I just reached the the topic of Compilers in the book "Reversing:Secrets of Reverse Engineering" So, I want to ask, is the knowledge of Compilers necessary for becoming a Malware Reverse Engineer?
Can anyone please guide me? ☺️
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
If you were given a piece of source code written in a language you had never seen before, you would want to study the syntax and rules of the language so that you could understand what the piece of code is doing.
A compiler transforms a high-level human friendly language (C for example) into in binary instructions that a CPU can run directly. These binary instructions are called assembly.
Understanding the process by which a program is compiled from human friendly languages to binary instructions is helpful for anyone writing programs because it lets you reason about what actually happens on the computer. Studying compilers helps you understand the syntax and rules at work when the compiler writes a program in assembly.
Compilers do all manner of smart things to make programs "better" or "faster". They can remove code which will never be executed, they can reorder chunks of code to use less memory, they can precompute constant values at compile time rather than running them at execution time.
By understanding what a compiler can do, you can recognize how it rewrites programs when it creates assembly. As a reverse engineer, recognizing these patterns will let you reason about what the original human friendly code was doing.
Knowledge of compilers and their output will make it easier to spot when something different has been introduced into an existing program.
Compilers are to computers what the discovery of flight was to transportation. They are a revolutionary technological breakthrough which are often taken for granted.
The two go-to references are Ullman (commonly known as the "Dragon Book") and Appel (commonly known as the "Tiger Book"). Or good old Wikipedia on Compilers. You can pickup a used early edition copy of Ullman for $20. It's well worth it.