📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  IDA Pro  >>  Intelligence of Checksum Methods

Topic created on: September 4, 2007 22:14 CDT by jaffersathik2010 .

Hi,

Correct me if I am wrong. Unpacking is the common and main activity in reverse engineering. In that checksum methods are one of the main barriers, which we have to break first.

My thinking is, checksum methods (mostly) are not intelligent enough to stop unpacking, if we are modifying the code on the fly (I mean during the execution time-debugging mode).

If we modify the code first and later executing then it will bring problem to us.

Am I correct? Give me your views.

Thanks,
Jaffer.

  aeppert     September 5, 2007 17:32.51 CDT
I would first of all argue, unpacking is not the main activity in reverse engineering, but simply the starting point for a lot of efforts (notice, I said a lot, not all.)

I for one deal very little with unpacking in a traditional since, albeit I have done it extensively in the past.  The general problem of reverse engineering is to understand what  something is doing, the packing method is simply obstructing the analysis of what is  generally most important - that which is being hidden by the packing method.  

Further, checksums are a finite part of most packing algorithms in the way they go about obfuscating and protecting their own behavior now.  

If you are simply letting a program unpack in memory and obtaining the unpacked portions of code as it goes, then checksums become a non-problem.  At this point your biggest obstacle lies in any and all anti-debugging techniques the packed code happens to utilize.  

I am not sure what code you are referring to in this case?  The _packing method_ code, or the _packed code to be executed_.  Either way, there, at least in my mind, is no reason to modify either if your only interest is to capture that which is packed for further analysis.  Once you understand the algorithm the packer is utilizing you may then write an unpacker at your leisure.

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit