# (Very) Basic reverse

#### strings

The Linux `strings` builtin and the Windows `sysinternals` `strings` utility can be used to extract the printable characters contained in a file, and notably in non-text files.

By default, only the sequences that are at least 4 characters long are retrieved.

```
strings <BINARY>
```

#### objdump

The GNU `objdump` command line utility can be used to disassemble the assembler contents of the executable sections of a binary:

```
objdump -d <BINARY>
```

#### radare2

The `radare2` suite is an open source reverse engineering framework consisting of multiples tools and features.

The framework supports multiples architectures (i386, x86-64, ARM, etc.), file formats (PE, PE+, ELF, Mach-O, etc.) and operating systems (Windows, GNU/Linux, OS X, etc.).

The `rabin2` utility can be used to retrieve information and protection mechanisms of a binary:

```
rabin2 -I <BINARY>

radar2 <BINARY>
[0xXXX] > iL
```

The strings in the binary can be printed and searched into using `izz`:

```
[0xXXX] > iiz
[0xXXX] > iiz~<SEARCH_KEYWORD>
[0xXXX] > iiz~password
```

The visual mode can entered by using the `v` command and quitted using the `q` command. In visual mode, the `p` command can be used to switch between display mode.

#### GDB

**Binaries without debugging symbols**

Debugging a binary compiled with out the debbugging symbols ("no debugging symbols found") is possible as GDB can directly handle assembly code.

GDB uses By default the AT\&T assembly syntax. The following command can be used to switch to the Intel syntax:

```
set disassembly-flavor intel
```

To setup a breakpoint, the binary entry point can be retrieved using the GDB `info` command:

```
(gdb) info file
Entry point: 0xXXXXXX

b *0xXXXXXX
```

The `nexti` (shortcut `ni`) and the `stepi` (shortcut `si`) commands are the assembly counter part of the soure code `next` and `step` commands.

The `examine` (shortcut `x`) command can be used to display the assembly code after the breakpoint:

```
# N = number of assembly line to print
# $pc = GDB variable for the program counter register

x/<N>i $pc
x/5i $pc
```

#### OllyDbg

`OllyDbg` is a GUI 32-bit assembler level analyzing debugger for Microsoft Windows.

The `Search for -> All referenced strings` functionality allows to retrieve all printable strings contained in the binary and their address location for breakpoint setting.

#### dnSpy

`dnSpy` is a GUI debugger and assembly editor which can be used to debug 32 or 64 bits .NET applications and edit assemblies in C# or Visual Basic.

The GUI interface can be launched using the `dnSpy.exe` or `dnSpy-x86.exe` programs.

***

#### References

<https://reverseengineering.stackexchange.com/questions/1935/how-to-handle-stripped-binaries-with-gdb-no-source-no-symbols-and-gdb-only-sho>