STUDY HALL MODULE

Executable Internals

Look inside compiled programs. You follow one small C program from source to a finished executable, read the PE format that Windows uses and the ELF format that Linux uses, and learn enough x86-64 assembly to trace a function and recover its logic from the machine code alone. A foundation for malware analysis and reverse engineering.

4 topics 15 pages

What you'll study

1 From source code to executable 3 pages · 5 learning objectives

What an executable file is, how the toolchain builds one, and how the operating system loads it into memory.

Learning Objectives

Learning objectives

  • Describe the four stages that turn C source code into an executable.
  • Explain the shared parts of an executable file format and where PE and ELF came from.
  • Identify a file's format from its magic number.
  • Describe what the loader does and how a file maps into a process.
  • Explain how ASLR, DEP and position-independent code protect a running program.

In this topic

  1. From source code to machine code
  2. What an executable file holds
  3. Loading a program into memory
2 The PE format 3 pages · 5 learning objectives

How Windows executables are laid out, and what their headers, sections and imports reveal.

Learning Objectives

Learning objectives

  • Walk through the PE header chain from the MZ signature to the optional header.
  • Read the DllCharacteristics flags that enable ASLR, DEP and Control Flow Guard.
  • Read the section table and convert between a relative virtual address and a file offset.
  • Explain how a call reaches a DLL function through the import address table.
  • Describe what an import list reveals about a program and its limits.

In this topic

  1. PE headers
  2. PE sections
  3. Imports and exports
3 The ELF format 3 pages · 5 learning objectives

How Linux executables are laid out, how they are loaded, and how they call shared libraries.

Learning Objectives

Learning objectives

  • Read the ELF header and identify the file type, class and entry point.
  • Explain the difference between sections and segments, and how they are grouped.
  • Describe how a call reaches a shared library through the PLT and GOT.
  • Explain lazy binding and what stripping a binary removes.
  • Compare the PE and ELF solutions to the same problems.

In this topic

  1. ELF headers
  2. ELF sections and segments
  3. Dynamic linking and symbols
4 Reading x86-64 assembly 6 pages · 6 learning objectives

Enough x86-64 assembly to follow a function, a full worked example that recovers a program's logic from its machine code, and a hands-on lab on two unknown executables.

Learning Objectives

Learning objectives

  • Name the main x86-64 registers and explain how the stack holds local data and return addresses.
  • Read the core instructions and recognise how comparisons and jumps build conditions and loops.
  • Describe the prologue, the epilogue and the System V and Microsoft calling conventions.
  • Disassemble a function and recover its logic without the source code.
  • Analyse unknown binaries safely and within legal and ethical limits.
  • Apply the module's ELF, PE and assembly skills to two unknown executables in a hands-on lab.

In this topic

  1. Registers and the stack
  2. Core instructions
  3. Functions and calling conventions
  4. Disassembling the sample program
  5. Lab: Examining two executables
  6. Lab walkthrough: Examining two executables

Subscribe to study this module

Study Hall modules come with a subscription. Subscribe to work through every topic at your own pace, with quizzes and hands-on labs along the way.

Subscribe to access

Already subscribed? Log in