如何最有效地进行一次逆向工程？
RE 对我来说是一个全新的学科，所以这可能很幼稚。
我想直接从文件中读取数据——问题是文件的格式未知，它也可以加密。我知道文件中的内容，因此我可以在必要时探测它，但我不知道它是如何编写的（例如，如果“hello”写为“hello”或“HELLO”或“hell o”，等等）。
我发现我可以使用一些 RE 工具并从已经读取该数据的程序（Windows，x86）中反汇编一个函数。但当我检查最流行的工具（IDA Pro）的价格时，我发现这个“一次性工作”会花费我很多钱——IDA Pro 大约 400 欧元，反编译器大约 1600 欧元。
好吧，我买不起这样的东西，不仅因为我没有那么多钱，而且只是因为我不确定我是否会失败。这只是作为一种爱好。
那么，还有其他工具的价格不那么高吗？或者还有其他方法吗？编写我自己的磁盘过滤驱动程序或类似的东西？
感谢您提前提供的任何帮助！
RE for me is a completely new subject, so this may be naive.
I would like to read data directly from the file -- the thing is the format of the file is unknown, it can be encrypted as well. I know what is in the file so I can probe it if it is necessary, but I don't know how it is written (for example if "hello" is written as "hello" or "HELLO" or "h e l l o", and so on).
I figure out that I could use some RE tool and disassemble a function from the program (Windows, x86) which already reads that data. But when I checked the prices for the most popular tools (IDA Pro) it appeared that this "one time job" would cost me a lot -- IDA Pro is around 400 EUR and Decompiler for it around 1600 EUR.
Well, I cannot afford such purchase not only because I don't have such money, but simply because I am not sure if I won't fail with the task. And this is only done as a hobby.
So -- are there any others tools without not such steep prices? Or is there other approach? Writing my own disk filter driver, or something like that?
Thank you for any help in advance!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
IDA Pro 有一个免费软件版本，对于大多数 x86 程序来说已经足够了（你没有提到你的目标是什么）。
There is a freeware version of IDA Pro which is perfectly enough for most x86 programs (you didn't mention what is your target).
OllyDbg工作得很好，而且是免费的。由于您显然正在查看数据文件，因此您可能需要查看一个好的十六进制转储程序，例如 Hiew或十六进制研讨会（谷歌搜索“十六进制编辑器”之类的东西可能会出现至少十几个）。OllyDbgworks quite well, and is free. Since you're apparently looking at a data file, you might want to look at a good hex dumper such as Hiew or Hex Workshop (Googling for something like "hex editor" will probably turn up at least a dozen more).