Software Security Links

Software Reverse Engineering

Software reverse engineering is the art of revealing the secrets behind a software. In addition to knowledge of how things really work (operating systems, processors, programs etc.), reverse engineering requires a lot of patience. It is illegal (and immoral in my view) to reverse engineer software for commercial purposes, but it is legal to reverse engineer for educational purposes.

• Reverse engineering beginners guide - an introduction to the topic, written by a friend of mine...
• Intel Literature Center - Official Intel documents for its processors
• sandpile.org - Useful IA32 information
• The Reverse Engineering Academy - Exercise yourself in reverse engineering!

Disassemblers, Decompilers and Debuggers

A disassembler takes a machine language file and translates it to assembly language; a decompiler takes a program and translates it to high level language. There are no good decompilers for translating machine language to high level language (e.g. C, C++ etc.) but there are decompilers for Java and .net-based languages. Also, there are good disassemblers (e.g. IDA).
A debugger may help in monitoring the execution of a program; using a debugger it is possible to get the contents of registers and memory at different stages, in addition to tracing the flow of the program.  

• Cristina Cifuentes PhD thesis about decompilation - principles of decompilation and disassembly
• The dcc decompiler - A 80286/DOS decompiler, written by Cristina Cifuentes as part of her PhD
• DataRescue's home page - Producers of the IDA Pro disassembler
• SoftIce - the best kernel debugger available today

Code Obfuscation

Code obfuscation is a technique for protecting programs from being reverse engineered. The general idea is making the program look much more complicated than it really is by changing its structure, complicating the way data is represented etc. There are several commercial obfuscators for Java and .net languages, in which decompilation is easy when the program is not protected.

• Robust Obfuscation - Christian Collberg's code obfuscation page
• On the (Im)possibility of Code Obfuscation - The title says it all...
• Protecting Java Code via Code Obfuscation - Summary of Douglas Low's Thesis about the topic. The Thesis can be found here
• .net Obfuscation and Intellectual Property - An article from Windows developer Journal by Brent Rector about obfuscating MSIL (MS Intermediate Language)
• Obfuscating .net - An e-book about .net code protection through obfuscation, by Dan Appleman

Obfuscators

• Salamander .net Obfuscator - a .net obfuscator and a .net decompiler
• Demeanor for .net Enterprise - Another tool for .net obfuscation, by wiseowl
• COBF - a (very) simple C obfuscator
• Uglify - a simple C obfuscator (written in Python)

General Software Security

• IBM Security Articles
• Program Evolution