LEADER 05354nam 2200649 450 001 9910825125303321 005 20200520144314.0 010 $a1-118-78739-0 010 $a1-118-78725-0 035 $a(CKB)2670000000523084 035 $a(EBL)1629173 035 $a(SSID)ssj0001166076 035 $a(PQKBManifestationID)11751579 035 $a(PQKBTitleCode)TC0001166076 035 $a(PQKBWorkID)11118216 035 $a(PQKB)11294503 035 $a(Au-PeEL)EBL1629173 035 $a(CaPaEBR)ebr10837612 035 $a(CaONFJC)MIL573950 035 $a(OCoLC)874161575 035 $a(CaSebORM)9781118787397 035 $a(MiAaPQ)EBC1629173 035 $a(EXLCZ)992670000000523084 100 $a20131030h20142014 uy| 0 101 0 $aeng 135 $aurunu||||| 181 $ctxt 182 $cc 183 $acr 200 10$aPractical reverse engineering $ex86, x64, ARM, Windows Kernel, reversing tools, and obfuscation /$fBruce Dang, Alexandre Gazet, Elias Bachaalany ; with contributions from Se?bastien Josse 205 $a1st edition 210 1$aIndianapolis, IN :$cJohn Wiley and Sons,$d[2014] 210 4$dİ2014 215 $a1 online resource (383 p.) 300 $aDescription based upon print version of record. 311 $a1-118-78731-5 320 $aIncludes bibliographical references and index. 327 $aCover; Title Page; Copyright; Contents; Chapter 1 x86 and x64; Register Set and Data Types; Instruction Set; Syntax; Data Movement; Exercise; Arithmetic Operations; Stack Operations and Function Invocation; Exercises; Control Flow; System Mechanism; Address Translation; Interrupts and Exceptions; Walk-Through; Exercises; x64; Register Set and Data Types; Data Movement; Canonical Address; Function Invocation; Exercises; Chapter 2 ARM; Basic Features; Data Types and Registers; System-Level Controls and Settings; Introduction to the Instruction Set; Loading and Storing Data; LDR and STR 327 $aOther Usage for LDRLDM and STM; PUSH and POP; Functions and Function Invocation; Arithmetic Operations; Branching and Conditional Execution; Thumb State; Switch-Case; Miscellaneous; Just-in-Time and Self-Modifying Code; Synchronization Primitives; System Services and Mechanisms; Instructions; Walk-Through; Next Steps; Exercises; Chapter 3 The Windows Kernel; Windows Fundamentals; Memory Layout; Processor Initialization; System Calls; Interrupt Request Level; Pool Memory; Memory Descriptor Lists; Processes and Threads; Execution Context; Kernel Synchronization Primitives; Lists 327 $aImplementation Details Walk-Through; Exercises; Asynchronous and Ad-Hoc Execution; System Threads; Work Items; Asynchronous Procedure Calls; Deferred Procedure Calls; Timers; Process and Thread Callbacks; Completion Routines; I/O Request Packets; Structure of a Driver; Entry Points; Driver and Device Objects; IRP Handling; A Common Mechanism for User-Kernel Communication; Miscellaneous System Mechanisms; Walk-Throughs; An x86 Rootkit; An x64 Rootkit; Next Steps; Exercises; Building Confidence and Solidifying Your Knowledge; Investigating and Extending Your Knowledge 327 $aAnalysis of Real-Life Drivers Chapter 4 Debugging and Automation; The Debugging Tools and Basic Commands; Setting the Symbol Path; Debugger Windows; Evaluating Expressions; Process Control and Debut Events; Registers, Memory, and Symbols; Breakpoints; Inspecting Processes and Modules; Miscellaneous Commands; Scripting with the Debugging Tools; Pseudo-Registers; Aliases; Language; Script Files; Using Scripts Like Functions; Example Debug Scripts; Using the SDK; Concepts; Writing Debugging Tools Extensions; Useful Extensions, Tools, and Resources; Chapter 5 Obfuscation 327 $aA Survey of Obfuscation Techniques The Nature of Obfuscation: A Motivating Example; Data-Based Obfuscations; Control-Based Obfuscation; Simultaneous Control-Flow and Data-Flow Obfuscation; Achieving Security by Obscurity; A Survey of Deobfuscation Techniques; The Nature of Deobfuscation: Transformation Inversion; Deobfuscation Tools; Practical Deobfuscation; Case Study; First Impressions; Analyzing Handlers Semantics; Symbolic Execution; Solving the Challenge; Final Thoughts; Exercises; Appendix Sample Names and Corresponding SHA1 Hashes; Index 330 $aAnalyzing how hacks are done, so as to stop them in the future Reverse engineering is the process of analyzing hardware or software and understanding it, without having access to the source code or design documents. Hackers are able to reverse engineer systems and exploit what they find with scary results. Now the good guys can use the same tools to thwart these threats. Practical Reverse Engineering goes under the hood of reverse engineering for security analysts, security engineers, and system programmers, so they can learn how to use these same processes to stop hacke 606 $aReverse engineering 615 0$aReverse engineering. 676 $a005.8 700 $aDang$b Bruce$01619680 701 $aGazet$b Alexandre$01619681 701 $aBachaalany$b Elias$01619682 701 $aJosse$b Se?bastien$01619683 801 0$bMiAaPQ 801 1$bMiAaPQ 801 2$bMiAaPQ 906 $aBOOK 912 $a9910825125303321 996 $aPractical reverse engineering$93952057 997 $aUNINA