[🛠️ ASSEMBLY FUNDAMENTALS]
// Master the building blocks of reverse engineering by understanding assembly language, CPU architecture, and how high-level code translates to machine instructions.
[🎯 LEARNING_OBJECTIVES]
> learning_outcomes.list
- [✓]Understand CPU architecture basics and instruction execution
- [✓]Know the purpose and usage of CPU registers
- [✓]Read and interpret basic assembly instructions
- [✓]Understand memory layout and addressing modes
> prerequisites.cfg
- - Basic programming concepts
- - Understanding of variables and functions
- - Completed Lesson 1: Foundations
[🛠️ ESSENTIAL_TOOLS]
[! WARNING] Tool Setup Required
# This lesson contains real analysis outputs and screenshots.
# Install the tools below to follow along with hands-on practice.
$Free Tools (Start Here!)
🔍 Ghidra (NSA's Free Disassembler)
Professional-grade reverse engineering tool, completely free!
ghidra-sre.org💻 Command Line Tools
Built into most systems or easily installable:
objdump - Disassemble binariesstrings - Extract text from binarieshexdump - View binary datafile - Identify file types🐍 Radare2/rizin
Powerful command-line reverse engineering framework
brew install radare2 (macOS)💎Professional Tools
🔥 IDA Pro (Industry Standard)
The gold standard for professional reverse engineering
⚡ x64dbg (Windows Debugger)
Excellent free debugger for Windows programs
🔬 Binary Ninja
Modern interface with powerful analysis capabilities
🚀 Quick Start: Your First Analysis (Using Ghidra)
1. Installation
# Extract the zip file
# Run ghidraRun (Linux/Mac) or ghidraRun.bat (Windows)
2. Create Your First Project
• Choose "Non-Shared Project"
• Give it a name like "Assembly_Practice"
3. Import a Binary
• Or File → Import File
• Try with /bin/ls (Linux/Mac) or C:\Windows\System32\calc.exe
4. Start Analysis
• Click "Yes" when asked to analyze
• Wait for analysis to complete
💡 Pro Tip: Start with simple programs like calculator or text editors. They're easier to understand and less overwhelming than complex software.
[🏢️ CPU_ARCHITECTURE]
The Central Processing Unit (CPU)
The CPU is the brain of your computer, executing instructions one by one in a continuous cycle. Understanding this cycle is crucial for reverse engineering because we're essentially reading the CPU's "thoughts" when we analyze assembly code.
🎯 Why This Matters for Reverse Engineering:
- • Malware Analysis: Understanding how instructions execute helps you trace malicious behavior step by step
- • Vulnerability Research: CPU execution patterns reveal where programs might crash or behave unexpectedly
- • Code Protection Bypass: Knowing instruction flow helps you skip license checks or authentication
- • Performance Analysis: Identify bottlenecks and optimization opportunities in software
📋 The Instruction Execution Cycle
Fetch
Get next instruction from memory
Decode
Interpret what the instruction means
Execute
Perform the operation
Store
Save results if needed
📝 Real Example: Password Check Bypass
Imagine you're reversing a program with a password check:
Reverse Engineering Insight: You could change the je (jump if equal) to jmp (always jump) to bypass the password check entirely!
x86-64 Architecture Overview
Most modern computers use x86-64 architecture (also called AMD64). This is what we'll focus on as it's the most common in reverse engineering scenarios.
🔍 Key Characteristics of x86-64:
- • 64-bit architecture - Can handle 64-bit data and addresses
- • Variable instruction length - Instructions can be 1-15 bytes long
- • Complex Instruction Set - Many powerful instructions available
- • Multiple addressing modes - Flexible ways to access memory
💻 Reverse Engineering Impact:
Variable Length = Analysis Challenge
Disassemblers can misinterpret where instructions start/end, making malware analysis harder.
Complex Instructions = Hidden Logic
Single instructions can perform multiple operations, hiding complex behavior in simple-looking code.
[📦 CPU_REGISTERS]
Registers are like the CPU's personal workspace - small, super-fast storage locations directly inside the processor. Think of them as the CPU's "hands" for holding and manipulating data.
🕵️♂️ Why Registers are a Reverse Engineer's Best Friend:
Function Arguments
Registers hold function parameters, revealing what data is being passed around
Return Values
Function results appear in specific registers, showing program outcomes
Hidden Data
Malware often stores decryption keys or important values in registers
Program State
Register contents reveal the current state and behavior of the program
🛠️ General Purpose Registers
Accumulator - Often holds return values
Common use: Function results, arithmetic
🔍 RE Example: Check if function returned 0 (success) or 1 (failure)
Base - General storage
Common use: Data storage, base addresses
🔍 RE Example: Often holds pointers to important data structures or strings
Counter - Loop operations
Common use: Loop counters, string operations
🔍 RE Example: Find loop boundaries to understand encryption algorithms
Data - I/O operations
Common use: I/O port access, large arithmetic
🔍 RE Example: Contains file handles or network socket descriptors
Source Index - Source for operations
Common use: String/memory copy source
🔍 RE Example: Points to source data in memory copying/decryption routines
Destination Index
Common use: String/memory copy destination
🔍 RE Example: Points to where malware writes decoded payload
Additional general registers
Common use: Extra storage in 64-bit mode
🔍 RE Example: Modern malware uses these for complex obfuscation schemes
⚙️ Special Purpose Registers
Instruction Pointer
Points to next instruction to execute
RE Importance: Critical for control flow analysis
Stack Pointer
Points to top of the stack
RE Importance: Essential for function calls
Base Pointer
Points to base of current stack frame
RE Importance: Helps navigate local variables
Status Flags
Stores condition codes and CPU state
RE Importance: Controls conditional jumps
💡 Pro Tip: Register Naming
Registers have different names based on their size:
- • RAX = 64-bit (full register)
- • EAX = 32-bit (lower half)
- • AX = 16-bit (lower quarter)
- • AL = 8-bit (lowest byte)
🔍 Practical Example: License Check Analysis
Let's see how registers reveal program logic:
- • RDI holds the license key - we found where it's stored!
- • RAX contains validation result - 0 = invalid, non-zero = valid
- • RBX tracks software mode - we could patch this to always = 1
[📝 ASSEMBLY_INSTRUCTIONS]
Assembly instructions are like a very simple language the CPU understands. Each instruction tells the CPU to perform one basic operation. Let's learn the most common ones you'll encounter in reverse engineering.
⚡ Why Each Instruction Type Matters in Reverse Engineering:
📦 Data Movement
Reveals how malware loads encrypted payloads, API addresses, or configuration data
🔢 Arithmetic
Shows encryption/decryption algorithms, checksum calculations, and obfuscation math
🔄 Control Flow
Exposes program logic - loops, conditions, function calls, and decision points
📦Data Movement Instructions
MOV
Copy data from source to destination
LEA
Load Effective Address - calculate address
🔢Arithmetic Instructions
ADD / SUB
Addition and subtraction
MUL / IMUL
Unsigned and signed multiplication
🔄Control Flow Instructions
JMP
Unconditional jump
CMP
Compare two values
Conditional Jumps
Jump based on flags
🧠 Understanding Control Flow
The combination of CMP followed by conditional jumps is how if-statements, loops, and other control structures are implemented at the assembly level. This pattern is everywhere in reverse engineering!
[🗺️ MEMORY_LAYOUT]
Understanding how programs organize memory is crucial for reverse engineering. Let's explore the typical memory layout of a running program.
🛡️ Why Memory Layout is Critical for Security Analysis:
Buffer Overflow Detection
Stack layout helps identify when programs write beyond buffer boundaries
Exploit Development
Memory layout knowledge is essential for ROP chains and shellcode injection
Malware Analysis
Understanding where malware stores data helps locate encryption keys and config
Anti-Analysis Evasion
Memory protections and ASLR can be bypassed with proper layout understanding
📚 Memory Sections
Function calls, local variables
Grows downward
Dynamic memory allocation
Grows upward
Global variables, initialized data
Fixed size
Program instructions (code)
Fixed size
🎯 Addressing Modes
Different ways to specify where data is located:
Value is specified directly in instruction
Value is in a register
Value is at specific memory address
Address is stored in register
Base register plus/minus offset
Complex calculation for address
🔍 Reverse Engineering Tip:
Pay attention to addressing patterns![rbp-8], [rbp-16]usually indicate local variables, while[rip+offset] often points to global data.
💥 Buffer Overflow Example:
Here's how addressing reveals vulnerability:
Vulnerability: Buffer at [rbp-32] can overflow into return address at [rbp+8], allowing code execution!
[🔬 BINARY_ANALYSIS_TUTORIAL]
🎯 Learning Goal
By following this guide, you'll learn exactly how to analyze any binary file from start to finish. We'll use both command-line tools and Ghidra to give you multiple approaches.
CLICommand Line Analysis
Step 1: Basic File Info
Always start here! Know what you're dealing with.
Step 2: String Analysis
Strings reveal a lot! Look for passwords, URLs, error messages.
Step 3: Disassembly
Start with main(), then explore interesting functions.
Step 4: Advanced Analysis
Understand the binary's security posture and dependencies.
GUIGhidra Analysis
Step 1: Import & Analyze
- • File → Import File (or drag & drop)
- • Double-click imported file
- • Click "Yes" to analyze when prompted
- • Wait for auto-analysis to complete (green bar)
Step 2: Navigate the Interface
- • Symbol Tree: Functions, variables, imports
- • Listing: Assembly code view
- • Decompiler: C-like pseudo code
- • Program Tree: File structure
Step 3: Analysis Features
- • String Search: Search → For Strings
- • Cross References: Right-click → Show References
- • Function Graph: Window → Function Graph
- • Hex View: Window → Bytes
Step 4: Make Notes
- • Right-click → Set Comment (add notes)
- • Right-click → Set Label (rename functions)
- • Bookmarks → Add Bookmark (save locations)
- • File → Export → Various formats
🎯 Common Patterns to Look For
🚨 Suspicious Indicators
ptrace, IsDebuggerPresentfopen, temp directories, persistence paths✅ Normal Program Elements
main, printf, malloc[🔬 HANDS_ON_EXERCISES]
Now that you know the process, let's practice! We'll analyze two binaries: a simple "hello" program and an educational malware simulation. Use the techniques from above to follow along.
1Exercise 1: Hello Binary Analysis
Let's start with our simple hello program to understand the basics.
Step 1: File Information
First, let's identify what type of file we're dealing with:
- • 64-bit ARM executable (Apple Silicon)
- • 16KB file size (typical for simple programs)
- • Executable permissions set
- • No file? Check you're in the right directory
- • Permission denied? Use
chmod +x - • Different architecture? That's expected!
Step 2: String Analysis
Extract readable strings to understand the program's purpose:
- • Two clear text messages (program purpose)
- • Uses
printffunction for output - • No suspicious URLs or IPs found
- • Standard system library paths
- • Use
strings -n 8for longer strings - • Try
strings -e lfor UTF-16 - • Pipe to
sort | uniqto remove duplicates - • Look for base64, hex, or encrypted data
Step 3: Disassembly Analysis
Now let's look at the actual assembly code:
🔍 Analysis Notes:
- • sub sp, sp, #0x20 - Allocate stack space
- • stp x29, x30 - Save frame pointer and return address
- • adrp/add - Load string addresses
- • bl - Call printf function
- • ret - Return from function
2Exercise 2: Educational Malware Analysis
⚠️ Important Safety Note
This is a completely safe educational simulation that only prints messages. It demonstrates common malware techniques without performing any harmful actions.
Step 1: Initial Execution
Run the malware simulation to see what it does:
Step 2: String Analysis - Spotting Obfuscation
Look for suspicious strings and patterns:
🚨 Red Flags: Anti-debugging, C&C communication, hidden functionality!
Step 3: Discovering Hidden Features
We found "--advanced" in the strings. Let's try it:
💡 Discovery: Hidden advanced malware features unlocked by command-line argument!
Step 4: Finding Encrypted Strings
Look for the obfuscated data at the end of strings output:
These are XOR-encrypted strings! Real malware often hides important data this way.
🎯 What We Learned:
- • Anti-Analysis: Debugger detection to avoid reverse engineering
- • String Obfuscation: XOR encryption to hide malicious intent
- • Hidden Functionality: Command-line activated advanced features
- • Persistence: Attempts to maintain presence on system
- • C&C Communication: Network communication with control server
🏆Challenge: Decrypt the Hidden Messages
Using your assembly knowledge, can you figure out how to decrypt those XOR-encrypted strings? Look at the malware_sim.c source code and find the XOR key!
Hints:
- • Look for the
decrypt_stringfunction - • Find the XOR key value (it's 0x32)
- • Try manually XORing the encrypted bytes
- • The decrypted results demonstrate the XOR process (they may appear garbled - that's normal!)
🔄Use the XOR Playground Tool!
The XOR playground script makes this challenge much easier to understand. Here's how to use it:
Step 1: Run the Script
Step 2: Choose Option 4
Step 3: See the Magic!
Option 4 shows the exact encrypted data from malware_sim and demonstrates step-by-step XOR decryption!
Step 4: Experiment
Try option 2 with hex bytes 5d 40 74 and key 50
📎Download Practice Files
📝 Exercise Source Files
🔧 Analysis Tools
analyze.sh
DownloadComprehensive automated binary analysis script with risk assessment
README.md
DownloadComplete instructions, learning objectives, and troubleshooting guide
🎓STUDENT_GUIDE.md
DownloadComplete step-by-step walkthrough - Follow this for guaranteed success!
QUICK_CHECKLIST.md
DownloadQuick reference checklist to track your progress through the challenge
🔄xor_playground.py
DownloadInteractive XOR Encryption/Decryption Tool - Perfect for understanding the malware_sim XOR challenge!
- • Text encryption/decryption
- • Hex byte analysis
- • XOR number calculator
- • Malware challenge simulation
🚀 Quick Start Commands
💡 Pro tip: Create a new folder for these exercises to keep your workspace organized!
🎁Exercise 3: Your Turn - Analyze Any Binary
💻 Try These Common Binaries
Directory listing command - great for beginners
strings /bin/ls | grep "Usage"Shows current username - simple and clean
objdump -d /usr/bin/whoami | head -50File display utility - moderate complexity
strings /bin/cat | grep -E "(error|usage)" -i🎯 Analysis Checklist
🎆 Challenge Yourself
Pick a binary you use daily (text editor, browser, game) and spend 30 minutes analyzing it. You'll be amazed at what you discover!
📄 Essential Analysis Commands
💡 Pro tip: Create a simple script with these commands, or use them one by one. Replace /path/to/binary with your actual file path.
🧩 Putting It All Together: From Code to Assembly to Exploitation
Let's see how a simple C function becomes assembly code and reveals security vulnerabilities:
📝 Original C Code:
🔧 Assembly Translation:
🚨 What a Reverse Engineer Sees:
- • Buffer Overflow: Only 32 bytes allocated but no length check on input
- • Stack Layout: Buffer starts at RSP, return address 32 bytes higher
- • Control Flow: Success/fail logic in the conditional jump
- • Secret Location: Password string address loaded into RSI
🔧 Possible Exploits/Bypasses:
- • Buffer Overflow: Send 40+ characters to overwrite return address
- • Logic Bypass: Patch the je return_success to jmp return_success
- • String Discovery: Find the secret string at the address in RSI
- • Return Value: Always return 1 by patching the return logic
🎆 The Power of Assembly Knowledge:
By understanding assembly, you can see vulnerabilities invisible in source code, find hidden functionality, bypass security checks, and understand exactly how malware operates. Every high-level programming construct has an assembly representation - and that's where the real secrets hide!
📚 Lesson Summary
✅ What We Covered:
- • CPU architecture and instruction execution cycle
- • General purpose and special registers
- • Basic assembly instructions (MOV, ADD, JMP, etc.)
- • Memory layout and addressing modes
- • Practical analysis techniques
🎯 Next Steps:
- • Complete the hands-on exercise
- • Practice reading assembly code daily
- • Experiment with different binaries
- • Move to Lesson 3: Executable File Formats