Gain a solid understanding of how Linux C and C++ compilers generate binary code. This book explains the reversing and binary analysis of ARM64 architecture now used by major Linux cloud providers and covers topics ranging from writing programs in assembly language, live debugging, and static binary analysis of compiled C and C++ code. It is ideal for those working with embedded devices, including mobile phones and tablets.
Using the latest version of Red Hat, you''ll look closely at the foundations of diagnostics of core memory dumps, live and postmortem debugging of Linux applications, services, and systems. You''ll also work with the GDB debugger and use it for disassembly and reversing. This book uses practical step-by-step exercises of increasing complexity with explanations and many diagrams, including some necessary background topics. In addition, you will be able to analyze such code confidently, understand stack memory usage, and reconstruct orig
Table of Contents
Chapter 1 - A64.1: Memory, Registers, and Simple Arithmetic 11
Memory and Registers inside an Idealized Computer 11Memory and Registers inside ARM 64-bit Computer 12“Arithmetic” Project: Memory Layout and Registers 13“Arithmetic” Project: A Computer Program 14“Arithmetic” Project: Assigning Numbers to Memory Locations 15Assigning Numbers to Registers 18“Arithmetic” Project: Adding Numbers to Memory Cells 19Incrementing/Decrementing Numbers in Memory and Registers 22Multiplying Numbers 25
Chapter 2 - A64.2: Code Optimization 29“Arithmetic” Project: C/C++ Program 29Downloading GDB 31GDB Disassembly Output – No Optimization 32GDB Disassembly Output – Optimization 37
Chapter 3 - A64.3: Number Representations 39Numbers and Their Representations 39Decimal Representation (Base Ten) 40Ternary Representation (Base Three) 41Binary Representation (Base Two) 42Hexadecimal Representation (Base Sixteen) 43Why are Hexadecimals Used? 44
Chapter 4 - A64.4: Pointers 47A Definition 47“Pointers” Project: Memory Layout and Registers 48“Pointers” Project: Calculations 50Using Pointers to Assign Numbers to Memory Cells 51Adding Numbers Using Pointers 58Incrementing Numbers Using Pointers 62Multiplying Numbers Using Pointers 65
Chapter 5 - A64.5: Bytes, Half Words, Words, and Double Words 69Using Hexadecimal Numbers 69Byte Granularity 70Bit Granularity 71Memory Layout 72
Chapter 6 - A64.6: Pointers to Memory 75Pointers Revisited 75Addressing Types 76Registers Revisited 81NULL Pointers 82Invalid Pointers 83Variables as Pointers 84Pointer Initialization 85Initialized and Uninitialized Data 86More Pseudo Notation 87“MemoryPointers” Project: Memory Layout 88
Chapter 7 - A64.7: Logical Instructions and PC 99Instruction Format 99Logical Shift Instructions 100Logical Operations 101Zeroing Memory or Registers 102Instruction Pointer 103Code Section 105
Chapter 8 - A64.8: Reconstructing a Program with Pointers 107Example of Disassembly Output: No Optimization 107Reconstructing C/C++ Code: Part 1 110Reconstructing C/C++ Code: Part 2 112Reconstructing C/C++ Code: Part 3 114Reconstructing C/C++ Code: C/C++ program 116Example of Disassembly Output: Optimized Program 117
Chapter 9 - A64.9: Memory and Stacks 119Stack: A Definition 119Stack Implementation in Memory 120Things to Remember 122Stack Push Implementation 123Stack Pop Implementation 124Register Review 125Application Memory Simplified 126Stack Overflow 127Jumps 128Calls 130Call Stack 131Exploring Stack in GDB 133
Chapter 10 - A64.10: Frame Pointer and Local Variables 137Stack Usage 137Register Review 138Addressing Array Elements 139Stack Structure (No Function Parameters) 140Function Prolog 141Raw Stack (No Local Variables and Function Parameters) 142Function Epilog 144“Local Variables” Project 145Disassembly of Optimized Executable 148
Chapter 11- A64.11: Function Parameters 149“FunctionParameters” Project 149Stack Structure 150Function Prolog and Epilog 152Project Disassembled Code with Comments 154Parameter Mismatch Problem 158
Chapter 12 - A64.12: More Instructions 159PSTATE Flags 159Testing for 0 160TST - Logical Compare 161CMP – Compare Two Operands 162TST or CMP? 163Conditional Jumps 164Function Return Value 165
Chapter 13 - A64.13: Function Pointer Parameters 167“FunctionPointerParameters” Project 167Commented Disassembly 168
Chapter 14 - A64.14: Summary of Code Disassembly Patterns 173Function Prolog / Epilog 173ADR (Address) 174Passing Parameters 175Accessing Saved Parameters and Local Variables 176
