    
 


   -  .          ,    ,  ,  ,    PE  ELF,     .      ,   , -,  ,  ,      .   ,  ,      .     ,     .      ,        .





 

    








         -  .      ,     ( C/C++),    .

- -         ,         .         , , ,     .

       ,   ,   ,   .

 :         -   ,  crackme,  malware-   .        .

   - 4-6    . :  ,   C/C++     .




 1.   -  





1.1.   


- (reverse engineering) -            .     ,          .

       , , ,   ,         .




1.2.   


 :

-     

-    

-    legacy-

-      

-    

-   

-    




1.3. 


 :   ,    (), ,    -.

 :  ( ),  (  ), .

 : software reverse engineering, protocol reverse engineering, hardware  firmware reverse engineering, data reverse engineering, architecture recovery.




1.4.  workflow -


1.     ( , , , ).

2.   .

3.   (, ).

4.   (, ).

5.   (, , IOC).

6.   -     .




1.5.     


    (Linux):

file sample.exe

strings -n 8 sample.exe | head -50

sha256sum sample.exe

 Windows      Detect It Easy  PE-bear,   ,   .




 2. ,    





2.1.  


        ( ,  IV),      .       , open-source,     ,     malware        .

        ,  , .      .




2.2.  


-     

-        

-          

-     

-     




2.3.   


 :

- -  VirtualBox  VMware

-   : Windows 10/11, Linux (Ubuntu/Debian)

-  (snapshots)    

- Host-only    

-      

 malware-    Cuckoo Sandbox      .




2.4. -  


-   ,   , open-source   ?

-  ?  snapshot?

-    ?

-       ?




 3.      





3.1.  x86/x64


  x64: RAX (,  ), RBX, RCX, RDX, RSI, RDI, RBP (base pointer), RSP (stack pointer), R8-R15.  : EAX, AX, AL  .

 (RFLAGS): ZF (zero), SF (sign), CF (carry), OF (overflow) -    (JE/JZ, JNE, JA, JB, JG, JL  ).

  .  :  ( ), return address,  ,  .




3.2.   


Microsoft x64 calling convention (Windows):  4   RCX, RDX, R8, R9;   ;    RAX.

System V AMD64 (Linux): RDI, RSI, RDX, RCX, R8, R9;   RAX.

 calling convention   ,         .




  .


   .

   ,     (https://www.litres.ru/book/uchitel-nachalnoy/kurs-revers-inzhiniring-informatsionnykh-sistem-74599012/)  .

      Visa, MasterCard, Maestro,    ,   ,     ,  PayPal, WebMoney, ., QIWI ,       .


