58627
58627
com
OR CLICK HERE
DOWLOAD NOW
https://ebookmass.com/product/foundations-of-arm64-linux-debugging-
disassembling-and-reversing-dmitry-vostokov/
ebookmass.com
https://ebookmass.com/product/physiology-sixth-edition-costanzo/
ebookmass.com
Business Communication: A Problem Solving Approach 1st
Edition, (Ebook PDF)
https://ebookmass.com/product/business-communication-a-problem-
solving-approach-1st-edition-ebook-pdf/
ebookmass.com
https://ebookmass.com/product/what-if-you-me-roni-loren/
ebookmass.com
https://ebookmass.com/product/interplanetary-liberty-building-free-
societies-in-the-cosmos-charles-s-cockell/
ebookmass.com
https://ebookmass.com/product/why-privacy-matters-neil-richards/
ebookmass.com
https://ebookmass.com/product/u-is-for-uncrossing-the-a-b-cs-of-
witchery-moonbeam-chronicles-book-21-carolina-mac/
ebookmass.com
Foundations of ARM64
Linux Debugging,
Disassembling, and
Reversing
Analyze Code, Understand Stack
Memory Usage, and Reconstruct
Original C/C++ Code with ARM64
—
Dmitry Vostokov
Foundations of
ARM64 Linux
Debugging,
Disassembling, and
Reversing
Analyze Code, Understand
Stack Memory Usage,
and Reconstruct Original C/C++
Code with ARM64
Dmitry Vostokov
Foundations of ARM64 Linux Debugging, Disassembling, and Reversing:
Analyze Code, Understand Stack Memory Usage, and Reconstruct Original
C/C++ Code with ARM64
Dmitry Vostokov
Dublin, Ireland
Preface����������������������������������������������������������������������������������������������xiii
iii
Table of Contents
Chapter 4: Pointers�����������������������������������������������������������������������������35
A Definition���������������������������������������������������������������������������������������������������������35
“Pointers” Project: Memory Layout and Registers����������������������������������������������36
“Pointers” Project: Calculations��������������������������������������������������������������������������38
Using Pointers to Assign Numbers to Memory Cells�������������������������������������������39
Adding Numbers Using Pointers�������������������������������������������������������������������������46
Incrementing Numbers Using Pointers���������������������������������������������������������������51
Multiplying Numbers Using Pointers�������������������������������������������������������������������54
Summary������������������������������������������������������������������������������������������������������������58
iv
Table of Contents
v
Table of Contents
vi
Table of Contents
vii
Table of Contents
Index�������������������������������������������������������������������������������������������������167
viii
About the Author
Dmitry Vostokov is an internationally
recognized expert, speaker, educator, scientist,
and author. He is the founder of the pattern-
oriented software diagnostics, forensics,
and prognostics discipline and Software
Diagnostics Institute (DA+TA: DumpAnalysis.
org + TraceAnalysis.org). Vostokov has also
authored more than 50 books on software
diagnostics, anomaly detection and analysis,
software and memory forensics, root cause analysis and problem solving,
memory dump analysis, debugging, software trace and log analysis,
reverse engineering, and malware analysis. He has more than 25 years
of experience in software architecture, design, development, and
maintenance in various industries, including leadership, technical, and
people management roles. Dmitry also founded Syndromatix, Anolog.
io, BriteTrace, DiaThings, Logtellect, OpenTask Iterative and Incremental
Publishing (OpenTask.com), Software Diagnostics Technology and
Services (former Memory Dump Analysis Services; PatternDiagnostics.
com), and Software Prognostics. In his spare time, he presents various
topics on Debugging TV and explores Software Narratology, its further
development as Narratology of Things and Diagnostics of Things (DoT),
Software Pathology, and Quantum Software Diagnostics. His current
areas of interest are theoretical software diagnostics and its mathematical
and computer science foundations, application of formal logic, artificial
intelligence, machine learning and data mining to diagnostics and anomaly
detection, software diagnostics engineering and diagnostics-driven
ix
About the Author
x
About the Technical Reviewer
Sundar Pandian has more than three
years of experience in embedded software
development, including development of device
drivers, middleware software, and application
services for the infotainment system on the
Android platform. He’s also developed CAN
protocol drivers for the automotive braking
system on the Autosar platform.
He’s developed software with C, C++,
and Java and worked in the automotive,
semiconductor, and telecom industries. He has
a bachelor’s in electronics and communication engineering. Currently, he
serves as a firmware/middleware engineer for audio DSPs.
xi
Preface
The book covers topics ranging from ARM64 assembly language
instructions and writing programs in assembly language to pointers, live
debugging, and static binary analysis of compiled C and C++ code.
Diagnostics of core memory dumps, live and postmortem debugging
of Linux applications, services, and systems, memory forensics, malware,
and vulnerability analysis require an understanding of ARM64 assembly
language and how C and C++ compilers generate code, including
memory layout and pointers. This book is about background knowledge
and practical foundations that are needed to understand internal Linux
program structure and behavior, start working with the GDB debugger, and
use it for disassembly and reversing. It consists of practical step-by-step
exercises of increasing complexity with explanations and many diagrams,
including some necessary background topics.
By the end of the book, you will have a solid understanding of how
Linux C and C++ compilers generate binary code. In addition, you will be
able to analyze such code confidently, understand stack memory usage,
and reconstruct original C/C++ code.
The book will be useful for
• Software testers
xiii
Preface
This book can also be used as an ARM64 assembly language and Linux
debugging supplement for relevant undergraduate-level courses.
Source Code
All source code used in this book can be downloaded from github.com/
apress/arm64-linux-debugging-disassembling-reversing.
xiv
CHAPTER 1
Memory, Registers,
and Simple Arithmetic
emory and Registers Inside an
M
Idealized Computer
Computer memory consists of a sequence of memory cells, and each cell
has a unique address (location). Every cell contains a “number.” We refer
to these “numbers” as contents at addresses (locations). Because memory
access is slower than arithmetic instructions, there are so-called registers
to speed up complex operations that require memory to store temporary
results. We can also think about them as stand-alone memory cells. The
name of a register is its address. Figure 1-1 illustrates this.
RUSTICATED MASONRY.
[See § 20, Rusticated Masonry and the Tuscan Order, ante, p. 65.]
In masonry of this kind the sides of the stones, where they come
into contact with each other, are dressed smooth, but the face of each
stone is left to project beyond the plane of the wall. The projections
may be rough and irregular, in which case the appearance is that of
natural stones, and a rugged rock-like aspect is given to the wall-face.
The projections may however be wrought into bosses of regular form,
or into the diamonds and facets of which Vasari goes on to speak,
and of which a notable example is the so-called ‘Palazzo de’
Diamanti’ at Ferrara.
This method of treating stones, at least when they are left rough
and irregular, saves time and labour, and hence it has been in use
among many ancient peoples, but almost always for substructures
and parts not meant to be seen. The Romans made a more extensive
employment of it, and we find it not only on sustaining walls, such as
those of the Hadrianic platform of the Olympeion at Athens, but on
monumental wall-faces, as on the enclosing wall of the Forum of
Augustus near the Arco dei Pantani at Rome, one of the finest extant
specimens of Roman masonry but still utilitarian in character. The
deliberate use of rustication, as an element of artistic effect, on the
façade of a public building, is another matter, and it is doubtful if any
instance of this occurs before the Italian Renaissance. There is a
piece of Roman rusticated masonry behind the ancient theatre at
Fiesole, the classical Faesolae, and Professor Durm thought at one
time that the Florentine builders might have derived from this their
idea of using the device as a means of expression in stonework. It
may be questioned however whether this was visible at all in the
fifteenth century, and it is much more likely that Renaissance
rustication was a natural development from the treatment of the wall
in many mediaeval Tuscan buildings, in which the surface of the
stones is left to project in an irregular undesigned fashion. The
Palazzo Vecchio and the Gothic Palazzo Alessandri at Florence are
examples. In any case, in the hands of the architects of the
Renaissance rustication became an important element in the
architectural style of the period, and is one of the special
contributions of this style to architecture at large.
Plate VI
EGG-SHELL MOSAIC.
It is the custom of many artists to make the figure nine heads high;
dividing it in the following manner; the throat, the neck, and the
height of the foot (from the instep to the sole) are equal to one head
and the rest of the body to eight; of these, the shinbone measures two
heads, from the knee to the organs of generation two more, while the
body up to the pit of the throat is equal to three, with another from
the chin to the top of the forehead, so that there are nine in all.[155] As
to the measurements across, from the pit of the throat to the
shoulder on each side is the length of a head, and each arm to the
wrist is three heads. Thus the man with his arms stretched out
measures exactly as much as his height.
After all the eye must give the final judgement, for, even though an
object be most carefully measured, if the eye remain offended it will
not cease on that account to censure it.
Let me repeat that although measurement exercises a just control
in enlarging the figure so that the height and breadth, kept according
to rule, may make the work well proportioned and beautiful, the eye
nevertheless must decide where to take away and where to add as it
sees defect in the work, till the due proportion, grace, design and
perfection are attained, so that the work may be praised in all its
parts by every competent authority. And that statue or figure which
shall have these qualities will be perfect in beauty, in design and in
grace. Such figures we call figures ‘in the round,’ provided that all the
parts appear finished, just as one sees them in a man, when walking
round him; the same holds good of all the details which depend on
the whole. But it seems to me high time to come to the particulars of
the subject.
CHAPTER II. (IX.)
Of the manner of making Models in Wax and in Clay; how they are
draped, and how they are afterwards enlarged in proportion in
the Marble; how Marbles are worked with the point and the
toothed tool, and are rubbed with pumice stone and polished till
they are perfect.
Our website is not just a platform for buying books, but a bridge
connecting readers to the timeless values of culture and wisdom. With
an elegant, user-friendly interface and an intelligent search system,
we are committed to providing a quick and convenient shopping
experience. Additionally, our special promotions and home delivery
services ensure that you save time and fully enjoy the joy of reading.
ebookmass.com