Overview

If you have always wanted to learn how to reverse and patch-packed programs - without unpacking, then this is the course for you. If you think that packing and anti-debugging are good enough to prevent reverse engineering, then you may be in for a surprise. In this course, I will show you how to test the effectiveness of several popular packers by packing crackmes and then reversing them - without unpacking. Traditionally packed programs are unpacked before debugging is carried out. This is because a packed program's file cannot be patched. Much of software protection has centered on making it difficult to unpack programs. However,  the important question is: how effective are packing, obfuscation, and anti-debugging as a means to prevent reversing? This course explores several packers to find the answers. 

You will learn to perform the analysis using a tool called Cheat Engine, which is a prominent tool used by game hackers. This tool could also be used to study and analyze the packed program's processes running in memory. You will learn how to perform debugging in spite of anti-debugging being implemented. There is no need to unpack and dump memory.  Instead of unpacking and then patching the dumped files and fixing IAT (Import Address Table) tables, we will write scripts to hack memory using byte patching using an advanced technique called AOB (Array-Of-Bytes) Injection, by injecting code into code caves (inline memory patching). In this course, you will learn how to do all of the above and more. 

At the end of this course, you will be able to gauge the effectiveness of software packers, obfuscation, and anti-debugging protection and also have a good idea of how to implement extra countermeasures to improve the security of software. 

In all the practical exercises and walkthroughs, we will use Crackme's which I have written. You will learn how to pack them using several popular packers and then hack them using Cheat Engine. 

The necessary resources for this course are in the "Resources" section of Video 1.1. You can also access them through this direct link - https://github.com/ec-council-learning/Reverse-Engineering-Memory-Hacking-and-Software-Protection