|
所在平台: Udemy |
课程主页: https://www.udemy.com/course/reverse-engineering-packed-programs/
课程评论：没有评论
Coursera 课程《逆向工程、内存黑客与软件保护》是一门专注于深入了解和绕过软件保护机制的实践课程。本课程建立在先前的《逆向工程与内存黑客》基础上，进一步探讨如何直接对已打包（packed）程序进行逆向和修补，而无需先行解包。 课程核心内容包括： * **评估软件保护技术：** 通过打包“Crackme”程序并进行逆向分析，检验多种流行打包器、混淆技术和反调试手段的有效性。 * **绕过反调试：** 学习如何在存在反调试保护的情况下依然能够进行调试，无需传统的解包和内存转储。 * **内存修补技术：** 采用“字节数组注入”（AOB Injection）等高级技术，直接在内存中进行代码注入和内联修补，解决修改导入地址表（IAT）等复杂问题。 * **使用 Cheat Engine：** 重点使用 Cheat Engine 工具，该工具是游戏黑客领域常用的强大工具，也可用于分析和修改运行中的打包程序。 * **实现自定义训练器：** 学习使用 Cheat Engine 编写 Lua 脚本，实现自定义游戏训练器，以修改和修补程序行为。 * **实际操作：** 通过作者编写的“Crackme”程序进行实践，学习打包技巧，并使用 Cheat Engine 进行内存修补。 **课程目标：** 学员将能够评估不同软件保护措施的有效性，并掌握提升软件安全性的额外对策。 **先修要求：** * 熟悉 x64dbg 和 Cheat Engine 的使用。 * Windows 操作系统。 * 具备汇编语言知识（非强制）。
If you had always wanted to learn how to reverse and patch packed programs - without unpacking, then this is the course for you. This course is a follow-up from the earlier course on Reverse Engineering & Memory Hacking. It is the practical application of what you have learnt in the first course. If you think that packing and anti-debugging is good enough to prevent reverse engineering, then you may be in for a surprise. In this course, I will show you how to test the effectiveness of several popular packers by packing crackmes and then reversing them - without unpacking. Traditionally packed programs are unpacked before debugging is carried out. This is because a packed program's file cannot be patched. Much of software protection has centered on making it difficult to unpack programs. However, the important question is: how effective is packing, obfuscation and anti-debugging as a means to prevent reversing? This course explores several packers to find the answers. We will do the analysis using a tool called Cheat Engine, which is a prominent tool used by game hackers. This tool could also be used to study and analyze packed program's processes that is running in memory. You will learn how to perform debugging in spite of anti-debugging being implemented. There is no need to unpack and dump memory. Instead of unpacking and then patching the dumped files and fixing IAT (Import Address Table) tables, we will write scripts to hack memory using byte patching using an advanced technique called AOB (Array-Of-Bytes) Injection, by injecting code into code caves (inline memory patching). In this course you will learn how to do all of the above and more.At the end of this course you will be able to gauge the effectiveness of software packers, obfuscation and anti-debugging protection and also to have a good idea of how to implement extra countermeasures to improve the security of software.In all the practical exercises and walkthroughs, we will use Crackme's which I have written. You will learn how to pack them using several popular packers and then hack them using Cheat Engine.What you will learnHow to set hardware breakpoints and debug packed programs in spite of anti-debugging protectionDoing Break and Trace to identify Algorithms for reversingIdentifying addresses to do memory patchingWriting custom trainers (loaders) using Cheat Engine to hack and patch memoryModify program behaviorProcess Patching programsCreating Lua Scripts for process patchingTest the effectiveness of Anti-Debugging technologyPacking crackmes using popular packersHack the packed crackmes and patch their memory during runtimePrerequisites:Before taking this course, you should preferably be already familiar with how to use x64dbg and Cheat EngineWindows PCSome knowledge of Assembly would be useful but not compulsorySo, go ahead and enroll now and I will see you inside!
