RE guide for beginners: Methodology and tools

hmm sounds like you are referring to a five finger discount :grimacing:

reads

doesn’t see perl

:frowning:

1 Like

“RE guide for beginners”

Deobfuscation isn’t beginner friendly, if you know what I mean :smirk:

[spoiler]That is a very nice guide, but I was quite surprised with your choosing of tools, I have nothing personal against bninja, but why radare? You have olly and immunity, which are both very powerful tools, the later is open-source and has a ton of friendly plugins too.

Anyway, thanks for the effort, it was pleasant reading.[/spoiler]

Nevermind, was stupid not to notice that the author used ELF binary as the subject.

I don’t believe either of them support ELF binaries. If there’s a plugin for that, I’d love to know about it. There is EDB which is the Linux counterpart and it’s not bad.

1 Like

You are absolutely right, my mistake for not reading carefully. Was foolish not taking notice that @Nitrax was RE’ing an ELF binary.

@Nitrax, ignore my previous comment.

1 Like

Hey this is a great article. Reverse engineering is very new to me, and this was a great introduction.

Something off topic (and not in anyway a critique of your expertise), you might want to avoid putting space characters before exclamation marks. “Foo bar ! Foo bar.” should actually look like “Foo bar! Foo bar.” in typed English.

The plan for pricing is described at the bottom of:

TL;DR – personal will be $149 after the introductory period ends, but it will be announced well in advance.

As for Static versus Dynamic, we’ll get there. As mentioned already, there are plugins that implement it already but it’s not as smooth because it can’t be natively integrated into the UI very well (that will change when the 1.2 release has a better mechanism for arbitrary GUI plugins)

And development will /always/ be ongoing. There’s tons of research we’re doing to improve things like the current state of the art in linear sweep, function similarity matching, etc. Emulation on the IL, lots of new interesting things underway. Doesn’t mean it’s not usable now, just that we’re dreaming big. :slight_smile:

Edited to add: For anyone with questions about Binary Ninja, we’ve got a public slack (hit the link above and look for the slack logo at the very bottom) that has a number of channels for different types of questions. Even if you’re brand new to RE, there’s a #ninjas-in-training channel just for folks to ask any question they like about RE.

5 Likes

@psifertex thank you for taking your time and answering in depth to my questions!
I guess i missed the pricing section when snooping around on the website.

Hope to see some awesome ongoing development from you!

1 Like

Thanks for your input, I will take it into consideration for my next article! I’m glad to see that this article is vastly appreciate!

Best,
Nitrax

I’m not from the radare team but I also want to recommend radare for both static and dynamic analysis. It has a quite steep learning curve but its also okay especially beginners coming from gdb

2 Likes

There is a migration guide from IDA, WinDbg or GDB: https://radare.gitbooks.io/radare2book/content/debugger/migration.html

1 Like

Thank you, this post was really helpful.If possible can you post more on the same method in subsequent posts??

2 Likes

Thanks, I was searching an alternative to bninja because I can’t afford it right now and I really like to learn some Reverse engineering.

Question: Radare supports 64bit binary?

Yup, in terms of file formats and architecture formats radare has a /huge/ number of things supported. It’s weakness is primarily one of usability and documentation. But you can’t beat the price. :slight_smile:

https://rada.re/r/cmp.html

Take that chart with a few mild grains of salt though. To say that some of those tools “have a decompiler” because they can use retdec for example, is completely not the same thing as saying that IDA Pro has a decompiler. They’re light-years apart.

2 Likes

I will do my best to post 1 article about RE every 1 or 2 weaks, depending on my spare time :slight_smile: stay tuned

2 Likes

another great plugin for gdb is pwndbg, it has a better graphics interface than peda and is developed by the same developers for pwntools

1 Like

Thanks for sharing ! I will give it a try when I would have some spare time :wink:

I have heard that hopper is a good one too. No doubt gdb rocks :D. cant wait for the exams to finish so that I can roll into action

1 Like