DR. MIGUEL ÁNGEL OROS HERNÁNDEZ 2. Software de bajo nivel

1. Perspectivas de bajo y alto nivel 2. Ensamblador 3. Compilación 4. Ambientes de ejecución

Perspectivas de bajo y alto nivel

Perspectivas de bajo y alto nivel high-level perspectives Program structure Encapsulation Modules  Static libraries  Dynamic (Link) libraries Common code constructs  Procedures  Objects Data Management  Variables  User-defined data structures  Lists Control Flow  Conditional blocks  Switch blocks (n-way conditionals)  Loops High-Level Languages CC  C++  Java  C# (CLR-MSIL)

Perspectivas de bajo y alto nivel low-level perspectives Low-level data management  Registers  The stack  Temporarily saved register values  Local variables  Function parameters and return addresess  Heaps  Executable Data Sections Control flow

Ensamblador

Ensamblador registers RegisterDescription EAX, EBX, EDX Generic registers They can be used for any integer, boolean, logical, or memory operation ECX Generic register used as a counter by repetitive instructions ESI/EDI Generic registers Used as source/destination pointers EBP Generic register Used as the stack base ponter ESP CPU stack pointer Stores the current position in the stack

Ensamblador Flags  Special register  Contains all kinds of status and system flags Instruction format Opcode DestOp SourceOp Basic instructions  Moving data ( MOV )  Arithmetic ( ADD, SUB, MUL, DIV, IMUL, IDIV )  Conditional branches ( JCC, JNZ )  Function calls ( CALL ) Examples cmp ebx, 0xf020 jnz mov edi, [ecx+0x5b0] mov ebx, [ecx+0x5b4] imul edi, ebx

Compilación

Herramientas compiladores Source code Object File Executable compilationlinking Human readable Text file Binary code with readable symbols Binary code with no symbols Code readability

Ambientes de ejecución

The componet that actually runs programs  CPU  Software environment, p.e. virtual machine Software execution environment Bytecode Virtual machine  Java Virtual Machine (JVM)  Common Language Runtime (CLR) Benefits  Platform isolation  Enhanced functionality Interpreters Just-in-Time compilers (JiTs) Reversing strategies (bytecode programs)

Ambientes de ejecución Hardware execution environments in modern processors AMD (Advanced Micro Devices) Intel NetBurst  ops Pipelines Branch prediction

Bibliografía Reversing: Secrets of Reverse Engineering  Eldad Eilam  Wiley Publishing, Inc.  2005

Fin