Day 17 - ReverseELFneering
Date: 17, December, 2020
Author: Dhilip Sanjay S
Introduction to x86-64 Assembly
Intel x86-64 instruction set architecture
Step in producing an executable file:
Compiler - source code to assembly code (.s files).
Assembler - assembly code to object code (.o file).
Linker - object code to executable file.
16 registers
Register size = 64 bits
Radare 2
Disassemble binaries(translate machine code to assembly)
Debug the binaries
Similar took for RE - Rizin
Basic commands:
d (debug)
a (analyze)
pdf (print disassembly function)
db (breakpoints)
dc (run until breakpoint)
px (show hexdump)
ds (execute next instruction)
dr (show register value)
ood (reopen in debugger mode)
x86-64 Assembly
Basic Data Types
Initial Data Type | Suffix | Size (bytes) |
---|---|---|
Byte | b | 1 |
Word | w | 2 |
Double Word | l | 4 |
Quad | q | 8 |
Single Precision | s | 4 |
Double Precision | l | 8 |
Memory manipulation using registers:
(Rb, Ri) = MemoryLocation[Rb + Ri]
D(Rb, Ri) = MemoryLocation[Rb + Ri + D]
(Rb, Ri, S) = MemoryLocation(Rb + S * Ri]
D(Rb, Ri, S) = MemoryLocation[Rb + S * Ri + D]
Important instructions
leaq source, destination: this instruction sets destination to the address denoted by the expression in source
addq source, destination: destination = destination + source
subq source, destination: destination = destination - source
imulq source, destination: destination = destination * source
salq source, destination: destination = destination << source where << is the left bit shifting operator
sarq source, destination: destination = destination >> source where >> is the right bit shifting operator
xorq source, destination: destination = destination XOR source
andq source, destination: destination = destination & source
orq source, destination: destination = destination | source
IP (Instruction Pointer )
rip (IP 64 bit)
eip (IP 32 bit)
CheatSheets
Solutions
Initial commands to be executed to analyze
Setup the appropriate break points
What is the value of local_ch when its corresponding movl instruction is called (first if multiple)?
Answer: 1
Steps to Reproduce:
What is the value of eax when the imull instruction is called?
Answer: 6
Steps to Reproduce:
What is the value of local_4h before eax is set to 0?
Answer: 6
Steps to Reproduce:
Last updated