search
Home

Intro to x86-64

Date: 31, May, 2021

Author: Dhilip Sanjay S

Click Herearrow-up-right to go to the TryHackMe room.

hashtag
Introduction

  • Computers execute machine code, which is encoded as bytes, to carry out tasks on a computer. Since different computers have different processors, the machine code executed on these computers is specific to the processor.

  • Intel x86-64 instruction set architecture is commonly used today.

  • This machine code is usually produced by a compiler, which takes the source code of a file, and after going through some intermediate stages, produces machine code that can be executed by a computer.

  • 16-bit -> 32 bit -> 64 bit (instruction set)

    • All these instruction sets have been created for backward compatibility, so code compiled for 32 bit architecture will run on 64 bit machines.

  • Before an executable file is produced, the source code is first compiled into assembly(.s files), after which the assembler converts it into an object program(.o files), and operations with a linker finally make it an executable.

hashtag
Radare2

  • radare2 is a framework for reverse engineering and analysing binaries.

  • It can be used to disassemble binaries(translate machine code to assembly, which is actually readable) and debug said binaries(by allowing a user to step through the execution and view the state of the program).

  • To debug the executable: r2 -d <executable>

  • To analyze all: aa

  • To set the syntax to AT&T: e asm.syntax=att

  • Help command: ?

  • To find a list of the functions run: afl

    [0x7fa314fcf090]> afl
0x55824f4fa560    1 42           entry0
0x55824f6fafe0    1 4124         reloc.__libc_start_main
0x55824f4fa590    4 50   -> 40   sym.deregister_tm_clones
0x55824f4fa5d0    4 66   -> 57   sym.register_tm_clones
0x55824f4fa620    5 58   -> 51   entry.fini0
0x55824f4fa550    1 6            sym..plt.got
0x55824f4fa660    1 10           entry.init0
0x55824f4fa730    1 2            sym.__libc_csu_fini
0x55824f4fa734    1 9            sym._fini
0x55824f4fa6c0    4 101          sym.__libc_csu_init
0x55824f4fa66a    1 78           main
0x55824f4fa540    1 6            sym.imp.__printf_chk
0x55824f4fa510    3 23           sym._init
0x55824f4fa000    3 97   -> 123  map.home_tryhackme_introduction_intro.r_x

  • Print Disassembly Function: pdf @main

  • The values on the complete left column are memory addresses of the instructions, and these are usually stored in a structure called the stack.

  • The middle column contains the instructions encoded in bytes(what is usually the machine code)

  • The last column actually contains the human readable instructions.

hashtag
List of registers:

64 bit
32 bit

%rax

%eax

%rbx

%ebx

%rcx

%ecx

%rdx

%edx

%rsi

%esi

%rdi

%edi

%rsp

%esp

%rbp

%ebp

%r8

%r8d

%r9

%r9d

%r10

%r10d

%r11

%r11d

%r12

%r12d

%r13

%r13d

%r14

%r14d

%r15

%r15d

  • The first 6 registers are known as general purpose registers.

  • The %rsp is the stack pointer and it points to the top of the stack which contains the most recent memory address. The stack is a data structure that manages memory for programs.

  • %rbp is a frame pointer and points to the frame of the function currently being executed - every function is executed in a new frame.

hashtag
Mov instruction

  • To move data using registers, the following instruction is used: movq source, destination

    • Transferring constants(which are prefixed using the $ operator) e.g. movq $3 rax would move the constant 3 to the register

    • Transferring values from/to a register e.g. movq %rax %rbx which involves moving value from rax to rbx

    • Transferring values from/to memory which is shown by putting registers inside brackets e.g. movq %rax (%rbx) which means move value stored in %rax to memory location represented by %rbx.

hashtag
Basic Data Types

Initial Data Type
Suffix
Size (bytes)

Byte

b

1

Word

w

2

Double Word

l

4

Quad

q

8

Single Precision

s

4

Double Precision

l

8

hashtag
Memory manipulation using registers

  • (Rb, Ri) = MemoryLocation[Rb + Ri]

  • D(Rb, Ri) = MemoryLocation[Rb + Ri + D]

  • (Rb, Ri, S) = MemoryLocation(Rb + S * Ri]

  • D(Rb, Ri, S) = MemoryLocation[Rb + S * Ri + D]

hashtag
Important instructions

  • leaq source, destination: this instruction sets destination to the address denoted by the expression in source (Load Effective Address - It doesn't mov the contents!)

  • addq source, destination: destination = destination + source

  • subq source, destination: destination = destination - source

  • imulq source, destination: destination = destination * source

  • salq source, destination: destination = destination << source where << is the left bit shifting operator

  • sarq source, destination: destination = destination >> source where >> is the right bit shifting operator

  • xorq source, destination: destination = destination XOR source

  • andq source, destination: destination = destination & source

  • orq source, destination: destination = destination | source

hashtag
If statements

  • If statements use 3 important instructions in assembly:

    • cmpq source2, source1: it is like computing source1-source2 without setting destination

      • Example: cmpl var_4h, %eax (Compare value in eax with var_4h)

    • testq source2, source1: it is like computing source1&source2 without setting destination

    • Jump instructions

hashtag
Types of Jumps

Jump Type
Description

jmp

Unconditional

je

Equal/Zero

jne

Not Equal/Not Zero

js

Negative

jns

Nonnegative

jg

Greater

jge

Greater or Equal

jl

Less

jle

Less or Equal

ja

Above(unsigned)

jb

Below(unsigned)

  • The last 2 values of the table refer to unsigned integers.

  • Unsigned integers cannot be negative while signed integers represent both positive and negative values.

  • Since the computer needs to differentiate between them, it uses different methods to interpret these values.

  • For signed integers, it uses something called the two’s complement representation and for unsigned integers it uses** normal binary calculations**.

hashtag
Analyzing Jump

  • To set a breakpoint: db 0x<Address>

  • To run the program until breakpoint: dc

  • To view the value of the registers at breakpoint: dr

  • To view the value in the variable: px @location

  • To seek/move onto the next instruction: ds

circle-info

  • popq instruction involves popping a value of the stack and reading it.

  • retq instruction sets this popped value to the current instruction pointer.

hashtag
Analysing if2

hashtag
Tracing the assembly code

  • Initially,

    • var_ch will have 0

    • var_4h will have 1000

    • var_8h will have 99

  • First jge will fail (var_ch > var_8h? -> FALSE)

  • Second jge will also fail (var_8h > var_4h? -> FALSE)

  • Perform and operation on var_8h with 0x64

  • Perform unconditional jmp

  • Perform sub operation on var_4h with 0x3e7

  • Clear eax

  • Pop rbp and return

hashtag
What is the value of var_8h before the popq and ret instructions?

  • Answer: 96

  • Steps to Reproduce:

    • Hex 60 -> Decimal 96

hashtag
What is the value of var_ch before the popq and ret instructions?

  • Answer: 0

  • Steps to Reproduce:

hashtag
What is the value of var_4h before the popq and ret instructions?

  • Answer: 1

  • Steps to Reproduce:

hashtag
What operator is used to change the value of var_8h, input the symbol as your answer(symbols include +, -, *, /, &, |):

  • Answer: &

  • Steps to Reproduce:

    • The following line in the code denotes that and operation is perfomed:

hashtag
Loops

  • A quicker way to examine the loop would be to add a break point to cmpl instruction and running dc. Since this is a loop, the program will always break at the cmpl instruction(because this instruction checks the condition before executing what is inside the loop)

hashtag
Analyzing loop2

hashtag
What is the value of var_8h on the second iteration of the loop?

  • Answer: 5

  • Steps to Reproduce:

hashtag
What is the value of var_ch on the second iteration of the loop?

  • Answer: 0

  • Steps to Reproduce:

hashtag
What is the value of var_8h at the end of the program?

  • Answer: 2

  • Steps to Reproduce:

hashtag
What is the value of var_ch at the end of the program?

  • Answer: 0

  • Steps to Reproduce:

hashtag
Crackme 1

hashtag
Analyzing crackme1

hashtag
What is the password?

  • Answer: 127.0.0.1

  • Steps to Reproduce:

hashtag
Crackme 2

hashtag
Analyzing crackme2

hashtag
What is the correct password?

  • Answer: dwperuc3sv

  • Steps to Reproduce:

  • Reading the secret.txt:

  • The password is checked in reverse. So, reverse the secret!

hashtag
References

PreviousCC: GhidraNextCC: Radare2

Last updated