What an executable file is, how the toolchain builds one, and how the operating system loads it into memory.
Learning Objectives
스터디홀 모듈
Executable Internals
Look inside compiled programs. You follow one small C program from source to a finished executable, read the PE format that Windows uses and the ELF format that Linux uses, and learn enough x86-64 assembly to trace a function and recover its logic from the machine code alone. A foundation for malware analysis and reverse engineering.
학습 내용
1 From source code to executable
학습 목표
- Describe the four stages that turn C source code into an executable.
- Explain the shared parts of an executable file format and where PE and ELF came from.
- Identify a file's format from its magic number.
- Describe what the loader does and how a file maps into a process.
- Explain how ASLR, DEP and position-independent code protect a running program.
이 주제의 내용
- From source code to machine code
- What an executable file holds
- Loading a program into memory
2 The PE format
How Windows executables are laid out, and what their headers, sections and imports reveal.
Learning Objectives
학습 목표
- Walk through the PE header chain from the MZ signature to the optional header.
- Read the DllCharacteristics flags that enable ASLR, DEP and Control Flow Guard.
- Read the section table and convert between a relative virtual address and a file offset.
- Explain how a call reaches a DLL function through the import address table.
- Describe what an import list reveals about a program and its limits.
이 주제의 내용
- PE headers
- PE sections
- Imports and exports
3 The ELF format
How Linux executables are laid out, how they are loaded, and how they call shared libraries.
Learning Objectives
학습 목표
- Read the ELF header and identify the file type, class and entry point.
- Explain the difference between sections and segments, and how they are grouped.
- Describe how a call reaches a shared library through the PLT and GOT.
- Explain lazy binding and what stripping a binary removes.
- Compare the PE and ELF solutions to the same problems.
이 주제의 내용
- ELF headers
- ELF sections and segments
- Dynamic linking and symbols
4 Reading x86-64 assembly
Enough x86-64 assembly to follow a function, a full worked example that recovers a program's logic from its machine code, and a hands-on lab on two unknown executables.
Learning Objectives
학습 목표
- Name the main x86-64 registers and explain how the stack holds local data and return addresses.
- Read the core instructions and recognise how comparisons and jumps build conditions and loops.
- Describe the prologue, the epilogue and the System V and Microsoft calling conventions.
- Disassemble a function and recover its logic without the source code.
- Analyse unknown binaries safely and within legal and ethical limits.
- Apply the module's ELF, PE and assembly skills to two unknown executables in a hands-on lab.
이 주제의 내용
- Registers and the stack
- Core instructions
- Functions and calling conventions
- Disassembling the sample program
- Lab: Examining two executables
- Lab walkthrough: Examining two executables
