وحدة STUDY HALL

Executable Internals

Look inside compiled programs. You follow one small C program from source to a finished executable, read the PE format that Windows uses and the ELF format that Linux uses, and learn enough x86-64 assembly to trace a function and recover its logic from the machine code alone. A foundation for malware analysis and reverse engineering.

4 مواضيع 15 صفحة

ما الذي ستدرسه

1 From source code to executable 3 صفحات · 5 أهداف تعليمية

What an executable file is, how the toolchain builds one, and how the operating system loads it into memory.

Learning Objectives

الأهداف التعليمية

  • Describe the four stages that turn C source code into an executable.
  • Explain the shared parts of an executable file format and where PE and ELF came from.
  • Identify a file's format from its magic number.
  • Describe what the loader does and how a file maps into a process.
  • Explain how ASLR, DEP and position-independent code protect a running program.

في هذا الموضوع

  1. From source code to machine code
  2. What an executable file holds
  3. Loading a program into memory
2 The PE format 3 صفحات · 5 أهداف تعليمية

How Windows executables are laid out, and what their headers, sections and imports reveal.

Learning Objectives

الأهداف التعليمية

  • Walk through the PE header chain from the MZ signature to the optional header.
  • Read the DllCharacteristics flags that enable ASLR, DEP and Control Flow Guard.
  • Read the section table and convert between a relative virtual address and a file offset.
  • Explain how a call reaches a DLL function through the import address table.
  • Describe what an import list reveals about a program and its limits.

في هذا الموضوع

  1. PE headers
  2. PE sections
  3. Imports and exports
3 The ELF format 3 صفحات · 5 أهداف تعليمية

How Linux executables are laid out, how they are loaded, and how they call shared libraries.

Learning Objectives

الأهداف التعليمية

  • Read the ELF header and identify the file type, class and entry point.
  • Explain the difference between sections and segments, and how they are grouped.
  • Describe how a call reaches a shared library through the PLT and GOT.
  • Explain lazy binding and what stripping a binary removes.
  • Compare the PE and ELF solutions to the same problems.

في هذا الموضوع

  1. ELF headers
  2. ELF sections and segments
  3. Dynamic linking and symbols
4 Reading x86-64 assembly 6 صفحات · 6 أهداف تعليمية

Enough x86-64 assembly to follow a function, a full worked example that recovers a program's logic from its machine code, and a hands-on lab on two unknown executables.

Learning Objectives

الأهداف التعليمية

  • Name the main x86-64 registers and explain how the stack holds local data and return addresses.
  • Read the core instructions and recognise how comparisons and jumps build conditions and loops.
  • Describe the prologue, the epilogue and the System V and Microsoft calling conventions.
  • Disassemble a function and recover its logic without the source code.
  • Analyse unknown binaries safely and within legal and ethical limits.
  • Apply the module's ELF, PE and assembly skills to two unknown executables in a hands-on lab.

في هذا الموضوع

  1. Registers and the stack
  2. Core instructions
  3. Functions and calling conventions
  4. Disassembling the sample program
  5. Lab: Examining two executables
  6. Lab walkthrough: Examining two executables

اشترك لدراسة هذه الوحدة

تأتي وحدات Study Hall مع الاشتراك. اشترك للعمل على كل موضوع بالسرعة التي تناسبك، مع اختبارات ومختبرات عملية على طول الطريق.

اشترك للوصول

مشترك بالفعل؟ سجّل الدخول