Foundations of Linux Debugging, Disassembling, and Reversing: Analyze Binary Code, Understand Stack Memory Usage, and Reconstruct C/C++ Code with Intel x64 1st Edition Dmitry Vostokov pdf download
Foundations of Linux Debugging, Disassembling, and Reversing: Analyze Binary Code, Understand Stack Memory Usage, and Reconstruct C/C++ Code with Intel x64 1st Edition Dmitry Vostokov pdf download
https://ebookmeta.com/product/cambridge-igcse-and-o-level-
history-workbook-2c-depth-study-the-united-states-1919-41-2nd-
edition-benjamin-harrison/
https://ebookmeta.com/product/accelerated-linux-core-dump-
analysis-third-edition-dmitry-vostokov/
https://ebookmeta.com/product/the-archive-project-archival-
research-in-the-social-sciences-1st-edition-niamh-moore/
The Silver Crown: An Alien Sci-Fi Harem Adventure (The
Makalang Book 8) 1st Edition Michael Dalton
https://ebookmeta.com/product/the-silver-crown-an-alien-sci-fi-
harem-adventure-the-makalang-book-8-1st-edition-michael-dalton-2/
https://ebookmeta.com/product/love-unfuked-1st-edition-gary-john-
bishop/
https://ebookmeta.com/product/developing-hospitality-properties-
and-facilities-3rd-edition-developing-hospitality-properties-and-
facilities/
https://ebookmeta.com/product/managerial-economics-12th-edition-
christopher-thomas/
Special Delivery Friends to Lovers Love After Romance
Divorce Romance Forever Stamps Book 3 1st Edition
Piper Cook
https://ebookmeta.com/product/special-delivery-friends-to-lovers-
love-after-romance-divorce-romance-forever-stamps-book-3-1st-
edition-piper-cook/
Foundations of Linux
Debugging, Disassembling,
and Reversing
Analyze Binary Code, Understand
Stack Memory Usage, and Reconstruct
C/C++ Code with Intel x64
—
Dmitry Vostokov
Foundations of Linux
Debugging,
Disassembling, and
Reversing
Analyze Binary Code,
Understand Stack Memory
Usage, and Reconstruct C/C++
Code with Intel x64
Dmitry Vostokov
Foundations of Linux Debugging, Disassembling, and Reversing: Analyze
Binary Code, Understand Stack Memory Usage, and Reconstruct C/C++
Code with Intel x64
Dmitry Vostokov
Dublin, Ireland
Preface����������������������������������������������������������������������������������������������xiii
iii
Table of Contents
Chapter 4: Pointers�����������������������������������������������������������������������������33
A Definition���������������������������������������������������������������������������������������������������������33
“Pointers” Project: Memory Layout and Registers����������������������������������������������34
“Pointers” Project: Calculations��������������������������������������������������������������������������36
Using Pointers to Assign Numbers to Memory Cells�������������������������������������������36
Adding Numbers Using Pointers�������������������������������������������������������������������������42
Incrementing Numbers Using Pointers���������������������������������������������������������������45
Multiplying Numbers Using Pointers�������������������������������������������������������������������48
Summary������������������������������������������������������������������������������������������������������������51
iv
Table of Contents
Registers Revisited���������������������������������������������������������������������������������������������65
NULL Pointers�����������������������������������������������������������������������������������������������������65
Invalid Pointers���������������������������������������������������������������������������������������������������65
Variables As Pointers������������������������������������������������������������������������������������������66
Pointer Initialization��������������������������������������������������������������������������������������������67
Initialized and Uninitialized Data�������������������������������������������������������������������������67
More Pseudo Notation�����������������������������������������������������������������������������������������68
“MemoryPointers” Project: Memory Layout�������������������������������������������������������68
Summary������������������������������������������������������������������������������������������������������������79
v
Table of Contents
vi
Table of Contents
vii
Table of Contents
Index�������������������������������������������������������������������������������������������������167
viii
About the Author
Dmitry Vostokov is an internationally
recognized expert, speaker, educator, scientist,
and author. He is the founder of the pattern-
oriented software diagnostics, forensics,
and prognostics discipline and Software
Diagnostics Institute (DA+TA: DumpAnalysis.
org + TraceAnalysis.org). Vostokov has also
authored more than 50 books on software
diagnostics, anomaly detection and analysis,
software and memory forensics, root cause analysis and problem solving,
memory dump analysis, debugging, software trace and log analysis,
reverse engineering, and malware analysis. He has more than 25 years
of experience in software architecture, design, development, and
maintenance in various industries, including leadership, technical, and
people management roles. Dmitry also founded Syndromatix, Anolog.
io, BriteTrace, DiaThings, Logtellect, OpenTask Iterative and Incremental
Publishing (OpenTask.com), Software Diagnostics Technology and
Services (former Memory Dump Analysis Services; PatternDiagnostics.
com), and Software Prognostics. In his spare time, he presents various
topics on Debugging TV and explores Software Narratology, its further
development as Narratology of Things and Diagnostics of Things (DoT),
and Software Pathology. His current areas of interest are theoretical
software diagnostics and its mathematical and computer science
foundations, application of artificial intelligence, machine learning and
ix
About the Author
x
About the Technical Reviewer
Vikas Talan is a senior engineer at Qualcomm
(an American multinational corporation). He is
the founder of S.M.A.R.T Solutions, a technical
company. He also worked at MediaTek and
Cadence in core technical domains. He has
in-depth experience in Linux kernel
programming, Linux device drivers, ARM 64,
ARM, and porting of Android OS and Linux
drivers on chipsets. He hails from Delhi
NCR, India.
xi
Preface
The book covers topics ranging from Intel x64 assembly language
instructions and writing programs in assembly language to pointers, live
debugging, and static binary analysis of compiled C and C++ code.
Diagnostics of core memory dumps, live and postmortem debugging
of Linux applications, services, and systems, memory forensics, malware,
and vulnerability analysis require an understanding of x64 Intel assembly
language and how C and C++ compilers generate code, including
memory layout and pointers. This book is about background knowledge
and practical foundations that are needed to understand internal Linux
program structure and behavior, start working with the GDB debugger, and
use it for disassembly and reversing. It consists of practical step-by-step
exercises of increasing complexity with explanations and many diagrams,
including some necessary background topics.
By the end of the book, you will have a solid understanding of how
Linux C and C++ compilers generate binary code. In addition, you will be
able to analyze such code confidently, understand stack memory usage,
and reconstruct original C/C++ code.
The book will be useful for
• Software testers
xiii
Preface
This book can also be used as an x64 assembly language and Linux
debugging supplement for relevant undergraduate-level courses.
Source Code
All source code used in this book can be downloaded from github.com/
apress/linux-debugging-disassembling-reversing.
xiv
CHAPTER 1
Memory, Registers,
and Simple Arithmetic
emory and Registers Inside
M
an Idealized Computer
Computer memory consists of a sequence of memory cells, and each cell
has a unique address (location). Every cell contains a “number.” We refer
to these “numbers” as contents at addresses (locations). Because memory
access is slower than arithmetic instructions, there are so-called registers
to speed up complex operations that require memory to store temporary
results. We can also think about them as stand-alone memory cells. The
name of a register is its address. Figure 1-1 illustrates this concept.
+ Am. Hist. R. 11: 907. Jl. ’06. 1270w. (Review of v. 8 and 9.)
“More exact dates would be in some of the chapters desirable.
The volume is quite worthy of recognition as a model history of the
time.” Austin Scott.
+ + –|Am. Hist. R. 11: 916. Jl. ’06. 1910w. (Review of v. 10.)
“The book itself is so sanely written that it seems ungrateful to
call attention to what are very small defects.” Worthington
Chauncey Ford.
+ + – Am. Hist. R. 12: 155. O. ’06. 1300w. (Review of v. 11.)
“Considering the limitations imposed by the nature of the task
assigned to them, the credit of fully maintaining the high standard
set in the preceding volumes of the ‘American nation’ series and of
closely approximating the ideal standard for works of this class
must be accorded both to Professor Channing and to President
Babcock.” Marshall Brown.
+ + – Ann. Am. Acad. 27: 245. Ja. ’06. 720w. (Review of v. 6.)
Reviewed by David Y. Thomas.
+ + Ann. Am. Acad. 27: 251. Ja. ’06. 760w. (Review of v. 10.)
Reviewed by St. George L. Sioussat.
+ + + Dial. 41: 159. S. 16, ’06. 4150w. (Review of v. 8–13.)
“No better introduction to a detailed study of American history
could be desired than these excellent volumes.” H. E. E.
Havell, Ernest Binfield. Benares the sacred city. $3.50. Blackie &
son, London.
These sketches of Hindu life and religion “are not offered as a
contribution to oriental scholarship, or to religious controversy,
but as an attempt, to give an intelligible outline of Hindu ideas and
religious practices, and especially as a presentation of the
imaginative and artistic side of Indian religions, which can be
observed at few places so well as in the sacred city and its
neighborhood—the birthplace of Buddhism and one of the
principal sects of Hinduism.”
“The historian’s tales in this book deal very largely with the
Greek struggle for liberty, and they will prove as helpful and
stimulating as they will fascinating to the children fortunate
enough to enjoy their reading.”
Healy, Most Rev. John. Life and writings of St. Patrick. *$4.50.
Benziger.
“Dr. Healy gives us, from an inside standpoint, a copious and
exhaustive history of Ireland’s Apostle. The present work,
containing over seven hundred and fifty good-sized pages,
embodies everything of value that is known, or probably ever will
be known, on the subject. Its chief excellence is the wealth of
topographical lore which the learned author has brought to his
task.... The narrative of St. Patrick’s journeyings is greatly
enlivened by the Archbishop’s identification of the various places
and landmarks in the modern nomenclature.”—Cath. World.