有趣的二进制 软件安全与逆向分析 (图灵程序设计丛书) ([日]爱甲健二)（Z-Library）

# 【One-Line Pitch】 A hands-on, beginner-friendly tour of software security and reverse engineering that teaches you to analyze malware, crack games, exploit buffer overflows, and build your own debugger — perfect for curious programmers who want to understand what happens under the hood of Windows and Linux binaries. # 【Book Arc】 - **Opening (~0%–11%)**: Introduces reverse engineering through practical analysis of a sample "malware" program, covering both dynamic analysis (Process Monitor, Wireshark) and static analysis (IDA, binary editors), then teaches basic x86 assembly reading with push/call/mov/lea patterns. - **Early (~11%–28%)**: Explores game hacking by modifying memory values with a process memory editor, then covers crash debugging with Dr. Watson and just-in-time debugging setup, plus introduces code obfuscation techniques that fool disassemblers. - **Early–Middle (~28%–39%)**: Demonstrates UPX packing and unpacking with OllyDbg and OllyDump, then dives into buffer overflow exploitation on FreeBSD — building a working exploit that overwrites the return address to execute shellcode. - **Middle (~39%–56%)**: Continues exploit development by examining stack layouts in GDB, crafting null-free shellcode (e.g., using `/bin//sh` and xor tricks), and introduces defensive mechanisms like ASLR and other OS/compiler protections. - **Middle–Late (~56%–end)**: Shifts to Windows debugging internals — using CreateProcess with CREATE_SUSPENDED, handling debug events, reading thread contexts with GetThreadContext/SetThreadContext — and covers malware analysis tools (REMnux, ClamAV, Zero Wine Tryouts) plus ROP and EMET anti-exploitation mechanisms. # 【Key Takeaways】 - **Static vs. dynamic analysis is the core dichotomy** (Opening): Static analysis reads code without running it (IDA, string extraction), while dynamic analysis observes behavior at runtime (Process Monitor, Wireshark, debuggers) — choose based on whether you need logic or behavior. - **Basic x86 assembly is surprisingly readable** (Opening): Most code consists of push, call, mov, lea, and conditional jumps via cmp/test + je/jne; understanding these covers 70–80% of typical function logic. - **Memory editing is the simplest "hack"** (Early): Using a process memory editor to change a score value (e.g., 0x1D to 0x2D) demonstrates that game state lives in predictable memory locations — search, modify, repeat. - **Obfuscation exploits linear disassembly** (Early): Inserting bytes like `EB FF` (jmp +1) makes IDA misalign instructions, showing that disassembled code may differ from executed code — a key anti-analysis technique. - **Buffer overflows work by overwriting the return address** (Middle): A 64-byte buffer overflowed with 70 'A's corrupts saved EBP and ret_addr; crafting shellcode plus a correct return address yields arbitrary code execution. - **Shellcode must avoid null bytes** (Middle): Null bytes terminate strings in C, so shellcode uses tricks like `/bin//sh` (8 bytes) and xor-to-zero to eliminate 0x00 from instruction encodings. - **ASLR and compiler defenses mitigate exploitation** (Middle): Address Space Layout Randomization and related mechanisms make classic buffer overflow exploitation unreliable, forcing attackers to develop ROP and other advanced techniques. - **Debuggers are just API consumers** (Middle–Late): A minimal debugger uses CreateProcess with CREATE_SUSPENDED, then DebugEvent loops, OpenThread/GetThreadContext/SetThreadContext to inspect and control a target process. # 【Reading Tips】 - **Skim the game-hacking chapter** (~17–22%): The "兔耳旋风" tool is Japan-only and dated; just grasp the concept of memory scanning and modification, then move on. - **Deep-read the buffer overflow chapters** (~33–50%): Follow along with the FreeBSD examples in a VM — compile the sample C code, run the exploits, and use GDB to inspect stack layouts yourself; this is where the book's real value lies. - **Treat assembly as a pattern language**: Don't memorize every instruction; learn to recognize prologues (push ebp; mov ebp, esp), call conventions (args pushed right-to-left), and the cmp/test + jcc idiom for branches. - **Use the book's toolchain as a starting point**: IDA, OllyDbg, Process Monitor, and Wireshark are still relevant; modern alternatives (Ghidra, x64dbg) work similarly, so transfer the skills rather than the exact tools. - **Skip the dated Windows-specific sections** (EMET, Zero Wine Tryouts) if you're not doing malware analysis; the conceptual explanations (ROP, heuristic detection) remain useful even if the tools are obsolete. # 【Coverage Limits】 The excerpts cover roughly the first 60% of the book (through Chapter 4's debugger implementation); later chapters on ROP, EMET, and malware analysis tools (REMnux, ClamAV) are only partially represented, and the final sections on heuristic detection are mentioned but not detailed. #