IHiheartmemcache·Sep 12, 2015
SoftICE was one of the most amazing utilities out there both for debugging as well as reverse engineering. The Wikipedia page is spot on about WinDbg/KD, but pretty out of date re: modern tools. Ollydbg2 came out more than half a decade ago and supports all the 64 bit registers and x86-64 instruction set. Immunity Debugger took the place as the defacto standard, and most modern scripts and tooling are built around Immunity for dynamic analysis and IDA Pro for static analysis. IDA Pro adopted QT natively, so the plugin communities are extending the hell out of what was already a great tool, and there are good plugins that export annotations/symbols that Immunity can consume so the union between static and dynamic analysis has never been smaller. If you don't have an IDA license, Immunity combined with Radare (read down) is still pretty pow
Read the rest
erful to play around with. Either way, the reverse engineering stuff out there is quite simply amazing.
https://github.com/aquynh/capstone
https://github.com/REhints/HexRaysCodeXplorer (this is CRAZY useful if you bought the Hex Rays license with IDA)
https://github.com/ynvb/DIE - makes IDA even better ("DIE is an IDA python plugin designed to enrich IDA`s static analysis with dynamic data)
https://portal.cert.org/web/mc-portal/pharos-static-analysis... - I haven't used this yet but Pharos is a static analysis tool out of Carnegie Melon that's particularly useful for C++ gen'd code. https://insights.sei.cmu.edu/sei_blog/2015/08/the-pharos-fra... Walks through some feature set. HexRays is great for somethings but when you F5 some block, you really are left wanting. This looks like it fills the gap quite nicely.
http://www.radare.org/r/cmp.html - Comparison beween IDA and Radare (admittedly unfair, even titled so, ha)
There are dozens of plugins I use which are just python scripts mapped to keyboard shortcuts so I don't even remember what they're called. Someone else is going to have to jump in because I'm not on my work machine and can't look it up.
You lost Ring0 with the demise of SoftICE, but the RE community is more active than ever. Just watch a few CCC talks if you're not convinced.
Just a note guys: I know you can pirate IDA but some companies just "do it right" and should be supported. I buy from Adafruit even though they're more expensive because I support them. IDA is one dude, who's responsive within the community, who goes out of his way to be nice and implement bug fixes and feature enhancements. I try not to get all preachy, but pirating IDA isn't stealing Visual Studio from Microsoft- you're ripping a dude who's contributed a lot to the community and even offers a free (granted less featureful) version.