Foundations of ARM64 Linux Debugging, Disassembling, and Reversing: Analyze Code, Understand Stack Memory Usage, and Reconstruct Original C/C++ Code with ARM64 1st Edition Dmitry Vostokov instant download
Foundations of ARM64 Linux Debugging, Disassembling, and Reversing: Analyze Code, Understand Stack Memory Usage, and Reconstruct Original C/C++ Code with ARM64 1st Edition Dmitry Vostokov instant download
or textbooks at https://ebookmass.com
https://ebookmass.com/product/foundations-of-arm64-linux-
debugging-disassembling-and-reversing-analyze-code-
understand-stack-memory-usage-and-reconstruct-original-c-c-
code-with-arm64-1st-edition-dmitry-vostokov/
https://ebookmass.com/product/foundations-of-arm64-linux-debugging-
disassembling-and-reversing-dmitry-vostokov/
https://ebookmass.com/product/international-swimming-pool-and-spa-
code-2021-1st-edition-international-code-council/
https://ebookmass.com/product/international-fire-code-international-
code-council-series-2021-1st-edition-international-code-council/
Foundations of ARM64
Linux Debugging,
Disassembling, and
Reversing
Analyze Code, Understand Stack
Memory Usage, and Reconstruct
Original C/C++ Code with ARM64
—
Dmitry Vostokov
Foundations of
ARM64 Linux
Debugging,
Disassembling, and
Reversing
Analyze Code, Understand
Stack Memory Usage,
and Reconstruct Original C/C++
Code with ARM64
Dmitry Vostokov
Foundations of ARM64 Linux Debugging, Disassembling, and Reversing:
Analyze Code, Understand Stack Memory Usage, and Reconstruct Original
C/C++ Code with ARM64
Dmitry Vostokov
Dublin, Ireland
Preface����������������������������������������������������������������������������������������������xiii
iii
Table of Contents
Chapter 4: Pointers�����������������������������������������������������������������������������35
A Definition���������������������������������������������������������������������������������������������������������35
“Pointers” Project: Memory Layout and Registers����������������������������������������������36
“Pointers” Project: Calculations��������������������������������������������������������������������������38
Using Pointers to Assign Numbers to Memory Cells�������������������������������������������39
Adding Numbers Using Pointers�������������������������������������������������������������������������46
Incrementing Numbers Using Pointers���������������������������������������������������������������51
Multiplying Numbers Using Pointers�������������������������������������������������������������������54
Summary������������������������������������������������������������������������������������������������������������58
iv
Table of Contents
v
Table of Contents
vi
Table of Contents
vii
Table of Contents
Index�������������������������������������������������������������������������������������������������167
viii
About the Author
Dmitry Vostokov is an internationally
recognized expert, speaker, educator, scientist,
and author. He is the founder of the pattern-
oriented software diagnostics, forensics,
and prognostics discipline and Software
Diagnostics Institute (DA+TA: DumpAnalysis.
org + TraceAnalysis.org). Vostokov has also
authored more than 50 books on software
diagnostics, anomaly detection and analysis,
software and memory forensics, root cause analysis and problem solving,
memory dump analysis, debugging, software trace and log analysis,
reverse engineering, and malware analysis. He has more than 25 years
of experience in software architecture, design, development, and
maintenance in various industries, including leadership, technical, and
people management roles. Dmitry also founded Syndromatix, Anolog.
io, BriteTrace, DiaThings, Logtellect, OpenTask Iterative and Incremental
Publishing (OpenTask.com), Software Diagnostics Technology and
Services (former Memory Dump Analysis Services; PatternDiagnostics.
com), and Software Prognostics. In his spare time, he presents various
topics on Debugging TV and explores Software Narratology, its further
development as Narratology of Things and Diagnostics of Things (DoT),
Software Pathology, and Quantum Software Diagnostics. His current
areas of interest are theoretical software diagnostics and its mathematical
and computer science foundations, application of formal logic, artificial
intelligence, machine learning and data mining to diagnostics and anomaly
detection, software diagnostics engineering and diagnostics-driven
ix
About the Author
x
About the Technical Reviewer
Sundar Pandian has more than three
years of experience in embedded software
development, including development of device
drivers, middleware software, and application
services for the infotainment system on the
Android platform. He’s also developed CAN
protocol drivers for the automotive braking
system on the Autosar platform.
He’s developed software with C, C++,
and Java and worked in the automotive,
semiconductor, and telecom industries. He has
a bachelor’s in electronics and communication engineering. Currently, he
serves as a firmware/middleware engineer for audio DSPs.
xi
Preface
The book covers topics ranging from ARM64 assembly language
instructions and writing programs in assembly language to pointers, live
debugging, and static binary analysis of compiled C and C++ code.
Diagnostics of core memory dumps, live and postmortem debugging
of Linux applications, services, and systems, memory forensics, malware,
and vulnerability analysis require an understanding of ARM64 assembly
language and how C and C++ compilers generate code, including
memory layout and pointers. This book is about background knowledge
and practical foundations that are needed to understand internal Linux
program structure and behavior, start working with the GDB debugger, and
use it for disassembly and reversing. It consists of practical step-by-step
exercises of increasing complexity with explanations and many diagrams,
including some necessary background topics.
By the end of the book, you will have a solid understanding of how
Linux C and C++ compilers generate binary code. In addition, you will be
able to analyze such code confidently, understand stack memory usage,
and reconstruct original C/C++ code.
The book will be useful for
• Software testers
xiii
Preface
This book can also be used as an ARM64 assembly language and Linux
debugging supplement for relevant undergraduate-level courses.
Source Code
All source code used in this book can be downloaded from github.com/
apress/arm64-linux-debugging-disassembling-reversing.
xiv
CHAPTER 1
Memory, Registers,
and Simple Arithmetic
emory and Registers Inside an
M
Idealized Computer
Computer memory consists of a sequence of memory cells, and each cell
has a unique address (location). Every cell contains a “number.” We refer
to these “numbers” as contents at addresses (locations). Because memory
access is slower than arithmetic instructions, there are so-called registers
to speed up complex operations that require memory to store temporary
results. We can also think about them as stand-alone memory cells. The
name of a register is its address. Figure 1-1 illustrates this.
2
Chapter 1 Memory, Registers, and Simple Arithmetic
3
Chapter 1 Memory, Registers, and Simple Arithmetic
static int a, b;
4
Chapter 1 Memory, Registers, and Simple Arithmetic
5
Chapter 1 Memory, Registers, and Simple Arithmetic
If we use the C or C++ language, “a” is called “the variable a,” and we
write the assignment as
a = 1;
adr x0, a
mov w1, #1
str w1, [x0]
adrp x0, 0x4b2000
add x0, x0, #0xb00
mov w1, #0x1
str w1, [x0]
adrp x0, 0x4b2000, and subsequent add x0, x0, #0xb00 is how the
compiler generates code to calculate the address “a” instead of specifying it
directly. Such code is required for addressing large regions of memory, and
6
Chapter 1 Memory, Registers, and Simple Arithmetic
the compiler uses it even for smaller regions where just one adr instruction
is sufficient.
Literal constants have the # prefix, for example, #0x1. The 0x prefix
means the following number is hexadecimal. We explain such numbers
in Chapter 3. Please also notice that the movement direction is the same
in both the disassembly output and the pseudo-code: from right to left
(except for the str instruction).
After executing the first three assembly language instructions, we have
the memory layout shown in Figure 1-4A.
Figure 1-4A. Memory layout after executing the first three assembly
language instructions
7
Chapter 1 Memory, Registers, and Simple Arithmetic
Figure 1-4B. Memory layout after executing the next three assembly
language instructions
register <- 1
register <- [a]
8
Chapter 1 Memory, Registers, and Simple Arithmetic
In the GDB disassembly output, we may see the output where one
adr instruction is replaced by adrp/add instructions with parts of the
address value:
9
Chapter 1 Memory, Registers, and Simple Arithmetic
b = b + a;
b += a;
adr x0, b
ldr w1, [x0]
adr x0, a
ldr w0, [x0]
add w1, w1, w0
adr x0, b
str w1, [x0]
10
Chapter 1 Memory, Registers, and Simple Arithmetic
After executing ADR, LDR, ADD, and STR instructions, we have the
memory layout illustrated in Figure 1-5.
11
Chapter 1 Memory, Registers, and Simple Arithmetic
Figure 1-5. Memory layout after executing ADR, LDR, ADD, and STR
instructions
Incrementing/Decrementing Numbers
in Memory and Registers
In pseudo-code, it looks simple and means increment (decrement) a
number stored at the location (address) “a”:
In the C or C++ language, we can write this using three possible ways:
12
Chapter 1 Memory, Registers, and Simple Arithmetic
a = a + 1;
++a;
a++;
b = b – 1;
--b;
b--;
add x0, x0, #1
sub x0, x0, #1
adr x0, a
ldr w1, [x0]
add w1, w1, #1
str w1, [x0]
adr x0, b
ldr w1, [x0]
sub w1, w1, #1
str w1, [x0]
13
Chapter 1 Memory, Registers, and Simple Arithmetic
After the execution of the ADD instruction, we have the memory layout
illustrated in Figure 1-6.
14
Chapter 1 Memory, Registers, and Simple Arithmetic
Figure 1-6. Memory layout after the execution of the ADD instruction
Multiplying Numbers
In pseudo-code, we write
b = b * a;
b *= a;
15
Chapter 1 Memory, Registers, and Simple Arithmetic
adr x0, b
ldr w1, [x0]
adr x0, a
ldr w0, [x0]
mul w1, w1, w0
adr x0, b
str w1, [x0]
16
Chapter 1 Memory, Registers, and Simple Arithmetic
After the execution of the STR instruction, we have the memory layout
illustrated in Figure 1-7.
17
Chapter 1 Memory, Registers, and Simple Arithmetic
Figure 1-7. Memory layout after the execution of the STR instruction
Summary
This chapter introduced CPU registers and explained the memory layout
of a simple arithmetic program. We learned basic ARM64 commands,
including loading values from and storing values in memory. We also
manually translated C and C++ code to assembly language.
The next chapter looks at assembly language code produced by a
debugger via disassembling binary code. Then, we reverse it to C and C++
code. We also compare the disassembly output of nonoptimized code to
optimized code.
18
CHAPTER 2
Code Optimization
“Arithmetic” Project: C/C++ Program
Let's rewrite our “Arithmetic” program in C/C++. Corresponding assembly
language instructions are put in comments:
int a, b;
++a; // adr x0, a
// ldr w1, [x0]
// add w1, w1, #1
// str w1, [x0]
Downloading GDB
We used one of the free ARM64 Linux compute instances available from
cloud providers. In our case, GDB was already available after provisioning.
If, in your case, GDB is not available, you need to install it together with
basic build tools. For example, in Debian:
20
Chapter 2 Code Optimization
github.com/apress/arm64-linux-debugging-disassembling-
reversing/Chapter2/
we get the binary executable module we can load in GDB and inspect
assembly code.
First, we run GDB with the program as a parameter:
$ gdb ./ArithmeticProjectC
GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-120.0.2.el7
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/
licenses/gpl.html>
This is free software: you are free to change and
redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type
"show copying"
and "show warranty" for details.
This GDB was configured as "aarch64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
21
Chapter 2 Code Optimization
Then we start the execution of the program (let it run). The program
then stops at the previously set breakpoint:
22
Chapter 2 Code Optimization
23
Chapter 2 Code Optimization
24
Chapter 2 Code Optimization
25
Chapter 2 Code Optimization
(gdb) q
A debugging session is active.
Quit anyway? (y or n) y
$
26
Chapter 2 Code Optimization
and after repeating the same steps in GDB, we get the following output:
[a] <- 2
[b] <- 4
27
Chapter 2 Code Optimization
Summary
In this chapter, we looked at assembly language code produced by a
debugger via disassembling binary code. Then, we reversed it to C and C++
code. We also compared the disassembly output of nonoptimized code to
optimized code and understood why.
The next chapter refreshes number representations, especially the
hexadecimal one.
28
CHAPTER 3
Number
Representations
Numbers and Their Representations
Imagine a herder in ancient times trying to count his sheep. He has a
certain number of stones (twelve):
However, he can only count up to three and arranges the total into
groups of three:
n
Ndec = ∑ ai*10i
i=0
30
Chapter 3 Number Representations
n
Ndec = ∑ ai*3i
i=0
n
Ndec = ∑ ai*2i
i=0
31
Other documents randomly have
different content
niinkuin seisomaan keskelle virtaa? Meitä ympäröi vesi, tyttäreni, ja
sen lisäksi sangen likaista vettä; pidetään varamme, ettemme
kastu."
"No mene sitten", sanoi parooni; "mutta minä, joka välitän viis
ilotulituksista, jään tänne".
Andrée kuuli kyllä nämä sanat; mutta kun ne oli kai lausunut joku
kansan mies, niin ei hän välittänyt niistä sen enempää kuin jokin
intialainen jumala uhrista, kun paaria-luokkaan kuuluva raukka
laskee sen hänen jalkainsa juureen.
KAHDESKYMMENESKUUDES LUKU
Pakokauhu
Yhtäkkiä välähti ilmi kirkas valo, joka syöksyi vinosti jokea kohti.
Se oli pommi, joka räjähti kovalla paukkeella ja jonka monia
vaihtelevia värejä Andrée ihaili.
Tuo väkivyöry veti nyt mukaansa tai murskasi kaikki ne, jotka
luulivat jo pelastuneensa haaksirikosta Kalustohuoneen luo turvaan
päästyään. Uusi putous törmäyksiä, eläviä ja kuolleita ruumiita
tulvahti Gilbertin yli; hän pääsi syvennykseen rautaisen säleportin
kulmaukseen ja mahtui siihen puolittain.
Joka hetki ilmestyi uusia sankareita, joita näytti aivan kuin maasta
nousevan, yhtyäkseen tuohon mieheen nuo kummallisella tavalla
lausutut sanat kuullessaan ja omituiset viittaukset nähdessään.
"Oh, minä saan kyllä kuolla", mutisi Gilbert, "kunhan vain hän
elää!
Tuo mies osaa hänet pelastaa."
Kuolonkenttä
Kello oli noin kaksi aamulla. Suuret, valkeat pilvet kiitivät yli
Pariisin, ja kalpeassa kuutamossa kuvastuivat terävin piirtein
maaperän epätasaisuudet tuolla onnettomuuden kentällä, jonka
kuoppiin pakeneva ihmisvyöry oli syöksynyt ja tuhoutunut.
Kun hän nyt kuuli toisen kerran, kuten olemme sanoneet, lääkärin
kehoituksen, niin hän nosti päätänsä ja sanoi katsahtaen surullisena
irtileikattuja jäseniä, joita lääkäri näytti silmäilevän melkein
nautinnokseen:
"Andrée! Andrée!"
Kun hän kuuli Filipin valittavan näin, käsitti hän, miten suuresti
nuori mies kärsi, ja mutisi itsekseen: "Voi onnetonta tuotakin!"
Mutta kun vanhus näytti tulleen torille samoissa aikeissa kuin
hänen surkuttelemansakin, jatkoi hän kulkuaan Filipin ohitse.
Mutta sitten virkkoi hän yhtäkkiä, ikäänkuin katuen sitä, että oli
mennyt kärsivän olennon ohitse tarjoamatta hänelle lohdutustaan:
"Monsieur, antakaa anteeksi, että otan osaa suruunne, mutta niiden,
joita on kohdannut sama onnettomuus, täytyy tukea toisiaan
pysyäkseen pystyssä. Sitäpaitsi voi teistä olla minulle hyötyä… te
olette etsinyt täältä kauan, sillä teidän kynttilänne on palanut
melkein loppuun, ja niinpä te tietänette pahimmat paikat torilla."
"Sisartanne?"
"Niin, hän oli tuolla alhaalla päin. Minä hukkasin hänet, kun seisoin
erään penkin vieressä. Minä löysin kyllä paikan, jossa minut
temmattiin hänestä erilleni, mutta en hänestä itsestään
merkkiäkään. Minä lähden siis uudestaan etsimään häntä bastionin
luota."
"Niin, monsieur."
"Kyllä, sillä tehän sanoitte, että väkijoukko oli kai rynnännyt sinne
päin, ja varmaan se on sen tehnytkin. Epäilemättäkin on poloinen
nuorukainen hyökännyt sille suunnalle? Hän oli maalaispoika, joka ei
tuntenut edes tämän suuren kaupungin katuja, puhumattakaan
täkäläisten tavoista. Ehkäpä hän oli vasta ensi kerran Ludvig XV:n
torillakin."
ebookmasss.com