{"id":388,"date":"2020-04-11T14:31:20","date_gmt":"2020-04-11T14:31:20","guid":{"rendered":"https:\/\/temp.ashkerala.com\/?p=388"},"modified":"2020-04-11T14:31:20","modified_gmt":"2020-04-11T14:31:20","slug":"reverse-code-engineering-tutorial-part-2","status":"publish","type":"post","link":"https:\/\/temp.ashkerala.com\/?p=388","title":{"rendered":"Reverse Code Engineering Tutorial Part 2"},"content":{"rendered":"

What is Assembly language?<\/strong>
Assembly language is a low level or simply called machine language made up of machine instructions. Assembly language is specific to processor architecture example different for x86 architecture than for SPARC architecture. Assembly language consist of assembly instructions and CPU registers. Isoftdl(Lokesh) means I will explain my tutorial considering x86 architecture… Ahhha… From where i start explaining to you … assembly language is too big topic… I think i have to tell only what you need for reverse engineering.. So i start from CPU registers.<\/p>\n

CPU registers – Brief Introduction:<\/strong>
First of all what are registers? Most of Computer Engineering and Electronics Engineering guys knows about them but for others, Registers are small segments of memory inside CPU that are used for storing temporary data. Some registers have specific functions, others are just use for some general data storage. I am considering that you all are using x86 machines. There are two types of processors 32 bit and 64 bit processors. In a 32 bit processor, each register can hold 32 bits of data. On the other hand 64 bit register can hold 64 bit data. I am explaining this tutorial considering that we are using 32 bit processors. I will explain the same for 64 bits in later classes on\u00a0 hackingloops.
There are several registers but for Reverse engineering we HackingLoops users are only interested in general purpose registers. We are interested in only 9 General purpose registers namely:<\/p>\n

\u00a0\u00a0\u00a0 EAX
\u00a0\u00a0\u00a0 EBX
\u00a0\u00a0\u00a0 ECX
\u00a0\u00a0\u00a0 EDX
\u00a0\u00a0\u00a0 ESI
\u00a0\u00a0\u00a0 EDI
\u00a0\u00a0\u00a0 ESP
\u00a0\u00a0\u00a0 EBP
\u00a0\u00a0\u00a0 EIP<\/p>\n

All these registers serves for different purposes. So I will start explaining all of them one by one for a more clear and accurate understanding of register concepts. I am putting more strain on these because these registers are called heart of reverse engineering.<\/p>\n

EAX register is accumulator register which is used to store results of calculations. If any function returns a value its stored into EAX register. We can access EAX register using functions to retrieve the value of EAX register.
Note: EAX register can also be used for holding normal values regardless of calculations too.<\/p>\n

The EDX is the data register. It\u0393\u00c7\u00d6s basically an extension of EAX to assist it in storing extra data for complex operations. It can also be used for general purpose data storage.<\/p>\n

The ECX, also called the count register, is used for looping operations. The repeated operations could be storing a string or counting numbers.<\/p>\n

The ESI and EDI relied upon by loops that process data. The ESI register is the source index for data operation and holds the location of the input data stream. The EDI points to the location where the result of data operation is stored, or the destination index.<\/p>\n

ESP is the stack pointer, and EBP is the base pointer. These registers are used for managing function calls and stack operations. When a function is called, the function\u0393\u00c7\u00d6s arguments are pushed on the stack and are followed by a return address. The ESP register points to the very top of the stack, so it will point to the return address. EBP is used to point to the bottom of the call stack.<\/p>\n

EBX is the only register that was not designed for anything specific. It can be used for extra storage.<\/p>\n

EIP is the register that points to the current instruction being executed. As the CPU moves through the binary executing code, EIP is updated to reflect the location where the execution is occurring.<\/p>\n

The ‘E’ at the beginning of each register name stands for Extended. When a register is referred to by its extended name, it indicates that all 32 bits of the register are being addressed.\u00a0 An interesting thing about registers is that they can be broken down into smaller subsets of themselves; the first sixteen bits of each register can be referenced by simply removing the ‘E’ from the name. For example, if you wanted to only manipulate the first sixteen bits of the EAX register, you would refer to it as the AX register. Additionally, registers AX through DX can be further broken down into two eight bit parts. So, if you wanted to manipulate only the first eight bits (bits 0-7) of the AX register, you would refer to the register as AL; if you wanted to manipulate the last eight bits (bits 8-15) of the AX register, you would refer to the register as AH (‘L’ standing for Low and ‘H’ standing for High).<\/p>\n

Introduction to Memory and Stacks:
There are three main sections of memory:<\/p>\n

1. Stack Section – Where the stack is located, stores local variables and function arguments.<\/p>\n

2. Data Section – Where the heap is located, stores static and dynamic variables.<\/p>\n

3. Code Section – Where the actual program instructions are located.<\/p>\n

The stack section starts at the high memory addresses and grows downwards, towards the lower memory addresses; conversely, the data section (heap) starts at the lower memory addresses and grows upwards, towards the high memory addresses. Therefore, the stack and the heap grow towards each other as more variables are placed in each of those sections. I have shown that in below Figure..<\/p>\n

\u00a0\u00a0\u00a0 High Memory Addresses (0xFFFFFFFF)
\u00a0\u00a0\u00a0 ———————- <—–Bottom of the stack
\u00a0\u00a0\u00a0 |\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 |
\u00a0\u00a0\u00a0 |\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 |\u00a0\u00a0 |
\u00a0\u00a0\u00a0 |\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Stack\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 |\u00a0\u00a0 | Stack grows down
\u00a0\u00a0\u00a0 |\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 |\u00a0\u00a0 v
\u00a0\u00a0\u00a0 |\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 |
\u00a0\u00a0\u00a0 |———————| <—-Top of the stack (ESP points here)
\u00a0\u00a0\u00a0 |\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 |
\u00a0\u00a0\u00a0 |\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 |
\u00a0\u00a0\u00a0 |\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 |
\u00a0\u00a0\u00a0 |\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 |
\u00a0\u00a0\u00a0 |\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 |
\u00a0\u00a0\u00a0 |———————|\u00a0 <—-Top of the heap
\u00a0\u00a0\u00a0 |\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 |
\u00a0\u00a0\u00a0 |\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 |\u00a0\u00a0\u00a0 ^
\u00a0\u00a0\u00a0 |\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Heap\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 |\u00a0\u00a0\u00a0\u00a0 |\u00a0\u00a0 Heap grows up
\u00a0\u00a0\u00a0 |\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 |\u00a0\u00a0\u00a0 |
\u00a0\u00a0\u00a0 |\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 |
\u00a0\u00a0\u00a0 |———————| <—–Bottom of the heap
\u00a0\u00a0\u00a0 |\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 |
\u00a0\u00a0\u00a0 |\u00a0\u00a0\u00a0 Instructions\u00a0\u00a0\u00a0 |
\u00a0\u00a0\u00a0 |\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 |
\u00a0\u00a0\u00a0 |\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 |
\u00a0\u00a0\u00a0 ———————–
\u00a0\u00a0\u00a0 Low Memory Addresses (0x00000000) \u00a0<\/p>\n

\u00a0Some Essential Assembly Instructions for Reverse Engineering:<\/strong><\/p>\n

Instruction \u00a0\u00a0 \u00a0Example \u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Description
push\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0push eax \u00a0\u00a0 \u00a0Pushes the value stored in EAX onto the stack
pop \u00a0\u00a0 \u00a0pop eax \u00a0\u00a0 \u00a0Pops a value off of the stack and stores it in EAX
call \u00a0\u00a0 \u00a0call 0x08abcdef \u00a0\u00a0 \u00a0Calls a function located at 0x08abcdef
mov \u00a0\u00a0 \u00a0mov eax,0x5 \u00a0\u00a0 \u00a0Moves the value of 5 into the EAX register
sub \u00a0\u00a0 \u00a0sub eax,0x4 \u00a0\u00a0 \u00a0Subtracts 4 from the value in the EAX register
add \u00a0\u00a0 \u00a0add eax,0x1 \u00a0\u00a0 \u00a0Adds 1 to the value in the EAX register
inc \u00a0\u00a0 \u00a0inc eax \u00a0\u00a0 \u00a0Increases the value stored in EAX by one
dec \u00a0\u00a0 \u00a0dec eax \u00a0\u00a0 \u00a0Decreases the value stored in EAX by one
cmp \u00a0\u00a0 \u00a0cmp eax,edx \u00a0\u00a0 \u00a0Compare values in EAX and EDX; if equal set the zero flag* to 1
test \u00a0\u00a0 \u00a0test eax,edx \u00a0\u00a0 \u00a0Performs an AND operation on the values in EAX and EDX; if the result is zero, sets the zero flag to 1
jmp \u00a0\u00a0 \u00a0jmp 0x08abcde \u00a0\u00a0 \u00a0Jump to the instruction located at 0x08abcde
jnz \u00a0\u00a0 \u00a0jnz 0x08ffff01 \u00a0\u00a0 \u00a0Jump if the zero flag is set to 1
jne \u00a0\u00a0 \u00a0jne 0x08ffff01 \u00a0\u00a0 \u00a0Jump to 0x08ffff01 if a comparison is not equal
and \u00a0\u00a0 \u00a0and eax,ebx \u00a0\u00a0 \u00a0Performs a bit wise AND operation on the values stored in EAX and EBX; the result is saved in EAX
or \u00a0\u00a0 \u00a0or eax,ebx \u00a0\u00a0 \u00a0Performs a bit wise OR operation on the values stored in EAX and EBX; the result is saved in EAX
xor \u00a0\u00a0 \u00a0xor eax,eax \u00a0\u00a0 \u00a0Performs a bit wise XOR operation on the values stored in EAX and EBX; the result is saved in EAX
leave \u00a0\u00a0 \u00a0leave \u00a0\u00a0 \u00a0Remove data from the stack before returning
ret \u00a0\u00a0 \u00a0ret \u00a0\u00a0 \u00a0Return to a parent function
nop \u00a0\u00a0 \u00a0nop \u00a0\u00a0 \u00a0No operation (a ‘do nothing’ instruction)<\/p>\n

*The zero flag (ZF) is a 1 bit indicator which records the result of a cmp or test instruction<\/p>\n

Each instruction performs one specific task, and can deal directly with registers, memory addresses, and the contents thereof. It is easiest to understand exactly what these functions are used for when seen in the context of a simple hello world program and try to relate assembly language with high level language such as C language.<\/p>\n

Here is simple C program that displays Hello World:<\/p>\n

\u00a0\u00a0\u00a0 int main(int argc, char *argv[])
\u00a0\u00a0\u00a0 {\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 printf(“Hello World!\\n”);\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 return 0;\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0
\u00a0\u00a0\u00a0 }\u00a0\u00a0\u00a0 \u00a0<\/p>\n

Save this program as helloworld.c and compile it with ‘gcc -o helloworld helloworld.c’; run the resulting binary and it should print “Hello World!” on the screen and exit. Ahhah… It looks quite simple. Now let’s look how it will look in assembly language.<\/p>\n

\u00a0\u00a0\u00a0 0x8048384\u00a0\u00a0\u00a0\u00a0 push ebp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <— Save the EBP value on the stack
\u00a0\u00a0\u00a0 0x8048385\u00a0\u00a0\u00a0\u00a0 mov ebp,esp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <— Create a new EBP value for this function
\u00a0\u00a0\u00a0 0x8048387\u00a0\u00a0\u00a0\u00a0 sub esp,0x8\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <—Allocate 8 bytes on the stack for local variables
\u00a0\u00a0\u00a0 0x804838a\u00a0\u00a0\u00a0\u00a0 and esp,0xfffffff0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <—Clear the last byte of the ESP register
\u00a0\u00a0\u00a0 0x804838d\u00a0\u00a0\u00a0\u00a0 mov eax,0x0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <—Place a zero in the EAX register
\u00a0\u00a0\u00a0 0x8048392\u00a0\u00a0\u00a0\u00a0 sub esp,eax\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <—Subtract EAX (0) from the value in ESP
\u00a0\u00a0\u00a0 0x8048394\u00a0\u00a0\u00a0\u00a0 mov DWORD PTR [esp],0x80484c4\u00a0\u00a0\u00a0\u00a0 <—Place our argument for the printf() (at address\u00a0\u00a0\u00a0 0x08048384) onto the stack
\u00a0\u00a0\u00a0 0x804839b\u00a0\u00a0\u00a0\u00a0 call 0x80482b0 <_init+56>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <—Call printf()
\u00a0\u00a0\u00a0 0x80483a0\u00a0\u00a0\u00a0\u00a0 mov eax,0x0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <—Put our return value (0) into EAX
\u00a0\u00a0\u00a0 0x80483a5\u00a0\u00a0\u00a0\u00a0 leave\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <—Clean up the local variables and restore the EBP value
\u00a0\u00a0\u00a0 0x80483a6\u00a0\u00a0\u00a0\u00a0 ret\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <—Pop the saved EIP value back into the EIP register<\/p>\n

As you can easily figure out these instructions are similar to that of C program. You can easily note that flow of program is same. Off course it will be same as its a assembly code of same binary (exe) obtained from executing above C program.
\u00a0
I hope you all like it. We will continue our discussion tomorrow where i will explain how to analyze assembly language codes for those binaries whose high level source code we don’t have.<\/p>\n

A quick tip for all users how to learn assembly language better…\u00a0 Pick a already made code and generate its binary or exe file and now obtains the assembly code of that binary and try to relate assembly code with high language code. I guarantee that will surely help you to understand better as I always used to do understand things like these ways only.<\/p>\n","protected":false},"excerpt":{"rendered":"

What is Assembly language? Assembly language is a low level or simply called machine language made up of machine instructions. Assembly language is specific to processor architecture example different for x86 architecture than for SPARC architecture. Assembly language consist of assembly instructions and CPU registers. Isoftdl(Lokesh) means I will explain my tutorial considering x86 architecture……<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"footnotes":""},"categories":[34],"tags":[],"class_list":["post-388","post","type-post","status-publish","format-standard","hentry","category-it-security"],"_links":{"self":[{"href":"https:\/\/temp.ashkerala.com\/index.php?rest_route=\/wp\/v2\/posts\/388","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/temp.ashkerala.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/temp.ashkerala.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/temp.ashkerala.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/temp.ashkerala.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=388"}],"version-history":[{"count":0,"href":"https:\/\/temp.ashkerala.com\/index.php?rest_route=\/wp\/v2\/posts\/388\/revisions"}],"wp:attachment":[{"href":"https:\/\/temp.ashkerala.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=388"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/temp.ashkerala.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=388"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/temp.ashkerala.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=388"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}