CNIT 126: Ch 6: Recognizing C Constructs in Assembly
0 likes362 views
This document discusses recognizing C constructs in assembly code. It explains how to find function calls in IDA Pro using strings and XREF, how function arguments are pushed onto the stack in reverse order before a call instruction launches the function. It also describes global variables, which are available to any function, and local variables, which are stored on the stack and only available within their defined function. The document provides examples of arithmetic operations, branching with conditional jumps, for loops with initialization, comparison, execution, and increment/decrement components, and arrays in assembly code.
CNIT 126: Ch 6: Recognizing C Constructs in Assembly
- 1. Practical Malware Analysis Ch 6: Recognizing C Constructs in Assembly Updated for FLARE-VM 10-6-20
- 3. Finding the Code in IDA Pro • IDA shows only the entry point
- 4. Use Strings, then XREF • Shift+F12 • Double- click • Double- click XREF
- 5. Disassembly in IDA Pro • Arguments for printf() function • Pushed onto stack • Reverse order • call launches function
- 6. Global vs. Local Variables • Global variables – Available to any function in the program – Stored outside all functions • Local variables – Defined in a function and only available to that function – Stored on the stack
- 7. Global vs. Local Variables
- 10. Finding for Loops • Four components • Initialization: i starts at 0 • Comparison: is i<100 ? • Execution: printf • Increment/decrement: i++
- 12. Arrays
- 14. Summary • Finding the Code – Strings, then XREF • Function Call – Arguments pushed onto stack – Reverse order – call • Variables – Global: in memory, available to all functions – Local: on stack, only available to one function
- 15. Summary • Arithmetic – Move variables into registers – Perform arithmetic (add, sub, idiv, etc.) – Move results back into variables • Branching – Compare (cmp, test, etc.) – Conditional jump (jz, jnz, etc.) – Red arrow if false, green arrow if true