Download ebooks file Foundations of ARM64 Linux Debugging, Disassembling, and Reversing: Analyze Code, Understand Stack Memory Usage, and Reconstruct Original C/C++ Code with ARM64 1st Edition Dmitry Vostokov all chapters
Download ebooks file Foundations of ARM64 Linux Debugging, Disassembling, and Reversing: Analyze Code, Understand Stack Memory Usage, and Reconstruct Original C/C++ Code with ARM64 1st Edition Dmitry Vostokov all chapters
com
OR CLICK HERE
DOWLOAD NOW
https://ebookmeta.com/product/accelerated-linux-core-dump-analysis-
third-edition-dmitry-vostokov/
ebookmeta.com
https://ebookmeta.com/product/open-wide-for-christmas-rough-bdsm-
milking-1st-edition-leandra-camilli/
ebookmeta.com
Phoenix Vigilante Daddies 3 1st Edition Lucky Moon
https://ebookmeta.com/product/phoenix-vigilante-daddies-3-1st-edition-
lucky-moon/
ebookmeta.com
https://ebookmeta.com/product/gender-and-sexuality-in-modern-japan-
sabine-fruhstuck/
ebookmeta.com
https://ebookmeta.com/product/a-matter-of-death-and-life-1st-edition-
simon-r-green/
ebookmeta.com
https://ebookmeta.com/product/greeks-books-and-libraries-in-
renaissance-venice-1st-edition-rosa-maria-piccione/
ebookmeta.com
Love and Monsters Book Club Boys 1 1st Edition Max Walker
https://ebookmeta.com/product/love-and-monsters-book-club-boys-1-1st-
edition-max-walker/
ebookmeta.com
Foundations of ARM64
Linux Debugging,
Disassembling, and
Reversing
Analyze Code, Understand Stack
Memory Usage, and Reconstruct
Original C/C++ Code with ARM64
—
Dmitry Vostokov
Foundations of
ARM64 Linux
Debugging,
Disassembling, and
Reversing
Analyze Code, Understand
Stack Memory Usage,
and Reconstruct Original C/C++
Code with ARM64
Dmitry Vostokov
Foundations of ARM64 Linux Debugging, Disassembling, and Reversing:
Analyze Code, Understand Stack Memory Usage, and Reconstruct Original
C/C++ Code with ARM64
Dmitry Vostokov
Dublin, Ireland
Preface����������������������������������������������������������������������������������������������xiii
iii
Table of Contents
Chapter 4: Pointers�����������������������������������������������������������������������������35
A Definition���������������������������������������������������������������������������������������������������������35
“Pointers” Project: Memory Layout and Registers����������������������������������������������36
“Pointers” Project: Calculations��������������������������������������������������������������������������38
Using Pointers to Assign Numbers to Memory Cells�������������������������������������������39
Adding Numbers Using Pointers�������������������������������������������������������������������������46
Incrementing Numbers Using Pointers���������������������������������������������������������������51
Multiplying Numbers Using Pointers�������������������������������������������������������������������54
Summary������������������������������������������������������������������������������������������������������������58
iv
Table of Contents
v
Table of Contents
vi
Table of Contents
vii
Table of Contents
Index�������������������������������������������������������������������������������������������������167
viii
About the Author
Dmitry Vostokov is an internationally
recognized expert, speaker, educator, scientist,
and author. He is the founder of the pattern-
oriented software diagnostics, forensics,
and prognostics discipline and Software
Diagnostics Institute (DA+TA: DumpAnalysis.
org + TraceAnalysis.org). Vostokov has also
authored more than 50 books on software
diagnostics, anomaly detection and analysis,
software and memory forensics, root cause analysis and problem solving,
memory dump analysis, debugging, software trace and log analysis,
reverse engineering, and malware analysis. He has more than 25 years
of experience in software architecture, design, development, and
maintenance in various industries, including leadership, technical, and
people management roles. Dmitry also founded Syndromatix, Anolog.
io, BriteTrace, DiaThings, Logtellect, OpenTask Iterative and Incremental
Publishing (OpenTask.com), Software Diagnostics Technology and
Services (former Memory Dump Analysis Services; PatternDiagnostics.
com), and Software Prognostics. In his spare time, he presents various
topics on Debugging TV and explores Software Narratology, its further
development as Narratology of Things and Diagnostics of Things (DoT),
Software Pathology, and Quantum Software Diagnostics. His current
areas of interest are theoretical software diagnostics and its mathematical
and computer science foundations, application of formal logic, artificial
intelligence, machine learning and data mining to diagnostics and anomaly
detection, software diagnostics engineering and diagnostics-driven
ix
About the Author
x
About the Technical Reviewer
Sundar Pandian has more than three
years of experience in embedded software
development, including development of device
drivers, middleware software, and application
services for the infotainment system on the
Android platform. He’s also developed CAN
protocol drivers for the automotive braking
system on the Autosar platform.
He’s developed software with C, C++,
and Java and worked in the automotive,
semiconductor, and telecom industries. He has
a bachelor’s in electronics and communication engineering. Currently, he
serves as a firmware/middleware engineer for audio DSPs.
xi
Preface
The book covers topics ranging from ARM64 assembly language
instructions and writing programs in assembly language to pointers, live
debugging, and static binary analysis of compiled C and C++ code.
Diagnostics of core memory dumps, live and postmortem debugging
of Linux applications, services, and systems, memory forensics, malware,
and vulnerability analysis require an understanding of ARM64 assembly
language and how C and C++ compilers generate code, including
memory layout and pointers. This book is about background knowledge
and practical foundations that are needed to understand internal Linux
program structure and behavior, start working with the GDB debugger, and
use it for disassembly and reversing. It consists of practical step-by-step
exercises of increasing complexity with explanations and many diagrams,
including some necessary background topics.
By the end of the book, you will have a solid understanding of how
Linux C and C++ compilers generate binary code. In addition, you will be
able to analyze such code confidently, understand stack memory usage,
and reconstruct original C/C++ code.
The book will be useful for
• Software testers
xiii
Preface
This book can also be used as an ARM64 assembly language and Linux
debugging supplement for relevant undergraduate-level courses.
Source Code
All source code used in this book can be downloaded from github.com/
apress/arm64-linux-debugging-disassembling-reversing.
xiv
CHAPTER 1
Memory, Registers,
and Simple Arithmetic
emory and Registers Inside an
M
Idealized Computer
Computer memory consists of a sequence of memory cells, and each cell
has a unique address (location). Every cell contains a “number.” We refer
to these “numbers” as contents at addresses (locations). Because memory
access is slower than arithmetic instructions, there are so-called registers
to speed up complex operations that require memory to store temporary
results. We can also think about them as stand-alone memory cells. The
name of a register is its address. Figure 1-1 illustrates this.
2
Chapter 1 Memory, Registers, and Simple Arithmetic
3
Chapter 1 Memory, Registers, and Simple Arithmetic
static int a, b;
4
Chapter 1 Memory, Registers, and Simple Arithmetic
5
Chapter 1 Memory, Registers, and Simple Arithmetic
If we use the C or C++ language, “a” is called “the variable a,” and we
write the assignment as
a = 1;
adr x0, a
mov w1, #1
str w1, [x0]
adrp x0, 0x4b2000
add x0, x0, #0xb00
mov w1, #0x1
str w1, [x0]
adrp x0, 0x4b2000, and subsequent add x0, x0, #0xb00 is how the
compiler generates code to calculate the address “a” instead of specifying it
directly. Such code is required for addressing large regions of memory, and
6
Chapter 1 Memory, Registers, and Simple Arithmetic
the compiler uses it even for smaller regions where just one adr instruction
is sufficient.
Literal constants have the # prefix, for example, #0x1. The 0x prefix
means the following number is hexadecimal. We explain such numbers
in Chapter 3. Please also notice that the movement direction is the same
in both the disassembly output and the pseudo-code: from right to left
(except for the str instruction).
After executing the first three assembly language instructions, we have
the memory layout shown in Figure 1-4A.
Figure 1-4A. Memory layout after executing the first three assembly
language instructions
7
Chapter 1 Memory, Registers, and Simple Arithmetic
Figure 1-4B. Memory layout after executing the next three assembly
language instructions
register <- 1
register <- [a]
8
Chapter 1 Memory, Registers, and Simple Arithmetic
In the GDB disassembly output, we may see the output where one
adr instruction is replaced by adrp/add instructions with parts of the
address value:
9
Chapter 1 Memory, Registers, and Simple Arithmetic
b = b + a;
b += a;
adr x0, b
ldr w1, [x0]
adr x0, a
ldr w0, [x0]
add w1, w1, w0
adr x0, b
str w1, [x0]
10
Chapter 1 Memory, Registers, and Simple Arithmetic
After executing ADR, LDR, ADD, and STR instructions, we have the
memory layout illustrated in Figure 1-5.
11
Chapter 1 Memory, Registers, and Simple Arithmetic
Figure 1-5. Memory layout after executing ADR, LDR, ADD, and STR
instructions
Incrementing/Decrementing Numbers
in Memory and Registers
In pseudo-code, it looks simple and means increment (decrement) a
number stored at the location (address) “a”:
In the C or C++ language, we can write this using three possible ways:
12
Chapter 1 Memory, Registers, and Simple Arithmetic
a = a + 1;
++a;
a++;
b = b – 1;
--b;
b--;
add x0, x0, #1
sub x0, x0, #1
adr x0, a
ldr w1, [x0]
add w1, w1, #1
str w1, [x0]
adr x0, b
ldr w1, [x0]
sub w1, w1, #1
str w1, [x0]
13
Chapter 1 Memory, Registers, and Simple Arithmetic
After the execution of the ADD instruction, we have the memory layout
illustrated in Figure 1-6.
14
Chapter 1 Memory, Registers, and Simple Arithmetic
Figure 1-6. Memory layout after the execution of the ADD instruction
Multiplying Numbers
In pseudo-code, we write
b = b * a;
b *= a;
15
Chapter 1 Memory, Registers, and Simple Arithmetic
adr x0, b
ldr w1, [x0]
adr x0, a
ldr w0, [x0]
mul w1, w1, w0
adr x0, b
str w1, [x0]
16
Discovering Diverse Content Through
Random Scribd Documents
ROBBY AND RUTH.
Robby and Ruth strolled out one day,
Over the meadows, beyond the town;
The robins sang, and the fields looked gay,
And the orchards dropped their blossoms down:
But they took no thought of song or flower,
For this, to them, was love’s sweet hour;
And love’s hour is fleet,
And swift love’s feet,
When a lad and a winsome lassie meet!
Louisa S. Upham.
Recitations for Children.
A BOY’S VIEW.
Girl is very nice! Everybody who has not the misfortune to be girl will
allow this. Nice girl will allow it also as far as itself is concerned.
Strange girl is objectionable in the eyes of girl generally.
Powder improves girl sometimes, but it seldom finds this out until it
is suggested to it by one of experience.
Healthy girl costs its parents less money for doctors’ bills, but
persons who write romantic tales for circulating libraries choose
unhealthy and pasty faced girl to write about—the swooning kind
preferred.
If I were not boy I think I should like to be girl. It’s best fun to be
boy when there’s plenty of girl about.
Jump down, honey, en fotch me dat rag fum de table, fer ter wipe
off dis hyah led. Tole yer so, dat milk gwine ter splatter up hyah
’reckly! Dar now, dat’s er good chile, git back in mer lap.
Uh-er! Teck kyah, honey, keep dem fingers way fum dar! Butter
mos’ come now: set still jis’ er leetle w’ile longer.
Dar now! [removing the top and giving the dasher a circular
motion] jis’ peep in dar en see de lumps ob yaller butter er-huddlin’
tergedder. Now run fotch yer leetle blue mug, en Mammy ’ll gib yer
some nice sweet buttermilk right outen dis hyah churn.
Edward A. Oldham.
ONLY A BIRD.
Only a bird! and a vagrant boy
Fits a pebble with a boyish skill
Into the fold of a supple sling.
“Watch me hit him. I can an’ I will.”
Whirr! and a silence chill and sad
Falls like a pall on the vibrant air,
From a birchen tree, whence a shower of song
Has fallen in ripples everywhere.
Mary Morrison.
THE WAY TO DO IT.
Teach the child to make all the gestures and facial
expressions. This is a captivating recital for any “little tot”
who can do it well, and this will require patient practice.
I’ll tell you how I speak a piece:
First, I make my bow;
Then I bring my words out clear
And plain as I know how.
KITTY AT SCHOOL.
Come, Kitty dear, I’ll tell you what
We’ll do this rainy day;
Just you and I, all by ourselves,
At keeping school, will play.
Kate Ulmer.
A FELLOW’S MOTHER.
“A fellow’s mother,” said Fred the wise,
With his rosy cheeks and his merry eyes,
“Knows what to do if a fellow gets hurt
By a thump, or a bruise, or a fall in the dirt.
A LITTLE ROGUE.
Grandma was nodding, I rather think;
Harry was sly and quick as a wink;
He climbed in the back of her great arm-chair,
And nestled himself very snugly there;
Grandma’s dark locks were mingled with white,
And quick this fact came to his sight;
A sharp twinge soon she felt at her hair,
And woke with a start, to find Harry there.
“Why, what are you doing, my child?” she said;
He answered, “I’se pulling a basting fread?”
Grace Gordon.
WILLIE’S BREECHES.
The boy’s garments should suit the description contained
in the piece. In reciting the last two lines he should point to
his head, stretch out his hands to show them, look down at
his feet, and then catch hold of his pants and spread them
out on the sides, putting on at the same time a look of
pride.
I’m just a little boy, you know,
And hardly can remember,
When people ask how old I am,
To tell ’em four last ’vember.
And yet for all I am so small,
I made so many stitches
For mamma’s fingers, that she put
Her little boy in breeches.
Etta G. Salsbury.
LITTLE KITTY.
Once there was a little kitty,
Whiter than snow;
In the barn she used to frolic,
Long time ago;
In the barn a little mousie
Ran to and fro;
For she heard the kitty coming,
Long time ago.
LABOR SONG.
This is a charming exercise for boys and girls. Each should
be dressed in the costume of the character to be
represented, and, as far as possible, should go through the
motions called for by the part. The properties can all be
placed on the stage before the performance begins. Each
character comes in alone, those who have already entered
remaining until the close. All unite in singing the chorus,
after each performer has spoken or sung (according to
choice) the part he or she is to act. Music suitable for this
selection is herewith furnished. Come in promptly and avoid
long pauses.
Chorus.
(Spoken).
A GENTLEMAN.
I knew him for a gentleman
By signs that never fail;
His coat was rough and rather worn,
His cheeks were thin and pale—
A lad who had his way to make,
With little time for play;
I knew him for a gentleman
By certain signs to-day.
Margaret E. Sangster.
L. M. Hadley.
A DISSATISFIED CHICKEN.
There was a little chicken that was shut up in a shell,
He thought to himself, “I’m sure I cannot tell
What I am walled in here for—a shocking coop I find,
Unfitted for a chicken with an enterprising mind.”
“There’s a place where ducks and pleasure boats go sailing to and fro,
There’s one world on the surface and another world below.”
The little waves crept nearer and, on the brink inclined,
They swallowed up the chicken with an enterprising mind.
A. G. Waters.