Request Quick question about reverse engineering

hvhcartisol said:

Is it possible to monitor what a program is doing and then reproduce it yourself? For example, if a program modifies another process's memory could you see what addresses it accesses what values it writes, and how it does it then replicate that behavior in your own program?
I assume this is possible to some extent, but probably difficult depending on the program. What tools or techniques?

Click to expand...

calloc0x75 said:

Well what youre describing is normal dynamic analysis, step through the programs memory with any Debugger, see what it does and then build the same, this works easily on small applications but if you want to recreate a bigger program youd need to do static analysis with a decompiler such as Ghidra so you actually know what each function it does and what it takes etc. If you just see values change in registers and at what address thats fine but reproducing a full function requires you to know the entire context.

Click to expand...

hvhcartisol said:

What if the program is VMProtect-protected or heavily packed? Does that still work

Click to expand...

calloc0x75 said:

I mean obviously yeah, youd just need to get a little bit more creative with the dynamic analysis and spend a LOT of time on the static part, its not impossible to reverse engineer protected binaries the amount of effort and work youd need put in just becomes exponentially harder.

Click to expand...

hvhcartisol said:

Yea i understand. Im pretty young ive never done anything like this I will probably not succeed but its fun. Danke

Click to expand...