Real-world Decompilation with IDA Pro - Part 3: File Handling
Channel: Adam M.
Date: 2013-09-19

This video is part 3 of a short series of tutorials to show how you can get started reverse engineering a large, real-world program by decompiling it with IDA Pro and the Hex-Rays decompiler (both from https://www.hex-rays.com/). It was created because all of the tutorials I've seen have used trivial examples that don't have the challenges of working with a real program. The program decompiled is the game Capitalism 2.

In this video, we decompile the file manipulation functions used throughout the program. This is slightly more complex than the string manipulation functions and is also important, since string manipulation and file manipulation form the basis for most code that reads data from game data files and populates important data structures.

Themes discussed:
* Using system calls to aid reverse engineering
* Reverse engineering structures

This video is best viewed full screen at 720p (HD) resolution. This tutorial assumes that you know how to program in C and that you know the basics of assembly programming as well.

I'm not an expert in reverse engineering, just a curious amateur. If you have tips on ways I can do things more easily, please let me know!

http://www.enlight.com/capitalism2/ -- Capitalism 2
http://www.adammil.net/files/115/kit.zip -- Files you can use to follow along if you don't have Capitalism 2
http://www.adammil.net/blog/v112_Reverse_Engineering_Capitalism_2.html -- Some internal information about Capitalism 2