News for hackers. Stuff that matters.
Re:Using Ghidra to Reverse Engineer Super Monkey Ball for Ga... by 2pEXgD0fZ5cF on Tuesday March 02, 2021 @10:24AM (#26316207)
Can anybody recommend some good resources and/or books (or some kind of roadmap) to get into practical reverse engineering "starting from zero" (as in: a person with general higher level programming experience)?
Re:Using Ghidra to Reverse Engineer Super Monkey Ball for Ga... by bumbada on Tuesday March 02, 2021 @12:28PM (#26317798)
For learning programming I always recommend that you have a specific project in mind, so instead of following a book, you follow your project's needs and use books as a reference.

I learned (intel x86)assembly from joining a cracking group when I was adolescent, it was my first programming language. Nothing beats being taught by masters of the craft and competing and contributing as a team.

Today I teach kids ARM assembly using microcontrollers like arduino unos or nanos and controlling a motor or servo, then I add more and more complexity like explaining klipper architecture, so they learn c and python.

With kids, the social part is very important, and making real things that move and react on the real world too. I suspect is of great help for adults too.

It is probably too dull to learn assembler today, on your own (alone) on a powerful computer. With a microcontroller you have a machine that is so constrained in resources that you really need to use c or assembly.

HN has very good resources about assembly, you can search them on google "hacker news assembly" or "hacker news reverse engineer", use zotero to aggregate the links.

Re:Using Ghidra to Reverse Engineer Super Monkey Ball for Ga... by pluc on Tuesday March 02, 2021 @01:53PM (#26318897)
is your answer to "how do I learn to reverse-engineer things" to learn Assembly? If so why?
Re:Using Ghidra to Reverse Engineer Super Monkey Ball for Ga... by secondcoming on Tuesday March 02, 2021 @04:05PM (#26320726)
Because if you're dumping binaries, or attaching to running processes, you'll be looking at assembly code.
Re:Using Ghidra to Reverse Engineer Super Monkey Ball for Ga... by pjc50 on Tuesday March 02, 2021 @04:23PM (#26320973)
Well, the assembly is literally all you have, so you're not going to make much progress otherwise..
Re:Using Ghidra to Reverse Engineer Super Monkey Ball for Ga... by barbecue_sauce on Tuesday March 02, 2021 @05:15PM (#26321779)
Pretty sure that's the whole basis of reverse engineering.
Re:Using Ghidra to Reverse Engineer Super Monkey Ball for Ga... by 0x003 on Tuesday March 02, 2021 @06:23PM (#26322607)
Crackmes are how I got into it. crackmes.one has a bunch of good ones. I whipped up a quick and easy one here for you you can run it if you want but it doesn't need to be run (generally don't run random executables you download off the internet) just load it in ghidra/radare/<decompiler of choice> and figure it out. it's just about finding the main entry point of the program and following the flow. https://filebin.net/h4kp7s0z04kqa5om
Re:Using Ghidra to Reverse Engineer Super Monkey Ball for Ga... by amatecha on Tuesday March 02, 2021 @07:07PM (#26323040)
nice. my recent discovery of "CTFs" made that challenge trivial haha! th@nk5 ;) Will check out this site though, that sounds interesting indeed.
Re:Using Ghidra to Reverse Engineer Super Monkey Ball for Ga... by coldpie on Tuesday March 02, 2021 @10:45AM (#26316462)
Hey, article author here. I'm not very good at this stuff, it's just applying knowledge I've picked up over my career working in systems-level programming and various little game hacking projects.

The one thing I'd say is a real pre-requisite is to learn C. And I mean really learn C: pointers, including arithmetic and aliasing; memory allocation; stack vs heap; statics and globals. C is the lingua franca of this environment, and learning C will give you a good window into what the compiler is doing to turn your code into what's actually running on the CPU.

It's also good to understand how computers actually work. I strongly recommend the book "Code" by Charles Petzold (Microsoft Press, be wary of counterfeits and don't buy from Amazon). It starts literally from scratch. Like, light bulbs with electricity and a switch. Then it builds on that to create a fundamental CPU, and then shows how to go from there into the real CPUs used today, including an introduction to assembly language and machine code. It's a fantastic book if you ever want to do anything low-level on a computer.

Once you've got C and a basic level of understanding of assembly/machine code, I think you're ready to do something real. Start simple. The NES runs on a 6502, which is 8-bit, has three registers and only a handful of opcodes, and is single-threaded. In the past I've used FCEUX-DSP's debugger features[1], but I think these days most people use Mesen. You can use the same basic techniques I did in these articles: scan memory for the values you want (the player's score or life count; the player character's velocity), then set watch points to find the code that modifies them, then go understand what that code is doing and change it to do what you want. Give yourself infinite lives or a crazy high jump in Super Mario Bros or something.

From there you can move on to more modern CPUs and such, but the complexity goes _way_ up once you move on from environments where most stuff was actually written in ASM or very simple C without fancy compilers. I was very relieved to see how readable Super Monkey Ball's disassembly actually was.

[1] My first real game RE project was dumping PNG pictures of the levels in M.C. Kids for NES, for comparison on TCRF:

https://gitlab.com/mcmapper/mcmapper/-/blob/master/main.c

https://tcrf.net/Proto:M.C._Kids

Re:Using Ghidra to Reverse Engineer Super Monkey Ball for Ga... by corysama on Tuesday March 02, 2021 @11:39AM (#26317147)
Thanks for the article! Over in https://www.reddit.com/r/ReverseEngineering/ there are a bunch more people who would really appreciate it if you also posted there.
Re:Using Ghidra to Reverse Engineer Super Monkey Ball for Ga... by coldpie on Tuesday March 02, 2021 @01:18PM (#26318443)
Thanks for the suggestion, I have done that. If you know of other communities that might enjoy the article, please do feel free to pass it along anywhere you like.
Re:Using Ghidra to Reverse Engineer Super Monkey Ball for Ga... by breakingcups on Friday March 05, 2021 @07:42AM (#26356204)
/r/REGames is also a good one
Re:Using Ghidra to Reverse Engineer Super Monkey Ball for Ga... by rcfox on Tuesday March 02, 2021 @11:00AM (#26316670)
From my experience: learning C will help you learn assembly, which will help you actually learn C.
Re:Using Ghidra to Reverse Engineer Super Monkey Ball for Ga... by btkramer9 on Tuesday March 02, 2021 @07:24PM (#26323161)
Haha this is very true. This also seems very true for Algebra and Calculus. I never really remembered/internalized all of the rules of Algebra (moving around log, e, ln, a^x, etc) until doing derivatives/integrals by hand
Re:Using Ghidra to Reverse Engineer Super Monkey Ball for Ga... by samwestdev on Tuesday March 02, 2021 @10:48AM (#26316504)
The book "Code" is by Petzold Charles
Re:Using Ghidra to Reverse Engineer Super Monkey Ball for Ga... by coldpie on Tuesday March 02, 2021 @10:49AM (#26316511)
Indeed, fixed. Thanks.
Re:Using Ghidra to Reverse Engineer Super Monkey Ball for Ga... by walls on Tuesday March 02, 2021 @10:34AM (#26316314)
'Practical Malware Analysis' was required reading for all RE candidates at my previous job.

It's very windows focused but teaches skills that are (somewhat) easily transferable.

Re:Using Ghidra to Reverse Engineer Super Monkey Ball for Ga... by ackbar03 on Tuesday March 02, 2021 @10:29AM (#26316263)
My 2 cents is do some CTF questions. PicoCTF's are good for beginners, they have a good progression in difficulty.

And once your more or less proficient then just crack some software. Find something old, like protected by purchasing key or whatever, and on the simpler side, don't go straight for photoshop or whatever. Its gonna take a long time but even if you don't succeed you'll get a much better feel for it in the process. Best way to learn is by doing, thats my experience anyways.

Re:Using Ghidra to Reverse Engineer Super Monkey Ball for Ga... by _joel on Tuesday March 02, 2021 @10:58AM (#26316646)
There's places like https://crackmes.one/ too
Re:Using Ghidra to Reverse Engineer Super Monkey Ball for Ga... by dilDDoS on Tuesday March 02, 2021 @11:37AM (#26317122)
HackTheBox (hackthebox.eu) has some great reverse engineering challenges that you can learn a lot from, and have a clear difficulty progression. The non-retired challenges are all free with a basic account, but if you're starting from scratch, it might be beneficial to try out a premium account to access retired challenges (and their associated write-ups).
Re:Using Ghidra to Reverse Engineer Super Monkey Ball for Ga... by NtGuy25 on Tuesday March 02, 2021 @12:58PM (#26318168)
As someone else said. Practical Malware Analysis is great. The ghidra book by Eagle is also decent as well.

The best thing for RE learning though is to use Visual Studio to write a few programs. From the debugger view you can use the assembly, and see what your program ends up in.

You also want to think about it as the programmer. You have a MASSIVE program. You want to see where it creates files. You know that on windows, it HAS to go through CreateFile, or at least NTcreatefile function or system call. So you can watch for these, or look where they are called in Ghidra. Now you can mark all the functions in the chain using xrefs (What references this) and then get all the functions that use createfile out of the way!

And lastly, as a programmer, you know the apis. So think of what cases someone would use printf for example. There's not many. You know by the use of printf, there's some sort of logging at that location. If they use openfile. You have a good idea that all the code surrounding that call is going to be about the file being opened.

TL;DR. Start from api calls, and work backwards. Use your knowledge as a dev for what these api calls are used for. And walk that call chain and mark. Eventually every function is mapped.

Re:Using Ghidra to Reverse Engineer Super Monkey Ball for Ga... by JohnCurran on Tuesday March 02, 2021 @10:48AM (#26316508)
This gets asked a fair bit. Here's an HN link tree you can follow to get you started:

https://news.ycombinator.com/item?id=26296951

Re:Using Ghidra to Reverse Engineer Super Monkey Ball for Ga... by yomansat on Tuesday March 02, 2021 @05:25PM (#26321901)
This series, for reverse engineering a multi-player game that's meant to be hacked:

https://www.youtube.com/watch?v=RDZnlcnmPUA&list=PLhixgUqwRT...

Re:Using Ghidra to Reverse Engineer Super Monkey Ball for Ga... by hatsunearu on Tuesday March 02, 2021 @10:04PM (#26324226)
https://microcorruption.com/

pretty easy and fun, there is a difficulty wall after a few stages though. but once you get there, you might be able to get through it with some general deduction skills.

Re:Using Ghidra to Reverse Engineer Super Monkey Ball for Ga... by elitepleb on Tuesday March 02, 2021 @10:42AM (#26316425)
Re:Using Ghidra to Reverse Engineer Super Monkey Ball for Ga... by blinkingled on Tuesday March 02, 2021 @03:14PM (#26319978)
I think the author made these available for free in the past but now they are paywalled. (Nothing wrong with that at all, just thought it would help others trying to find the download on the site.)
Re:Using Ghidra to Reverse Engineer Super Monkey Ball for Ga... by Cloudef on Tuesday March 02, 2021 @01:16PM (#26318418)
Get a debugger and disassembler. Read their manual.
Re:Using Ghidra to Reverse Engineer Super Monkey Ball for Ga... by jhatemyjob on Tuesday March 02, 2021 @01:53PM (#26318901)
pokered or pokecrystal