a day ago
- Reverse engineering involves taking a binary executable and figuring out its functionality or code structure.
- Memory types in reverse engineering include stack, heap, and static memory, each with different allocation methods.
- The standard library is compiled into programs via a linker; avoiding it can reduce program size.
- Instructions like mov, add, cmp, je, xor, push/pop, call/ret, lea, and nop are fundamental in x86 assembly.
- Control flow constructs such as if/then/else, while loops, for loops, switch statements, and recursion can be identified in assembly by patterns like cmp and conditional jumps.
- Common functions in binaries include strcmp, fwrite, getline, puts, scanf, and strtol, which reveal program interactions.
- Disassembly often shows function prologues (push rbp, mov rsp, rbp) as a way to allocate stack space for local variables.
- Jump tables can be used for implementing switch statements, allowing efficient branching based on an index.
- Recursive functions follow patterns of calling themselves with modified arguments, as seen in assembly with multiple call instructions.
- Reverse engineering tools and techniques allow analysis of both simple and complex binaries, from basic guessing to advanced debugging.