- Reverse Engineering Generic Drug
- Reverse Engineering Software Keygen
- Reverse Engineering Keygen Software
- Reverse Engineering Genetics
- Reverse Engineering Keygen Key
- Reverse Engineering A Key Generator
- Reverse Engineering Keygen Download
Every reverse engineer, malware analyst or simply a researcher eventually collects a set of utility software that they use on a daily basis to analyze, unpack, and crack other software. This article will cover mine. It will be useful to anyone who has not yet collected their own toolset and is just starting to look into the subject. However, an experienced reverse engineer must also be curious about what other crackers are using.
WARNING
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up. Unauthorised keygens that typically violate software licensing terms are written by programmers who engage in reverse engineering and software cracking, often called crackers, to circumvent copy protection of software or digital rights management for multimedia. Keygens are available for download on warez sites or through peer-to-peer (P2P.
This article is for information purposes only. Neither the editorial team nor the author assumes any responsibility for possible harm that may arise from the use of these materials.
Debuggers
Debugging an application is an essential part of studying it, so every reverse engineer needs a debugger at the ready. A modern debugger must support both Intel architectures (x64 and x86), so this is the first prerequisite.
We must also be able to debug kernel-mode code. You will need this every once in a while, especially if you want to look for zero-day vulnerabilities in OS kernels or reverse engineer malware in drivers. The main candidates are x64dbg and WinDbg. The first debugger works in user mode, while the second one can debug kernel-mode code.
Reverse Engineering Generic Drug
x64dbg
This is a modern debugger with a good user interface, a worthy successor of OllyDbg. It supports both architectures (x64 and x86), and there are tons of useful plugins.
Granted, it has its downsides as there are a number of annoying bugs. But it is actively developed and supported. Since the debugger works in user mode, it is of course vulnerable to a wide range of anti-debugging techniques. This is, however, in part offset by the availability of many different debugger hiding plugins.
x64dbg has a built-in decompiler and imports reconstructor (both x64 and x86), supports code graph visualization and read/write/execute/access breakpoints. This debugger has enabled some hackers to break down the infamous Denuvo DRM system!
Why not OllyDbg
We haven't included OllyDbg here because it is very outdated. It does not support the latest operating systems or x64. The app's official website announced a x64 version and even reported some development progress, but the site itself has not been updated since 2014. OllyDbg is undoubtedly a milestone piece of software, but now it seems that its time has passed. There have also been fewer kernel mode debuggers since Syser Kernel Debugger, a successor to SoftICE, was abandoned.
WinDbg
WinDbg is one of the best kernel or driver debugging tools. This debugger is supported by Microsoft and included in the Windows Driver Kit (WDK). This is currently the most up-to-date and powerful kernel code debugger. It does not feature the user-friendly interface of x64dbg, but there are not many other options, as other debuggers don't support kernel-mode code.
WinDbg supports remote debugging and can download debug symbols directly from Microsoft servers. The VirtualKD booster exists to speed up the WinDbg setup for debugging kernel-mode code in a VM. WinDbg is definitely not for beginners, but as you gain experience in reverse engineering and start testing various interesting options, you won't be able to avoid it.
WinDbg enables you to view various system structures and easily disassemble NTAPI functions. Of course it can also be used to debug 'regular' applications, but I prefer to unleash this powerful weapon only when it is really needed!
Disassemblers
Reverse engineering cannot exist without static code analysis tools. The current selection of disassemblers is not much better than that of debuggers, but there we still have some favorites. The IDA Pro disassembler is a de facto standard in antivirus labs. Next is the Radare2 reverse engineering framework (many reckon that Radare2 is on par with IDA).
IDA Disassembler
There are two versions of IDA, a paid Pro version and a free Starter version. The free version is limited to x86 and does not support plugins. The Pro version offers full functionality with a large number of supported processor architectures and plugin support.
IDA does have a built-in debugger with rather basic functionality, but its unconventional interface takes some time to get used to. IDA can also be augmented with the Hex-Rays addon, a decompiler of application source code into C code. This is very useful as it really speeds up program analysis.
Overall, IDA is a very powerful and polished tool with a long development history. Unfortunately, the Pro version costs about $500-1000 (depending on the license type) and they do not sell it to just anybody. So we have to make do with other options.
Radare2
Radare2 was initially conceived as a simple hex editor but grew into a full framework able to debug and disassemble all types of code including firmware, viruses and cracks.
Radare is a set of console tools including a debugger, disassembler, decompiler, hex editor, its own compiler, utility for comparing binary files and much more. There is also a GUI addon named Cutter that greatly improves the look and usability of Radare's framework.
The framework supports a large number of processors and platforms, which enables it to compete with products like IDA Pro. Another big advantage of Radare is that it is an open source, free and community-driven project.
Additional utilities
We have covered the main tools, but reverse engineering also needs packer identifiers, network monitors, hex editors and many other utilities. Let's have a closer look to the main ones.
Detect it Easy (DiE)
This is a great packer identifier with a large number of useful functions. For example, it allows you to view file section entropy, which facilitates visual identification of encryption.
It also has a resource viewer with a dump-to-disk feature. DiE enables you to easily access the import table and add plugins and scripts, configure signature scanning methods and view file headers. It fully supports PE and PE+.
There is only one problem with this program: a slow update cycle, although it has not been abandoned. In fact, a new version was released recently!
INFO
You can see examples of working with DiE in my previous articles: 'Manual unpacking. Cracking a custom packer based on GlobeImposter 2.0 ransomware' and 'The art of unpacking. Gutting the protection of the crafty GootKit banker'.
ExeInfoPE
Reverse Engineering Software Keygen
This is another packer and protector detector. It has an unconventional interface that will not be to everybody's taste. On the other hand, the program is frequently updated, offers numerous interesting functions and user-friendly tips for unpacking.
Overall, I would recommend it to beginners. ExeInfoPE has a number of automatic unpackers and will tell you which tool to use to crack a bolt-on protection system.
Of course, the program also offers the full set of standard features including a file header viewer, section viewer, hex viewer and even a number of built-in mini-utilities like TerminateProcess and more. ExeInfoPE also supports plugins.
HxD
Sometimes you may need to access HDD, memory or applications in binary mode. This is where hex editors come in handy, as exemplified by HxD. This program is free and frequently updated, supports popular formats, is good for searching and offers a user-friendly UI. There are other well-executed features, such as the ability to remotely erase (zerofill) files. There is also a portable version for easy storage on a flash drive.
HIEW
This hex editor has a long history, but it is still supported by its devs. It comes in free and paid versions (the latter is $20 without updates or $200 with lifelong updates). The Norton Commander-like interface might scare off a younger crowd, but it is easy to get used to. What is especially great about HIEW, is that you can work in 'keyboard-only' mode by controlling all its functions via hotkeys.
Pestudio
A useful program for malware analysis. Prestudio automatically scans files samples with VirusTotal, offers an interesting view of the analyzed application's import table functions, shows the application's viral markers, used libraries and PE file header info. It also enables you to work with resources. In other words, this is a versatile antivirus tool for initial sample analysis.
PE-bear
Another interesting viewer/editor of PE and PE+ files comes with a packer/protector identifier and shows info on file headers, resources and sections. If you want to, you can view sections in hex mode and disassemble them into regular assembler mnemonics.
PE-bear has a user-friendly UI and file-comparing utility. The program's only downside, despite its open source code, are its rare updates. So, if you find a bug, you can fix it yourself.
Fakenet-NG
This program emulates working with a network. When studying malware samples, you often need to see all their Internet activities: monitor DNS and HTTP queries, sniff traffic and identify IP addresses of the controlling servers (for example, if you are dealing with a ransomware bot). Your VM should of course be offline, but if the virus detects it, it won't do all the things that it usually does.
Fakenet-NG is fully supported with frequent updates, so this utility can be used in the latest operating sytems.
ProcessExplorer
It would be hard to perform reverse engineering without programs from Sysinternals that monitor how applications access the filesystem and processes. ProcessExplorer shows all processes in a hierarchical tree view, so you can easily see their spawning order. You can also see which dynamic libraries they use, as well as their priority, digital signatures, processor usage and much more.
Reverse Engineering Keygen Software
RegShot
A handy utility for monitoring registry changes. RegShot takes snapshots of the registry before and after you do some system or software changes.
TCPView
A small program for monitoring an application's network activity. You can see which ports it accesses (both local and remote), together with protocols, process identifiers and transmitted packet counters. Overall, this is one of the most useful tools for any hacker!
Resource Hacker
A popular program for editing resources, including manifests, icons, text dialog lines, cursor info and much more. You won't need this functionality very often, but when you do, this is a suitable tool to have.
Summing up
We have covered the main utilities used for most reverse engineering tasks. I think this should be enough for a beginner. Your own list will grow as you progress.
Many reverse engineers end up writing their own targeted programs, plugins and scripts. You won't be able to find tools for every task that will make your life easier. If you know similar software or want to share links to other useful tools, please do so in the comments!
Reverse Engineering challenges
Contrived by Dennis Yurichev (yurichev.com).
The website has been inspired by Project Euler and 'the matasano crypto challenges'.
NEW: solutions.
All challenges/exercises/problems/tasks
1; 2; 3; 4; 5; 6; 7; 8; 9; 10; 11; 12; 13; 14; 15; 16; 17; 18; 19; 20; 21; 22; 23; 24; 25 (black boxes); 26; 27; 28; 29 (obfuscation); 30; 31; 32; 33; 34; 35; 36; 37; 38; 39; 40; 41; 42 (unknown cryptoalgorithm); 43; 44; 45 (simple copyprotection); 46 (toy-level web server); 47 (broken data compression algorithm); 48; 49; 50 (4-byte XOR mask); 51 (stack); 52 (stack); 53; 54 (LOOP instruction); 55 (simple patching exercise); 56; 57; 58; 59; 60; 61; 62 (array); 63 (array); 64 (array); 65 (array); 66 (array); 67 (bit field); 68 (bit field); 69 (bit field); 70 (bit field); 71 (structure); 72 (structure); 73; 74; 75; 76; 77; 78; 79; 80; 81; 82; 83; 84; 85; 86; 87.
By level
Level 1: 2; 3; 4; 5; 6; 7; 8; 9; 10; 11; 12; 13; 14; 15; 16; 17; 18; 19; 20; 21; 22; 23; 26; 27; 28; 30; 31; 32; 33; 34; 35; 36; 37; 38; 39; 41; 43; 48; 49; 51 (stack); 52 (stack); 53; 54 (LOOP instruction); 55 (simple patching exercise); 56; 57; 58; 59; 60; 61; 62 (array); 63 (array); 64 (array); 65 (array); 66 (array); 67 (bit field); 68 (bit field); 69 (bit field); 70 (bit field); 71 (structure); 72 (structure); 74; 75; 76; 79; 80; 81; 82; 83; 84; 85; 86.
Level 2: 1; 24; 29 (obfuscation); 40; 42 (unknown cryptoalgorithm); 44; 45 (simple copyprotection); 46 (toy-level web server); 73; 74; 77; 78.
Level 3: 25 (black boxes); 47 (broken data compression algorithm); 87.
Distinction between levels is very blurred and not very strict, so don't rely on them fully.But feel free to send me recommendations about them.I would love to hear comments like 'it was so easy/hard' or 'I've spent 2 hours for this',so I can gather some statistics about exercises and promote/demote them.Email: book@beginners.re
By type
Piece of assembly listing: 1; 2; 3; 4; 5; 6; 7; 8; 9; 10; 11; 12; 13; 15; 16; 17; 18; 19; 20; 21; 22; 23; 27; 28; 31; 32; 33; 34; 35; 36; 48; 49; 52 (stack); 56; 58; 59; 60; 61; 62 (array); 63 (array); 64 (array); 65 (array); 66 (array); 67 (bit field); 68 (bit field); 69 (bit field); 70 (bit field); 72 (structure); 75; 76; 77; 78; 79; 80; 81; 82; 83; 84; 85.
There are two questions for almost every exercise similar to the following (unless otherwise specified):1) What does this function do? Try to give one-sentence answer.2) Rewrite this function into C/C++.Executable file: 12; 24; 29 (obfuscation); 30; 38; 39; 40; 41; 42 (unknown cryptoalgorithm); 43; 44; 45 (simple copyprotection); 46 (toy-level web server); 47 (broken data compression algorithm); 71 (structure); 73; 74; 86.
By architecture
X86: 2; 3; 4; 27; 30; 31; 32; 33; 35; 36; 37; 38; 40; 41; 42 (unknown cryptoalgorithm); 44; 45 (simple copyprotection); 46 (toy-level web server); 47 (broken data compression algorithm); 48; 52 (stack); 54 (LOOP instruction); 56; 58; 59; 60; 62 (array); 63 (array); 64 (array); 65 (array); 66 (array); 67 (bit field); 68 (bit field); 69 (bit field); 70 (bit field); 71 (structure); 72 (structure); 75; 87.
X64: 1; 5; 6; 7; 8; 9; 10; 11; 12; 13; 15; 16; 17; 18; 19; 20; 21; 22; 23; 24; 28; 31; 36; 38; 41; 46 (toy-level web server); 47 (broken data compression algorithm); 49; 54 (LOOP instruction); 73; 74; 76; 77; 78; 79; 80; 81; 82; 83; 84; 85; 86.
X86/X64 SSE: 13; 15; 16; 20; 31; 36; 80; 84.
X86/X64 FPU: 20; 31; 36; 60; 61; 62 (array); 72 (structure); 80; 84.
MIPS: 2; 3; 4; 5; 6; 7; 8; 9; 10; 11; 19; 20; 21; 22; 24; 28; 30; 32; 33; 34; 35; 36; 37; 39; 40; 42 (unknown cryptoalgorithm); 43; 45 (simple copyprotection); 52 (stack); 56; 58; 59; 61; 62 (array); 63 (array); 64 (array); 65 (array); 66 (array); 67 (bit field); 68 (bit field); 70 (bit field); 71 (structure); 72 (structure); 76; 77; 78; 79; 80; 81; 82; 83; 84; 85; 86.
ARM: 2; 3; 4; 5; 6; 7; 8; 10; 11; 19; 20; 21; 22; 28; 32; 33; 34; 35; 36; 37; 41; 52 (stack); 56; 58; 59; 62 (array); 63 (array); 64 (array); 65 (array); 66 (array); 67 (bit field); 68 (bit field); 70 (bit field); 72 (structure); 76; 77; 78; 79; 80; 81; 82; 83; 84; 85; 86.
ARM64: 2; 3; 4; 5; 6; 7; 8; 9; 10; 11; 18; 19; 20; 21; 22; 23; 27; 28; 32; 33; 34; 35; 36; 37; 52 (stack); 56; 58; 59; 61; 62 (array); 63 (array); 64 (array); 65 (array); 66 (array); 67 (bit field); 68 (bit field); 70 (bit field); 72 (structure); 76; 77; 78; 79; 80; 81; 82; 83; 84; 85.
CLR (.NET): 14; 26.
JVM (Java Virtual Machine): 14; 26.
By OS
Windows: 24; 29 (obfuscation); 30; 38; 39; 40; 41; 42 (unknown cryptoalgorithm); 43; 44; 45 (simple copyprotection); 46 (toy-level web server); 47 (broken data compression algorithm); 48; 53; 69 (bit field); 73; 74; 86.
Linux: 12; 24; 30; 38; 39; 40; 41; 42 (unknown cryptoalgorithm); 43; 45 (simple copyprotection); 46 (toy-level web server); 47 (broken data compression algorithm); 49; 53; 71 (structure); 73; 74; 86.
Mac OS X: 30; 38; 39; 40; 42 (unknown cryptoalgorithm); 43; 46 (toy-level web server); 47 (broken data compression algorithm).
Raspberry Pi Linux: 24; 35; 41; 86.
Other
Amateur cryptography: 25 (black boxes); 33; 34; 42 (unknown cryptoalgorithm); 44; 50 (4-byte XOR mask).
This kind of cryptography is very different from professional one, nevertheless,it is highly popular in various types of software, so practicing reverse engineers has experience with it (or should have).
Crackme/keygenme: 73; 74.
About the website
Well, 'challenges' is a loud word, these are rather just exercises.
Some exercises were in my book for beginners, some were in my blog,and I eventually decided to keep them all in one single place like this website, so be it.
Exercise numbers
There is no correlation between exercise number and hardness.Sorry: I add new exercises occasionally and I can't use some fixed numbering system, so numbers are chaotic and has no meaning at all.
On the other hand, I can assure, exercise numbers will never change, so my readers can refer to them, and they are also referred from my book for beginners.
Duplicates
There are some pieces of code which are really does the same thing, but in different ways.Or maybe it is implemented for different architectures (x86 and Java VM/.NET).That's OK.
FAQ
Can I use Google?
It's up to you. I would first try to solve exercise without googling.If I would stuck, I would try to google some constants, text messages, etc.
Should I give low-level answer (what each instruction does) or high-level (what the function does)?
As highest as possible.In fact, reverse engineer's job is to reduce amount of information he/she has.Malware analyst should describe a specific piece of malware using couple of sentences, no one really interesting what each of its several thousand instructions does.
How can I measure my performance?
As far as I can realize, If reverse engineer can solve most of these exercises, he is a hot target for head hunters (programming jobs in general).
Those who can solve from ¼ to ½ of all levels, perhaps, can freely apply for reverse engineering/malware analysts/vulnerability research job positions.
How can I learn Reverse Engineering?
Here is my book for beginners: http://beginners.re/.
Can I use these exercises for my teaching?
Yes, that is why they are (and this website as a whole) licensed under Creative Commons terms (CC BY-SA 4.0),like my book about RE for beginners.
Solutions
I made decision not to publish solutions.
Some computer science/programming books has solutions for exercises (like TAOCP), some has not (K&R, SICP, Niklaus Wirth - 'Algorithms and Data Structures', Brian Kernighan/Rob Pike - The Practice of Programming' to name a few).
This website has been inspired by Project Euler and 'the matasano crypto challenges' - and there are no solutions as well.
In my own opinion and experience, published solutions are killers to incentive (or motivation).When you see solution to the exercise, you lost an intellectual curiosity to solve it.It's like when magician reveals his tricks - he will loose all attention after the moment.
So please do not publish solutions on googleable forums/blogs/social networks, etc.On the other hand, you can freely discuss exercises with your friends and other people on the closed non-googleable private forums.Of course, I can't force anyone to do so, I just ask.Here is also explanation by one of 'the matasano crypto challenges' website authors:https://www.reddit.com/r/haskell/comments/1fa8br/matasano_crypto_challenges_in_haskell/ca8em35.
If you are unsure if you solved some exercise correctly, just ask me by email (book@beginners.re)(please also put exercise number in subject line like 'exercise #123').If you don't want to reveal your name/email, you may use BitMessage (my ID is BM-2cUyrfGUDyjuUHyzAA63kq5NHAB2zMo4Q2) and a temporary throw-away ID.
Reverse Engineering Genetics
Updates/news
Reverse Engineering Keygen Key
I'll add more exercises in future, if you interesting, you may subscribe to myblog.
Reverse Engineering A Key Generator
This is a modern debugger with a good user interface, a worthy successor of OllyDbg. It supports both architectures (x64 and x86), and there are tons of useful plugins.
Granted, it has its downsides as there are a number of annoying bugs. But it is actively developed and supported. Since the debugger works in user mode, it is of course vulnerable to a wide range of anti-debugging techniques. This is, however, in part offset by the availability of many different debugger hiding plugins.
x64dbg has a built-in decompiler and imports reconstructor (both x64 and x86), supports code graph visualization and read/write/execute/access breakpoints. This debugger has enabled some hackers to break down the infamous Denuvo DRM system!
Why not OllyDbg
We haven't included OllyDbg here because it is very outdated. It does not support the latest operating systems or x64. The app's official website announced a x64 version and even reported some development progress, but the site itself has not been updated since 2014. OllyDbg is undoubtedly a milestone piece of software, but now it seems that its time has passed. There have also been fewer kernel mode debuggers since Syser Kernel Debugger, a successor to SoftICE, was abandoned.
WinDbg
WinDbg is one of the best kernel or driver debugging tools. This debugger is supported by Microsoft and included in the Windows Driver Kit (WDK). This is currently the most up-to-date and powerful kernel code debugger. It does not feature the user-friendly interface of x64dbg, but there are not many other options, as other debuggers don't support kernel-mode code.
WinDbg supports remote debugging and can download debug symbols directly from Microsoft servers. The VirtualKD booster exists to speed up the WinDbg setup for debugging kernel-mode code in a VM. WinDbg is definitely not for beginners, but as you gain experience in reverse engineering and start testing various interesting options, you won't be able to avoid it.
WinDbg enables you to view various system structures and easily disassemble NTAPI functions. Of course it can also be used to debug 'regular' applications, but I prefer to unleash this powerful weapon only when it is really needed!
Disassemblers
Reverse engineering cannot exist without static code analysis tools. The current selection of disassemblers is not much better than that of debuggers, but there we still have some favorites. The IDA Pro disassembler is a de facto standard in antivirus labs. Next is the Radare2 reverse engineering framework (many reckon that Radare2 is on par with IDA).
IDA Disassembler
There are two versions of IDA, a paid Pro version and a free Starter version. The free version is limited to x86 and does not support plugins. The Pro version offers full functionality with a large number of supported processor architectures and plugin support.
IDA does have a built-in debugger with rather basic functionality, but its unconventional interface takes some time to get used to. IDA can also be augmented with the Hex-Rays addon, a decompiler of application source code into C code. This is very useful as it really speeds up program analysis.
Overall, IDA is a very powerful and polished tool with a long development history. Unfortunately, the Pro version costs about $500-1000 (depending on the license type) and they do not sell it to just anybody. So we have to make do with other options.
Radare2
Radare2 was initially conceived as a simple hex editor but grew into a full framework able to debug and disassemble all types of code including firmware, viruses and cracks.
Radare is a set of console tools including a debugger, disassembler, decompiler, hex editor, its own compiler, utility for comparing binary files and much more. There is also a GUI addon named Cutter that greatly improves the look and usability of Radare's framework.
The framework supports a large number of processors and platforms, which enables it to compete with products like IDA Pro. Another big advantage of Radare is that it is an open source, free and community-driven project.
Additional utilities
We have covered the main tools, but reverse engineering also needs packer identifiers, network monitors, hex editors and many other utilities. Let's have a closer look to the main ones.
Detect it Easy (DiE)
This is a great packer identifier with a large number of useful functions. For example, it allows you to view file section entropy, which facilitates visual identification of encryption.
It also has a resource viewer with a dump-to-disk feature. DiE enables you to easily access the import table and add plugins and scripts, configure signature scanning methods and view file headers. It fully supports PE and PE+.
There is only one problem with this program: a slow update cycle, although it has not been abandoned. In fact, a new version was released recently!
INFO
You can see examples of working with DiE in my previous articles: 'Manual unpacking. Cracking a custom packer based on GlobeImposter 2.0 ransomware' and 'The art of unpacking. Gutting the protection of the crafty GootKit banker'.
ExeInfoPE
Reverse Engineering Software Keygen
This is another packer and protector detector. It has an unconventional interface that will not be to everybody's taste. On the other hand, the program is frequently updated, offers numerous interesting functions and user-friendly tips for unpacking.
Overall, I would recommend it to beginners. ExeInfoPE has a number of automatic unpackers and will tell you which tool to use to crack a bolt-on protection system.
Of course, the program also offers the full set of standard features including a file header viewer, section viewer, hex viewer and even a number of built-in mini-utilities like TerminateProcess and more. ExeInfoPE also supports plugins.
HxD
Sometimes you may need to access HDD, memory or applications in binary mode. This is where hex editors come in handy, as exemplified by HxD. This program is free and frequently updated, supports popular formats, is good for searching and offers a user-friendly UI. There are other well-executed features, such as the ability to remotely erase (zerofill) files. There is also a portable version for easy storage on a flash drive.
HIEW
This hex editor has a long history, but it is still supported by its devs. It comes in free and paid versions (the latter is $20 without updates or $200 with lifelong updates). The Norton Commander-like interface might scare off a younger crowd, but it is easy to get used to. What is especially great about HIEW, is that you can work in 'keyboard-only' mode by controlling all its functions via hotkeys.
Pestudio
A useful program for malware analysis. Prestudio automatically scans files samples with VirusTotal, offers an interesting view of the analyzed application's import table functions, shows the application's viral markers, used libraries and PE file header info. It also enables you to work with resources. In other words, this is a versatile antivirus tool for initial sample analysis.
PE-bear
Another interesting viewer/editor of PE and PE+ files comes with a packer/protector identifier and shows info on file headers, resources and sections. If you want to, you can view sections in hex mode and disassemble them into regular assembler mnemonics.
PE-bear has a user-friendly UI and file-comparing utility. The program's only downside, despite its open source code, are its rare updates. So, if you find a bug, you can fix it yourself.
Fakenet-NG
This program emulates working with a network. When studying malware samples, you often need to see all their Internet activities: monitor DNS and HTTP queries, sniff traffic and identify IP addresses of the controlling servers (for example, if you are dealing with a ransomware bot). Your VM should of course be offline, but if the virus detects it, it won't do all the things that it usually does.
Fakenet-NG is fully supported with frequent updates, so this utility can be used in the latest operating sytems.
ProcessExplorer
It would be hard to perform reverse engineering without programs from Sysinternals that monitor how applications access the filesystem and processes. ProcessExplorer shows all processes in a hierarchical tree view, so you can easily see their spawning order. You can also see which dynamic libraries they use, as well as their priority, digital signatures, processor usage and much more.
Reverse Engineering Keygen Software
RegShot
A handy utility for monitoring registry changes. RegShot takes snapshots of the registry before and after you do some system or software changes.
TCPView
A small program for monitoring an application's network activity. You can see which ports it accesses (both local and remote), together with protocols, process identifiers and transmitted packet counters. Overall, this is one of the most useful tools for any hacker!
Resource Hacker
A popular program for editing resources, including manifests, icons, text dialog lines, cursor info and much more. You won't need this functionality very often, but when you do, this is a suitable tool to have.
Summing up
We have covered the main utilities used for most reverse engineering tasks. I think this should be enough for a beginner. Your own list will grow as you progress.
Many reverse engineers end up writing their own targeted programs, plugins and scripts. You won't be able to find tools for every task that will make your life easier. If you know similar software or want to share links to other useful tools, please do so in the comments!
Reverse Engineering challenges
Contrived by Dennis Yurichev (yurichev.com).
The website has been inspired by Project Euler and 'the matasano crypto challenges'.
NEW: solutions.
All challenges/exercises/problems/tasks
1; 2; 3; 4; 5; 6; 7; 8; 9; 10; 11; 12; 13; 14; 15; 16; 17; 18; 19; 20; 21; 22; 23; 24; 25 (black boxes); 26; 27; 28; 29 (obfuscation); 30; 31; 32; 33; 34; 35; 36; 37; 38; 39; 40; 41; 42 (unknown cryptoalgorithm); 43; 44; 45 (simple copyprotection); 46 (toy-level web server); 47 (broken data compression algorithm); 48; 49; 50 (4-byte XOR mask); 51 (stack); 52 (stack); 53; 54 (LOOP instruction); 55 (simple patching exercise); 56; 57; 58; 59; 60; 61; 62 (array); 63 (array); 64 (array); 65 (array); 66 (array); 67 (bit field); 68 (bit field); 69 (bit field); 70 (bit field); 71 (structure); 72 (structure); 73; 74; 75; 76; 77; 78; 79; 80; 81; 82; 83; 84; 85; 86; 87.
By level
Level 1: 2; 3; 4; 5; 6; 7; 8; 9; 10; 11; 12; 13; 14; 15; 16; 17; 18; 19; 20; 21; 22; 23; 26; 27; 28; 30; 31; 32; 33; 34; 35; 36; 37; 38; 39; 41; 43; 48; 49; 51 (stack); 52 (stack); 53; 54 (LOOP instruction); 55 (simple patching exercise); 56; 57; 58; 59; 60; 61; 62 (array); 63 (array); 64 (array); 65 (array); 66 (array); 67 (bit field); 68 (bit field); 69 (bit field); 70 (bit field); 71 (structure); 72 (structure); 74; 75; 76; 79; 80; 81; 82; 83; 84; 85; 86.
Level 2: 1; 24; 29 (obfuscation); 40; 42 (unknown cryptoalgorithm); 44; 45 (simple copyprotection); 46 (toy-level web server); 73; 74; 77; 78.
Level 3: 25 (black boxes); 47 (broken data compression algorithm); 87.
Distinction between levels is very blurred and not very strict, so don't rely on them fully.But feel free to send me recommendations about them.I would love to hear comments like 'it was so easy/hard' or 'I've spent 2 hours for this',so I can gather some statistics about exercises and promote/demote them.Email: book@beginners.re
By type
Piece of assembly listing: 1; 2; 3; 4; 5; 6; 7; 8; 9; 10; 11; 12; 13; 15; 16; 17; 18; 19; 20; 21; 22; 23; 27; 28; 31; 32; 33; 34; 35; 36; 48; 49; 52 (stack); 56; 58; 59; 60; 61; 62 (array); 63 (array); 64 (array); 65 (array); 66 (array); 67 (bit field); 68 (bit field); 69 (bit field); 70 (bit field); 72 (structure); 75; 76; 77; 78; 79; 80; 81; 82; 83; 84; 85.
There are two questions for almost every exercise similar to the following (unless otherwise specified):1) What does this function do? Try to give one-sentence answer.2) Rewrite this function into C/C++.Executable file: 12; 24; 29 (obfuscation); 30; 38; 39; 40; 41; 42 (unknown cryptoalgorithm); 43; 44; 45 (simple copyprotection); 46 (toy-level web server); 47 (broken data compression algorithm); 71 (structure); 73; 74; 86.
By architecture
X86: 2; 3; 4; 27; 30; 31; 32; 33; 35; 36; 37; 38; 40; 41; 42 (unknown cryptoalgorithm); 44; 45 (simple copyprotection); 46 (toy-level web server); 47 (broken data compression algorithm); 48; 52 (stack); 54 (LOOP instruction); 56; 58; 59; 60; 62 (array); 63 (array); 64 (array); 65 (array); 66 (array); 67 (bit field); 68 (bit field); 69 (bit field); 70 (bit field); 71 (structure); 72 (structure); 75; 87.
X64: 1; 5; 6; 7; 8; 9; 10; 11; 12; 13; 15; 16; 17; 18; 19; 20; 21; 22; 23; 24; 28; 31; 36; 38; 41; 46 (toy-level web server); 47 (broken data compression algorithm); 49; 54 (LOOP instruction); 73; 74; 76; 77; 78; 79; 80; 81; 82; 83; 84; 85; 86.
X86/X64 SSE: 13; 15; 16; 20; 31; 36; 80; 84.
X86/X64 FPU: 20; 31; 36; 60; 61; 62 (array); 72 (structure); 80; 84.
MIPS: 2; 3; 4; 5; 6; 7; 8; 9; 10; 11; 19; 20; 21; 22; 24; 28; 30; 32; 33; 34; 35; 36; 37; 39; 40; 42 (unknown cryptoalgorithm); 43; 45 (simple copyprotection); 52 (stack); 56; 58; 59; 61; 62 (array); 63 (array); 64 (array); 65 (array); 66 (array); 67 (bit field); 68 (bit field); 70 (bit field); 71 (structure); 72 (structure); 76; 77; 78; 79; 80; 81; 82; 83; 84; 85; 86.
ARM: 2; 3; 4; 5; 6; 7; 8; 10; 11; 19; 20; 21; 22; 28; 32; 33; 34; 35; 36; 37; 41; 52 (stack); 56; 58; 59; 62 (array); 63 (array); 64 (array); 65 (array); 66 (array); 67 (bit field); 68 (bit field); 70 (bit field); 72 (structure); 76; 77; 78; 79; 80; 81; 82; 83; 84; 85; 86.
ARM64: 2; 3; 4; 5; 6; 7; 8; 9; 10; 11; 18; 19; 20; 21; 22; 23; 27; 28; 32; 33; 34; 35; 36; 37; 52 (stack); 56; 58; 59; 61; 62 (array); 63 (array); 64 (array); 65 (array); 66 (array); 67 (bit field); 68 (bit field); 70 (bit field); 72 (structure); 76; 77; 78; 79; 80; 81; 82; 83; 84; 85.
CLR (.NET): 14; 26.
JVM (Java Virtual Machine): 14; 26.
By OS
Windows: 24; 29 (obfuscation); 30; 38; 39; 40; 41; 42 (unknown cryptoalgorithm); 43; 44; 45 (simple copyprotection); 46 (toy-level web server); 47 (broken data compression algorithm); 48; 53; 69 (bit field); 73; 74; 86.
Linux: 12; 24; 30; 38; 39; 40; 41; 42 (unknown cryptoalgorithm); 43; 45 (simple copyprotection); 46 (toy-level web server); 47 (broken data compression algorithm); 49; 53; 71 (structure); 73; 74; 86.
Mac OS X: 30; 38; 39; 40; 42 (unknown cryptoalgorithm); 43; 46 (toy-level web server); 47 (broken data compression algorithm).
Raspberry Pi Linux: 24; 35; 41; 86.
Other
Amateur cryptography: 25 (black boxes); 33; 34; 42 (unknown cryptoalgorithm); 44; 50 (4-byte XOR mask).
This kind of cryptography is very different from professional one, nevertheless,it is highly popular in various types of software, so practicing reverse engineers has experience with it (or should have).
Crackme/keygenme: 73; 74.
About the website
Well, 'challenges' is a loud word, these are rather just exercises.
Some exercises were in my book for beginners, some were in my blog,and I eventually decided to keep them all in one single place like this website, so be it.
Exercise numbers
There is no correlation between exercise number and hardness.Sorry: I add new exercises occasionally and I can't use some fixed numbering system, so numbers are chaotic and has no meaning at all.
On the other hand, I can assure, exercise numbers will never change, so my readers can refer to them, and they are also referred from my book for beginners.
Duplicates
There are some pieces of code which are really does the same thing, but in different ways.Or maybe it is implemented for different architectures (x86 and Java VM/.NET).That's OK.
FAQ
Can I use Google?
It's up to you. I would first try to solve exercise without googling.If I would stuck, I would try to google some constants, text messages, etc.
Should I give low-level answer (what each instruction does) or high-level (what the function does)?
As highest as possible.In fact, reverse engineer's job is to reduce amount of information he/she has.Malware analyst should describe a specific piece of malware using couple of sentences, no one really interesting what each of its several thousand instructions does.
How can I measure my performance?
As far as I can realize, If reverse engineer can solve most of these exercises, he is a hot target for head hunters (programming jobs in general).
Those who can solve from ¼ to ½ of all levels, perhaps, can freely apply for reverse engineering/malware analysts/vulnerability research job positions.
How can I learn Reverse Engineering?
Here is my book for beginners: http://beginners.re/.
Can I use these exercises for my teaching?
Yes, that is why they are (and this website as a whole) licensed under Creative Commons terms (CC BY-SA 4.0),like my book about RE for beginners.
Solutions
I made decision not to publish solutions.
Some computer science/programming books has solutions for exercises (like TAOCP), some has not (K&R, SICP, Niklaus Wirth - 'Algorithms and Data Structures', Brian Kernighan/Rob Pike - The Practice of Programming' to name a few).
This website has been inspired by Project Euler and 'the matasano crypto challenges' - and there are no solutions as well.
In my own opinion and experience, published solutions are killers to incentive (or motivation).When you see solution to the exercise, you lost an intellectual curiosity to solve it.It's like when magician reveals his tricks - he will loose all attention after the moment.
So please do not publish solutions on googleable forums/blogs/social networks, etc.On the other hand, you can freely discuss exercises with your friends and other people on the closed non-googleable private forums.Of course, I can't force anyone to do so, I just ask.Here is also explanation by one of 'the matasano crypto challenges' website authors:https://www.reddit.com/r/haskell/comments/1fa8br/matasano_crypto_challenges_in_haskell/ca8em35.
If you are unsure if you solved some exercise correctly, just ask me by email (book@beginners.re)(please also put exercise number in subject line like 'exercise #123').If you don't want to reveal your name/email, you may use BitMessage (my ID is BM-2cUyrfGUDyjuUHyzAA63kq5NHAB2zMo4Q2) and a temporary throw-away ID.
Reverse Engineering Genetics
Updates/news
Reverse Engineering Keygen Key
I'll add more exercises in future, if you interesting, you may subscribe to myblog.
Reverse Engineering A Key Generator
Thanks
Reverse Engineering Keygen Download
Thanks to Diego Boy, Wolfgang Reiter, Nikita Mahilewets and Niklas for bugfixes.
