In his How To, he lists the skills hackers should acquire first:
Learn C.²²
Learn just a little bit of x86 assembler.²³ You don't have to be great at this at first, but you need to sort of kind of know what the fuck is going on.
Work through Hacking: The Art of Exploitation by Erickson.
Learn JavaScript.
Go through the big exploit archives. Star in the 1990s. Look through exploits. Figure out how they worked. Turn the clock forward to the modern era, so you slowly accustom yourself to newer exploitation techniques.
Get really good at x86 assembler, and learn IDA Pro and OllyDbg.
22. C is a general-purpose, machine-independent programming language that was used to write a range of well-known applications – from Windows operating systems to Oracle databases.
23. x86 assembler is a programming language used for time-sensitive applications and detailed software systems.
"Going Dark: The Secret Social Lives of Extremists" - Julia Ebner
IDA Pro Owner Hex-Rays Acquired by European VC Firm
IDA Pro Owner Hex-Rays Acquired by European VC Firm
Home › Cyberwarfare
IDA Pro Owner Hex-Rays Acquired by European VC Firm
By Ryan Naraine on October 18, 2022
Tweet
European venture capital and private equity firm Smartfin on Tuesday announced a deal to acquire Hex-Rays, the Belgian company behind the widely deployed IDA Pro software disassembler.
Financial terms of the acquisition were not released but Smartfin said IDA Pro creator Ilfak…
PE Tree - Python Module For Viewing Portable Executable (PE) Files
PE Tree - Python Module For Viewing Portable Executable (PE) Files In A Tree-View #Executable #Files #IDAPro
[sc name=”ad_1″]
Python module for viewing Portable Executable (PE) files in a tree-view using pefile and PyQt5. Can also be used with IDA Pro to dump in-memory PE files and reconstruct imports.
Features
Standalone application and IDAPython plugin
Supports Windows/Linux/Mac
Rainbow PE ratio map:
High-level overview of PE structures, size and file location
IDA Pro Scripting Intro - Automate Dynamic Import Resolving for REvil Ransomware (OALabs Tutorial)
The world needs Cliqz. The world needs more search engines.
Data Collection and Monitoring
Apple Explains Mysterious iPhone 11 Location Requests
If you found some other interesting stuff this week feel free to leave a link to it in the comments section. Otherwise feel free to check out the last roundup here.
A few Ghidra tips for IDA users, part 2 - strings and parameters
Who’s Behind the RevCode WebMonitor RAT?
Http GETs with comma and IP address?
IoT Goes Nuclear: Creating a Zigbee Chain Reaction
ChipWhisperer® by NewAE Technology Inc.
If you found some other interesting stuff this week feel free to leave a link to it in the comments section. Otherwise feel free to check out the last roundup here.
IDA Pro is the gold standard for disassemblers. However, IDA Pro licenses start at $1,129, so it can be extremely cost prohibitive for many. Thankfully there have been some solid alternatives that have sprouted up over the years. Here’s a list of 9 alternative disassemblers to IDA Pro.
1. Hopper
Hopper is a reverse engineering tool for OS X and Linux, that lets you disassemble, and decompile your 32/64bits Intel Mac, Linux, Windows and iOS executables!
2. x64dbg
x64dbg is an open-source x64/x32 debugger for Windows.
3. Visual DuxDebugger
Visual DuxDebugger is a 64-bit debugger disassembler for Windows, especially useful when the source code is unavailable.
4. Immunity Debugger
Immunity Debugger is a branch of OllyDbg v1.10, with built-in support for Python scripting and much more.
5. PE Explorer Disassembler
The PE Explorer Disassembler is designed to be easy to use compared with other disassemblers. To that end, some of the functionality found in other products has been left out in order to keep the process simple and fast. While as powerful as the more expensive, dedicated disassemblers, PE Explorer focuses on ease of use, clarity and navigation.
6. Hiew
Hiew is a great disassembler designed for hackers, as the name suggests. It supports three modes - Text, Hexadecimal and Decode (Dis-assembly) mode.
7. Radare2
Radare2 is an open source tool to disassemble, debug, analyze and manipulate binary files.
It actually supports many architectures (x86{16,32,64}, Dalvik, avr, ARM, java, PowerPC, Sparc, MIPS) and several binary formats (pe{32,64}, [fat]mach0{32,64}, ELF{32,64}, dex and Java classes), apart from support for filesystem images and many more features.
It runs on the command line, but it has a graphical interface in PyGTK called Bokken that has support for some of its features already.
8. ODA (Online Disassembler)
The Online Disassembler is a free web-based, reverse engineering platform that supports over 60 architectures and object file formats from all the major operating systems, including Windows, Mac OS X, Linux, and mobile platforms.
9. Panopticon
Panopticon is a disassembler that understands the semantics of opcodes. This way it's able to help the user by discovering and displaying invariants that would have to be discovered "by hand" in traditional disassemblers. This allows an interactive search through the space of all possible program executions.
This year I decided to try submitting to the annual Hex Rays plugin contest. I'm pleased to announce my plugin, Rails.
Rails is a plugin that simplifies the task of working with multiple instances of IDA Pro. There are three main advantages to Rails. First, you won't go insane trying to work with several instances at once. Second, your project databases remain uncluttered from the addition of linked libraries and other bits of code. And third, you don't need to continuously reverse the same libraries over and over again.
The plugin is pretty straight forward to use. Once you've opened up a database, just go to Edit->Plugins->Rails and enable it. This will cause a new panel to appear in IDA which lists any other open instances of IDA that are using Rails as well as output from Rails. With it you can select a function and then see the associated comments or jump to its definition where ever that may be. Another handy feature is the ability to see the list of open instances and just jump to them by double clicking there name in the list. For a demo check out the video below.
If you'd like to work with the code it is available on Github at https://github.com/lightbulbone/rails. Note that the plugin currently only builds on Mac OS X; however, I will (very soon) make a build script for Windows.
