| Assembly Language | |
| Introduction | p. 1 |
| Registers | p. 1 |
| General Purpose Register | p. 1 |
| FLAGS Register | p. 2 |
| 80x86 Instruction Format | p. 3 |
| Instruction Prefix | p. 4 |
| Lock and Repeat Prefixes | p. 4 |
| Segment Override Prefixes | p. 4 |
| Opcode | p. 5 |
| Instructions | p. 7 |
| Basic Instructions | p. 7 |
| Floating Point Instruction | p. 10 |
| Stack Setup | p. 13 |
| Passing Parameters in C to the Procedure | p. 13 |
| Local Data Space on the Stack | p. 15 |
| Calling Conventions | p. 16 |
| cdecl calling convention | p. 16 |
| fastcall calling convention | p. 17 |
| stdcall calling convention | p. 17 |
| thiscall | p. 17 |
| Data Constructs | p. 17 |
| Global Variables | p. 18 |
| Local Variables | p. 18 |
| Registers | p. 19 |
| Imported Variables | p. 19 |
| Thread Local Storage (TLS) | p. 20 |
| Executable Data Section | p. 20 |
| Representation of Arithmetic Operations in Assembly | p. 21 |
| Multiplication | p. 22 |
| Division | p. 22 |
| Modulo | p. 24 |
| Representation of Data Structure in Assembly | p. 24 |
| Representation of Array in Assembly | p. 24 |
| Representation of Linked List in Assembly | p. 25 |
| Virtual Function Call in Assembly | p. 26 |
| Representation of classes in Assembly | p. 27 |
| Conclusion | p. 28 |
| Fundamental of Windows | |
| Introduction | p. 29 |
| Memory Management | p. 29 |
| Virtual Memory Management | p. 29 |
| Virtual Memory Management in Windows NT | p. 32 |
| Impact of Hooking | p. 33 |
| Segmented Memory Management | p. 34 |
| Paged Memory Management | p. 36 |
| Kernel Memory and User Memory | p. 37 |
| Kernel Memory Space | p. 37 |
| Section Object | p. 38 |
| Virtual Address Descriptor | p. 39 |
| User Mode Address Space | p. 39 |
| Memory Management in Windows | p. 39 |
| Objects and Handles | p. 40 |
| Named Objects | p. 40 |
| Processes and Threads | p. 41 |
| Context Switching | p. 43 |
| Context Switches and Mode Switches | p. 43 |
| Synchronization Objects | p. 44 |
| Critical Section | p. 44 |
| Mutex | p. 44 |
| Semaphore | p. 45 |
| Event | p. 45 |
| Metered Section | p. 45 |
| Process Initialization Sequence | p. 46 |
| Application Programming Interface | p. 47 |
| Reversing Windows NT | p. 48 |
| ExpEchoPoolCalls | p. 49 |
| ObpShowAllocAndFree | p. 49 |
| LpcpTraceMessages | p. 49 |
| MmDebug | p. 49 |
| NtGlobalFlag | p. 49 |
| SepDumpSD | p. 50 |
| CmLogLevel and CmLogSelect | p. 50 |
| Security Features in Vista | p. 50 |
| Address Space Layout Randomization (ASLR) | p. 50 |
| Stack Randomization | p. 51 |
| Heap Defenses | p. 52 |
| NX | p. 54 |
| /GS | p. 55 |
| Pointer Encoding | p. 56 |
| Cryptographic API in Windows Vista | p. 58 |
| Crypto-Agility | p. 59 |
| CryptoAgility in CNG | p. 60 |
| Algorithm Providers | p. 62 |
| Random Number Generator | p. 63 |
| Hash Functions | p. 64 |
| Symmetric Encryption | p. 65 |
| Asymmetric Encryption | p. 67 |
| Signatures and Verification | p. 68 |
| Conclusion | p. 68 |
| Portable Executable File Format | |
| Introduction | p. 69 |
| PE file Format | p. 69 |
| Import Address Table | p. 77 |
| Executable and Linking Format | p. 79 |
| ELF Header | p. 79 |
| The Program Header Table | p. 80 |
| Conclusion | p. 83 |
| Reversing Binaries for Identifying Vulnerabilities | |
| Introduction | p. 85 |
| Stack Overflow | p. 85 |
| CAN-2002-1123 Microsoft SQL Server 'Hello' Authentication Buffer Overflow" | p. 88 |
| CAN-2004-0399 Exim Buffer Overflow | p. 88 |
| Stack Checking | p. 90 |
| Off-by-One Overflow | p. 90 |
| OpenBSD 2.7 FTP Daemon Off-by-One | p. 93 |
| Non-Executable Memory | p. 94 |
| Heap Overflows | p. 94 |
| Heap Based Overflows | p. 96 |
| Integer Overflows | p. 106 |
| Types Integer Overflow | p. 108 |
| CAN-2004-0417 CVS Max dotdot Protocol Command Integer Overflow | p. 111 |
| Format String | p. 112 |
| Format String Vulnerability | p. 113 |
| Format String Denial of Service Attack | p. 115 |
| Format String Vulnerability Reading Attack | p. 115 |
| SEH Structure Exception Handler | p. 116 |
| Exploiting the SEH | p. 119 |
| Writing Exploits General Concepts | p. 122 |
| Stack Overflow Exploits | p. 122 |
| Injection Techniques | p. 123 |
| Optimizing the Injection Vector | p. 123 |
| The Location of the Payload | p. 123 |
| Direct Jump (Guessing Offsets) | p. 124 |
| Blind Return | p. 124 |
| Pop Return | p. 124 |
| No Operation Sled | p. 125 |
| Call Register | p. 125 |
| Push Return | p. 126 |
| Calculating Offset | p. 126 |
| Conclusion | p. 126 |
| Fundamental of Reverse Engineering | |
| Introduction | p. 127 |
| Anti-Reversing Method | p. 127 |
| Anti Disassembly | p. 128 |
| Linear Sweep Disassembler | p. 128 |
| Recursive Traversal Disassembler | p. 130 |
| Evasion of Disassemble | p. 131 |
| Self Modifying Code | p. 135 |
| Virtual Machine Obfuscation | p. 139 |
| Anti Debugging Techniques | p. 140 |
| BreakPoints | p. 142 |
| Software Breakpoint | p. 142 |
| Hardware Breakpoint | p. 143 |
| Detecting Hardware BreakPoint | p. 144 |
| Virtual Machine Detection | p. 145 |
| Checking Fingerprint Inside Memory, File System and Registry | p. 145 |
| Checking System Tables | p. 145 |
| Checking Processor Instruction Set | p. 146 |
| Unpacking | p. 147 |
| Manual Unpacking of Software | p. 148 |
| Finding an Original Entry Point of an Executable | p. 148 |
| Taking Memory Dump | p. 154 |
| Import Table Reconstruction | p. 156 |
| Import Redirection and Code emulation | p. 162 |
| Conclusion | p. 166 |
| Appendix | p. 168 |
| Index | p. 187 |
| Table of Contents provided by Ingram. All Rights Reserved. |