Linux Debugging Dissasseblining Reversing

Contents
Preface
About the Author
Chapter x64.1: Memory, Registers, and Simple Arithmetic
	Memory and Registers inside an Idealized Computer
	Memory and Registers inside Intel 64-bit PC
	“Arithmetic” Project: Memory Layout and Registers
	“Arithmetic” Project: A Computer Program
	“Arithmetic” Project: Assigning Numbers to Memory Locations
	Assigning Numbers to Registers
	“Arithmetic” Project: Adding Numbers to Memory Cells
	Incrementing/Decrementing Numbers in Memory and Registers
	Multiplying Numbers
Chapter x64.2: Code Optimization
	“Arithmetic” Project: C/C++ Program
	Downloading GDB
	GDB Disassembly Output – No Optimization
	GDB Disassembly Output – Optimization
Chapter x64.3: Number Representations
	Numbers and Their Representations
	Decimal Representation (Base Ten)
	Ternary Representation (Base Three)
	Binary Representation (Base Two)
	Hexadecimal Representation (Base Sixteen)
	Why are Hexadecimals used?
Chapter x64.4: Pointers
	A Definition
	“Pointers” Project: Memory Layout and Registers
	“Pointers” Project: Calculations
	Using Pointers to Assign Numbers to Memory Cells
	Adding Numbers Using Pointers
	Incrementing Numbers Using Pointers
	Multiplying Numbers Using Pointers
Chapter x64.5: Bytes, Words, Double, and Quad Words
	Using Hexadecimal Numbers
	Byte Granularity
	Bit Granularity
	Memory Layout
Chapter x64.6: Pointers to Memory
	Pointers Revisited
	Addressing Types
	Registers Revisited
	NULL Pointers
	Invalid Pointers
	Variables as Pointers
	Pointer Initialization
	Initialized and Uninitialized Data
	More Pseudo Notation
	“MemoryPointers” Project: Memory Layout
Chapter x64.7: Logical Instructions and RIP
	Instruction Format
	Logical Shift Instructions
	Logical Operations
	Zeroing Memory or Registers
	Instruction Pointer
	Code Section
Chapter x64.8: Reconstructing a Program with Pointers
	Example of Disassembly Output: No Optimization
	Reconstructing C/C++ Code: Part 1
	Reconstructing C/C++ Code: Part 2
	Reconstructing C/C++ Code: Part 3
	Reconstructing C/C++ Code: C/C++ program
	Example of Disassembly Output: Optimized Program
Chapter x64.9: Memory and Stacks
	Stack: A Definition
	Stack Implementation in Memory
	Things to Remember
	PUSH Instruction
	POP instruction
	Register Review
	Application Memory Simplified
	Stack Overflow
	Jumps
	Calls
	Call Stack
	Exploring Stack in GDB
Chapter x64.10: Frame Pointer and Local Variables
	Stack Usage
	Register Review
	Addressing Array Elements
	Stack Structure (No Function Parameters)
	Function Prolog
	Raw Stack (No Local Variables and Function Parameters)
	Function Epilog
	“Local Variables” Project
	Disassembly of Optimized Executable
Chapter x64.11: Function Parameters
	“FunctionParameters” Project
	Stack Structure
	Function Prolog and Epilog
	Project Disassembled Code with Comments
	Parameter Mismatch Problem
Chapter x64.12: More Instructions
	CPU Flags Register
	The Fast Way to Fill Memory
	Testing for 0
	TEST - Logical Compare
	CMP – Compare Two Operands
	TEST or CMP?
	Conditional Jumps
	The Structure of Registers
	Function Return Value
	Using Byte Registers
Chapter x64.13: Function Pointer Parameters
	“FunctionPointerParameters” Project
	Commented Disassembly
Chapter x64.14: Summary of Code Disassembly Patterns
	Function Prolog / Epilog
	LEA (Load Effective Address)
	Passing Parameters
	Accessing Parameters and Local Variables