I just reached the the topic of Compilers in the book "Reversing:Secrets of Reverse Engineering" So, I want to ask, is the knowledge of Compilers necessary for becoming a Malware Reverse Engineer?
Can anyone please guide me? ☺️
-
2This question is really trying to elicit opinions and therefore not suitable for this site as it stands. But let me try to answer by stating the obvious: a reverse (code) engineer usually has to excel in knowledge about all aspects of how the subject matter came to be. So yes, it's necessary. How much it matters will vary. But to give you a glance, you will quickly become accustomed to how certain compilers produce code and will notice when this is not the case. This matters when you are looking at protection/anti-debugging mechanisms et cetera.– 0xC0000022L ♦Jan 5, 2021 at 15:29
-
Thanks ☺️ Understood– Ramesses IIJan 5, 2021 at 17:35
-
I would think like this - it will be easier for you to deconstruct a table piece by piece, if you know how it has been constructed. Otherwise there is a chance that you may break it. The knowledge of compiler too chain, standard defense mechanisms, common malware patterns certainly help.– R4444Jan 8, 2021 at 4:16
Add a comment
|
1 Answer
If you were given a piece of source code written in a language you had never seen before, you would want to study the syntax and rules of the language so that you could understand what the piece of code is doing.
A compiler transforms a high-level human friendly language (C for example) into in binary instructions that a CPU can run directly. These binary instructions are called assembly.
Understanding the process by which a program is compiled from human friendly languages to binary instructions is helpful for anyone writing programs because it lets you reason about what actually happens on the computer. Studying compilers helps you understand the syntax and rules at work when the compiler writes a program in assembly.
Compilers do all manner of smart things to make programs "better" or "faster". They can remove code which will never be executed, they can reorder chunks of code to use less memory, they can precompute constant values at compile time rather than running them at execution time.
By understanding what a compiler can do, you can recognize how it rewrites programs when it creates assembly. As a reverse engineer, recognizing these patterns will let you reason about what the original human friendly code was doing.
Knowledge of compilers and their output will make it easier to spot when something different has been introduced into an existing program.
Compilers are to computers what the discovery of flight was to transportation. They are a revolutionary technological breakthrough which are often taken for granted.
The two go-to references are Ullman (commonly known as the "Dragon Book") and Appel (commonly known as the "Tiger Book"). Or good old Wikipedia on Compilers. You can pickup a used early edition copy of Ullman for $20. It's well worth it.
