0

One of the threads I have discovered in my reading about learning how to reverse engineer is to write "small" c programs compile them and then disassemble them to see how the c code gets translated into assembly.

I am working on windows 7 64-bit, and have had problems getting visual studio installed. When I select one of the visual studio command prompts the environment never gets set correctly so the compilers are not available.

So my question is: Should I install mingw, mingw-w64, or cygwin to provide the best environment for this kind of testing/learning?

  • 1
    IMO: Install a linux VM and use the gcc or clang toolchain. That's what I've done for reverse engineering and ctf exercises. – JAL Jun 4 '17 at 0:51
  • how different is the compiled code between linux and windows though? – dnraikes Jun 4 '17 at 1:22
  • 2
    stackoverflow.com/q/2067524/2415822 – JAL Jun 4 '17 at 1:31
  • 1
    You could try enterprise wdk or ewdk a big download but no installation just unzip open a cmd prompt and run the bat file in root folder ( you may need to pass correct include paths or write a small bat file to set them – blabb Jun 4 '17 at 16:49
2

This is a question which leads to a very subjective answer. I would (and have) install MinGW and then use gcc to compile your C code. You don't even need all the Visual Studio bloatware stuff for what you want to accomplish. It'll be as simple as opening your favorite text editor, writing a C program (yes, you can still #include and use the Win32 API just fine), and running gcc at the command prompt. You can even force a 32 bit binary with -m32, turn off stack canaries with -fno-stack-protector, and etc... If you desire, to practice.

You will also want to be using gdb galore. gdb also comes with MinGW so you're covered there as well. This method will be incredibly straightforward and easy. Text editor -> save, gcc, run, gdb, repeat. All can be done from the command prompt. This is as easy as you can get on either Linux or Windows.

For some reason, there is a tendency to believe that you must either use Visual Studio on Windows or switch to Linux. This simply isn't the case and for what you are trying to accomplish, both could be overkill and both will definitely take some time, especially if you've never used either. However, if you are interested in working with or learning a Linux environment, and have no problem setting up a virtual machine, you could install Linux on a VM and then you will already have all the tools you need installed. Linux and C do go hand-in-hand and many programmers prefer Linux for this reason amongst others.

  • "This is as easy as you can get on either Linux or Windows." - no it isn't. You could work in an IDE, like Visual Studio :-p There you can save, compile, run and step into a debugger all in a single keypress. – Rup Jun 4 '17 at 23:05
1

Kris Kaspersky's (RIP) book called Hacker Disassembly Uncovered (freely available in chm format, just google for it) has a whole chapter just on that topic - he shows different code snippets (starting with really simple ones and then goes to floating points, virtual functions tables and other C++ constructs) under different compilers and does a line-by-line disassembly with in-depth insights.

This book does exactly what you're asking for.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.