Request Quick question about reverse engineering

[hvhcartisol]

Is it possible to monitor what a program is doing and then reproduce it yourself? For example, if a program modifies another process's memory could you see what addresses it accesses what values it writes, and how it does it then replicate that behavior in your own program?
I assume this is possible to some extent, but probably difficult depending on the program. What tools or techniques?

 

[calloc0x75]

Is it possible to monitor what a program is doing and then reproduce it yourself? For example, if a program modifies another process's memory could you see what addresses it accesses what values it writes, and how it does it then replicate that behavior in your own program?
I assume this is possible to some extent, but probably difficult depending on the program. What tools or techniques?

Well what youre describing is normal dynamic analysis, step through the programs memory with any Debugger, see what it does and then build the same, this works easily on small applications but if you want to recreate a bigger program youd need to do static analysis with a decompiler such as Ghidra so you actually know what each function it does and what it takes etc. If you just see values change in registers and at what address thats fine but reproducing a full function requires you to know the entire context.

 

[hvhcartisol]

Well what youre describing is normal dynamic analysis, step through the programs memory with any Debugger, see what it does and then build the same, this works easily on small applications but if you want to recreate a bigger program youd need to do static analysis with a decompiler such as Ghidra so you actually know what each function it does and what it takes etc. If you just see values change in registers and at what address thats fine but reproducing a full function requires you to know the entire context.

What if the program is VMProtect-protected or heavily packed? Does that still work

 

[calloc0x75]

What if the program is VMProtect-protected or heavily packed? Does that still work

I mean obviously yeah, youd just need to get a little bit more creative with the dynamic analysis and spend a LOT of time on the static part, its not impossible to reverse engineer protected binaries the amount of effort and work youd need put in just becomes exponentially harder.

 

[hvhcartisol]

I mean obviously yeah, youd just need to get a little bit more creative with the dynamic analysis and spend a LOT of time on the static part, its not impossible to reverse engineer protected binaries the amount of effort and work youd need put in just becomes exponentially harder.

Yea i understand. Im pretty young ive never done anything like this I will probably not succeed but its fun. Danke

 

[calloc0x75]

Yea i understand. Im pretty young ive never done anything like this I will probably not succeed but its fun. Danke

Immer gerne, and well skill developes through learning so starting somewhere is certainly a step in the right direction