Skip to content

Latest commit

 

History

History
57 lines (40 loc) · 1.94 KB

Reverse Engineering.md

File metadata and controls

57 lines (40 loc) · 1.94 KB

Reverse Engineering

Binaries

Reverse engineering challenges often have to do with examining binaries and re-creating the flag for yourself.

Binwalk

A command to look through a binary.

binwalk -e firmware.bin

Ghidra

Use ghidra to reverse engineer all binaries.

UPX

Some binaries are packed, you can use UPX to unpack binaries.

Go Binaries

If the binaries are written in Go, you can use pygore or goretk.

Static Analysis

Analysis of executables or binaries can be done statically.

Ghidra

Use ghidra to reverse engineer all binaries.

XXD

The xxd command returns a hexdump of the executable.

Objdump

Objdump is a command to display object data of a file.

Detect It Easy

Use Detect It Easy to determine if something is packed and it's entry point.

CFF Explorer

Use CFF Explorer to look at executable, similar to Detect It Easy.

UPX

Some binaries are packed, you can use UPX to unpack binaries.

Cobalt Strike Beacons

1768 is a great tool to analyze CS beacons that require investigation.

Java

Some challenges in CTFs require analysis of Java code.

Disassemble

Analyze java code using javap -c file.class on the command line.

Code

Some reverse engineering challenges require you to review code and see what it does.

Code Beautifier

There is an awesome code beautifier, especially with PHP herehttps://github.com/unode/firefox_decrypt

VBScript Encryption/Decryption

If there is any mention of WScript or VBScript, use the decryption tool here.