What an executable file is, how the toolchain builds one, and how the operating system loads it into memory.
Learning Objectives
MÓDULO DE SALA DE ESTUDIO
Executable Internals
Look inside compiled programs. You follow one small C program from source to a finished executable, read the PE format that Windows uses and the ELF format that Linux uses, and learn enough x86-64 assembly to trace a function and recover its logic from the machine code alone. A foundation for malware analysis and reverse engineering.
Lo que estudiarás
1 From source code to executable
Objetivos de aprendizaje
- Describe the four stages that turn C source code into an executable.
- Explain the shared parts of an executable file format and where PE and ELF came from.
- Identify a file's format from its magic number.
- Describe what the loader does and how a file maps into a process.
- Explain how ASLR, DEP and position-independent code protect a running program.
En este tema
- From source code to machine code
- What an executable file holds
- Loading a program into memory
2 The PE format
How Windows executables are laid out, and what their headers, sections and imports reveal.
Learning Objectives
Objetivos de aprendizaje
- Walk through the PE header chain from the MZ signature to the optional header.
- Read the DllCharacteristics flags that enable ASLR, DEP and Control Flow Guard.
- Read the section table and convert between a relative virtual address and a file offset.
- Explain how a call reaches a DLL function through the import address table.
- Describe what an import list reveals about a program and its limits.
En este tema
- PE headers
- PE sections
- Imports and exports
3 The ELF format
How Linux executables are laid out, how they are loaded, and how they call shared libraries.
Learning Objectives
Objetivos de aprendizaje
- Read the ELF header and identify the file type, class and entry point.
- Explain the difference between sections and segments, and how they are grouped.
- Describe how a call reaches a shared library through the PLT and GOT.
- Explain lazy binding and what stripping a binary removes.
- Compare the PE and ELF solutions to the same problems.
En este tema
- ELF headers
- ELF sections and segments
- Dynamic linking and symbols
4 Reading x86-64 assembly
Enough x86-64 assembly to follow a function, a full worked example that recovers a program's logic from its machine code, and a hands-on lab on two unknown executables.
Learning Objectives
Objetivos de aprendizaje
- Name the main x86-64 registers and explain how the stack holds local data and return addresses.
- Read the core instructions and recognise how comparisons and jumps build conditions and loops.
- Describe the prologue, the epilogue and the System V and Microsoft calling conventions.
- Disassemble a function and recover its logic without the source code.
- Analyse unknown binaries safely and within legal and ethical limits.
- Apply the module's ELF, PE and assembly skills to two unknown executables in a hands-on lab.
En este tema
- Registers and the stack
- Core instructions
- Functions and calling conventions
- Disassembling the sample program
- Lab: Examining two executables
- Lab walkthrough: Examining two executables
Suscríbase para estudiar este módulo
Los módulos de Study Hall vienen con una suscripción. Suscríbase para estudiar cada tema a su propio ritmo, con cuestionarios y laboratorios prácticos en el camino.
Suscríbete para accederYa está suscrito? Iniciar sesión
