(Ebook) Foundations of ARM64 Linux Debugging, Disassembling, and Reversing: Analyze Code, Understand Stack Memory Usage, and Reconstruct Original C/C++ Code with ARM64 by Dmitry Vostokov ISBN 9781484290811, 148429081X - Read the ebook online or download it as you prefer
(Ebook) Foundations of ARM64 Linux Debugging, Disassembling, and Reversing: Analyze Code, Understand Stack Memory Usage, and Reconstruct Original C/C++ Code with ARM64 by Dmitry Vostokov ISBN 9781484290811, 148429081X - Read the ebook online or download it as you prefer
com
OR CLICK BUTTON
DOWLOAD EBOOK
https://ebooknice.com/product/foundations-of-linux-debugging-disassembling-and-
reversing-analyze-binary-code-understand-stack-memory-usage-and-reconstruct-c-c-
code-with-intel-x64-47633766
ebooknice.com
(Ebook) Biota Grow 2C gather 2C cook by Loucas, Jason; Viles, James ISBN
9781459699816, 9781743365571, 9781925268492, 1459699815, 1743365578, 1925268497
https://ebooknice.com/product/biota-grow-2c-gather-2c-cook-6661374
ebooknice.com
(Ebook) Matematik 5000+ Kurs 2c Lärobok by Lena Alfredsson, Hans Heikne, Sanna
Bodemyr ISBN 9789127456600, 9127456609
https://ebooknice.com/product/matematik-5000-kurs-2c-larobok-23848312
ebooknice.com
(Ebook) SAT II Success MATH 1C and 2C 2002 (Peterson's SAT II Success) by Peterson's
ISBN 9780768906677, 0768906679
https://ebooknice.com/product/sat-ii-success-math-1c-and-2c-2002-peterson-s-sat-
ii-success-1722018
ebooknice.com
(Ebook) Master SAT II Math 1c and 2c 4th ed (Arco Master the SAT Subject Test: Math
Levels 1 & 2) by Arco ISBN 9780768923049, 0768923042
https://ebooknice.com/product/master-sat-ii-math-1c-and-2c-4th-ed-arco-master-
the-sat-subject-test-math-levels-1-2-2326094
ebooknice.com
(Ebook) Cambridge IGCSE and O Level History Workbook 2C - Depth Study: the United
States, 1919-41 2nd Edition by Benjamin Harrison ISBN 9781398375147, 9781398375048,
1398375144, 1398375047
https://ebooknice.com/product/cambridge-igcse-and-o-level-history-
workbook-2c-depth-study-the-united-states-1919-41-2nd-edition-53538044
ebooknice.com
https://ebooknice.com/product/accelerated-disassembly-reconstruction-and-
reversing-second-revised-edition-52237588
ebooknice.com
(Ebook) Python Debugging for AI, Machine Learning, and Cloud Computing by Dmitry
Vostokov ISBN 9781484297452, 1484297458
https://ebooknice.com/product/python-debugging-for-ai-machine-learning-and-
cloud-computing-55714196
ebooknice.com
(Ebook) Advanced Windows Memory Dump Analysis with Data Structures by Dmitry
Vostokov ISBN 9781908043849, 1908043849
https://ebooknice.com/product/advanced-windows-memory-dump-analysis-with-data-
structures-6621088
ebooknice.com
Foundations of ARM64
Linux Debugging,
Disassembling, and
Reversing
Analyze Code, Understand Stack
Memory Usage, and Reconstruct
Original C/C++ Code with ARM64
—
Dmitry Vostokov
Foundations of
ARM64 Linux
Debugging,
Disassembling, and
Reversing
Analyze Code, Understand
Stack Memory Usage,
and Reconstruct Original C/C++
Code with ARM64
Dmitry Vostokov
Foundations of ARM64 Linux Debugging, Disassembling, and Reversing:
Analyze Code, Understand Stack Memory Usage, and Reconstruct Original
C/C++ Code with ARM64
Dmitry Vostokov
Dublin, Ireland
Preface����������������������������������������������������������������������������������������������xiii
iii
Table of Contents
Chapter 4: Pointers�����������������������������������������������������������������������������35
A Definition���������������������������������������������������������������������������������������������������������35
“Pointers” Project: Memory Layout and Registers����������������������������������������������36
“Pointers” Project: Calculations��������������������������������������������������������������������������38
Using Pointers to Assign Numbers to Memory Cells�������������������������������������������39
Adding Numbers Using Pointers�������������������������������������������������������������������������46
Incrementing Numbers Using Pointers���������������������������������������������������������������51
Multiplying Numbers Using Pointers�������������������������������������������������������������������54
Summary������������������������������������������������������������������������������������������������������������58
iv
Table of Contents
v
Table of Contents
vi
Table of Contents
vii
Table of Contents
Index�������������������������������������������������������������������������������������������������167
viii
About the Author
Dmitry Vostokov is an internationally
recognized expert, speaker, educator, scientist,
and author. He is the founder of the pattern-
oriented software diagnostics, forensics,
and prognostics discipline and Software
Diagnostics Institute (DA+TA: DumpAnalysis.
org + TraceAnalysis.org). Vostokov has also
authored more than 50 books on software
diagnostics, anomaly detection and analysis,
software and memory forensics, root cause analysis and problem solving,
memory dump analysis, debugging, software trace and log analysis,
reverse engineering, and malware analysis. He has more than 25 years
of experience in software architecture, design, development, and
maintenance in various industries, including leadership, technical, and
people management roles. Dmitry also founded Syndromatix, Anolog.
io, BriteTrace, DiaThings, Logtellect, OpenTask Iterative and Incremental
Publishing (OpenTask.com), Software Diagnostics Technology and
Services (former Memory Dump Analysis Services; PatternDiagnostics.
com), and Software Prognostics. In his spare time, he presents various
topics on Debugging TV and explores Software Narratology, its further
development as Narratology of Things and Diagnostics of Things (DoT),
Software Pathology, and Quantum Software Diagnostics. His current
areas of interest are theoretical software diagnostics and its mathematical
and computer science foundations, application of formal logic, artificial
intelligence, machine learning and data mining to diagnostics and anomaly
detection, software diagnostics engineering and diagnostics-driven
ix
About the Author
x
About the Technical Reviewer
Sundar Pandian has more than three
years of experience in embedded software
development, including development of device
drivers, middleware software, and application
services for the infotainment system on the
Android platform. He’s also developed CAN
protocol drivers for the automotive braking
system on the Autosar platform.
He’s developed software with C, C++,
and Java and worked in the automotive,
semiconductor, and telecom industries. He has
a bachelor’s in electronics and communication engineering. Currently, he
serves as a firmware/middleware engineer for audio DSPs.
xi
Preface
The book covers topics ranging from ARM64 assembly language
instructions and writing programs in assembly language to pointers, live
debugging, and static binary analysis of compiled C and C++ code.
Diagnostics of core memory dumps, live and postmortem debugging
of Linux applications, services, and systems, memory forensics, malware,
and vulnerability analysis require an understanding of ARM64 assembly
language and how C and C++ compilers generate code, including
memory layout and pointers. This book is about background knowledge
and practical foundations that are needed to understand internal Linux
program structure and behavior, start working with the GDB debugger, and
use it for disassembly and reversing. It consists of practical step-by-step
exercises of increasing complexity with explanations and many diagrams,
including some necessary background topics.
By the end of the book, you will have a solid understanding of how
Linux C and C++ compilers generate binary code. In addition, you will be
able to analyze such code confidently, understand stack memory usage,
and reconstruct original C/C++ code.
The book will be useful for
• Software testers
xiii
Preface
This book can also be used as an ARM64 assembly language and Linux
debugging supplement for relevant undergraduate-level courses.
Source Code
All source code used in this book can be downloaded from github.com/
apress/arm64-linux-debugging-disassembling-reversing.
xiv
CHAPTER 1
Memory, Registers,
and Simple Arithmetic
emory and Registers Inside an
M
Idealized Computer
Computer memory consists of a sequence of memory cells, and each cell
has a unique address (location). Every cell contains a “number.” We refer
to these “numbers” as contents at addresses (locations). Because memory
access is slower than arithmetic instructions, there are so-called registers
to speed up complex operations that require memory to store temporary
results. We can also think about them as stand-alone memory cells. The
name of a register is its address. Figure 1-1 illustrates this.
2
Chapter 1 Memory, Registers, and Simple Arithmetic
3
Chapter 1 Memory, Registers, and Simple Arithmetic
static int a, b;
4
Chapter 1 Memory, Registers, and Simple Arithmetic
5
Chapter 1 Memory, Registers, and Simple Arithmetic
If we use the C or C++ language, “a” is called “the variable a,” and we
write the assignment as
a = 1;
adr x0, a
mov w1, #1
str w1, [x0]
adrp x0, 0x4b2000
add x0, x0, #0xb00
mov w1, #0x1
str w1, [x0]
adrp x0, 0x4b2000, and subsequent add x0, x0, #0xb00 is how the
compiler generates code to calculate the address “a” instead of specifying it
directly. Such code is required for addressing large regions of memory, and
6
Chapter 1 Memory, Registers, and Simple Arithmetic
the compiler uses it even for smaller regions where just one adr instruction
is sufficient.
Literal constants have the # prefix, for example, #0x1. The 0x prefix
means the following number is hexadecimal. We explain such numbers
in Chapter 3. Please also notice that the movement direction is the same
in both the disassembly output and the pseudo-code: from right to left
(except for the str instruction).
After executing the first three assembly language instructions, we have
the memory layout shown in Figure 1-4A.
Figure 1-4A. Memory layout after executing the first three assembly
language instructions
7
Chapter 1 Memory, Registers, and Simple Arithmetic
Figure 1-4B. Memory layout after executing the next three assembly
language instructions
register <- 1
register <- [a]
8
Chapter 1 Memory, Registers, and Simple Arithmetic
In the GDB disassembly output, we may see the output where one
adr instruction is replaced by adrp/add instructions with parts of the
address value:
9
Chapter 1 Memory, Registers, and Simple Arithmetic
b = b + a;
b += a;
adr x0, b
ldr w1, [x0]
adr x0, a
ldr w0, [x0]
add w1, w1, w0
adr x0, b
str w1, [x0]
10
Chapter 1 Memory, Registers, and Simple Arithmetic
After executing ADR, LDR, ADD, and STR instructions, we have the
memory layout illustrated in Figure 1-5.
11
Chapter 1 Memory, Registers, and Simple Arithmetic
Figure 1-5. Memory layout after executing ADR, LDR, ADD, and STR
instructions
Incrementing/Decrementing Numbers
in Memory and Registers
In pseudo-code, it looks simple and means increment (decrement) a
number stored at the location (address) “a”:
In the C or C++ language, we can write this using three possible ways:
12
Chapter 1 Memory, Registers, and Simple Arithmetic
a = a + 1;
++a;
a++;
b = b – 1;
--b;
b--;
add x0, x0, #1
sub x0, x0, #1
adr x0, a
ldr w1, [x0]
add w1, w1, #1
str w1, [x0]
adr x0, b
ldr w1, [x0]
sub w1, w1, #1
str w1, [x0]
13
Chapter 1 Memory, Registers, and Simple Arithmetic
After the execution of the ADD instruction, we have the memory layout
illustrated in Figure 1-6.
14
Chapter 1 Memory, Registers, and Simple Arithmetic
Figure 1-6. Memory layout after the execution of the ADD instruction
Multiplying Numbers
In pseudo-code, we write
b = b * a;
b *= a;
15
Chapter 1 Memory, Registers, and Simple Arithmetic
adr x0, b
ldr w1, [x0]
adr x0, a
ldr w0, [x0]
mul w1, w1, w0
adr x0, b
str w1, [x0]
16
Chapter 1 Memory, Registers, and Simple Arithmetic
After the execution of the STR instruction, we have the memory layout
illustrated in Figure 1-7.
17
Chapter 1 Memory, Registers, and Simple Arithmetic
Figure 1-7. Memory layout after the execution of the STR instruction
Summary
This chapter introduced CPU registers and explained the memory layout
of a simple arithmetic program. We learned basic ARM64 commands,
including loading values from and storing values in memory. We also
manually translated C and C++ code to assembly language.
The next chapter looks at assembly language code produced by a
debugger via disassembling binary code. Then, we reverse it to C and C++
code. We also compare the disassembly output of nonoptimized code to
optimized code.
18
CHAPTER 2
Code Optimization
“Arithmetic” Project: C/C++ Program
Let's rewrite our “Arithmetic” program in C/C++. Corresponding assembly
language instructions are put in comments:
int a, b;
++a; // adr x0, a
// ldr w1, [x0]
// add w1, w1, #1
// str w1, [x0]
Downloading GDB
We used one of the free ARM64 Linux compute instances available from
cloud providers. In our case, GDB was already available after provisioning.
If, in your case, GDB is not available, you need to install it together with
basic build tools. For example, in Debian:
20
Chapter 2 Code Optimization
github.com/apress/arm64-linux-debugging-disassembling-
reversing/Chapter2/
we get the binary executable module we can load in GDB and inspect
assembly code.
First, we run GDB with the program as a parameter:
$ gdb ./ArithmeticProjectC
GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-120.0.2.el7
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/
licenses/gpl.html>
This is free software: you are free to change and
redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type
"show copying"
and "show warranty" for details.
This GDB was configured as "aarch64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
21
Chapter 2 Code Optimization
Then we start the execution of the program (let it run). The program
then stops at the previously set breakpoint:
22
Chapter 2 Code Optimization
23
Chapter 2 Code Optimization
24
Chapter 2 Code Optimization
25
Chapter 2 Code Optimization
(gdb) q
A debugging session is active.
Quit anyway? (y or n) y
$
26
Chapter 2 Code Optimization
and after repeating the same steps in GDB, we get the following output:
[a] <- 2
[b] <- 4
27
Chapter 2 Code Optimization
Summary
In this chapter, we looked at assembly language code produced by a
debugger via disassembling binary code. Then, we reversed it to C and C++
code. We also compared the disassembly output of nonoptimized code to
optimized code and understood why.
The next chapter refreshes number representations, especially the
hexadecimal one.
28
CHAPTER 3
Number
Representations
Numbers and Their Representations
Imagine a herder in ancient times trying to count his sheep. He has a
certain number of stones (twelve):
However, he can only count up to three and arranges the total into
groups of three:
n
Ndec = ∑ ai*10i
i=0
30
Chapter 3 Number Representations
n
Ndec = ∑ ai*3i
i=0
n
Ndec = ∑ ai*2i
i=0
31
Random documents with unrelated
content Scribd suggests to you:
CHAPITRE DEUXIÈME
1623-1626
Our website is not just a platform for buying books, but a bridge
connecting readers to the timeless values of culture and wisdom. With
an elegant, user-friendly interface and an intelligent search system,
we are committed to providing a quick and convenient shopping
experience. Additionally, our special promotions and home delivery
services ensure that you save time and fully enjoy the joy of reading.
ebooknice.com