This has been week #2 learning reverse engineering, this time I've gone over some basics:
- The call stack
- What is it? How does it work?
- Assembly
- Learning more about assembly x86
- How does assembly work
Week #2 has been all about the stack
and assembly
. Going over the preparations section of the workshop, I went over the purpose of the stack
as well as assembly
:
What is the stack?
-
The stack
is a data structure, it gets assigned an area of memory which it uses to store information about the executing program, it usesregisters
(storage areas,esp
,ebp
,eax
,nop
etc) to know what's executing by storing data & memory addresses, we can useinstructions
(actions we can perform usingassembly language
likepush
,pop
,mov
,jmp
and more) to interact withthe stack
- The stack grows down to higher memory addresses, which also means
the stack
starts at lower memory addresses. -
The stack
keeps track of everything that happens when a program executes, it knows exactly what variables the program will use and which functions are running by usingregisters
likeebp
(which points to the base of the stack) andeip
(which points to the next instruction to perform).
What is assembly?
- Low-level programming language
- Gets turned into
machine language
-
Instruction set
is used to write programs which useregisters
andinstructions
- some
instructions
include:-
nop
push
pop
mov
add
call
ret
-
- all instructions performs actions using
registers
-
mov eax, [ebx]
: move the 4 bytes in memory at the address contained inebx
intoeax
-
- instruction format
operation argument
-
operation argument, argument
-
mov eax, [ebp-8]
square brackets acts as the de-reference operator inc
so themov
instruction "moves" the value that's atebp-8
and stores it insideeax
[Intel Syntax]
-
- some
Next week: Going over some basic C
, installing tools, trying some exercises
Resources
azeria-labs more about the stack
OALabs: youtube channel
Discord: resources, and community
Awesome RE: Github repo
ROP beginers: return-oriented programming (here for later reference)
Modern X86 ASM
x86 ASM
Top comments (0)