Episode Details

Back to Episodes
Course 33 - Static Analysis for Reverse Engineering | Episode 5: Register Fundamentals, Graphical Analysis, and the Easy Peasy Solution

Course 33 - Static Analysis for Reverse Engineering | Episode 5: Register Fundamentals, Graphical Analysis, and the Easy Peasy Solution

Published 1 week, 3 days ago
Description
In this lesson, you’ll learn about: cracking 64-bit software and understanding architectural differences1. Transition from 32-bit to 64-bit🔹 Register Naming Changes
  • 32-bit:
    • EAX, EBX, ECX
  • 64-bit:
    • RAX, RBX, RCX
🔹 New Registers
  • Additional registers introduced:
    • R8 → R15
👉 These give you:
  • More space for data handling
  • More efficient execution
2. Key Difference: Parameter Passing🔹 32-bit Systems
  • Arguments passed via:
    • Stack
🔹 64-bit Systems
  • Arguments passed via:
    • Registers (faster & cleaner)
🔹 Common Calling Convention (Important)
  • First parameters usually go into:
    • RCX
    • RDX
    • R8
    • R9
👉 This changes how you:
  • Trace function calls
  • Identify input comparisons
3. Identifying a 64-bit Binary
  • Use tools like:
    • Detect It Easy
  • Look for:
    • PE64 format
4. Practical Analysis WorkflowUsing:
  • x64dbg
🔹 Step 1: Find Key Strings
  • Search for:
    • “Wrong password”
    • “Access denied”
👉 Leads you to:
  • Validation functions
🔹 Step 2: Use Graph View (CFG)**
  • Press:
    • G
  • This shows:
    • Decision branches
    • Logic flow
🔹 Step 3: Locate Decision Points
  • Identify:
    • Comparisons (CMP)
    • Conditional jumps (JE, JNE, etc.)
🔹 Step 4: Trace Credentials**
  • Follow:
    • Register values (NOT stack like before)
👉 Look inside:
  • RCX / RDX / R8 / R9
5. “Fishing” for Credentials
  • Track how input is compared against:
    • Hardcoded values
    • Stored strings
👉 Often you’ll find:
  • Correct username/password directly in registers
6. Essential x64dbg Graph Shortcuts🔹 Navigation & Simulation
  • Enter
    • Follow a branch
  • - (Minus)
    • Go back
🔹 Synchronization
  • S key
    • Return to origin of graph
🔹 Trace Recording
  • Highlights:
    • Actual execution path
👉 Helps you see:
  • What REALLY happens during runtime
Key Takeaways
  • 64-bit = new registers + new workflow
  • Parameters are passed via registers, not stack
  • CFG makes logic easier to understand
  • Credential checks are still:
    • Comparisons + jumps
  • Core cracking logic remains the same
Big InsightEven though architecture evolved:👉 The mindset didn’t changeYou’re still:
  • Finding comparisons
  • Tracking inputs
  • Understanding branches
Mental Model Upgrade
  • 32-bit thinking:
    • “Check the stack”
  • 64-bit thinking:
    • “Check the registers first”


You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy
Listen Now

Love PodBriefly?

If you like Podbriefly.com, please consider donating to support the ongoing development.

Support Us