逆向工程入门指南：从C到汇编的解析

需积分: 9 91 浏览量更新于2024-07-18 收藏 1.82MB PDF 举报

"RE4B-EN-lite.pdf 是一本适合新手入门的逆向工程指南，作者 Dennis Yurichev 详细阐述了 C 程序如何转换成汇编语言。该资源受到 Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported License 的保护，并在 beginners.re 网站上提供最新版本和俄语版。此外，还有电子书阅读器版本可供下载，以及作者的 Twitter 账号和邮件订阅列表，以便获取更新信息。封面设计由 Andy Nechaevsky 创作。" 本文档是 Dennis Yurichev 为初学者编写的逆向工程入门教程，它旨在帮助读者理解计算机程序，特别是 C 语言程序在执行时如何被转换成机器可以理解和执行的低级语言——汇编语言。逆向工程是软件安全、漏洞分析和代码优化等领域的重要技能，通过学习逆向工程，开发者能够理解程序内部的工作机制，这对于调试、优化和保护软件都至关重要。教程可能涵盖以下几个关键知识点： 1. **基础知识**：介绍二进制代码、机器指令集和汇编语言的基本概念，以及它们与高级编程语言（如 C）的关系。 2. **编译过程**：解释 C 编译器如何将源代码转化为汇编语言，包括预处理、编译、汇编和链接这些阶段。 3. **反汇编**：探讨如何使用反汇编器将可执行文件中的机器码转换回汇编代码，这对于理解未有源代码的二进制程序特别有用。 4. **寄存器和内存**：讲解 CPU 寄存器的作用以及它们如何与内存交互，这是理解程序执行流程的关键。 5. **控制流**：介绍条件分支、循环和跳转指令，以及如何通过它们来分析程序的逻辑结构。 6. **函数调用**：讲解函数的参数传递方式、调用约定和返回值处理，这些都是逆向分析函数行为的关键。 7. **调试工具**：介绍常用的调试器，如 GDB，以及如何使用它们来单步执行代码、设置断点和查看内存状态。 8. **静态分析**：讲解如何通过静态分析工具来分析未运行的二进制文件，以发现潜在的安全问题或结构信息。 9. **动态分析**：介绍在程序运行时进行分析的技术，如插桩、内存取证和网络监控。 10. **代码保护**：讨论如何通过混淆、加密等技术来保护代码，以及逆向工程师如何绕过这些防护措施。 11. **案例研究**：提供实际的代码示例和练习，帮助读者将理论知识应用到实际逆向工程场景中。 12. **法律与道德**：强调逆向工程的合法用途，例如软件安全研究，并提醒读者尊重版权和隐私。 "RE4B-EN-lite.pdf" 提供了一个全面的起点，引导新手逐步进入逆向工程的世界，通过学习，读者将能够理解和解析程序的底层运作，这对于进一步深入计算机科学的其他领域，如操作系统、网络安全和恶意软件分析，都有着重要的基础作用。

CHAPTER 2. THE SIMPLEST FUNCTION CHAPTER 2. THE SIMPLEST FUNCTION

Chapter 2

The simplest Function

The simplest possible function is arguably one that simply returns a constant value:

Here it is:

Listing 2.1: C/C++ Code

int f()

{

return 123;

};

Lets compile it!

2.1 x86

Here’s what both the optimizing GCC and MSVC compilers produce on the x86 platform:

Listing 2.2: Optimizing GCC/MSVC (assembly output)

mov eax, 123

ret

There are just two instructions: the ﬁrst places the value 123 into the EAX register, which is used by convention for storing

the return value and the second one is RET, which returns execution to the caller.

The caller will take the result from the EAX register.

It is worth noting that MOV is a misleading name for the instruction in both x86 and ARM ISAs.

The data is not in fact moved, but copied.

CHAPTER 3. HELLO, WORLD! CHAPTER 3. HELLO, WORLD!

#include <stdio.h>

const char $SG3830[]="hello, world\n";

int main()

{

printf($SG3830);

return 0;

}

Let’s go back to the assembly listing. As we can see, the string is terminated by a zero byte, which is standard for C/C++

strings.More about C strings: 25.1.1 on page 112.

In the code segment, _TEXT, there is only one function so far: main(). The function main() starts with prologue code

and ends with epilogue code (like almost any function)

After the function prologue we see the call to the printf() function : CALL _printf. Before the call the string address

(or a pointer to it) containing our greeting is placed on the stack with the help of the PUSH instruction.

When the printf() function returns the control to the main() function, the string address (or a pointer to it) is still on

the stack.Since we do not need it anymore, the stack pointer (the ESP register) needs to be corrected.

ADD ESP, 4 means add 4 to the ESP register value. Why 4? Since this is a 32-bit program, we need exactly 4 bytes for

address passing through the stack. If it was x64 code we would need 8 bytes. ADD ESP, 4 is effectively equivalent to

POP register but without using any register

For the same purpose, some compilers (like the Intel C++ Compiler) may emit POP ECX instead of ADD (e.g., such a pattern

can be observed in the Oracle RDBMS code as it is compiled with the Intel C++ compiler). This instruction has almost the

same effect but the ECX register contents will be overwritten. The Intel C++ compiler probably uses POP ECX since this

instruction’s opcode is shorter than ADD ESP, x (1 byte for POP against 3 for ADD).

Here is an example of using POP instead of ADD from Oracle RDBMS:

Listing 3.2: Oracle RDBMS 10.2 Linux (app.o ﬁle)

.text:0800029A push ebx

.text:0800029B call qksfroChild

.text:080002A0 pop ecx

After calling printf(), the original C/C++ code contains the statement return 0 —return 0 as the result of the main()

function. In the generated code this is implemented by the instruction XOR EAX, EAX. XOR is in fact just “eXclusive

OR”

but the compilers often use it instead of MOV EAX, 0— again because it is a slightly shorter opcode (2 bytes for XOR

against 5 for MOV).

Some compilers emit SUB EAX, EAX, which means SUBtract the value in the EAX from the value in EAX, which, in any case,

results in zero.

The last instruction RET returns the control to the caller. Usually, this is C/C++ CRT

code, which, in turn, returns control to

the OS.

3.2 x86-64

3.2.1 MSVC—x86-64

Let’s also try 64-bit MSVC:

Listing 3.3: MSVC 2012 x64

$SG2989 DB 'hello, world', 0AH, 00H

main PROC

sub rsp, 40

lea rcx, OFFSET FLAT:$SG2989

call printf

xor eax, eax

You can read more about it in the section about function prologues and epilogues ( 4 on page 8).

CPU ﬂags, however, are modiﬁed

wikipedia

C runtime library

剩余158页未读，继续阅读

qq_36414764

粉丝: 0
资源: 1

逆向工程入门指南：从C到汇编的解析

re-for-beginners 逆向工程入门指南

Reverse_Engineering_for_Beginners-en.pdf

refman-8.0-en.a4.pdf

RE4B-EN.zip_RE4B-EN_engineering_re4b_reverse engineering_x86 ARM

JEDEC JESD79-4B-2017 DDR4 SDRAM.pdf

基于自适应权重粒子群算法的PSS4B-W参数优化研究.pdf

JESD209-4B-LPDDR4.pdf

初学者逆向工程教程RE4B-EN.pdf

Apollo4B-SDK-2021.03.16

xen-livepatch-build-tools-4.8.4.43.ge52ec4b787-1.el7.x86_64.rpm

最新资源