2

I just reached the the topic of Compilers in the book "Reversing:Secrets of Reverse Engineering" So, I want to ask, is the knowledge of Compilers necessary for becoming a Malware Reverse Engineer?

Can anyone please guide me? ☺️

3
  • 2
    This question is really trying to elicit opinions and therefore not suitable for this site as it stands. But let me try to answer by stating the obvious: a reverse (code) engineer usually has to excel in knowledge about all aspects of how the subject matter came to be. So yes, it's necessary. How much it matters will vary. But to give you a glance, you will quickly become accustomed to how certain compilers produce code and will notice when this is not the case. This matters when you are looking at protection/anti-debugging mechanisms et cetera. – 0xC0000022L Jan 5 at 15:29
  • Thanks ☺️ Understood – Ramesses II Jan 5 at 17:35
  • I would think like this - it will be easier for you to deconstruct a table piece by piece, if you know how it has been constructed. Otherwise there is a chance that you may break it. The knowledge of compiler too chain, standard defense mechanisms, common malware patterns certainly help. – R4444 Jan 8 at 4:16
4

If you were given a piece of source code written in a language you had never seen before, you would want to study the syntax and rules of the language so that you could understand what the piece of code is doing.

A compiler transforms a high-level human friendly language (C for example) into in binary instructions that a CPU can run directly. These binary instructions are called assembly.

Understanding the process by which a program is compiled from human friendly languages to binary instructions is helpful for anyone writing programs because it lets you reason about what actually happens on the computer. Studying compilers helps you understand the syntax and rules at work when the compiler writes a program in assembly.

Compilers do all manner of smart things to make programs "better" or "faster". They can remove code which will never be executed, they can reorder chunks of code to use less memory, they can precompute constant values at compile time rather than running them at execution time.

By understanding what a compiler can do, you can recognize how it rewrites programs when it creates assembly. As a reverse engineer, recognizing these patterns will let you reason about what the original human friendly code was doing.

Knowledge of compilers and their output will make it easier to spot when something different has been introduced into an existing program.

Compilers are to computers what the discovery of flight was to transportation. They are a revolutionary technological breakthrough which are often taken for granted.

The two go-to references are Ullman (commonly known as the "Dragon Book") and Appel (commonly known as the "Tiger Book"). Or good old Wikipedia on Compilers. You can pickup a used early edition copy of Ullman for $20. It's well worth it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.