A list of some hacking resources, mostly Windows oriented

on

I always see questions on here about good starting resources. So here is a list that I've compiled from my browser bookmarks that I've found helpful in the past, mostly related to old Windows game hacking, so that when I see those questions I can link them back to here.

If any of these links are not acceptable to post here for whatever reason then let me know and I can edit them out to leave the rest.

Tools

  • Cheat Engine: it may sound silly, but using Cheat Engine to hack games can teach you a lot of the basic concepts of debugging an executable at a little bit lower level.
  • HxD: this is a basic hex editor. You can use it to edit binary files, similar to how you would use a text editor to edit text files. It's split into two columns: a hexadecimal representation and a text representation (which shows what the file would look like interpreted as text.)
    • Some tips: HxD also has a built in memory viewer which you can use to view of memory of a process without needing to attach to it as a debugger, which is quite useful for searching for strings in protected executables that detect when a debugger is attached. You can also use HxD to open very large text files (GB's in size) instantly and without any lag, as long as you don't mind the lack of newlines!
  • CFF Explorer: you'll want to become deeply familiar with the Portable Executable (PE) file format used by Windows EXE and DLL files, and CFF Explorer allows you to poke around, view what the headers look like, and edit them. It even includes some more advanced utilities like an Import Adder, to add DLL imports to an executable.
  • Ghidra or IDA: I mention both because they fill similar roles. They are static analysis tools which can be used to examine a compiled executable to get some guess of what the original source code sort of looked like, without needing to actually run the executable. Ghidra is free/open source and IDA is an expensive commercial software, each with their own features and tradeoffs. I see Ghidra being used more and more often but IDA is still definitely holding on.
  • x64dbg or Ollydbg: again, these are similar tools - x64dbg is meant to be a modern successor of sorts, but some hackers still swear on Ollydbg with plugins to iron out some of the bugs on newer Windows versions. These are dynamic analysis tools: you can actually run the code and step through it as it is running to see what it is doing, what values are in memory, in the CPU registers, and so on. Often times both static and dynamic analysis need to be combined to get a fuller picture and you'll need to learn which one is more useful for figuring out the thing you want to know.
  • ScyllaHide: because x64dbg allows you to see what a program is doing in great detail, it is in the best interest of malware creators to prevent you from using it and exposing how their program works. This is the world of "anti-debug" techniques: methods of discreetly detecting if a debugger is running, and either stopping or changing how the program operates if there is in order to hinder your progress. ScyllaHide attempts to make the debugger stealthier, in order to prevent the debugged program from finding out that you are investigating its inner workings.
  • Olly Advanced: a classic plugin for Ollydbg that fixes some of its bugs and provides more anti-debugging workarounds. A must have if you use Ollydbg.
  • LordPE: a classic executable memory dumper. This is used to turn a currently running process back into an executable file. Why would you want to do this? Well, oftentimes programs will be "packed," meaning that the executable file for them is compressed or encrypted. By running the executable, it will decompress/decrypt itself, and then the process can be dumped in its uncompressed/unencrypted state, allowing you to more easily analyze the code within.
    • Of note: LordPE doesn't work very well on modern Windows versions, since the list of processes caps out at a small number (I think 50,) and it only works for 32-bit processes. I don't know of a better modern alternative though - I've tried some, but haven't found one that is reliable for 64-bit processes. Maybe someone in replies can tell me.
  • Scylla or ImpREC: import rebuilders. Much like with x64dbg and Ollydbg, Scylla is the modern, open source implementation, and ImpREC is the original classic. Windows programs use DLL libraries in order to interact with the system. For example, the MessageBoxA function in USER32.DLL allows a program to display the built in Windows message box with an icon and OK/Cancel buttons. Usually, programs have an Import Address Table (or IAT for short) which specifes which imports the program uses. However, a very common trick to make dumping a process (such as with LordPE) difficult is to intentionally forego the Import Table, instead using the GetProcAddress function to populate a "fake IAT." This means that when the process is dumped, the imports will be random pointers into non-existent memory. Scylla and ImpREC are import rebuilders, which search for such a fake IAT and attempt to build a real IAT from them.
  • Process Monitor: allows you to see all the files and registry keys being accessed by a process. You can even right click on an entry to view the program's call stack when the file or registry key was accessed. This is great if you want a sort of overview or summary of what the process is doing if you don't know where to begin looking.
  • Luke Stackwalker: a profiler that can be used on processes even if you do not have symbols for the executable, to see where the most processing time is being spent.
  • Fiddler: allows you to see all HTTP (and HTTPS, with a bit of setup) requests being made by any running program on the current machine, including their headers and contents. Very useful if you want to find out why a program needs to connect online. There is also Wireshark for lower level network stuff (unpopular opinion: it lowkey it kind of sucks and I rarely use it)
  • Resource Hacker: for viewing and replacing executable resources. This tool is not generally useful for changing the behaviour of an executable, only aesthetic things like its icon and text strings, but it can still reveal useful information on occasion.

YouTube

  • Stephen Chapman: great Cheat Engine tutorials. This is how I got started.
  • LiveOverflow: more Linux focused, but nonetheless essential. I watch every new video from this channel.
  • Give Academy: tutorials for x64dbg and Ollydbg.
  • Guided Hacking: focused on writing code for hacking Windows games.
  • Null Byte: exploits, network hacking stuff.
  • OALabs: IDA malware reverse engineering and debugger fundamentals, in a livestream format.
  • Nathan Baggs: new, smaller channel, retro game hacking.
  • John Hammond: mostly focused on reversing obfuscated malware VBScript, JavaScript, Python scripts.

Links

submitted by /u/tomysshadow
[link] [comments]

from hacking: security in practice https://ift.tt/rZV32C0

Comments

Post a Comment