1

Debugger v
Disassembler v
Decompiler v

Debugger


...
.




... .
.
:
.
...
- ...

. ...

.

: :
ApplicationMode
Kernel Mode

Application Mode Ring3 User Mode

Resolve
Kernel Mode Kernel Debugger
Ring0 Kernel Space Symbol file
Resolve .

:
Source code Level
Assembler Level
Source Code Level

Assembler Level

.
Assembler Call Test

Mov BreakPoint.

.
:
v :
...
v
Hook Hook

v ) ( Ring0

Trick


by Pass .
.

:Windbg
. Windows Symbol

files .

:Ollydbg
Assembler Level Application Mode .
.
Olly Olly . BCB6 /.

:SoftICE
Kernel Mode Source Level
Assembler Level .
. .
.
. Visual SoftICE
DriverStudio DevPartnet
SICE .

: kd
Kernel Debugger DDK Driver development

Kit . Kernel Mode Assembler Level

Source Level . SICE Windows

Symbol Files .

OllyDBG SI
kd Ring0 .
Disassembler Decompiler .
.

Disassembler
.
Instruction
.

: PE MASM Macro Assembler

. Disassembler .

: . Disassembler
. Knowledge Base

.

Disassembler
. Disasembler MASM GCC
VC
VCL MFC
Disassembler
.

: Disassembler
: Protection
.
Disassembler
Patch
.
Disassembler !

Disassembler IDA Pro WinDasm

PView :
...

- Disassembler

... Disassembler
. IDA Pro
Disassembler ) .
(
Borland C

. WinDasm .
8,9 9 10 Patch

. WinDasm )
( IDA
. IDA Pro
)
(
.

Decompiler
Decompiler

Decompiler :

: VC / ) Win32/IA32
32 32 ( .

: .

: . VB6 PCode VB

runtime .

: . .

: .

: Decompiler
:.

Decompiler .
.

.
- Delphi VC

: Decompiler
: Decompiler .

:
: Decompiler .
) VB (

) ( Decompiler

.
: Decompiler
: .
Decompiler .

.

.

Reverse Engineering

10

:
: :

Trace VC
Runtime JRE CLR

) Native ( VC .
Framework
Delphi .

VC .



Native .

Managed CPP

11

: Decompiler

: . Decompiler
. DeDe Delphi

Decompiler Decompiler
.

.

Decompiler .

Decompiler !
Compressor

][
Disk Image
.
)
Loader

Access Violation

12

! (

. ]
[
/





:
. .- .

:
Memory Dump PE .
Loader
-

13

Single Module

Packer Encryptor

Packer

Packer . : Packer
... .
UnPack .

Packer :

) ( ...- ) Memory

( Image
CRC Hash -

14

Packer

- -

Packer

VM

) ( Packer ...

Packer
: UnPack
. Packer

.

UnPack
][ !

Packer .
Packed ][
Packer
.

15

Packer
:
Packer v .
Packer v
.
v Packer

v Packer

:Packer

Packer .

Pack .

ATM
.

Packer :

.

.

16

Packer

.

Best Wishes
.
Pack.
HEX Editor .
Packer



.
.
ATM

.
.

17

Packer
:
: Packer
PCI Packer .
: . Packer
.

Packer yP Packer
SVKP
//


.


.
Encryptor
Encryptor .

18

Encryptor :

/ - -

- -

Encryptor :

: .
: .
:
.

Encryptor
3DES
PKI
.

)
( )

19

( PKI CA:
.

:
A a b c . c
a
. .

:
c .
a b
.

b .

:
d CA e .
d c
c c
.
:
-

20

:
) PKI .
(.

:



:

Encryptor
- -
.
- Packer Encryptor

.

21

/
:

http://www.anticracking.sk/download.html
SEPP
http://www.webtoolmaster.com/exes.htm
EXE Stealth
http://www.anticracking.sk/products_svkp.html
SVK Protector
http://www.rtsoftware.org
Code-Lock
http://pelock.pac.pl
PE Lock
http://www.xprotector.com/downloads.php
Themida
http://www.aspack.com
ASProtect

22

http://www.siliconrealms.com/armadillo.shtml
Armadillo
http://www.pc-guard.co.yu/e_pcgw32.htm
PC Guard
http://www.ultraprotect.com/download.htm
Ultra Protect
http://www.obsidium.de/show.php?details
obsidium

http://virogen.cjb.net
VGCrypt
http://yodap.cjb.net
Yoda
http://egoiste.da.ru
tElock
http://pespin.w.interia.pl
PESpin

23

http://www.blinkinc.com
Shrinker
http://www.neoworx.com
NeoLite
http://www.collakesoftware.com
PEBundle
http://www.pecompact.com
PEcompact
http://packman.cjb.net
PackMan
http://upx.sourceforge.net
UPX
http://dwing.go.nease.net
UPack

24