Assembly language for reverse engineering

Question

What should I choose NASM or MASM for assembly training. I want to learn how to build, motivation is reverse engineering.

So when I parse some kind of executable, I can understand the code by looking at the disassembled code.

Update: I think I do not understand what I myself understood. I understand that these are assemblers, but to understand the output of the disassembler I need to know the assembly and that the reason I ask where to start (using MASM or NASM)

Answer 1

Assuming you want to learn how to do reverse engineering in Windows , here's how to do it. The Linux path is very different (although in the end you get more or less the same place):

You want to start with something very simple, for example, with an 8080 processor. You can find an online emulator here: http://www.tramm.li/i8080 - this is an outdated OS called "CP / M". Click the link "Run EMU8080" - you will get the command line "SID" - a simple ancient debugger. It has only 10 commands - to view memory at any address, to enter new build commands, etc. Enter HELP to see all of them. You can try google to guide the SID if you want. Then google for the 8080 build guide - you will find a bunch of PDF files - all of them will be copies of the same two manuals written by Intel in the 1970s. Read both - they will give you a good start on 808x core processors. All modern processors used on PCs are manufactured from 8080. Play with the SID and 8080 until you feel that you have an idea.

The next step is 8086. To do this, you need to get a copy of Window XP and run the DEBUG program on the command line. DEBUG stands for Microsoft SID. It will be very easy to find out once you know the SID. The documentation is here: http://thestarman.pcministry.com/asm/debug/debug.htm - read as much as possible, also follow links to other pages - the same site contains a lot of materials on basic programming 8086. If so time you will learn the manual 8080, 8086 will feel very easy. (If you skip the 8080 / SID phase, everything will be weird, and the puzzle will take longer to figure out, trust me.)

You can also play with http://ladsoft.tripod.com/grdb_debugger.html , an improved DEBUG clone that is easier to work with.

The next step is to get Peter Abel’s book entitled "IBM PC Assembler Language and Programming" - the older the better. You can find it on Amazon for $ 1 (I'm not joking!). Read the first 7 chapters. Take yourself an assembler called "FASM" (forget MASM and NASM shit). Read the FASM documentation. Write a program in real mode 16 bit. You can still run them on the Windows XP command prompt.

Next step, read http://www.drpaulcarter.com/pcasm/ - this will help you understand protected mode. Then read the Intel 386 reference documentation: http://www.logix.cz/michal/doc/i386/

Then buy a book called Reverse. Reverse Engineering Secrets. It is rather lame, but will give you some ideas on what you need to know next. How low-level Windows programming (messages, handlers, etc.)

As soon as you go through all this, only then you can download http://www.ollydbg.de/ and try to play with it. Be sure to get version 1.x, not 2.x. Go to Youtube and find some tutorials. You can go to this step, but I can guarantee that you will be disappointed and do not understand anything that you see on the screen if you do not complete all of the above.

Good luck. If you have any questions, you can contact me through my blog (the link is on my profile page).

Answer 2

You talk about disassembling here. The tools you specified are assemblers that won't help you understand or understand existing code. However, they will be useful for the reassembly phase!

For disassembly, I highly recommend IDA Pro . It has all the tools, documentation, plugins, and community help you are looking for. As a bonus, older versions are also free.

Answer 3

I think you got it back. I studied assembly by debugging the output of a high-level language compiler.