Posts

Bismillah, and peace and blessings upon the Messenger of Allah, and upon his family and companions and those who follow him. Praise be to Allah, Lord of the worlds, by whose favor and guidance the Entry P01NT workshop has been completed. I ask Allah to record for you beneficial knowledge and righteous deeds through it, and that it be a good beginning for you. The Road Ahead Reverse engineering is not merely reading articles; it is practice, experimentation, and building muscle memory in handling tools and analyzing code. Accordingly, we have prepared a simple roadmap for you: ...

Bismillah In this article, we will solve a simple lab challenge that relies entirely on dynamic analysis using the x64dbg debugger. We assess that the exercise demonstrates how to bypass anti-debugging mechanisms and how to patch the program’s execution flow so that it accepts any key we provide. Lab environment setup: The executable for this lab can be downloaded from the following link dyn4m1c_cr4ckm3 in the course repository. Archive password: p01nt ...

Bismillah In this article, we will solve a simple lab challenge that relies entirely on static analysis (Static Analysis). The objective here is to apply the concepts learned previously to decrypt the flag hidden within the program. Lab environment setup: You may download the executable for this lab from the following link 5t4t1c_cr4ckm3 in the course repository. The archive password is: p01nt To open this file you must open it inside a VM. Although I am the one who designed this file, never trust the cyber community. We will run the file with the following command ...

Bismillah The reverse engineer does not perceive code merely as complex programming instructions, but rather as a “black box” with inputs and outputs. In this article, we discuss how the reverse engineer’s mindset is built and how to infer the hidden programmatic logic. The Scenario Imagine we are confronted with a locked electronic door. This door opens only if a single correct character is entered from the keyboard. We have only the keyboard and a small screen that displays a single message upon each input attempt. ...

Bismillah Having completed the basic analysis (Basic Analysis), we proceed to the advanced analysis (Advanced Analysis). In this article, we examine the principal disassembler and debugger tools employed to analyze binaries, providing a concise and rapid overview. During hands-on application, these tools will be explored in greater depth and detail. Disassemblers These tools are used to read a program without executing it (Static Analysis), analogous to reading a map to identify directions and terrain before commencing a journey. ...

Bismillah Whenever we intend to analyze any file, we follow the steps below, irrespective of whether the objective is to determine whether the file is benign or contains malware, or even whether we intend to crack its protection: The 4 Stages of Analysis Basic Static Analysis: This analysis does not require deep technical expertise, but relies entirely on tools that operate automatically (such as VirusTotal). It reveals indicators that show whether the file is a virus or not. ...

Bismillah When engaging with malicious software (malware) that warrants examination, one must understand the mindset of the adversary and the objectives they pursue. Therefore, in this research we examine the attack lifecycle and explain several fundamental concepts in malware development. The attack cycle is divided into three principal stages: Figure (1): Illustration of the attack lifecycle. Stage 1: Initial Access This stage focuses on breaching the initial defensive perimeter and gaining a foothold within the target system. ...

Bismillah When beginning to work with Assembly language, one invariably perceives a degree of difficulty owing to its low-level nature, in contrast to higher-level languages such as C or Python. In this research, we attempt to simplify assembly code so that it may be more readily understood. The premise of this article is that we will author a simple program in C, compile it into x86 Assembly, and then explain the operations that occur in order to analyze the control flow. ...

Bismillah Have you ever wondered how programs operate within systems? Or has the following thought occurred to you: what is the difference between an ordinary user and a developer in terms of their understanding of the systems they interact with? God willing, in this article we will clarify the executable file format in Windows and discuss some important matters regarding Windows architecture that we must not be ignorant of. Before beginning, if you do not have sufficient knowledge of operating systems, we advise you to review the following series: 🔗 Operating Systems Series on the Shell Network ...

Bismillah In this article we will review the foundational disciplines that must be learned before embarking on the field of reverse engineering. We have distilled this knowledge from several international references and formulated it into Arabic explanations and series that we published on the “Arabic Shell Network” (Shabakat Shill al-Arabiya), and we append them here along with the original references at the end of each section. To begin, every field has fundamentals that cannot be overlooked, and learning them is an obligation, for they will be the launching point of the journey of empowerment that we strive toward, God willing. ...