Foundations of Linux Debugging, Disassembling, and Reversing: Analyze Binary Code, Understand Stack Memory Usage, and Reconstruct C/C++ Code with Intel x64 1st Edition Dmitry Vostokov pdf download
Foundations of Linux Debugging, Disassembling, and Reversing: Analyze Binary Code, Understand Stack Memory Usage, and Reconstruct C/C++ Code with Intel x64 1st Edition Dmitry Vostokov pdf download
https://ebookmass.com/product/foundations-of-linux-
debugging-disassembling-and-reversing-analyze-binary-code-
understand-stack-memory-usage-and-reconstruct-c-c-code-with-
intel-x64-1st-edition-dmitry-vostokov/
https://ebookmass.com/product/foundations-of-arm64-linux-debugging-
disassembling-and-reversing-dmitry-vostokov/
https://ebookmass.com/product/international-swimming-pool-and-spa-
code-2021-1st-edition-international-code-council/
https://ebookmass.com/product/international-fire-code-international-
code-council-series-2021-1st-edition-international-code-council/
Foundations of Linux
Debugging, Disassembling,
and Reversing
Analyze Binary Code, Understand
Stack Memory Usage, and Reconstruct
C/C++ Code with Intel x64
—
Dmitry Vostokov
Foundations of Linux
Debugging,
Disassembling, and
Reversing
Analyze Binary Code,
Understand Stack Memory
Usage, and Reconstruct C/C++
Code with Intel x64
Dmitry Vostokov
Foundations of Linux Debugging, Disassembling, and Reversing: Analyze
Binary Code, Understand Stack Memory Usage, and Reconstruct C/C++
Code with Intel x64
Dmitry Vostokov
Dublin, Ireland
Preface����������������������������������������������������������������������������������������������xiii
iii
Table of Contents
Chapter 4: Pointers�����������������������������������������������������������������������������33
A Definition���������������������������������������������������������������������������������������������������������33
“Pointers” Project: Memory Layout and Registers����������������������������������������������34
“Pointers” Project: Calculations��������������������������������������������������������������������������36
Using Pointers to Assign Numbers to Memory Cells�������������������������������������������36
Adding Numbers Using Pointers�������������������������������������������������������������������������42
Incrementing Numbers Using Pointers���������������������������������������������������������������45
Multiplying Numbers Using Pointers�������������������������������������������������������������������48
Summary������������������������������������������������������������������������������������������������������������51
iv
Table of Contents
Registers Revisited���������������������������������������������������������������������������������������������65
NULL Pointers�����������������������������������������������������������������������������������������������������65
Invalid Pointers���������������������������������������������������������������������������������������������������65
Variables As Pointers������������������������������������������������������������������������������������������66
Pointer Initialization��������������������������������������������������������������������������������������������67
Initialized and Uninitialized Data�������������������������������������������������������������������������67
More Pseudo Notation�����������������������������������������������������������������������������������������68
“MemoryPointers” Project: Memory Layout�������������������������������������������������������68
Summary������������������������������������������������������������������������������������������������������������79
v
Table of Contents
vi
Table of Contents
vii
Table of Contents
Index�������������������������������������������������������������������������������������������������167
viii
About the Author
Dmitry Vostokov is an internationally
recognized expert, speaker, educator, scientist,
and author. He is the founder of the pattern-
oriented software diagnostics, forensics,
and prognostics discipline and Software
Diagnostics Institute (DA+TA: DumpAnalysis.
org + TraceAnalysis.org). Vostokov has also
authored more than 50 books on software
diagnostics, anomaly detection and analysis,
software and memory forensics, root cause analysis and problem solving,
memory dump analysis, debugging, software trace and log analysis,
reverse engineering, and malware analysis. He has more than 25 years
of experience in software architecture, design, development, and
maintenance in various industries, including leadership, technical, and
people management roles. Dmitry also founded Syndromatix, Anolog.
io, BriteTrace, DiaThings, Logtellect, OpenTask Iterative and Incremental
Publishing (OpenTask.com), Software Diagnostics Technology and
Services (former Memory Dump Analysis Services; PatternDiagnostics.
com), and Software Prognostics. In his spare time, he presents various
topics on Debugging TV and explores Software Narratology, its further
development as Narratology of Things and Diagnostics of Things (DoT),
and Software Pathology. His current areas of interest are theoretical
software diagnostics and its mathematical and computer science
foundations, application of artificial intelligence, machine learning and
ix
About the Author
x
About the Technical Reviewer
Vikas Talan is a senior engineer at Qualcomm
(an American multinational corporation). He is
the founder of S.M.A.R.T Solutions, a technical
company. He also worked at MediaTek and
Cadence in core technical domains. He has
in-depth experience in Linux kernel
programming, Linux device drivers, ARM 64,
ARM, and porting of Android OS and Linux
drivers on chipsets. He hails from Delhi
NCR, India.
xi
Preface
The book covers topics ranging from Intel x64 assembly language
instructions and writing programs in assembly language to pointers, live
debugging, and static binary analysis of compiled C and C++ code.
Diagnostics of core memory dumps, live and postmortem debugging
of Linux applications, services, and systems, memory forensics, malware,
and vulnerability analysis require an understanding of x64 Intel assembly
language and how C and C++ compilers generate code, including
memory layout and pointers. This book is about background knowledge
and practical foundations that are needed to understand internal Linux
program structure and behavior, start working with the GDB debugger, and
use it for disassembly and reversing. It consists of practical step-by-step
exercises of increasing complexity with explanations and many diagrams,
including some necessary background topics.
By the end of the book, you will have a solid understanding of how
Linux C and C++ compilers generate binary code. In addition, you will be
able to analyze such code confidently, understand stack memory usage,
and reconstruct original C/C++ code.
The book will be useful for
• Software testers
xiii
Preface
This book can also be used as an x64 assembly language and Linux
debugging supplement for relevant undergraduate-level courses.
Source Code
All source code used in this book can be downloaded from github.com/
apress/linux-debugging-disassembling-reversing.
xiv
CHAPTER 1
Memory, Registers,
and Simple Arithmetic
emory and Registers Inside
M
an Idealized Computer
Computer memory consists of a sequence of memory cells, and each cell
has a unique address (location). Every cell contains a “number.” We refer
to these “numbers” as contents at addresses (locations). Because memory
access is slower than arithmetic instructions, there are so-called registers
to speed up complex operations that require memory to store temporary
results. We can also think about them as stand-alone memory cells. The
name of a register is its address. Figure 1-1 illustrates this concept.
2
Chapter 1 Memory, Registers, and Simple Arithmetic
3
Chapter 1 Memory, Registers, and Simple Arithmetic
static int a, b;
4
Chapter 1 Memory, Registers, and Simple Arithmetic
5
Chapter 1 Memory, Registers, and Simple Arithmetic
If we use the C or C++ language, “a” is called “the variable a,” and we
write the assignment as
a = 1;
mov $1, a
In the GDB disassembly output, we see the following code where the
variable “a” and address are shown in comments:
Notice movl instructions instead of mov. This is because “a” and “b”
can point to both 32-bit (like %EAX or %EDX registers) and 64-bit memory
cells (like %RAX and %RDX registers). In the registers’ case, it is clear from
their names whether we use 64-bit %RAX or 32-bit %EAX. But in the case
of memory addresses “a” and “b,” it is not clear whether they refer to 64-bit
or 32-bit cells. We use movl to disambiguate and show that we use 32-bit
memory cells that are enough to hold integers from 0 to 4294967295.
0x2ef2(%rip) is how the compiler generates code to calculate the
address “a” instead of specifying it directly. Such code requires less
memory space. We explain this in later chapters.
6
Chapter 1 Memory, Registers, and Simple Arithmetic
Literal constants have the $ prefix, for example, $0x1. The 0x prefix
means the following number is hexadecimal. The leading four zeroes of
the address are also omitted in the comment. We explain such numbers in
Chapter 3. Please also notice that the movement direction is the same in
both the disassembly output and the pseudo-code: from left to right.
After executing the first two assembly language instructions, we have
the memory layout shown in Figure 1-4.
Figure 1-4. Memory layout after executing the first two assembly
language instructions
7
Chapter 1 Memory, Registers, and Simple Arithmetic
1 -> register
(a) -> register
mov $0x0,%eax
8
Chapter 1 Memory, Registers, and Simple Arithmetic
b = b + a;
b += a;
mov a, %eax
add %eax, b
or we can add two registers and move the result to the memory cell b:
mov b, %edx
mov a, %eax
add %edx, %eax
mov %eax, b
9
Chapter 1 Memory, Registers, and Simple Arithmetic
10
Chapter 1 Memory, Registers, and Simple Arithmetic
Incrementing/Decrementing Numbers
in Memory and Registers
In pseudo-code, it looks simple and means increment (decrement) a
number stored at the location (address) “a”:
11
Chapter 1 Memory, Registers, and Simple Arithmetic
In the C or C++ language, we can write this using three possible ways:
a = a + 1;
++a;
a++;
b = b – 1;
--b;
b--;
incl a
inc %eax
decl a
dec %eax
inc %eax
or
12
Chapter 1 Memory, Registers, and Simple Arithmetic
13
Chapter 1 Memory, Registers, and Simple Arithmetic
Multiplying Numbers
In pseudo-code, we write
b = b * a;
b *= a;
14
Chapter 1 Memory, Registers, and Simple Arithmetic
mov a, %eax
imul b, %eax
mov %eax, b
mov a, %eax
mov b, %edx
imul %edx, %eax
mov %eax, b
15
Chapter 1 Memory, Registers, and Simple Arithmetic
16
Chapter 1 Memory, Registers, and Simple Arithmetic
Figure 1-7. Memory layout after the execution of IMUL and MOV
instructions
Summary
This chapter introduced CPU registers and explained the memory layout
of a simple arithmetic program. We learned basic x64 instructions and
manually translated simple C and C++ code to assembly language.
The next chapter looks at assembly language code produced by a
debugger via disassembling binary code. Then, we reverse it to C and C++
code. We also compare the disassembly output of nonoptimized code to
optimized code.
17
CHAPTER 2
Code Optimization
“Arithmetic” Project: C/C++ Program
Let’s rewrite our “Arithmetic” program in C/C++. Corresponding assembly
language instructions are put in comments:
int a, b;
Downloading GDB
We used WSL2 and "Debian GNU/Linux 10 (buster)" as a working
environment. We chose Debian because we used it for the “Accelerated
Linux Core Dump Analysis” training course.1 After installing Debian, we
need to install essential build tools and GDB:
1
www.dumpanalysis.org/accelerated-linux-core-dump-analysis-book
20
Chapter 2 Code Optimization
coredump@DESKTOP-IS6V2L0:~/pflddr/x64/Chapter2$ gcc
ArithmeticProjectC.cpp -o ArithmeticProjectC
we get the binary executable module we can load in GDB and inspect
assembly code.
First, we run GDB with the program as a parameter:
coredump@DESKTOP-IS6V2L0:~/pflddr/x64/Chapter2$ gdb ./
ArithmeticProjectC
GNU gdb (Debian 8.2.1-2+b3) 8.2.1
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/
licenses/gpl.html>
This is free software: you are free to change and
redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources
online at:
<http://www.gnu.org/software/gdb/documentation/>.
21
Chapter 2 Code Optimization
Then we start execution of the program (let it run). The program then
stops at the previously set breakpoint:
(gdb) run
Starting program: /home/coredump/pflddr/x64/Chapter2/
ArithmeticProjectC
22
Chapter 2 Code Optimization
0x0000555555555152 <+45>: mov %eax,0x2ed8(%rip)
# 0x555555558030 <b>
0x0000555555555158 <+51>: mov 0x2ece(%rip),%eax
# 0x55555555802c <a>
0x000055555555515e <+57>: add $0x1,%eax
0x0000555555555161 <+60>: mov %eax,0x2ec5(%rip)
# 0x55555555802c <a>
0x0000555555555167 <+66>: mov 0x2ec3(%rip),%edx
# 0x555555558030 <b>
0x000055555555516d <+72>: mov 0x2eb9(%rip),%eax
# 0x55555555802c <a>
0x0000555555555173 <+78>: imul %edx,%eax
0x0000555555555176 <+81>: mov %eax,0x2eb4(%rip)
# 0x555555558030 <b>
0x000055555555517c <+87>: mov $0x0,%eax
0x0000555555555181 <+92>: pop %rbp
0x0000555555555182 <+93>: retq
End of assembler dump.
0x0000555555555130 <+11>: movl $0x1,0x2ef2(%rip)
# 0x55555555802c <a>
0x000055555555513a <+21>: movl $0x1,0x2eec(%rip)
# 0x555555558030 <b>
0x0000555555555144 <+31>: mov 0x2ee6(%rip),%edx
# 0x555555558030 <b>
0x000055555555514a <+37>: mov 0x2edc(%rip),%eax
# 0x55555555802c <a>
0x0000555555555150 <+43>: add %edx,%eax
23
Chapter 2 Code Optimization
0x0000555555555152 <+45>: mov %eax,0x2ed8(%rip)
# 0x555555558030 <b>
0x0000555555555158 <+51>: mov 0x2ece(%rip),%eax
# 0x55555555802c <a>
0x000055555555515e <+57>: add $0x1,%eax
0x0000555555555161 <+60>: mov %eax,0x2ec5(%rip)
# 0x55555555802c <a>
0x0000555555555167 <+66>: mov 0x2ec3(%rip),%edx
# 0x555555558030 <b>
0x000055555555516d <+72>: mov 0x2eb9(%rip),%eax
# 0x55555555802c <a>
0x0000555555555173 <+78>: imul %edx,%eax
0x0000555555555176 <+81>: mov %eax,0x2eb4(%rip)
# 0x555555558030 <b>
24
Chapter 2 Code Optimization
(gdb) q
A debugging session is active.
Quit anyway? (y or n) y
coredump@DESKTOP-IS6V2L0:~/pflddr/x64/Chapter2$
coredump@DESKTOP-IS6V2L0:~/pflddr/x64/Chapter2$ gcc
ArithmeticProjectC.cpp -O1 -o ArithmeticProjectC
and after repeating the same steps in GDB, we get the following output:
Please note that the compiler also chose to put memory cell “b” first
(000055555555802c) and then memory cell “a” (0000555555558030).
25
Chapter 2 Code Optimization
What happened to all our assembly code in this executable? This code
seems to be directly placing the end result into the “b” memory cell if we
observe. Why is this happening? The answer lies in compiler optimization.
When the code is compiled in optimization mode, the compiler can
calculate the final result from the simple C/C++ source code itself and
generate only the necessary code to update corresponding memory
locations.
Summary
In this chapter, we looked at assembly language code produced by a
debugger via disassembling binary code. Then, we reversed it to C and C++
code. We also compared the disassembly output of nonoptimized code to
optimized code and understood why.
The next chapter refreshes number representations, especially the
hexadecimal one.
26
CHAPTER 3
Number
Representations
Numbers and Their Representations
Imagine a herder in ancient times trying to count his sheep. He has a
certain number of stones (twelve):
However, he can only count up to three and arranges the total into
groups of three:
n
Ndec = ∑ ai*10i
i=0
28
Chapter 3 Number Representations
n
Ndec = ∑ ai*3i
i=0
n
Ndec = ∑ ai*2i
i=0
29
Chapter 3 Number Representations
123dec = 7Bhex
n
Ndec = ∑ ai*16i
i=0
Now we divide the binary number digits into groups of four and write
them down in decimal and hexadecimal notation:
110001010011
30
Chapter 3 Number Representations
0000 0 0
0001 1 1
0010 2 2
0011 3 3
0100 4 4
0101 5 5
0110 6 6
0111 7 7
1000 8 8
1001 9 9
1010 10 A
1011 11 B
1100 12 C
1101 13 D
1110 14 E
1111 15 F
31
Chapter 3 Number Representations
Summary
This chapter refreshed different representations of a number, including
hexadecimal notation.
The next chapter introduces pointers. We rewrite our arithmetic
program from Chapter 1 using pointers to memory and use the GDB
debugger to execute instructions one by one and watch changes
to memory.
32
Other documents randomly have
different content
ORNITHOLOGY.
PLATE XXXIII.
PSITTACUS MACULATUS
SPOTTED BREASTED PARRAKEET.
Picæ.
GENERIC CHARACTER.
Bill falcated; upper mandible moveable and in general covered
with a cere: nostrils rounded, placed in the base of the bill: tongue
fleshy, obtuse, entire: feet formed for climbing.
SPECIFIC CHARACTER.
Green: crown, hind, head and nape black: temples cinereous:
throat, neck, and breast fuscous with the margins of the feather
sulphureous: shoulder scarlet: rump and middle of the abdomen
sanguineous.
Psittacus Maculatus: viridis: vertice, occipite, nuchaque nigris:
temporibus cinereis: gula, collo, pectoreque fuscis
marginibus pennarum sulphureis: humeris coccineis:
uropygio abdomineque medio sanguineis.
A very rare species of the Parrakeet tribe, and which is presumed
to be a native of South America.
The length of this bird is nine inches and a half; the bill and legs
blackish. The prevailing colour of the plumage green, front and
crown of the head blueish green, the rest of the head and neck
black: the feathers upon the face glossed with blue: a large ovate
cinereous spot on the cheeks: throat and breast black varied with
pale yellowish scollops, the margin of the feathers being a pale
sulphureous yellow, the disk black: the black disk usually forming a
kind of triangular spot with the point tending downwards. The wings
are green, except the quill feathers, which are blue, and the butt of
the wing or shoulder the colour of which is scarlet. The body
beneath green with a large spot of sanguineous-purple on the
abdomen. The lower part of the back and rump the same
sanguineous purple colour as the abdominal spot: tail above green,
the feathers purplish towards the end; beneath rufous brown.
This curious bird is nearly allied to Psittacus Squammosus, the
Scaly Breasted Parrakeet, and in no very remote degree with
another kind of Parrakeet, the Wavy Breasted Parrot, Psittacus
Lineatus. The first of these our bird exceeds by at least an inch in
length, the other by an inch and a quarter. Instead of the dark
colours of the head, as in our bird, the head and neck of P.
Squammosus are dull orange. The darker colouring of our bird
assimilates more nearly with Psittacus Lineatus, but in other respects
is entirely different. We have considered it as a new species, at the
same time that it must be observed from the very close analogy that
prevails between this bird and the Scaly Breasted Parrakeet, it may
possibly prove hereafter to be the adult bird of that kind rather than
a distinct species.
34
London. Published by E. Donovan & Mess.rs Simpkin & Marshall, March 1, 1823.
CONCHOLOGY.
PLATE XXXIV.
TEREBRATULA SANGUINEA
SANGUINEOUS LAMP-ANOMIA,
TEREBRATULA,
OR,
LAMP COCKLE.
Bivalve.
GENERIC CHARACTER.
Shell inequivalve regular, somewhat triagonal: upper valve
imperforate, lower valve beaked above the hinge, the beak usually
incurvate, perforated at the tip, or grooved, for the passage of a
short tendinous pedicle, by means of which it adheres to other
bodies: Hinge with two teeth, and furnished with two osseous
elevated and furcated processes arising from the disk of the upper or
smaller valve, destined to support the animal.
SPECIFIC CHARACTER
AND
SYNONYMS.
Shell red, ventricose, suborbicular, longitudinally ribbed: upper
valve depressed in the middle; the lower with the back elevated.
Terebratula Sanguinea: testa rubrâ ventricosa, suborbiculata,
longitudinaliter costata: valva superiore in medio excavato:
inferiore dorso elevato, apice incurvato perforato.
Anomia Sanguinea. Obovata longitudinaliter sulcata, triloba; sinu
profundo, nate producta latere angulata foramen ambiente.
Solanders MSS.—Hab. in O. Pacifico. G. R. Forster.
Anomia Sanguinea. Portland Catalogue.
Anomia Sanguinea. Leverian Cat. sec. part. p. 15.
Anomia Sanguinea. Dillwyn’s Conch. 1. 293. 21.
Terebratula Sanguinea. Leach. Zool. Misc. t. 76.
Terebratula Sanguinea. Lamarck Anim. sans. Vert. T. 6. p. 1. p. 243.
Lampas Sanguineus, La Sanguinolente (Anomia Sanguinea S.)
Calonne Cat. Humph. MS.
PLATE XXXV.
PAPILIO BELLADONNA
BELLADONNA’S BUTTERFLY.
Lepidoptera.
GENERIC CHARACTER.
Antennæ thicker towards the tip, and generally terminating in a
knob: wings erect when at rest. Fly by day.
**** Heliconii.
SPECIFIC CHARACTER
AND
SYNONYMS.
Wings oblong entire, black with somewhat hyaline spots: posterior
pair with a yellow spot at the base, and two at the anal angle.
Papilio Belladonna: alis oblongis integerrimis atris sub-hyalino
maculatis: posticis macula baseos anguloque ani maculis
duobus flavis.
Papilio Belladonna: alis oblongis integerrimis atris: anticis hyalino
punctatis, posticis flavo maculatis. Fabr. Ent. Syst. T. 3. p. 1.
p. 180.
Papilio Belladonna. Jon. fig. pict. 3. tab. 37. fig. 2.
Statura P. Pasithoe at major. Corpus nigrum abdominis marginibus
cinereis. Alæ atræ, cinereo punctatæ. Subtus concolores at lineola
maculaque baseos albis. Posticæ atræ, flavo maculatæ macula
baseos angulique ani majoribus. Subtus fere concolores.
A figure of this very rare and probably unique insect cannot fail, it
is presumed, of proving an acceptable addition to the collectanea of
the Entomologist: it is the only representation of the species now
extant, and has been ascertained upon the authority of the only
document we now possess of the insect intended in the Fabrician
writings under the appellation of Papilio Hel. Belladonna.
Fabricius, as it appears from his references in his Entomologia
Systematica, met with the drawings of this species in the collection
of Mr. Jones, whose cabinet also possessed the original specimen
from which the drawing was taken. It is from this individual example
in the cabinet of Mr. Jones that the delineation in the annexed plate
is copied.
This curious Papilio is one of the larger species of the Heliconi
tribe to which it appertains. The wings are a blueish black, and
rather closely studded with sub-hyaline or transparent spots, which
are minutely speckled with black: those on the anterior wings are
somewhat sagittate and disposed into two irregular bands towards
the exterior half of the wings: those on the posterior wings are
rather larger and more inclining to an ovate form; and three of the
largest, namely, one at the base, and two at the anal angle, are of a
bright yellow colour. The inner limb of the wing is grey inclining to
yellowish. The head and thorax are black; the abdomen black with
the sides pale yellow. The spots being semitransparent the
appearance on the underside in a great degree corresponds with
that above: there is a small difference, because instead of one
yellowish spot at the base of the posterior wing, there are two,
another smaller than that which appears at the base of that wing on
the upper surface being situated below it. We have been more
minute in the description of these spots, because upon an attentive
comparison of the insect in Mr. Jones’s Cabinet, with the Fabrician
description, we perceive some small deficiency in the latter, a
circumstance, it must be confessed, of rare occurrence in this author,
but unquestionably worthy of our notice and correction, as it is the
only authority upon which the species must in future rest.
The country of this interesting insect is unknown; it is remotely
conjectured only that it may be Africa. The insect is represented with
its wings expanded upon a sprig of
ERICA PARMENTARIA,
an elegant vegetable production of the Cape of Good Hope.
36
PLATE XXXVI.
Univalve.
GENERIC CHARACTER.
Animal a Limax. Linn.[28] Shell univalve, spiral, gibbous, flattish at
the bottom: aperture semi-orbicular and semi-lunar, pillar lip
transversely truncated.
*** Perforated with the lips denticulated.
SPECIFIC CHARACTER
AND
SYNONYMS.
Shell thick, glabrous, variously coloured, crown obliterated: lip
toothed each side.
* Var. Variegated with white, red, and black.
Nerita Polita: testa crossâ, glabrâ, colore variâ vertice obliterato,
labio utroque dentato.
* Ex albo rubro nigroque variegata.
Nerita Polita: testa lævi: vertice obliterato, labio utroque dentato.
Linn. Mus. Lud. Ulr. 678. n. 392.
Linn. Syst. Nat. edit. 12. 2. 1254. 731.
Gmel. Linn. Syst. 6. 3680. 43.
Nerita Polita. Chemn. 5. t. 193. f. 200. 2014.
Rumpf. Mus. t. 22. fig. 1. k.
Argenv. Conch. t. 7. f. k.
Seba Mus. 3. t. 38. f. 56.
Lamarck T. 6. p. 2. 192. 7.
END OF VOL. I.
7. This article is thus described in the last day’s sale, lot 81, “An
elegant and unique pink variety of the imperial sun, drawn up with
the anchor of a ship, from the depth of sixty fathoms, in Cook’s
Straits, New Zealand.” Sold for £24 3s.
14. The Hindoos entertain the belief of a general deluge, not very
dissimilar to that of the Mosaic records. They admit, however, many
such catastrophes of the earth, and subsequent renovations through
the creative power of this attribute of Brahma, which they
denominate Vishnu. The Chank Shell refers to a deluge of the earth,
anterior to that which seems to accord with the sacred writ. The
deliverance of the earth from the Mosaic deluge they term the lotos
creation, the type of which is the expanded flower of the lotos, the
indian pedma emerging above the surface of the waters with Vishnu
seated in its centre.
15. Were it requisite to treat more amply upon this subject, it
would be in our power to produce abundant evidence of the
prevalence of this symbol of the sacred Volute, wherever Vishnu or
his delegated power appears. The rich repository of the India House,
the British Museum, and many private collections afford us some
examples of the most interesting kind. Some few of these are so
immediately connected with the object of our enquiry, that we feel
persuaded no apology will be necessary for their introduction.
In the collection of Lord Valentia is a four-sided cast in brass,
resembling a kind of pyramid, consisting of three low platforms,
each bearing idols, and surmounted at the summit by a tortoise. In
several Indian paintings mythologically adverting to the subject of
the creation, the tortoise is represented raising the new-born earth
upon its back above the waters, and it is usually seen in other
mythological paintings of the same subject bearing the throne upon
which Vishnu is seated, while the attendants, personified by various
beings, are lifting the earth from the deep. Such a painting was once
in the celebrated collection of Colonel Stuart: and we need no other
evidence to shew that the bronze of Lord Valentia’s collection is of
the same mythological nature, and referable to the deluge, than to
observe the Chank Shell placed at each of the four corners of the
ornament. We may comprehend the allusion of the tortoise raising
the earth from the waters of the deluge, from a trait of the ancient
Chinese astronomy; by the tortoise bearing the earth, they intended
the north pole of the ecliptic, which, at the time of the deluge, they
maintained had not materially changed its position, and that by this
means the world was sustained and saved from utter annihilation.
An Indian painting, mentioned by Mr. Edward Moor, the author of
the Hindoo Pantheon, presents us with another deity, Sivi, who holds
the Chank Shell in one of his four hands, and the antelope (moon) in
another.
There is also an Indian painting of Devi, who appears holding a
Chank Shell, furnished on each side with a lateral lappit or wing: this
symbol he holds in one hand, and the wheel, the emblem of the
Welcome to our website – the perfect destination for book lovers and
knowledge seekers. We believe that every book holds a new world,
offering opportunities for learning, discovery, and personal growth.
That’s why we are dedicated to bringing you a diverse collection of
books, ranging from classic literature and specialized publications to
self-development guides and children's books.
ebookmasss.com