This website collects my attempts at reverse-engineering binaries – mostly crackmes and keygens – and the notes I took in the process in an effort to learn more about a discipline I was interested in many years ago but gradually abandoned. Posts are listed in order of increasing complexity (kind of) as I find more difficult challenges to solve. To follow these posts with an RSS reader, use this feed.

The tools and techniques presented here are for educational purpose only; no commercial software is reversed, attacked, or disassembled in any way.

Please exercise caution when running unknown binaries, especially if they were made by people who are interested in bypassing software protections.

Docker image

I usually run unknown binaries in a Docker container with no network access, based on an image with a few different tools pre-installed.

The image is built from a short Dockerfile and includes the GDB dashboard tool, which is packaged as a standalone .gdbinit file and provides a great user interface for GDB. Download the GDB dashboard .gdbinit file from their GitHub project and the custom settings to save as gdbinit-re.local here.

FROM debian:stable
RUN apt-get update
RUN apt-get install -y libc6-i386 lib32stdc++6 binutils less man manpages-dev strace gdb \
    gdbserver gcc ltrace curl wget unzip xxd python3 vim-nox procps python3-pip \
    silversearcher-ag upx-ucl

RUN pip3 install pygments

# Dashboard
COPY .gdbinit /root/.gdbinit
# Custom settings
RUN mkdir /root/.gdbinit.d
COPY gdbinit-re.local /root/.gdbinit.d/

# Add non-root user
RUN mkdir -p /home/re && useradd -N -d /home/re -u 1001 -s /bin/bash re && chown re /home/re

CMD ["/bin/bash"]

To build the image and tag it as re-tools:

$ docker build -t re-tools .

I run it with SYS_PTRACE enabled and networking disabled, and with a local directory mounted to /re:

$ docker run --rm --network none --cap-add=SYS_PTRACE --privileged \
  --security-opt seccomp:unconfined -ti -v ~/reverse-engineering:/re re-tools

In some cases I have also found it useful to disable address space layout randomization (ASLR) inside the container (see also this page explaining the feature):

# echo 0 > /proc/sys/kernel/randomize_va_space

Reverse-engineering software

Reference documents

This work is © Nicolas Favre-Felix, licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.

You can reach me on Twitter, by email at n.favrefelix@gmail.com, or via Keybase.