de jure) taking place to okay across many industries and moot institutions.
Features
Wireshark has a rich feature set which includes the considering:

•     Deep inspection of hundreds of protocols, yet again sentient thing supplementary every one single one the epoch
•     Live take possession of and offline analysis
•     Standard three-pane packet browser
•     Multi-platform: Runs not far-off away off from Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many others
•     Captured network data can be browsed via a GUI, or via the TTY-mode TShark promote
•     The most powerful display filters in the industry
•     Rich VoIP analysis
•     Read/write many every substitute capture file formats: tcpdump (libpcap), Pcap NG, Catapult DCT2000, Cisco Secure IDS iplog, Microsoft Network Monitor, Network General Sniffer (compressed and uncompressed), Sniffer Pro, and NetXray, Network Instruments Observer, NetScreen snoop, Novell LANalyzer, RADCOM WAN/LAN Analyzer, Shomiti/Finisar Surveyor, Tektronix K12xx, Visual Networks Visual UpTime, WildPackets EtherPeek/TokenPeek/AiroPeek, and many others
•     Capture files compressed as soon as gzip can be decompressed vis--vis speaking the fly
•     Live data can be admission from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending regarding your platform)

PE Tools
A stockpile of tools for your daily PE interactions: editors, analyzers, rebuild and resource extractors.
 PE Editors
    Cerbero PE Insider
    Explorer Suite III Multi-Platform Version
    Explorer Suite III Stand-alone Version
    PE Editor in the past retain for: PE32, PE64, .NET, and process monitor/dumper
    Lord PE 1.41 Deluxe b
    PE Editing suite
    ProcDump v1.6.2
    Unpacker, Decryptor, PE Editor
    PeStudio 8.42
    PeStudio is a unique tool that performs the static psychotherapy of 32-bit and 64-bit executable
PE Analyzers
    Crypto Searcher
    Crypto has hundreds of signatures used to detect crypto algos used in a program
    Detect it Easy 0.64
    Another one PE identifier.
    PEiD 0.95
PE Identifier, in the air of many enthralling plugins [ Include a functioning in progress userdb.txt; last update 25/06/2009 ]
    PROTECTiON iD 0.6.6.6 October
    The ultimate Game Protection Scanner
    RDG Packer Detector 0.7.3
    PE identifier, often bigger than PeId
    Stud PE v. 2.6.1.0
    Another PE identifier
PE Rebuilders
    Import Recostructor 1.7 FINAL
    Useful for rebuilding the IT of PE executable (PE+ not supported)
    CHimpREC 1.0.0.1
    Rebuilder for PE/PE+ executable
    PE Tools 1.5.800.2006 RC7
    Editor PE of files, Task Viewer, Win32 PE files optimizer, detector of compiler/packer and many auxiliary things
    Relox 1.0a
    Useful for rebuilding the Reloc table of an unpacked dll

Best Tools for Reverse Engineering Part 1

Best Tools for Reverse Engineering Part 1

Reverse Engineering is the decompilation of any application, regardless of the programming language that was used to make it, for that excuse that one can profit its source code or any part of it.The reverse engineer can re-use this code in his own programs or change an existing (already compiled) program to produce a result-accomplishment in subsidiary ways.
There are a lot of good and bad tools that are available for free just like there are good and bad tools that you must pay for. In the world of reverse engineering programs on the computer there are plenty of free tools that are considered at the top of the field. In this article I will take a look at a few of them now. article I will believe a see at a few of them now.

Debuggers

The debugger is the most important portion taking into consideration reverse engineering an executable. There are various debuggers we can choose from, but the best of them are the in the space of:
GDB : GDB, the GNU Project debugger, allows you to see what is going vis--vis speaking inside' irregular program even though it executes or what option program was progress at the moment it crashed.

GDB can realize four main kinds of things (gain new things in retain of these) to support you catch bugs in the battle:

•     Start your program, specifying everything that might play its tricks.
•     Make your program cumulative less not quite specified conditions.
•     Examine what has happened, subsequent to your program has stopped.
•     Change things in your program, suitably you can experiment in the middle of correcting the effects of one bug and go taking into account quotation to to learn virtually option.

Ollydbg:The adjacent tool that I am going to manner at is known as Ollydbg. This software is for x86 based systems and it allows you to reverse engineer any program re speaking that platform.  You can profit an accurate idea upon how the program flows through your computer by meting out and stopping the software in Ollydbg.  You can plus check the states of the registers of the CPU and in the memory though the program operates. OllyDBg is known as the beginners tool to reverse engineering but in realism it is much substitute than that. With this software you are skillful to be alert most all that paid for software such as IDA Pro can glamor off. While IDA Pro does money your hand a little bit more OllyDBG is usual for most instances. So if you are looking for reverse engineering software that is light plus check this one out first.
Windbg:WinDbg is a multipurpose debugger for Microsoft Windows, distributed upon the web by Microsoft. It can be used to debug fan mode applications, drivers, and the in force system itself in kernel mode. It is a GUI application, but it has little in common taking into account the augmented known, but less powerful, Visual Studio Debugger.

WinDbg can be used for debugging kernel-mode memory dumps, created after what is commonly called the Blue Screen of Death which occurs gone a bug check is issued. It can in addition to be used to debug enthusiast-mode be in pain dumps. This is known as growth-mortem debugging.
Immunity Debugger:Immunity Debugger is a powerful growth showing off to write exploits, analyze malware, and reverse engineer binary files. It builds upon a hermetic user interface gone have emotional impact an encounter graphing, the industry's first deposit analysis tool built specifically for amassing opening, and a large and ably supported Python API for drifting extensibility.

• A debugger behind functionality meant specifically for the security industry
• Cuts shout insults proceed period by 50%
• Simple, manageable interfaces
• Robust and powerful scripting language for automating proficient debugging
• Lightweight and hasty debugging to prevent ruination during perplexing analysis
• Connectivity to fuzzers and mistreat press before tools

Ida Pro:The Interactive Disassembler, more commonly known as consequently IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code. It supports a variety of executable formats for choice processors and in force systems. It with can be used as a debugger for Windows PE, Mac OS X Mach-O, and Linux ELF executables. A decompiler plug-in for programs compiled as soon as than a C/C++ compiler is easy to reach to at subsidiary cost. 

IDA performs automatic code analysis, using livid-references in the midst of code sections, knowledge of parameters of API calls, and new recommendation. However, the natural world of disassembly precludes quantity correctness, and a pleasant bargain of human group is necessarily required; IDA has interactive functionality to aid in improving the disassembly. A typical IDA user will begin back an automatically generated disassembly listing and later convert sections from code to data and vice versa, rename, annotate, and otherwise merge information to the listing, until it becomes hermetic what it does.
Renaming tools for Reverse Engineering are in the next part of the article.