If you had always wanted to learn how to reverse and patch packed programs - without unpacking, then this is the course for you. This course is a follow-up from the earlier course on Reverse Engineering & Memory Hacking. It is the practical application of what you have learnt in the first course. If you think that packing and anti-debugging is good enough to prevent reverse engineering, then you may be in for a surprise. In this course, I will show you how to test the effectiveness of several popular packers by packing crackmes and then reversing them - without unpacking.
If you had always wanted to learn how to reverse and patch packed programs - without unpacking, then this is the course for you. This course is a follow-up from the earlier course on Reverse Engineering & Memory Hacking. It is the practical application of what you have learnt in the first course. If you think that packing and anti-debugging is good enough to prevent reverse engineering, then you may be in for a surprise. In this course, I will show you how to test the effectiveness of several popular packers by packing crackmes and then reversing them - without unpacking.
Traditionally packed programs are unpacked before debugging is carried out. This is because a packed program's file cannot be patched. Much of software protection has centered on making it difficult to unpack programs. However, the important question is: how effective is packing, obfuscation and anti-debugging as a means to prevent reversing? This course explores several packers to find the answers.
We will do the analysis using a tool called Cheat Engine, which is a prominent tool used by game hackers. This tool could also be used to study and analyze packed program's processes that is running in memory. You will learn how to perform debugging in spite of anti-debugging being implemented. There is no need to unpack and dump memory. Instead of unpacking and then patching the dumped files and fixing IAT (Import Address Table) tables, we will write scripts to hack memory using byte patching using an advanced technique called AOB (Array-Of-Bytes) Injection, by injecting code into code caves (inline memory patching). In this course you will learn how to do all of the above and more.
At the end of this course you will be able to gauge the effectiveness of software packers, obfuscation and anti-debugging protection and also to have a good idea of how to implement extra countermeasures to improve the security of software.
In all the practical exercises and walkthroughs, we will use Crackme's which I have written. You will learn how to pack them using several popular packers and then hack them using Cheat Engine.
What you will learn
How to set hardware breakpoints and debug packed programs in spite of anti-debugging protection
Doing Break and Trace to identify Algorithms for reversing
Identifying addresses to do memory patching
Writing custom trainers (loaders) using Cheat Engine to hack and patch memory
Modify program behavior
Process Patching programs
Creating Lua Scripts for process patching
Test the effectiveness of Anti-Debugging technology
Packing crackmes using popular packers
Hack the packed crackmes and patch their memory during runtime
Prerequisites:
Before taking this course, you should preferably be already familiar with how to use x64dbg and Cheat Engine
Windows PC
Some knowledge of Assembly would be useful but not compulsory
So, go ahead and enroll now and I will see you inside.
Intro to course
Introduction to Memory Hacking
Basic Technique to Bypass Packer Protection
Basic Technique to Bypass Anti-Debug Protection
Applying Memory Hacking Techniques On VMProtect
Bypassing Kernel Level Anti-Debug Protection
Creating a Custom Memory Hacker (Trainer)
How to use install packer 273 and pack a crackme
Using JMP memory hack technique
How to create a custom memory hacker for packed program packed with Packer 273
How to download and install pakcer 731 and then use it to pack a Crackme
How to use the String Search method to hack memory
Bypass Using Memory Scanning Technique
Creating a Trainer
Bonus Lecture
OpenCourser helps millions of learners each year. People visit us to learn workspace skills, ace their exams, and nurture their curiosity.
Our extensive catalog contains over 50,000 courses and twice as many books. Browse by search, by topic, or even by career interests. We'll match you to the right resources quickly.
Find this site helpful? Tell a friend about us.
We're supported by our community of learners. When you purchase or subscribe to courses and programs or purchase books, we may earn a commission from our partners.
Your purchases help us maintain our catalog and keep our servers humming without ads.
Thank you for supporting OpenCourser.