Vostokov Dmitry / Востоков Дмитрий - Foundations of Linux Debugging, Disassembling, and Reversing / Основы отладки, дизассемблирования и реверсирования Linux [2023, PDF, EPUB, ENG]

Примеры страниц

Оглавление

About the Author ..........................................................................................ix
About the Technical Reviewer .........................................................................xi
Preface ........................................................................................................xiii
Chapter 1: Memory, Registers, and Simple Arithmetic .........................................1
Memory and Registers Inside an Idealized Computer ..........................................1
Memory and Registers Inside Intel 64-Bit PC .......................................................2
“Arithmetic” Project: Memory Layout and Registers ............................................3
“Arithmetic” Project: A Computer Program ...........................................................5
“Arithmetic” Project: Assigning Numbers to Memory Locations ...........................5
Assigning Numbers to Registers ...........................................................................8
“Arithmetic” Project: Adding Numbers to Memory Cells .......................................8
Incrementing/Decrementing Numbers in Memory and Registers .......................11
Multiplying Numbers ...........................................................................................14
Summary.............................................................................................................17
Chapter 2: Code Optimization .............................................................................19
“Arithmetic” Project: C/C++ Program .................................................................19
Downloading GDB ...............................................................................................20
GDB Disassembly Output – No Optimization .......................................................20
GDB Disassembly Output – Optimization ............................................................25
Summary.............................................................................................................26
Chapter 3: Number Representations.....................................................................27
Numbers and Their Representations ...................................................................27
Decimal Representation (Base Ten) ....................................................................28
Ternary Representation (Base Three) ..................................................................29
Binary Representation (Base Two) ......................................................................29
Hexadecimal Representation (Base Sixteen) ......................................................30
Why Are Hexadecimals Used? .............................................................................30
Summary.............................................................................................................32
Chapter 4: Pointers ...............................................................................................33
A Definition..........................................................................................................33
“Pointers” Project: Memory Layout and Registers ..............................................34
“Pointers” Project: Calculations ..........................................................................36
Using Pointers to Assign Numbers to Memory Cells ...........................................36
Adding Numbers Using Pointers .........................................................................42
Incrementing Numbers Using Pointers ...............................................................45
Multiplying Numbers Using Pointers ...................................................................48
Summary.............................................................................................................51
Chapter 5: Bytes, Words, Double, and Quad Words .................................................53
Using Hexadecimal Numbers ..............................................................................53
Byte Granularity ..................................................................................................53
Bit Granularity .....................................................................................................54
Memory Layout ...................................................................................................55
Summary.............................................................................................................58
Chapter 6: Pointers to Memory ..............................................................................59
Pointers Revisited ...............................................................................................59
Addressing Types ................................................................................................59
Registers Revisited .............................................................................................65
NULL Pointers .....................................................................................................65
Invalid Pointers ...................................................................................................65
Variables As Pointers ..........................................................................................66
Pointer Initialization ............................................................................................67
Initialized and Uninitialized Data .........................................................................67
More Pseudo Notation .........................................................................................68
“MemoryPointers” Project: Memory Layout..............................................................68
Summary.............................................................................................................79
Chapter 7: Logical Instructions and RIP ..................................................................81
Instruction Format...............................................................................................81
Logical Shift Instructions ....................................................................................82
Logical Operations ..............................................................................................82
Zeroing Memory or Registers.................................................................................83
Instruction Pointer ...............................................................................................84
Code Section .......................................................................................................85
Summary.............................................................................................................86
Chapter 8: Reconstructing a Program with Pointers .................................................87
Example of Disassembly Output: No Optimization ..............................................87
Reconstructing C/C++ Code: Part 1 ....................................................................90
Reconstructing C/C++ Code: Part 2 ....................................................................92
Reconstructing C/C++ Code: Part 3 ....................................................................93
Reconstructing C/C++ Code: C/C++ Program ....................................................94
Example of Disassembly Output: Optimized Program .........................................95
Summary.............................................................................................................96
Chapter 9: Memory and Stacks ............................................................................97
Stack: A Definition ...............................................................................................97
Stack Implementation in Memory .......................................................................98
Things to Remember .........................................................................................100
PUSH Instruction ...............................................................................................101
POP Instruction .................................................................................................101
Register Review ................................................................................................102
Application Memory Simplified .............................................................................105
Stack Overflow ..................................................................................................105
Jumps ...............................................................................................................106
Calls ..................................................................................................................108
Call Stack ..........................................................................................................110
Exploring Stack in GDB .....................................................................................112
Summary...........................................................................................................115
Chapter 10: Frame Pointer and Local Variables .......................................................117
Stack Usage ......................................................................................................117
Register Review ................................................................................................118
Addressing Array Elements ...............................................................................118
Stack Structure (No Function Parameters) ...........................................................119
Function Prolog .................................................................................................121
Raw Stack (No Local Variables and Function Parameters) ........................................121
Function Epilog .................................................................................................123
“Local Variables” Project ..................................................................................124
Disassembly of Optimized Executable ..............................................................127
Summary...........................................................................................................128
Chapter 11: Function Parameters .......................................................................129
“FunctionParameters” Project ..........................................................................129
Stack Structure .................................................................................................130
Function Prolog and Epilog ...............................................................................132
Project Disassembled Code with Comments ....................................................133
Parameter Mismatch Problem ..........................................................................137
Summary...........................................................................................................138
Chapter 12: More Instructions .............................................................................139
CPU Flags Register ............................................................................................139
The Fast Way to Fill Memory .............................................................................140
Testing for 0 ......................................................................................................141
TEST – Logical Compare ...................................................................................142
CMP – Compare Two Operands .........................................................................143
TEST or CMP? ...................................................................................................144
Conditional Jumps ............................................................................................144
The Structure of Registers ................................................................................145
Function Return Value .......................................................................................146
Using Byte Registers .........................................................................................146
Summary...........................................................................................................147
Chapter 13: Function Pointer Parameters ..............................................................149
“FunctionPointerParameters” Project ...................................................................149
Commented Disassembly .................................................................................150
Summary...........................................................................................................159
Chapter 14: S ummary of Code Disassembly Patterns ...........................................161
Function Prolog/Epilog ......................................................................................161
LEA (Load Effective Address) ............................................................................164
Passing Parameters ..........................................................................................164
Accessing Parameters and Local Variables ............................................................165
Summary...........................................................................................................166
Index .............................................................................................................167