About

This website collects my attempts at reverse-engineering binaries – mostly crackmes and keygens – in an effort to learn more about a discipline I was interested in many years ago but gradually abandoned. Posts are listed in order of increasing complexity (kind of) as I find more difficult challenges to solve. To follow these posts with an RSS reader, use this feed.

The tools and techniques presented here are for educational purpose only; no commercial software is reversed, attacked, or disassembled in any way.

Please exercise caution when running unknown binaries, especially if they were made by people who are interested in bypassing software protections.

Docker image

I usually run unknown binaries in a Docker container with no network access, based on an image with a few different tools pre-installed.

The image is built from a short Dockerfile and includes the GDB dashboard tool, which is packaged as a standalone .gdbinit file and provides a great user interface for GDB. Download the GDB dashboard .gdbinit file from their GitHub project and the custom settings to save as gdbinit-re.local here.

FROM debian:stable
RUN apt-get update
RUN apt-get install -y libc6-i386 lib32stdc++6 binutils less man manpages-dev strace gdb \
    gdbserver gcc ltrace curl wget unzip xxd python3 vim-nox procps python3-pip \
    silversearcher-ag upx-ucl

RUN pip3 install pygments

# Dashboard
COPY .gdbinit /root/.gdbinit
# Custom settings
RUN mkdir /root/.gdbinit.d
COPY gdbinit-re.local /root/.gdbinit.d/

# Add non-root user
RUN mkdir -p /home/re && useradd -N -d /home/re -u 1001 -s /bin/bash re && chown re /home/re

CMD ["/bin/bash"]

To build the image and tag it as re-tools:

$ docker build -t re-tools .

I run it with SYS_PTRACE enabled and networking disabled, and with a local directory mounted to /re:

$ docker run --rm --network none --cap-add=SYS_PTRACE --privileged \
  --security-opt seccomp:unconfined -ti -v ~/reverse-engineering:/re re-tools

A command that’s not included in the Dockerfile but that I have found useful is this echo to disable address space layout randomization (ASLR) inside the container:

# echo 0 > /proc/sys/kernel/randomize_va_space

Software

Reference documents


This work is © Nicolas Favre-Felix, licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.

You can reach me on Twitter, by email at n.favrefelix@gmail.com, or via Keybase.