Techniques

Not all those who wander are lost, but how did you end up here?

This page is a work in progress

On this page I will describe some approaches that can be used to make sense of reverse-engineered programs. The idea is to give you some ideas of the things you can try when you are stuck.

Basic techniques

  • Top-down analysis - start from the entrypoint and go down from there
  • Bottom-up analysis (strings) - start from strings and go up from there
  • Bottom-up analysis (imports) - start from imports and go up from there
  • Bottom-up analysis (random walk) - when you’re feeling lucky

Intermediate techniques

  • Passive API monitoring

  • Manual unpacking with Debugger

  • Code coverage tracking

  • Differential code coverage

notes

Cartographer

DynamoRIO-Windows-11.0.0.zip

dynamoriodir\bin32\drrun.exe -t drcov — malware.exe