-
Book Overview & Buying
-
Table Of Contents
Ghidra Software Reverse-Engineering for Beginners - Second Edition
By :
In this chapter, we will address how to incorporate new processor modules in Ghidra. This is an advanced topic that involves learning the Specification Language for Encoding and Decoding for Ghidra (SLEIGH) so that we can specify the language, disassemble the code, perform function identification via prologue and epilogue byte pattern matching, stack frame creation, and function cross-references generation.
During this chapter, you will acquire extremely useful skills for breaking down advanced reverse-engineering protections. This skill will allow you to understand how a custom virtual machine is implemented and how to reverse engineer it. There are several examples of malware (such as ZeusVM, KINS, and so on) and powerful software protection that’s mostly based on virtualization (such as VMProtect, Denuvo, and more).
SLEIGH and SLED
SLEIGH, the Ghidra processor specification language, has its origins in the Specification Language for Encoding...