Reverse Engineering Challenges

Re:Reverse Engineering Challenges by lunixbochs on Friday November 13, 2015 @12:50PM (#10561179)

Much of assembly programming is variants of these commands:

    - mov <dst>, <src>            | dst = src
    - sub <dst>, <src a>, <src b> | dst = a - b
    - jump <label>                | continue running at <label>
    - jump if equal <label>       | continue running at <label> if both sources of
                                    the last command were equal
    - call <label>                | save the current location, then continue
                                    running at <label>
    - ret                         | continue running after the previous CALL
                                    instruction

<dst> can be:

    - any memory address
    - any of 8-32 available temporary integer variables called "registers"

<src> can be any valid <dst> or a hardcoded integer known as an "immediate"

[ Parent | on HN ]

Re:Reverse Engineering Challenges by tptacek on Friday November 13, 2015 @01:02PM (#10561260)

This is both more detailed than mine and uses fewer sentences. My only nit is that I feel like understanding status flags is really important.

[ Parent | on HN ]

Re:Reverse Engineering Challenges by lunixbochs on Friday November 13, 2015 @02:45PM (#10561977)

I had several nitpicks with mine, but realized once the learner starts asking questions about gaps they're in a pretty good place to find an answer on their own.

I do agree flags is less obvious, but also takes a bit of space to list what kind of flags one might see:

"jump if equal" is facilitated by an implicit "flags" register which is set after most arithmetic or comparison operations like "sub". Possible flags include:

- carry: the last arithmetic operation overflowed

- zero: result of the last operation was zero

- parity: result of the last operation was odd

- sign: result of the last operation was negative

[ Parent | on HN ]