RE Week 1
Tags: hacking
Published: 2019-10-21 01:13:08

---
title: RE Week 1 
published: true
description: Tracking my process while learning Reverse Engineering
tags: #hacking
cover_image: https://i.imgur.com/CMRVR.jpg
series: RE
---

I decided to start taking reverse engineering more serious as it is something that I have always wanted to understand. I will be using resources online, mostly free ones with the exception of a few things. (Thanks to [dee-see](https://twitter.com/dee__see/status/1183772074201899008?s=20) & [lillost](https://twitter.com/lil_lost) for the windows vm link)  

I found this workshop which seems like a good introduction, called [begin.re](https://www.begin.re). At the end of the workshop I will attempt to do the following CTFs:


- [zombieland](https://mcb101.blog/2019/10/11/zombieland-ctf-reverse-engineering-for-beginners/)
- [reversing hero](https://www.reversinghero.com/) *might buy the videos that come with the exercises*

I want to be able to complete both of these two challenges by the time I'm done with the [begin.re](https://www.begin.re) workshop. I will be releasing a blog post every Sunday highlighting what I have learned as well as sharing resources I learn about, if you have any please share them in the comments. 

<hr>

### Welcome

The first session in `Preparations Assignments` called [Welcome](https://www.begin.re/assignment-1), is a primer for `x86` assembly, it referenced this [doc](http://www.cs.virginia.edu/~evans/cs216/guides/x86.html):
- registers
 - general registers: `EAX`, `EBX`,`ECX`,`EDX`
 - index registers: `ESI`, `EDI`, `EBP`, `EIP`, `ESP`
- stacks
 - data structure (FILO)
 - keep track of the point to which an active subroutine should return when it finished executing
 - local data storage
 - parameter passing
- instructions
 - usually fall into 3 categories
 - data movement
 - arithmetic/logic
 - control flow
- memory and addressing modes
 - modern `x86` processors are capable of addressing `2^32` bytes of memory

<hr>

### Installing FlareVM

Installing FlareVM is recommended to complete the `zombieland CTF` by the author, this makes sense for me since most of the material I want to learn will be `Windows` relates because I want to use what I learn at work. The process was easy once I found the right blog about how to install the script needed to set up the whole thing. If you want to follow along use [this link](https://www.fireeye.com/blog/threat-research/2018/11/flare-vm-update.html) which is from `FireEye` the creators of the `FlareVM`. 

To use `FlareVM` you will need a `Windows` VM, for this I used the VMs available from widows [here](https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/) (I'm using Virtual Box). You can select which VM to use from the dropdown, I went for the `MSEdge on Windows 10`. Once I downloaded the VM, I followed the instructions from the `Fire Eye` [blog](https://www.fireeye.com/blog/threat-research/2018/11/flare-vm-update.html) and just followed along, the process did take around 2 hours for me, since I'm running `Virtual Box` on a potato. Once the script finished, I checked it out and I had all the tools needed to start, list of tools included [here](https://github.com/fireeye/flare-vm#legal-notice)

<hr> 

### Thoughts 

#### begin.re - welcome 
Good primer, I've tried learning `x86` before so this helped me, I spent the week reading through the primer and started on the next section which goes more in depth into what a `stack` is and what it does.

#### FlareVM

Easy to install if you follow the right directions, took a while but that's mostly because . I can't wait to start messing with the software and understand how the tools work.

### Resources

[FlareVm Installation](https://www.fireeye.com/blog/threat-research/2018/11/flare-vm-update.html)
[x86 RE Cheat Sheet](https://trailofbits.github.io/ctf/vulnerabilities/references/X86_Win32_Reverse_Engineering_Cheat_Sheet.pdf)
[begin.re](https://www.begin.re/)
[OpenSecurityTraining](http://www.opensecuritytraining.info/)
[Malware Analysis VM Setup Tutorial](https://www.youtube.com/watch?v=gFxImi5t37c)



[**cover image**](https://imgur.com/a/2gN8s)