Foundations of Linux Debugging Disassembling and Reversing Analyze Binary Code Understand Stack Memory Usage and Reconstruct CC Code With Intel X64 1st Edition Dmitry Vostokov PDF Download
Foundations of Linux Debugging Disassembling and Reversing Analyze Binary Code Understand Stack Memory Usage and Reconstruct CC Code With Intel X64 1st Edition Dmitry Vostokov PDF Download
https://ebookbell.com/product/foundations-of-arm64-linux-debugging-
disassembling-and-reversing-analyze-code-understand-stack-memory-
usage-and-reconstruct-original-cc-code-with-arm64-1st-edition-dmitry-
vostokov-47632832
https://ebookbell.com/product/foundations-of-centos-linux-enterprise-
linux-on-the-cheap-chivas-sicam-ryan-baclit-peter-membrey-john-
newbigin-43788600
https://ebookbell.com/product/practicing-medicine-without-a-license-
the-story-of-the-linus-pauling-therapy-for-heart-disease-second-
edition-pauling-therapy-handbook-book-1-2nd-edition-owen-
fonorow-11379384
https://ebookbell.com/product/foundations-of-scalable-systems-
designing-distributed-architectures-1st-edition-ian-gorton-44887562
Foundations Of Software Science And Computation Structures 25th
International Conference Fossacs 2022 Held As Part Of The European
Joint Conferences On Theory And Practice Of Software Etaps 2022 Munich
Germany April 27 2022 Proceedings Patricia Bouyer
https://ebookbell.com/product/foundations-of-software-science-and-
computation-structures-25th-international-conference-
fossacs-2022-held-as-part-of-the-european-joint-conferences-on-theory-
and-practice-of-software-etaps-2022-munich-germany-
april-27-2022-proceedings-patricia-bouyer-44887776
https://ebookbell.com/product/foundations-of-software-science-and-
computation-structures-24th-international-conference-stefan-
kiefer-44887782
https://ebookbell.com/product/foundations-of-marketing-9th-william-m-
pride-o-c-ferrell-44954530
https://ebookbell.com/product/foundations-of-rural-public-health-in-
america-joseph-n-inungu-44963066
https://ebookbell.com/product/foundations-of-marketing-9e-9th-edition-
william-m-pride-o-c-ferrell-44975342
Foundations of Linux
Debugging, Disassembling,
and Reversing
Analyze Binary Code, Understand
Stack Memory Usage, and Reconstruct
C/C++ Code with Intel x64
—
Dmitry Vostokov
Foundations of Linux
Debugging,
Disassembling, and
Reversing
Analyze Binary Code,
Understand Stack Memory
Usage, and Reconstruct C/C++
Code with Intel x64
Dmitry Vostokov
Foundations of Linux Debugging, Disassembling, and Reversing: Analyze
Binary Code, Understand Stack Memory Usage, and Reconstruct C/C++
Code with Intel x64
Dmitry Vostokov
Dublin, Ireland
Preface����������������������������������������������������������������������������������������������xiii
iii
Table of Contents
Chapter 4: Pointers�����������������������������������������������������������������������������33
A Definition���������������������������������������������������������������������������������������������������������33
“Pointers” Project: Memory Layout and Registers����������������������������������������������34
“Pointers” Project: Calculations��������������������������������������������������������������������������36
Using Pointers to Assign Numbers to Memory Cells�������������������������������������������36
Adding Numbers Using Pointers�������������������������������������������������������������������������42
Incrementing Numbers Using Pointers���������������������������������������������������������������45
Multiplying Numbers Using Pointers�������������������������������������������������������������������48
Summary������������������������������������������������������������������������������������������������������������51
iv
Table of Contents
Registers Revisited���������������������������������������������������������������������������������������������65
NULL Pointers�����������������������������������������������������������������������������������������������������65
Invalid Pointers���������������������������������������������������������������������������������������������������65
Variables As Pointers������������������������������������������������������������������������������������������66
Pointer Initialization��������������������������������������������������������������������������������������������67
Initialized and Uninitialized Data�������������������������������������������������������������������������67
More Pseudo Notation�����������������������������������������������������������������������������������������68
“MemoryPointers” Project: Memory Layout�������������������������������������������������������68
Summary������������������������������������������������������������������������������������������������������������79
v
Table of Contents
vi
Table of Contents
vii
Table of Contents
Index�������������������������������������������������������������������������������������������������167
viii
About the Author
Dmitry Vostokov is an internationally
recognized expert, speaker, educator, scientist,
and author. He is the founder of the pattern-
oriented software diagnostics, forensics,
and prognostics discipline and Software
Diagnostics Institute (DA+TA: DumpAnalysis.
org + TraceAnalysis.org). Vostokov has also
authored more than 50 books on software
diagnostics, anomaly detection and analysis,
software and memory forensics, root cause analysis and problem solving,
memory dump analysis, debugging, software trace and log analysis,
reverse engineering, and malware analysis. He has more than 25 years
of experience in software architecture, design, development, and
maintenance in various industries, including leadership, technical, and
people management roles. Dmitry also founded Syndromatix, Anolog.
io, BriteTrace, DiaThings, Logtellect, OpenTask Iterative and Incremental
Publishing (OpenTask.com), Software Diagnostics Technology and
Services (former Memory Dump Analysis Services; PatternDiagnostics.
com), and Software Prognostics. In his spare time, he presents various
topics on Debugging TV and explores Software Narratology, its further
development as Narratology of Things and Diagnostics of Things (DoT),
and Software Pathology. His current areas of interest are theoretical
software diagnostics and its mathematical and computer science
foundations, application of artificial intelligence, machine learning and
ix
About the Author
x
About the Technical Reviewer
Vikas Talan is a senior engineer at Qualcomm
(an American multinational corporation). He is
the founder of S.M.A.R.T Solutions, a technical
company. He also worked at MediaTek and
Cadence in core technical domains. He has
in-depth experience in Linux kernel
programming, Linux device drivers, ARM 64,
ARM, and porting of Android OS and Linux
drivers on chipsets. He hails from Delhi
NCR, India.
xi
Preface
The book covers topics ranging from Intel x64 assembly language
instructions and writing programs in assembly language to pointers, live
debugging, and static binary analysis of compiled C and C++ code.
Diagnostics of core memory dumps, live and postmortem debugging
of Linux applications, services, and systems, memory forensics, malware,
and vulnerability analysis require an understanding of x64 Intel assembly
language and how C and C++ compilers generate code, including
memory layout and pointers. This book is about background knowledge
and practical foundations that are needed to understand internal Linux
program structure and behavior, start working with the GDB debugger, and
use it for disassembly and reversing. It consists of practical step-by-step
exercises of increasing complexity with explanations and many diagrams,
including some necessary background topics.
By the end of the book, you will have a solid understanding of how
Linux C and C++ compilers generate binary code. In addition, you will be
able to analyze such code confidently, understand stack memory usage,
and reconstruct original C/C++ code.
The book will be useful for
• Software testers
xiii
Preface
This book can also be used as an x64 assembly language and Linux
debugging supplement for relevant undergraduate-level courses.
Source Code
All source code used in this book can be downloaded from github.com/
apress/linux-debugging-disassembling-reversing.
xiv
CHAPTER 1
Memory, Registers,
and Simple Arithmetic
emory and Registers Inside
M
an Idealized Computer
Computer memory consists of a sequence of memory cells, and each cell
has a unique address (location). Every cell contains a “number.” We refer
to these “numbers” as contents at addresses (locations). Because memory
access is slower than arithmetic instructions, there are so-called registers
to speed up complex operations that require memory to store temporary
results. We can also think about them as stand-alone memory cells. The
name of a register is its address. Figure 1-1 illustrates this concept.
2
Chapter 1 Memory, Registers, and Simple Arithmetic
3
Chapter 1 Memory, Registers, and Simple Arithmetic
static int a, b;
4
Chapter 1 Memory, Registers, and Simple Arithmetic
5
Random documents with unrelated
content Scribd suggests to you:
possessed by the late Mr. Martindale is bequeathed to
me by an error; and therefore I must positively, though
respectfully, decline accepting more than the devisor
apprehended he had bequeathed to me.
“I have written on the same subject, and to the
same purpose, to Signora Rivolta; and I wait to know
hers and your lordship’s will and pleasure concerning
the matter in question.
“I have the honor to be, &c.”
When the above letter arrived at Trimmerstone, his lordship was
busily engaged in inspecting the progress of the operatives at the
old hall.
Part of the building had been promptly made fit for his lordship’s
residence; and as his establishment was now very small, he was not
reluctant to use the contracted residence assigned to him. We have
already intimated that the Earl of Trimmerstone was depressed in
spirits: it is indeed very natural that he should be. The life which he
had led, the companions with whom he had associated, the
disappointments which he had experienced, his foolish marriage, the
disgraceful conduct of his silly countess, the taunts and reproaches
of his opulent relative, the weariness and disgust that he felt in
having nothing to do, and the annoyance of an empty title, which
merely mocked him with the epithet of Right Honorable, all these
things combined to render him almost disgusted with, and weary of
life.
In this humor he went to Trimmerstone, and took up his abode at
the miserable old hall. The gloom of the building was quite in unison
with the feelings of his mind, and he very contentedly set himself
down to lament over the vanity of life, and to make amends for his
past transgressions by growling right surlily at the sins of others. His
solitude was soon invaded by a visit from the rector of
Trimmerstone, who was rather fanatical in his theology, and finical in
attire and address. Neither of these qualities were, in the first
instance, agreeable to his lordship; but the Rev. Marmaduke Sprout
had the capacity for flattery in a very high degree. He could
presently render himself agreeable to any person of exalted rank by
his very courteous and conciliating demeanour; and he possessed a
peculiar softness and gentleness of manner, with which indeed the
Earl of Trimmerstone would, in his past days of cock-fighting, horse-
racing, and boxing, have been thoroughly disgusted. But his lordship
was quite an altered man. He did not exactly know what was the
matter with himself, till Mr. Sprout introduced to his fretful and
fidgetty lordship the subject of fanaticism. That became an excellent
antistagnator, and set all his fancies and vagaries at work in quite an
opposite direction to that which they had hitherto taken. Formerly,
the lowest pursuits under the name of sport or fancy had been
agreeable to his lordship; and every species of religious sentiment
he had regarded with the profoundest contempt and the most
unmingled abhorrence. But now he was sick, and weary of all these
things; and because one extreme was purely offensive and
wearisome, he took it for granted that the opposite must be truly
delightful and highly consistent, and so under the tuition of Mr.
Sprout, he changed and reversed all his habits, good, bad, and
indifferent. From staking thousands at a horse-race, he turned up his
eyes at the grievous abomination of half-crown whist; and, indeed,
had he been disposed to card-playing, he could not have indulged
himself at Trimmerstone, for Mr. Sprout had banished almost all
card-playing from the place, so that there was not a pack of cards in
the parish, except two or three mutilated well-thumbed packs of
quadrille-cards, which were still used by a knot of antiquated
spinsters worthy of the good old days of Sacheverel and High
Church. Quadrille-cards will not do for whist, for all the eights, nines
and tens are thrown out. Formerly, Lord Trimmerstone used to be
proud of giving some of his acquaintance a sumptuous dinner; but
now he had changed all that, and he only kept one female cook,
who could just manage to make a comfortable and snug little dish or
two for his lordship’s own self, occasionally assisted by the Rev. Mr.
Sprout. Formerly, his lordship had been disposed to be lively, and
oftentimes facetious; but now he was prodigiously grave, and almost
sulky. Formerly, his lordship never went to church; now he went
twice every Sunday, and said Amen as loud as the clerk, and with
much more solemnity, for the clerk did not turn up his eyes for fear
of losing the place. Formerly, his lordship had been very candid; now
he had become exceedingly censorious, and he seemed to measure
his religion by the severity with which he reproved transgressors. His
lordship several times attempted to make all the inhabitants of
Trimmerstone go to church twice every Sunday, except his own
cook. But in this his lordship could not succeed, and indeed it was
well for him that he could not; for if he had, the church would have
been so crowded that he could not have enjoyed a great, large,
lined, stuffed, padded, carpeted pew for himself.
Though Lord Trimmerstone was a zealous convert to Mr. Sprout’s
theory of the national religion, yet that theory was not quite obvious
and distinct to his lordship’s apprehension; and often did he blunder
in the enunciation of his theory, and awkwardly did he sometimes
express himself when he thought he was contending for the truth:
for he has been known to rebuke the unepiscopal worshippers in
barns and outhouses for holding the pestilential doctrines of election
and predestination. This was pardonable in a young beginner; but
Mr. Sprout set him right, and showed that the doctrines of
predestination and election had been sometimes erroneously
apprehended to mean predestination and election, whereas the
proper view of the subject was that they meant election and
predestination.
That part of fanaticism which consists in gloominess and
moroseness, his lordship could manage to admiration; for he was
thoroughly disgusted with every thing and every body. We cannot
resist the inclination to observe in this part of our narrative, how
very just and appropriate a punishment is fanaticism for gross
immorality. When the mind has spurned the meeker and gentler
bonds of religious principle and conscientious thought, it is rightly
punished by the withering rigors of fanaticism, and the gloomy
terrors of superstition. Under these influences was now lying the Earl
of Trimmerstone. And he was engaged in conversation with the Rev.
Marmaduke Sprout, when there was delivered into his lordship’s
hands the above-mentioned letter of Horatio Markham.
His lordship made the apology usual on such occasions, and
forthwith opened and read Markham’s letter. As soon as the reading
was finished, his lordship said, “This is very honorable conduct in Mr.
Markham.”
Then handing the letter to Mr. Sprout, he said, “Read this letter,
sir, and let me have your advice, how I ought to act under present
circumstances.”
The reverend gentleman took the letter bowing, and perused it
with great attention, and returned to his lordship with another bow,
and a smile of satisfaction at being let into a great man’s confidence;
and said,
“Really, my lord, I hardly know how to advise. Cases do
sometimes occur in which there is a great deal of difficulty, and this
appears to me to be one of them.”
By this speech, though delivered with the solemnity of an oracle,
very little information was communicated to his lordship. When
people ask for advice, they should, in order to save their friends a
great deal of trouble, state explicitly what sort of advice they wish to
have. It is for want of this honesty and explicitness that so much
good advice is continually thrown away.
His lordship was now fairly puzzled and perplexed. It was
necessary to send some answer to the communication of Markham;
and his lordship had discernment enough to perceive that this
gentleman was truly a scrupulous and conscientious man. The
present transaction proved that fact abundantly. For nine hundred
and ninety-nine persons out of a thousand would, without much if
any hesitation, have accepted the legacy in question. That feeling in
Markham, to which some persons might be inclined to give the name
of moral prudery, prevented him from availing himself of a decided
error; and on the other hand, his dislike of ostentatious magnanimity
and heroics placed him in an unpleasant situation in making an offer
of surrendering the legacy.
Notwithstanding the various lectures and the great and clear
information which Mr. Sprout had communicated to Lord
Trimmerstone, concerning those views of religion most suitable to
fanaticism, his lordship was but imperfectly initiated: therefore,
when he had read Markham’s letter, and handed it over to Mr. Sprout
for his perusal also, his lordship could not help observing,
“This is really very meritorious conduct in Mr. Markham, there is
not one man in a thousand who would have acted thus under these
circumstances.”
To this Mr. Sprout very seriously and solemnly replied, “Your
lordship will excuse me, but I must observe that there is nothing
meritorious in human actions.”
“Mr. Sprout,” said his lordship, “I will not contend with you for a
word; but you must grant, that notwithstanding the supreme
importance of faith, which I am quite ready to allow, there is a great
difference in human actions, and that some conduct is better than
other. There are multitudes who have not faith who frequently
perform virtuous actions, and live according to the principles of
morality.”
The clergyman shook his head, and said, “Mere heathen morality.”
“And that,” replied Lord Trimmerstone, “is better than no morality
at all.”
It could not be entertaining to our readers to pursue the long and
elaborate arguments by which the rector of Trimmerstone attempted
to prove that virtue was of no value but of great importance. We
therefore proceed with our narrative.
When the discussion was concluded, and his lordship was
abundantly convinced that he knew nothing about the matter, he
directed his thoughts to the subject of Markham’s letter: and as the
divine had given all the advice upon the business which he was able
to give, he took his leave; and the Earl of Trimmerstone remained
alone to consult with his own thoughts.
All that his lordship could think was, that this conduct of Markham
was very handsome. But that was not enough. It would not be a
very satisfactory answer to Markham should his lordship say merely
that such conduct was very handsome. After much deliberation, his
lordship came to the conclusion, that it would be best to have an
interview with Markham on the subject, and to make inquiry into all
the particulars, resolving to compel the barrister to the acceptance
of as much as he could force upon him.
With this view his lordship sent to Markham an immediate
acknowledgment of the receipt of his communication, proposing at
the same time a meeting with him for the purpose of entering into
the particulars of the affair; for Markham’s letter had not sufficiently
to his lordship’s apprehension explained the cause and nature of the
error in the will.
Markham’s letter to Signora Rivolta received also an immediate
answer, and that answer was decisive. The lady, after complimenting
the barrister for his very honorable conduct, said, that it was quite
out of the question that she or her family could have, according to
the laws of England, any claim whatever on any part of the property,
save that which was literally and expressly bequeathed to them; and
that if any remained unappropriated or unclaimed, the only person
who had aught to do with it must of course be the heir-at-law.
Thus it seemed that the business was brought into a small
compass, resting only between Markham and Lord Trimmerstone.
And though his lordship’s moral susceptibility might not have been
quite so acute and delicate as Markham’s, yet when such an appeal
as this was made to his feelings, he could not but entertain some
thoughts of disinterestedness: for the disinterestedness of the
residuary-legatee was so powerful, as to excite in his lordship’s mind
a degree of sympathy and a corresponding feeling.
CHAPTER XVII.
“He could not do it handsomer than thus.”
Shirley.
Tailor.
Tuke.
THE END.
LONDON:
PRINTED BY A. J. VALPY, RED LION COURT, FLEET STREET.
INTERESTING WORKS
JUST PUBLISHED BY
HENRY COLBURN, NEW BURLINGTON STREET.
1. ZILLAH; a TALE of the HOLY CITY. By the Author of
“Brambletye-House,” “The Tor Hill,” and “Reuben Apsley.” Second
Edition, in 3 vols. post 8vo. 31s. 6d.
“Viewing it as a work of information on a most interesting subject presented in a
very agreeable form, we recommend its perusal to all persons of leisure. The
religious world especially ought to congratulate themselves on its appearance:
they are usually debarred from the pleasure of reading works of imagination—here
is one which might be preached from the pulpit; it is a “sacred performance,” and
as legitimate in a church, as a piece of Handel or Horsley. It may throw light upon
the Scriptures; it may even make the searching of them a lighter task; while the
most scrupulous reader cannot condemn the author for having rashly or profanely
approached subjects which he might deem could not be handled without impiety
in a work of fiction.”—Spectator.
Shakspeare.
11. The RED ROVER. By the Author of “The Spy,” “The Pilot,”
“The Prairie,” &c. Second Edition, 3 vols. post 8vo. 28s. 6d.
“Another tale of the sea, a companion worthy of the Pilot, and superior to any
description of nautical scenes hitherto laid before the public, not even excepting
those of our own Smollet. Cooper the American novelist has no living superior.”—
Scotsman.
ebookbell.com