Complete Download Foundations of Linux Debugging, Disassembling, and Reversing: Analyze Binary Code, Understand Stack Memory Usage, and Reconstruct C/C++ Code with Intel x64 1st Edition Dmitry Vostokov PDF All Chapters
Complete Download Foundations of Linux Debugging, Disassembling, and Reversing: Analyze Binary Code, Understand Stack Memory Usage, and Reconstruct C/C++ Code with Intel x64 1st Edition Dmitry Vostokov PDF All Chapters
com
OR CLICK HERE
DOWLOAD NOW
https://ebookmeta.com/product/accelerated-linux-core-dump-analysis-
third-edition-dmitry-vostokov/
ebookmeta.com
https://ebookmeta.com/product/the-archive-project-archival-research-
in-the-social-sciences-1st-edition-niamh-moore/
ebookmeta.com
The Silver Crown: An Alien Sci-Fi Harem Adventure (The
Makalang Book 8) 1st Edition Michael Dalton
https://ebookmeta.com/product/the-silver-crown-an-alien-sci-fi-harem-
adventure-the-makalang-book-8-1st-edition-michael-dalton-2/
ebookmeta.com
https://ebookmeta.com/product/love-unfuked-1st-edition-gary-john-
bishop/
ebookmeta.com
https://ebookmeta.com/product/developing-hospitality-properties-and-
facilities-3rd-edition-developing-hospitality-properties-and-
facilities/
ebookmeta.com
https://ebookmeta.com/product/managerial-economics-12th-edition-
christopher-thomas/
ebookmeta.com
Special Delivery Friends to Lovers Love After Romance
Divorce Romance Forever Stamps Book 3 1st Edition Piper
Cook
https://ebookmeta.com/product/special-delivery-friends-to-lovers-love-
after-romance-divorce-romance-forever-stamps-book-3-1st-edition-piper-
cook/
ebookmeta.com
Foundations of Linux
Debugging, Disassembling,
and Reversing
Analyze Binary Code, Understand
Stack Memory Usage, and Reconstruct
C/C++ Code with Intel x64
—
Dmitry Vostokov
Foundations of Linux
Debugging,
Disassembling, and
Reversing
Analyze Binary Code,
Understand Stack Memory
Usage, and Reconstruct C/C++
Code with Intel x64
Dmitry Vostokov
Foundations of Linux Debugging, Disassembling, and Reversing: Analyze
Binary Code, Understand Stack Memory Usage, and Reconstruct C/C++
Code with Intel x64
Dmitry Vostokov
Dublin, Ireland
Preface����������������������������������������������������������������������������������������������xiii
iii
Table of Contents
Chapter 4: Pointers�����������������������������������������������������������������������������33
A Definition���������������������������������������������������������������������������������������������������������33
“Pointers” Project: Memory Layout and Registers����������������������������������������������34
“Pointers” Project: Calculations��������������������������������������������������������������������������36
Using Pointers to Assign Numbers to Memory Cells�������������������������������������������36
Adding Numbers Using Pointers�������������������������������������������������������������������������42
Incrementing Numbers Using Pointers���������������������������������������������������������������45
Multiplying Numbers Using Pointers�������������������������������������������������������������������48
Summary������������������������������������������������������������������������������������������������������������51
iv
Table of Contents
Registers Revisited���������������������������������������������������������������������������������������������65
NULL Pointers�����������������������������������������������������������������������������������������������������65
Invalid Pointers���������������������������������������������������������������������������������������������������65
Variables As Pointers������������������������������������������������������������������������������������������66
Pointer Initialization��������������������������������������������������������������������������������������������67
Initialized and Uninitialized Data�������������������������������������������������������������������������67
More Pseudo Notation�����������������������������������������������������������������������������������������68
“MemoryPointers” Project: Memory Layout�������������������������������������������������������68
Summary������������������������������������������������������������������������������������������������������������79
v
Table of Contents
vi
Table of Contents
vii
Table of Contents
Index�������������������������������������������������������������������������������������������������167
viii
About the Author
Dmitry Vostokov is an internationally
recognized expert, speaker, educator, scientist,
and author. He is the founder of the pattern-
oriented software diagnostics, forensics,
and prognostics discipline and Software
Diagnostics Institute (DA+TA: DumpAnalysis.
org + TraceAnalysis.org). Vostokov has also
authored more than 50 books on software
diagnostics, anomaly detection and analysis,
software and memory forensics, root cause analysis and problem solving,
memory dump analysis, debugging, software trace and log analysis,
reverse engineering, and malware analysis. He has more than 25 years
of experience in software architecture, design, development, and
maintenance in various industries, including leadership, technical, and
people management roles. Dmitry also founded Syndromatix, Anolog.
io, BriteTrace, DiaThings, Logtellect, OpenTask Iterative and Incremental
Publishing (OpenTask.com), Software Diagnostics Technology and
Services (former Memory Dump Analysis Services; PatternDiagnostics.
com), and Software Prognostics. In his spare time, he presents various
topics on Debugging TV and explores Software Narratology, its further
development as Narratology of Things and Diagnostics of Things (DoT),
and Software Pathology. His current areas of interest are theoretical
software diagnostics and its mathematical and computer science
foundations, application of artificial intelligence, machine learning and
ix
About the Author
x
About the Technical Reviewer
Vikas Talan is a senior engineer at Qualcomm
(an American multinational corporation). He is
the founder of S.M.A.R.T Solutions, a technical
company. He also worked at MediaTek and
Cadence in core technical domains. He has
in-depth experience in Linux kernel
programming, Linux device drivers, ARM 64,
ARM, and porting of Android OS and Linux
drivers on chipsets. He hails from Delhi
NCR, India.
xi
Preface
The book covers topics ranging from Intel x64 assembly language
instructions and writing programs in assembly language to pointers, live
debugging, and static binary analysis of compiled C and C++ code.
Diagnostics of core memory dumps, live and postmortem debugging
of Linux applications, services, and systems, memory forensics, malware,
and vulnerability analysis require an understanding of x64 Intel assembly
language and how C and C++ compilers generate code, including
memory layout and pointers. This book is about background knowledge
and practical foundations that are needed to understand internal Linux
program structure and behavior, start working with the GDB debugger, and
use it for disassembly and reversing. It consists of practical step-by-step
exercises of increasing complexity with explanations and many diagrams,
including some necessary background topics.
By the end of the book, you will have a solid understanding of how
Linux C and C++ compilers generate binary code. In addition, you will be
able to analyze such code confidently, understand stack memory usage,
and reconstruct original C/C++ code.
The book will be useful for
• Software testers
xiii
Preface
This book can also be used as an x64 assembly language and Linux
debugging supplement for relevant undergraduate-level courses.
Source Code
All source code used in this book can be downloaded from github.com/
apress/linux-debugging-disassembling-reversing.
xiv
CHAPTER 1
Memory, Registers,
and Simple Arithmetic
emory and Registers Inside
M
an Idealized Computer
Computer memory consists of a sequence of memory cells, and each cell
has a unique address (location). Every cell contains a “number.” We refer
to these “numbers” as contents at addresses (locations). Because memory
access is slower than arithmetic instructions, there are so-called registers
to speed up complex operations that require memory to store temporary
results. We can also think about them as stand-alone memory cells. The
name of a register is its address. Figure 1-1 illustrates this concept.
Fig. 564
End-to-end union of intestine by means of the Murphy button: the two portions of
the Murphy button, held in position by purse-string sutures, are ready to be
pressed together. (Richardson.)
Fig. 572
The underlying principle of the Murphy button is that each half can
be inserted separately and that then, by pressing these halves
together, an opening is at once afforded from one part of the bowel
to the other. If the halves be pressed together with the proper
degree of firmness they produce, first, adhesion between
considerable areas around their circumference, followed in the
course of a few days by a necrosis of the central portion, which
sloughs because deprived of its circulation by the pressure. So soon
as this separation or sloughing is complete the button drops into the
intestinal canal, being completely loosened, and is now carried along
by peristalsis and by the fecal current from above, its position
shifting as would that of a scybalous mass or a fecal concretion, until
it finally emerges from the intestinal tube, being passed from the
anus. How soon it will thus appear will depend in large measure
upon the point of the intestinal canal into which it is thus intruded. If
this be high up it will be slower in appearing. If low down it may be
expected sooner. While it usually appears within ten days or two
weeks it may, however, be longer retained, and in one case of my
own was not passed for three months, although the anastomosis
was made with the ascending colon, into which it must have
dropped.
Fig. 573 shows one of the halves held in the grasp of a forceps,
being inserted into a small buttonhole opening just large enough to
receive it, around which there has been passed a buttonhole or
purse-string suture of silk. This portion once thus inserted should not
be lost within the bowel, it being necessary to retain control of it by
the forceps until its application to the other half. Both halves being
inserted and brought opposite to each other, as in Fig. 574, the
smaller is introduced into the larger, and they are then pressed
together until the included serous surfaces are brought into contact,
with sufficient pressure inflicted to bleach them, in order that their
subsequent necrosis may be ensured. A circular row of sutures
should now be placed around the surfaces thus applied, in order to
more widely secure them in contact. The procedure being completed
in this way, the parts are dropped back into the abdomen and the
abdominal wound closed.
Fig. 573
Intestinal anastomosis with a Murphy button, showing the halves in position ready
to be pushed together. (Bergmann.)