In-Depth Analysis of Disassembly Techniques
Comparison of Mainstream Disassembly Tools
| Tool | Architecture Support | GUI | Core Advantages | Typical Use Cases |
|---|---|---|---|---|
| IDA Pro | x86/ARM/MIPS, etc. | Yes | Powerful disassembly engine, cross-references | Commercial reverse engineering, vulnerability analysis |
| Ghidra | Multi-architecture | Yes | NSA open-source, free, script support | Security research, malware analysis |
| Radare2 | Multi-architecture | Optional | CLI-driven, highly extensible | Embedded analysis, automated reverse engineering |
IDA Pro Advanced Features:
- FLIRT signature for identifying library functions
- Interactive disassembly navigation
- Python/API automation scripting
- Binary diffing
Ghidra Signature Features:
# Ghidra Python script example: batch marking strings
from ghidra.app.decompiler import DecompInterface
def mark_strings():
current_program = getCurrentProgram()
listing = current_program.getListing()
for addr in listing.getAddresses(True):
if listing.getCodeUnitAt(addr).isString():
createBookmark(addr, "String", "Identified string")
Key Points of Disassembly Techniques
Instruction Decoding Essentials:
- Opcode identification and classification
- Operand parsing (registers/memory/immediate values)
- Prefix byte handling (e.g., 66h/67h)
- Branch target calculation
Pseudocode Generation Principles:
- Control Flow Graph (CFG) construction
- Data flow analysis
- Type inference
- Intermediate Representation (IR) transformation
Dynamic Analysis Techniques
Dynamic Debugging Tools
OllyDbg Core Features:
- Memory breakpoints (access/write)
- Hardware breakpoints (DR0–DR7)
- Script debugging (OLLYScript)
- API call tracing
x64dbg Modern Features:
- Multi-threaded debugging support
- Memory search highlighting
- Plugin system (Python/Lua)
- Symbol server integration
Dynamic Analysis Tips
; Example: setting a hardware breakpoint in a debugger
mov eax, [target_address] ; Target address
mov dr0, eax ; Set DR0 register
mov dr7, 0x00000001 ; Enable execution breakpoint (DR7[0]=1)
Runtime Behavior Analysis
API Call Monitoring Techniques:
- SSDT Hook (System Service Descriptor Table)
- Inline Hook (instruction replacement)
- EAT Hook (Export Address Table)
Memory Monitoring Methods:
- Page table permission modification (PAGE_GUARD)
- Write breakpoints (DR0–DR3)
- Heap allocation tracking (RtlAllocateHeap)
Code Injection Techniques
Shellcode Injection Techniques
Classic Injection Workflow:
- Allocate executable memory (
VirtualAlloc/VirtualAllocEx) - Write shellcode
- Create remote thread (
CreateRemoteThread) - Execute and clean up
Shellcode Development Principles:
- Position-independent code (PIC)
- Avoid null bytes (0x00)
- Direct system calls
- Compatibility with initial register states
Shellcode Example (x86):
; Windows MessageBox Shellcode
mov eax, 0x77D507E0 ; MessageBoxA address
push 0 ; uType
push 0x74736577 ; "wset"
push 0x6F6C6C63 ; "cllo"
push 0 ; hWnd
mov ebx, esp
push 0
call eax
DLL Injection Techniques
Comparison of Mainstream Injection Methods:
| Method | Principle | Detection Difficulty |
|---|---|---|
| CreateRemoteThread | Remotely create thread to load DLL | Low |
| SetWindowsHookEx | Install global hook | Medium |
| Reflective DLL | Load DLL in memory without file drop | High |
| APC Injection | Asynchronous Procedure Call | Medium |
Reflective DLL Injection Key Code:
// Core steps of reflective loading
void* mem = VirtualAlloc(NULL, dll_size, MEM_COMMIT, PAGE_READWRITE);
memcpy(mem, dll_buffer, dll_size);
relocate(mem); // Fix relocation table
resolve_imports(); // Resolve import table
call_entrypoint(); // Invoke DllMain
Software Cracking Techniques
Patching Techniques Classification
- Instruction replacement (e.g.,
JNZ→JMP) - Data modification (jump table alteration)
- Structure patching (vtable hijacking)
- Import Table Hook
Keygen Algorithm Reversing:
; Typical serial validation logic
mov eax, [user_input]
call crc32_hash
cmp eax, [stored_hash]
jne show_error_message
Bypassing Protection Mechanisms
- Anti-debugging detection (
IsDebuggerPresent) - VM detection (CPUID instruction analysis)
- Environment checks (registry/filesystem)
Advanced Cracking Techniques
Memory Patching Techniques:
- Runtime code modification
- Import Address Table (IAT) Hook
- Exception handler hijacking
Example: IAT Hook Implementation:
; Modify IAT entry to point to our function
mov eax, [iat_entry] ; Original function address
mov [new_iat_entry], eax
mov [iat_entry], our_function
Anti-Debugging and Anti-Reverse Engineering Techniques
Common Anti-Debugging Methods
- Debugger flag detection (
IsDebuggerPresent) - Time-difference detection (
RDTSC) - Exception handling detection (SEH chain inspection)
- Process enumeration checks
Advanced Anti-Debugging Example:
; Detect hardware breakpoints
mov eax, dr7
test eax, 0x0F ; Check DR0–DR3
jnz debugger_detected
; Detect memory breakpoints
mov eax, [target_address]
mov ebx, [eax]
; Attempting to write will trigger an exception
Code Obfuscation Techniques
Control Flow Flattening:
; Flattened control flow
dispatch_loop:
mov eax, [state_var]
jmp [dispatch_table + eax*4]
handler1:
; ... code ...
mov [state_var], 2
jmp dispatch_loop
handler2:
; ... code ...
mov [state_var], 1
jmp dispatch_loop
Data Encryption Techniques:
; Runtime string decryption
mov esi, encrypted_string
mov edi, decrypted_buffer
mov ecx, string_length
decrypt_loop:
lodsb
xor al, key
stosb
loop decrypt_loop
Comprehensive Practical Case Studies
Cracking Example: Serial Validation
Reverse Engineering Steps:
- Locate validation function (via string cross-references)
- Analyze algorithm logic (CRC32/MD5, etc.)
- Identify critical comparison instruction
- Modify jump condition (
JNZ→JMP)
Patch Process:
; Original code
cmp eax, ebx
jne show_error
; After patch
cmp eax, ebx
jmp skip_error ; Skip error message directly
Shellcode Development in Practice
Principles for AV-Evading Shellcode:
- Dynamic API resolution (
GetProcAddress) - Direct system calls
- Instruction randomization
- Polymorphic code generation
Example: Dynamic API Resolution:
; Resolve API via NTDLL
mov eax, [ntdll_base]
mov eax, [eax + GetProcAddress_offset]
call eax
Anti-Debugging Countermeasure Drill
Detection and Bypass Example:
; Anti-debugging check
mov eax, 0x77D507E0 ; IsDebuggerPresent address
call eax
test eax, eax
jnz exit_program
; Bypass method: NOP out or modify return value
; nop
; mov eax, 0
By mastering these techniques, security researchers can:
- Analyze malware behavior
- Assess software security vulnerabilities
- Develop security protection solutions
- Conduct authorized penetration testing
- Understand the principles behind software protection mechanisms
Legal Disclaimer:
The techniques described in this document are intended solely for legitimate security research purposes. Unauthorized reverse engineering may violate laws and regulations such as the Regulations on Computer Software Protection.
