Scribd
Upload
11 views

Week 4 Lecture PART 1

Uploaded by

karish jey
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
11 views

Week 4 Lecture PART 1

Uploaded by

karish jey
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 19

Week 4 - Lecture (Part 1)

Malware Forensics
C Language
Basic C Program Structure
//Library imports
#include <stdio.h>
// Global variables and function defs.
//main function, where the program starts and runs from
int main() {
// Add functionality e.g., printf
printf( “Hello World\n” );
return 0 ;
}
// function definitions go below main()

// is used for one line comments in C


C Setup and Compiling (Linux)
● sudo apt-get install gcc-multilib
gdb
● vim main.c (enter program)
● gcc -m32 -g main.c
● gdb -q ./a.out
● disassemble /m main
● q (to quit gdb)

Can also disassemble in IDA


C Setup and Compiling (Windows MingW32)

● Install MingW32
● vim main.c (enter program)
● gcc -m32 -g main.c (compile w/ debug)
● gdb -q .\a.exe (debug)
● disassemble /m main (disassemble)
● q (to quit gdb)

Can also disassemble in IDA


GDB and IDA Both Display Assembly

Annotation of disassembly is slightly different though in IDA


Basic C Types
● char – holds characters, 1 byte
● int – holds integers, 4 bytes
● float – holds floating point (decimal), 4 bytes

● Various other types depending on C specification


and type specifiers (short, long, etc.) - these are
not needed here (see recommended book, if
you’re interested).
Basic C Variables
● Variables have two pieces to them
− A value
− Their memory address

● We can access the address with the “address-of”


operator, also called the reference operator
− &
− Goes in front of the variable
Basic C Variables
#include <stdio.h>

int main() {

int mark = 52 ;
printf( "Value: %d\n", mark ) ;
printf( "Address: %p\n", &mark ) ;

return 0 ;

}
Basic C Output
● printf(...) print formatted string
● Simple template language, which allows
variables to copied into the output stream
Basic C Input
● scanf(...) - scan formatted string
● Simple template language, which allows
variables to copied from the output stream
● Use & in front of variables
#include <stdio.h>
int main()
{
int n;
scanf("%d", &n);
printf("%d\n", n);
return 0;
}
Basic C Input
#include <stdio.h>
int main()
{
int n;
scanf("%d", &n) ;
printf("%d\n", n) ;
char str[50] ;
scanf("%s", &str) ;
printf("%s\n", str) ;
return 0;
}
Conditionals in C
> greater than: 5 > 4 is TRUE

< less than: 4 < 5 is TRUE

>= greater than or equal: 4 >= 4 is TRUE

<= less than or equal: 3 <= 4 is TRUE

== equal to: 5 == 5 is TRUE (one = symbol is assignment)


!= not equal: to 5 != 4 is TRUE
if-elseif-else in C
if ( TRUE ) {
/* Execute these statements if TRUE */
}
else {
/* Execute these statements if FALSE */
}
if ( TRUE ) {
/* Execute these statements if TRUE */
}
else if ( TRUE ) {
/* Execute these statements if TRUE if above “if” is not TRUE */
}
else {
/* Executed if no other statement is TRUE */
}
if-else-elseif in C
#include <stdio.h>
int main()
{
int i = 0;
scanf( "%d", &i );
if( i == 10 ) {
printf( "i equals 10\n" ) ;
}
else if ( i == 20 ) {
printf( "i equals 20\n" );
}
else {
printf( "Something else\n" ) ;
}
return 0;
}
for in C
for (initializationStatement; testExpression; updateStatement)
{
// statements inside the body of loop
}

- The initialization statement is executed only once.


- Then, the test expression is evaluated. If the test expression is evaluated
to false, the for loop is terminated.
- However, if the test expression is evaluated to true, statements inside the
body of the for loop are executed, and the update expression is updated.
- Again the test expression is evaluated.

int sum = 1;
for(int i=0; i<5; i=i+1) {
sum = 1 + sum * i ;
}
printf(“sum = %d”, sum);
for in C
#include <stdio.h>
int main()
{

int sum = 1 ;
for( int i = 0 ; i < 5 ; i = i+1 ) {
sum = 1 + sum * i ;
}
printf( "sum = %d" , sum ) ;

return 0;
}
Arrays in C

dataType arrayName[arraySize];
int mark[5];
int mark[5] = {19, 10, 8, 17, 9};
int mark[] = {19, 10, 8, 17, 9};
Arrays I/O in C
#include <stdio.h>
int main() {
int values[5];
// taking input and storing it in an array
for(int i = 0; i < 5; i++) {
scanf("%d", &values[i]);
}
printf("\n");
// printing elements of an array
for(int i = 0; i < 5; i++) {
printf("%d\n", values[i]);
}

return 0 ;
}

You might also like