Post

Decoding the Core: Unveiling the Secrets of Assembly Language

Posted Updated
Preview Image
By
views 43 min read
Decoding the Core: Unveiling the Secrets of Assembly Language

The Ultimate Guide to Assembly Language for Reverse Engineering

Assembly language holds a special place in the world of malware analysis and reverse engineering. Whether you are analyzing a piece of malware, exploiting a vulnerability, or understanding the inner workings of a program, a solid grasp of assembly language is essential. Assembly serves as the human-readable counterpart to machine code, allowing reverse engineers to decode low-level instructions that computers execute.

This guide is designed to provide you with resources, books, tools, and tutorials that will help you master assembly language and apply it effectively in reverse engineering and malware analysis. Understanding assembly not only deepens your understanding of how software works but also gives you the ability to break apart malicious binaries to investigate their behavior.

🧠 Why Learn Assembly Language?

Assembly language is as close to the hardware as you can get without stepping into the realm of machine code. It’s the bridge between the high-level programming languages we use to write software and the binary instructions the CPU understands.

In reverse engineering and malware analysis, assembly language becomes essential for dissecting executable files and malicious binaries. Malware often relies on obfuscation techniques, and being able to read assembly allows analysts to deconstruct these techniques, understand their behavior, and identify malicious functionality. Whether it’s shellcode, packers, or crackmes, assembly will be your key to unlocking the code.

Learning assembly equips reverse engineers with the tools to disassemble code, analyze system calls, debug programs, and understand how code interacts with memory and hardware. This is especially crucial when dealing with obfuscated malware or advanced persistent threats (APTs) that employ complex techniques to evade detection and analysis.

🔍 The Core Role of Assembly in Reverse Engineering

When you reverse-engineer a program or malware, you’re essentially mapping out its behavior by deconstructing the binary code. This binary is made up of machine code, which is not human-readable but directly executable by the CPU. The transformation from high-level languages (like C or Python) to machine code involves multiple layers of translation—compilers convert source code to assembly language, and then assemblers convert that assembly into machine code. However, the assembly language version of the code provides an intermediary step that can be understood by humans.

This is where disassemblers and debuggers come in. Tools like IDA Pro, Ghidra, and OllyDbg allow reverse engineers to transform machine code back into assembly language. With these tools, analysts can examine the control flow of a program, track the values in CPU registers, trace function calls, and understand how data is manipulated. This is essential for analyzing how malware behaves, especially when the malware is packed or obfuscated to disguise its functionality.

🦠 Why Assembly is Crucial for Malware Analysis ?

Malware authors often use various obfuscation techniques to make it harder for security professionals to analyze their code. These techniques may include packing, encryption, polymorphism, and metamorphism. A packed binary might look like random gibberish, but when disassembled into assembly code, the underlying logic is often easier to understand.

In addition to identifying the core functionality of malware, assembly language is also key to exploiting vulnerabilities and writing exploits. Many vulnerabilities are caused by buffer overflows and format string vulnerabilities, which are often discovered through analysis of machine code in assembly. Analyzing how data is manipulated in registers or how memory addresses are handled in assembly can give you the information needed to craft an exploit that targets these vulnerabilities.

By analyzing malware at the assembly level, you can also learn to identify packers, debug polymorphic malware, and detect memory manipulation techniques such as heap spraying and return-oriented programming (ROP), which are frequently used in modern malware and advanced persistent threat (APT) operations.

🔐 Understanding Assembly in the Context of Malware Protection

Beyond simply analyzing and dissecting malicious code, assembly language is also important for building defenses against malware. When you’re working to create effective anti-virus (AV) software, anti-malware tools, or intrusion detection systems (IDS), understanding assembly language allows you to build signatures based on the specific behavior of malware. This also helps when implementing sandboxing and emulation techniques, as you need to understand how assembly code interacts with system memory, processes, and external resources.

Moreover, by being proficient in assembly, you can create better rootkits, exploit mitigations, and bypass detection mechanisms by fully understanding how malware operates at the machine level.

🧩 Assembly Language: A Tool for Reversing Software

Assembly isn’t just for reverse-engineering malware—it’s also used in software cracking, debugging, and reverse-engineering proprietary software. Whether you’re attempting to crack software protections like DRM (Digital Rights Management) or copy protection mechanisms, assembly gives you a solid understanding of how the software interacts with the operating system and hardware.

Many modern software protections rely on obfuscation and anti-debugging techniques to prevent reverse engineers from understanding or modifying the software. Assembly allows you to break through these protections by enabling you to manipulate the program’s instructions directly at the CPU level, thereby bypassing or disabling these protections.

🎯 Key Benefits of Learning Assembly for Reverse Engineers

  1. Deep Understanding of Code: Assembly provides a deep insight into how a program works at the most fundamental level. It reveals how data is stored, how functions are called, and how the CPU processes instructions.

  2. Dealing with Obfuscation: As mentioned earlier, malware obfuscation is common. Being able to reverse these techniques and gain an understanding of the underlying behavior is a skill that assembly mastery provides.

  3. Detecting Vulnerabilities: Buffer overflows, format string vulnerabilities, and improper memory access often exist in the low-level code of software. Assembly allows you to spot these vulnerabilities, making it an essential skill for exploit development.

  4. Creating Signatures: If you are involved in creating tools for malware detection, being able to write signatures based on assembly code can improve the accuracy of intrusion detection systems (IDS), anti-malware tools, and file scanners.

  5. Bypassing Protections: Whether you’re bypassing anti-debugging techniques or breaking through software protections, assembly lets you understand how a program operates on the lowest level, giving you the ability to manipulate its behavior.

This is your comprehensive guide to understanding assembly language in the context of reverse engineering and malware analysis. With these foundational skills, you will be able to dive deep into the world of low-level code, analyze malware with precision, and harness the full power of reverse engineering tools.

💻 Common CPU Architectures

x86 Architecture

The x86 architecture, developed by Intel, remains one of the most prevalent architectures in personal computing. Its evolution spans multiple decades, starting from 16-bit systems to modern 64-bit implementations.

Key Features:

  • Complex Instruction Set Computing (CISC)
  • Backward compatibility
  • Wide range of addressing modes
  • Rich instruction set

ARM Architecture

ARM (Advanced RISC Machine) dominates the mobile and embedded systems market, known for its power efficiency and simplified instruction set.

Key Characteristics:

  • Reduced Instruction Set Computing (RISC)
  • Power-efficient design
  • Load-store architecture
  • Conditional execution

MIPS Architecture

MIPS (Microprocessor without Interlocked Pipeline Stages) is commonly found in embedded systems and networking equipment.

Notable Features:

  • RISC architecture
  • Fixed instruction length
  • Simple addressing modes
  • Delay slots for branch instructions

32-bit vs 64-bit Comparison

Feature32-bit64-bit
Memory AddressingUp to 4GBUp to 16 Exabytes
Register Size32 bits64 bits
PerformanceLimited for modern applicationsBetter for memory-intensive tasks
CompatibilityWorks with older softwareMay not run 16-bit applications

🛠️ Essential Assembly Language Instructions

In assembly language, instructions are the fundamental operations that a CPU executes. These instructions directly correspond to the actions that a processor performs on data, such as moving data between locations, performing arithmetic, making decisions, or jumping to different parts of a program. Understanding the most common assembly instructions is crucial for reverse engineering, malware analysis, and debugging, as they give insights into how a program operates at the most basic level.

📑 Table of Contents

  1. Data Moving Operations
  2. Arithmetic Operations
  3. Logical Operations
  4. Control Flow Operations
  5. String Operations
  6. Miscellaneous Instructions

Data Moving Operations

Data moving operations form the foundation of assembly programming, handling the transfer of data between different components of the computer system.

Primary Functions:

  • Transfer data between registers
  • Move data between memory and registers
  • Load immediate values into registers
  • Handle address calculations
  • Manage stack operations

Key Characteristics:

  • Don’t perform calculations or modifications
  • Preserve data integrity during transfer
  • Critical for memory management
  • Essential for function calls and parameter passing

Common Use Cases:

  • Variable initialization
  • Parameter passing to functions
  • Saving/restoring register states
  • Memory buffer management
  • Stack frame setup and cleanup

MOV Instruction

Moves data between registers, memory, and immediate values.

1
2
3
4
5
6
7
8
9
10

; Basic register moves
mov eax, ebx          ; Copy from register to register
mov ecx, 42           ; Load immediate value
mov edx, [eax]        ; Load from memory
mov [ebx], eax        ; Store to memory
mov byte [edi], 5     ; Store immediate to memory

; Segment register moves
mov ds, ax            ; Load data segment
mov es, bx            ; Load extra segment

Equivalent C Code:

1
2
3
4
5

int dest = source;
*pointer = value;
value = *pointer;
char* bytePtr = (char*)pointer;
*bytePtr = 5;

LEA (Load Effective Address)

Calculates memory addresses without accessing memory.

1
2
3
4
5

; Address calculations
lea eax, [ebx + 4]            ; Simple offset
lea eax, [ebx + 4*ecx]        ; Scaled index
lea eax, [ebx + ecx + 8]      ; Complex addressing
lea eax, [ebx + ecx*4 + 16]   ; Full SIB addressing

Equivalent C Code:

1
2
3
4

int* ptr = &array[1];
int* scaled = &array[index * 4];
int* complex = &base[index + offset];
int* full = &base[index * 4 + 16];

MOVZX/MOVSX (Move with Zero/Sign Extension)

Moves smaller values to larger registers with extension.

1
2
3
4
5
6
7

; Zero extension
movzx eax, byte [ebx]     ; Zero-extend byte to dword
movzx ecx, word [esi]     ; Zero-extend word to dword

; Sign extension
movsx eax, byte [ebx]     ; Sign-extend byte to dword
movsx ecx, word [esi]     ; Sign-extend word to dword

Equivalent C Code:

1
2
3
4
5
6
7

// Zero extension
unsigned int value = (unsigned char)*bytePtr;
unsigned int word_val = (unsigned short)*wordPtr;

// Sign extension
int value = (signed char)*bytePtr;
int word_val = (signed short)*wordPtr;

XCHG (Exchange)

Swaps values between two locations.

1
2
3
4
5
6

; Register exchanges
xchg eax, ebx              ; Swap register contents
xchg eax, [memory]         ; Swap with memory
xchg byte [esi], al        ; Swap bytes

; Note: XCHG with memory is always atomic

Equivalent C Code:

1
2
3
4
5
6
7

// Register exchange
temp = a;
a = b;
b = temp;

// Atomic exchange (simplified)
__atomic_exchange(&memory, &value, &old, __ATOMIC_SEQ_CST);

PUSH/POP Instructions

Stack operations for saving and restoring values.

1
2
3
4
5
6
7
8
9
10
11
12
13

; Basic stack operations
push eax                ; Push register
push dword [ebx]        ; Push from memory
push 42                 ; Push immediate

pop eax                 ; Pop to register
pop dword [ebx]         ; Pop to memory

; Multiple pushes/pops
pushad                  ; Push all GP registers
popad                   ; Pop all GP registers
pushfd                  ; Push FLAGS register
popfd                   ; Pop FLAGS register

Equivalent C Code:

1
2
3
4
5
6
7
8
9
10
11
12
13
14

// Stack simulation
void* stack[1024];
int stackPtr = 0;

// Push
stack[stackPtr++] = (void*)value;

// Pop
value = (int)stack[--stackPtr];

// Multiple registers (conceptual)
struct RegisterState {
    int eax, ebx, ecx, edx, esi, edi, ebp, esp;
} regs;

Final C Code For Data Moving Operations In C

This Is The Final Code In C Programming Lang With Comments To See The Compinations Of These Instructions In One High Level Code In C Programming Language :

Final Equivalent C Code For All Instructions:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

#include <stdio.h>

void swap(int *x, int *y) {
    int temp = *x;
    *x = *y;
    *y = temp;
}

int main() {
    int a = 10;       // MOV: a = 10
    int b = 20;       // MOV: b = 20
    int c;            // For results
    short d = -5;     // MOVSX: a short integer
    unsigned char e = 120;  // MOVZX: unsigned char
    int array[5] = {1, 2, 3, 4, 5}; // An array for LEA demonstration

    // MOV example: Assign value
    c = a;   // This should generate a MOV instruction in assembly

    // LEA example: Load effective address for pointer arithmetic
    c = 3 * a;  // This should generate LEA in assembly to compute 3 * a

    // MOVZX example: Zero extend the unsigned char to a larger type (int)
    int extended_e = e;

    // MOVSX example: Sign extend the short (d) to a larger type (int)
    int extended_d = d;

    // XCHG example: Swap two variables (this typically generates the XCHG instruction)
    swap(&a, &b);  // This will likely result in XCHG or equivalent swap assembly

    // PUSH and POP example:
    {
        int temp = a;  // This block should push and pop `temp` on the stack
        a = b;
        b = temp;
    }

    // Accessing array elements (demonstrates pointer arithmetic / LEA in assembly)
    c = array[2];  // Access the 3rd element, which will involve LEA in the assembly

    // Output to ensure that variables are used
    printf("a = %d, b = %d, c = %d\n", a, b, c);
    printf("Extended e (MOVZX): %d\n", extended_e);
    printf("Extended d (MOVSX): %d\n", extended_d);

    return 0;
}

Arithmetic Operations

Arithmetic operations perform mathematical calculations, forming the basis for numerical computations in assembly.

Primary Functions:

  • Basic mathematics (addition, subtraction)
  • Complex calculations (multiplication, division)
  • Increment/decrement operations
  • Comparison operations
  • Sign extension and conversion

Key Characteristics:

  • Affect CPU flags (carry, overflow, zero, sign)
  • Handle both signed and unsigned numbers
  • Support different data sizes (byte, word, dword)
  • Can work with immediate values or memory operands

Common Use Cases:

  • Mathematical computations
  • Array indexing
  • Memory address calculations
  • Loop counters
  • Financial calculations

ADD/SUB Instructions

Basic addition and subtraction.

1
2
3
4
5
6
7
8
9
10
11
12

; Addition
add eax, ebx           ; Add register to register
add eax, [memory]      ; Add memory to register
add [memory], eax      ; Add register to memory
add eax, 42            ; Add immediate
add byte [esi], 5      ; Add to memory byte

; Subtraction
sub eax, ebx           ; Subtract register from register
sub eax, [memory]      ; Subtract memory from register
sub [memory], eax      ; Subtract register from memory
sub eax, 42            ; Subtract immediate

Equivalent C Code:

1
2
3
4
5
6
7
8
9
10
11

// Addition
result += value;
result += *memPtr;
*memPtr += value;
result += 42;

// Subtraction
result -= value;
result -= *memPtr;
*memPtr -= value;
result -= 42;

MUL/DIV Instructions

Unsigned multiplication and division.

1
2
3
4
5
6
7
8
9
10
11

; Multiplication
mul ebx                ; EDX:EAX = EAX * EBX
mul dword [memory]     ; EDX:EAX = EAX * [memory]

; Division
div ebx                ; EAX = EDX:EAX / EBX, EDX = remainder
div dword [memory]     ; EAX = EDX:EAX / [memory], EDX = remainder

; Special cases
mul byte [esi]         ; AX = AL * byte
div byte [esi]         ; AL = AX / byte, AH = remainder

Equivalent C Code:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

// Multiplication
unsigned long long result = (unsigned long long)a * b;

// Division
unsigned quotient = dividend / divisor;
unsigned remainder = dividend % divisor;

// With explicit high/low parts
struct DivResult {
    unsigned quotient;
    unsigned remainder;
};

DivResult divideWithRemainder(unsigned long long dividend, unsigned divisor) {
    return (DivResult){
        .quotient = dividend / divisor,
        .remainder = dividend % divisor
    };
}

Final C Code For Arithemetic Operations In C

This Is The Final Code In C Programming Lang With Comments To See The Compinations Of These Instructions In One High Level Code In C Programming Language :

Final Equivalent C Code For All Instructions:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

#include <stdio.h>

int main() {
    int a = 10;  // Variable initialization
    int b = 5;
    int c;
    int result;

    // ADD: Perform addition
    result = a + b;  // This should generate an ADD instruction

    // SUB: Perform subtraction
    result = a - b;  // This should generate a SUB instruction

    // MUL: Perform multiplication
    result = a * b;  // This should generate a MUL instruction

    // DIV: Perform division
    result = a / b;  // This should generate a DIV instruction

    // INC: Increment a variable
    a++;  // This should generate an INC instruction

    // DEC: Decrement a variable
    b--;  // This should generate a DEC instruction

    // IMUL: Signed multiplication (should generate IMUL)
    result = a * b;  // Signed multiplication should result in IMUL

    // CMP: Perform a comparison
    if (a == b) {    // This will generate a CMP instruction for comparison
        c = 1;
    } else {
        c = 0;
    }

    // Output to ensure all variables are used
    printf("result = %d\n", result);
    printf("a = %d, b = %d, c = %d\n", a, b, c);

    return 0;
}

Logical Operations

Logical operations manipulate individual bits within data, essential for boolean logic and bit manipulation.

Primary Functions:

  • Bitwise operations (AND, OR, XOR)
  • Bit testing and manipulation
  • Shift and rotate operations
  • Bit masking
  • Flag manipulation

Key Characteristics:

  • Work at the bit level
  • Don’t generate carries between bits
  • Useful for optimization
  • Essential for hardware interaction
  • Important for cryptography

Common Use Cases:

  • Flag manipulation
  • Hardware register configuration
  • Data compression
  • Encryption algorithms
  • Pattern matching

AND/OR Instructions

Bitwise logical operations for bit manipulation.

1
2
3
4
5
6
7
8
9
10
11

; AND operations
and eax, ebx           ; Bitwise AND registers
and eax, [memory]      ; AND with memory
and eax, 0xFF          ; AND with immediate
and byte [esi], 0x0F   ; AND memory byte with immediate

; OR operations
or eax, ebx            ; Bitwise OR registers
or eax, [memory]       ; OR with memory
or eax, 0xFF00         ; OR with immediate
or word [esi], 0x8000  ; OR memory word with immediate

Equivalent C Code:

1
2
3
4
5
6
7
8
9
10
11

// AND operations
result &= value;
result &= *memPtr;
result &= 0xFF;
*bytePtr &= 0x0F;

// OR operations
result |= value;
result |= *memPtr;
result |= 0xFF00;
*wordPtr |= 0x8000;

XOR/NOT Instructions

Exclusive OR and bit inversion operations.

1
2
3
4
5
6
7
8
9
10

; XOR operations
xor eax, eax           ; Zero register (faster than mov eax, 0)
xor eax, ebx           ; XOR registers
xor [memory], eax      ; XOR memory with register
xor eax, 0xFF          ; XOR with immediate

; NOT operations
not eax                ; Invert all bits in register
not byte [esi]         ; Invert memory byte
not word [edi]         ; Invert memory word

Equivalent C Code:

1
2
3
4
5
6
7
8
9
10

// XOR operations
value = 0;              // xor eax, eax
result ^= value;
*memPtr ^= value;
result ^= 0xFF;

// NOT operations
result = ~value;
*bytePtr = ~(*bytePtr);
*wordPtr = ~(*wordPtr);

Shift Instructions (SHR/SHL/ROR/ROL)

Bit shifting and rotation operations.

1
2
3
4
5
6
7
8
9
10
11

; Logical shifts
shr eax, 1             ; Shift right by 1 (divide by 2)
shr eax, cl            ; Shift right by CL bits
shl eax, 4             ; Shift left by 4 (multiply by 16)
shl byte [esi], 1      ; Shift memory byte left

; Rotations
ror eax, 8             ; Rotate right 8 bits
ror dword [esi], cl    ; Rotate memory right
rol eax, 1             ; Rotate left 1 bit
rol word [edi], 4      ; Rotate memory word left

Equivalent C Code:

1
2
3
4
5
6
7
8
9
10
11
12

// Logical shifts
unsigned int rightShift = value >> 1;
unsigned int leftShift = value << 4;

// Rotations (no direct C equivalent, needs helper function)
unsigned int rotateRight(unsigned int value, int shift) {
    return (value >> shift) | (value << (32 - shift));
}

unsigned int rotateLeft(unsigned int value, int shift) {
    return (value << shift) | (value >> (32 - shift));
}

Final C Code For Logical Operations In C

This Is The Final Code In C Programming Lang With Comments To See The Compinations Of These Instructions In One High Level Code In C Programming Language :

Final Equivalent C Code For All Instructions:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

#include <stdio.h>

int main() {
    unsigned int a = 0xF0F0F0F0;  // Example hex value
    unsigned int b = 0x0F0F0F0F;  // Example hex value
    unsigned int result;

    // AND: Perform bitwise AND
    result = a & b;  // This should generate an AND instruction

    // OR: Perform bitwise OR
    result = a | b;  // This should generate an OR instruction

    // XOR: Perform bitwise XOR
    result = a ^ b;  // This should generate an XOR instruction

    // NOT: Perform bitwise NOT
    result = ~a;  // This should generate a NOT instruction

    // SHR: Shift right
    result = a >> 2;  // This should generate a SHR (shift right) instruction

    // SHL: Shift left
    result = a << 2;  // This should generate a SHL (shift left) instruction

    // ROR: Rotate right (can use logical shifts or emulate it)
    result = (a >> 2) | (a << (32 - 2));  // This should emulate ROR instruction

    // ROL: Rotate left (can use logical shifts or emulate it)
    result = (a << 2) | (a >> (32 - 2));  // This should emulate ROL instruction

    // Output to ensure variables are used
    printf("a = %08x, b = %08x, result = %08x\n", a, b, result);

    return 0;
}

Control Flow Operations

Control flow operations determine program execution path, enabling decision-making and loop structures.

Primary Functions:

  • Unconditional jumps
  • Conditional branches
  • Loop control
  • Function calls and returns
  • Exception handling

Key Characteristics:

  • Based on CPU flags
  • Support both near and far jumps
  • Enable complex decision trees
  • Critical for program structure
  • Handle interrupt processing

Common Use Cases:

  • Implementing if-then-else structures
  • Creating loops
  • Function implementation
  • Error handling
  • State machine implementation

Unconditional Jump

Direct and indirect jumps.

1
2
3
4
5
6
7
8
9

; Direct jumps
jmp label              ; Jump to label
jmp short label        ; Short jump (±128 bytes)
jmp near label         ; Near jump (±2GB)

; Indirect jumps
jmp eax                ; Jump to address in register
jmp [eax]              ; Jump to address in memory
jmp [table + eax*4]    ; Jump using jump table

Equivalent C Code:

1
2
3
4
5
6
7
8
9
10
11

// Direct jump
goto label;

// Indirect jump (function pointer)
void (*func_ptr)() = some_function;
func_ptr();

// Jump table
typedef void (*jump_func)();
jump_func jump_table[] = {func1, func2, func3};
jump_table[index]();

Conditional Jumps

Various condition-based jumps.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

; Equality comparisons
je  equal_label        ; Jump if equal (ZF=1)
jne different_label    ; Jump if not equal (ZF=0)

; Signed comparisons
jg  greater_label      ; Jump if greater (signed)
jge greater_eq_label   ; Jump if greater or equal
jl  less_label        ; Jump if less
jle less_eq_label     ; Jump if less or equal

; Unsigned comparisons
ja  above_label       ; Jump if above (unsigned)
jae above_eq_label    ; Jump if above or equal
jb  below_label      ; Jump if below
jbe below_eq_label   ; Jump if below or equal

; Flag-based jumps
jo  overflow_label    ; Jump if overflow
jno no_overflow      ; Jump if no overflow
js  sign_label       ; Jump if sign (negative)
jns no_sign_label    ; Jump if no sign (positive)
jc  carry_label      ; Jump if carry
jnc no_carry_label   ; Jump if no carry

Equivalent C Code:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

// Equality
if (a == b) goto equal_label;
if (a != b) goto different_label;

// Signed comparisons
if (a > b)  goto greater_label;
if (a >= b) goto greater_eq_label;
if (a < b)  goto less_label;
if (a <= b) goto less_eq_label;

// Unsigned comparisons
if ((unsigned)a > (unsigned)b)  goto above_label;
if ((unsigned)a >= (unsigned)b) goto above_eq_label;
if ((unsigned)a < (unsigned)b)  goto below_label;
if ((unsigned)a <= (unsigned)b) goto below_eq_label;

// Flag checks (no direct C equivalent)
if (overflow_occurred) goto overflow_label;
if (!overflow_occurred) goto no_overflow;
if (value < 0) goto sign_label;
if (value >= 0) goto no_sign_label;

Final C Code For Control Flow Operations In C

This Is The Final Code In C Programming Lang With Comments To See The Compinations Of These Instructions In One High Level Code In C Programming Language :

Final Equivalent C Code For All Instructions:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

    #include <stdio.h>

int main() {
    int a = 10;
    int b = 20;
    int c = 15;

    // Unconditional Jump: Using a `goto` statement in C
    printf("Before unconditional jump\n");
    goto label_unconditional; // This should generate a JMP instruction
    printf("This will be skipped due to the unconditional jump\n");

label_unconditional:
    printf("After unconditional jump\n");

    // Conditional Jumps: Using `if` statements to generate various jump instructions
    if (a == b) { // JE/JZ (Jump if equal)
        printf("a is equal to b (JE/JZ)\n");
    }

    if (a != b) { // JNE/JNZ (Jump if not equal)
        printf("a is not equal to b (JNE/JNZ)\n");
    }

    if (a > b) { // JG/JNLE (Jump if greater)
        printf("a is greater than b (JG/JNLE)\n");
    }

    if (a >= b) { // JGE/JNL (Jump if greater or equal)
        printf("a is greater than or equal to b (JGE/JNL)\n");
    }

    if (a < b) { // JL/JNGE (Jump if less)
        printf("a is less than b (JL/JNGE)\n");
    }

    if (a <= b) { // JLE/JNG (Jump if less or equal)
        printf("a is less than or equal to b (JLE/JNG)\n");
    }

    unsigned int ua = 10, ub = 5;

    if (ua > ub) { // JA/JNBE (Jump if above, for unsigned comparison)
        printf("ua is above ub (JA/JNBE)\n");
    }

    if (ua >= ub) { // JAE/JNB (Jump if above or equal, for unsigned comparison)
        printf("ua is above or equal to ub (JAE/JNB)\n");
    }

    if (ua < ub) { // JB/JNAE (Jump if below, for unsigned comparison)
        printf("ua is below ub (JB/JNAE)\n");
    }

    if (ua <= ub) { // JBE/JNA (Jump if below or equal, for unsigned comparison)
        printf("ua is below or equal to ub (JBE/JNA)\n");
    }

    // Loop with conditional jump at the end
    int counter = 3;
    while (counter > 0) { // Loop will likely generate conditional jump instructions
        printf("Counter: %d\n", counter);
        counter--;
    }

    return 0;
}

String Operations

String operations efficiently handle sequential data manipulation, optimized for bulk data processing.

Primary Functions:

  • String copying and moving
  • String comparison
  • Memory scanning
  • Buffer filling
  • String searching

Key Characteristics:

  • Auto-increment/decrement addressing
  • Support for repeated operations
  • Direction control (forward/backward)
  • Hardware-optimized performance
  • Block operation capability

Common Use Cases:

  • Memory copying
  • String manipulation
  • Buffer initialization
  • Pattern searching
  • Data validation

Basic String Move Instructions (MOVS)

Transfer data between memory locations using ESI (source) and EDI (destination).

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

; Byte string operations
movsb                  ; Move single byte [ESI] to [EDI]
rep movsb              ; Move ECX bytes
; Word string operations
movsw                  ; Move single word [ESI] to [EDI]
rep movsw              ; Move ECX words
; Doubleword operations
movsd                  ; Move single dword [ESI] to [EDI]
rep movsd              ; Move ECX dwords

; Example: Copy 100 bytes
mov ecx, 100           ; Set counter
mov esi, source        ; Set source
mov edi, destination   ; Set destination
cld                    ; Clear direction flag (forward)
rep movsb              ; Copy bytes

Equivalent C Code:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

// Basic memory copy operations
void* string_copy(void* dest, const void* src, size_t count) {
    char* d = (char*)dest;
    const char* s = (const char*)src;
    
    // Byte copy
    while (count--)
        *d++ = *s++;
        
    return dest;
}

// Word copy (16-bit)
void word_copy(uint16_t* dest, const uint16_t* src, size_t count) {
    while (count--)
        *dest++ = *src++;
}

// Dword copy (32-bit)
void dword_copy(uint32_t* dest, const uint32_t* src, size_t count) {
    while (count--)
        *dest++ = *src++;
}

String Scan Instructions (SCAS)

Compare AL/AX/EAX with memory at EDI.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

; Byte scan
mov al, 'A'            ; Character to find
mov edi, string        ; String to search
mov ecx, length        ; String length
repne scasb            ; Scan until match or ECX=0

; Word scan
mov ax, pattern        ; Pattern to find
repne scasw            ; Scan for word pattern

; Dword scan
mov eax, dwordPattern  ; Pattern to find
repne scasd            ; Scan for dword pattern

; Example: Find string terminator
mov al, 0              ; Look for null terminator
repne scasb            ; Scan string
sub edi, string        ; Calculate length
dec edi                ; Adjust for off-by-one

Equivalent C Code:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

// Byte scan
char* find_char(const char* str, char ch, size_t length) {
    while (length--) {
        if (*str == ch)
            return (char*)str;
        str++;
    }
    return NULL;
}

// Word scan
uint16_t* find_word(uint16_t* data, uint16_t pattern, size_t length) {
    while (length--) {
        if (*data == pattern)
            return data;
        data++;
    }
    return NULL;
}

// Calculate string length
size_t string_length(const char* str) {
    const char* s = str;
    while (*s) s++;
    return s - str;
}

String Store Instructions (STOS)

Fill memory with value from AL/AX/EAX.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

; Byte store
mov al, 0              ; Value to store
mov edi, buffer        ; Destination buffer
mov ecx, size          ; Buffer size
rep stosb              ; Fill buffer

; Word store
mov ax, 0xFFFF         ; Pattern to store
rep stosw              ; Fill with words

; Dword store
mov eax, 0xAAAAAAAA    ; Pattern to store
rep stosd              ; Fill with dwords

; Example: Initialize array
xor eax, eax           ; Clear EAX (zeros)
mov ecx, 1000          ; Array size
mov edi, array         ; Array pointer
rep stosd              ; Fill array with zeros

Equivalent C Code:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

// Memory fill operations
void* mem_set(void* dest, int value, size_t count) {
    unsigned char* ptr = (unsigned char*)dest;
    unsigned char val = (unsigned char)value;
    
    while (count--)
        *ptr++ = val;
        
    return dest;
}

// Word fill
void word_set(uint16_t* dest, uint16_t value, size_t count) {
    while (count--)
        *dest++ = value;
}

// Dword fill
void dword_set(uint32_t* dest, uint32_t value, size_t count) {
    while (count--)
        *dest++ = value;
}

Miscellaneous Instructions

Miscellaneous instructions provide system control and special-purpose operations.

Primary Functions:

  • Processor control
  • Flag manipulation
  • System timing
  • Processor synchronization
  • Special hardware operations

Key Characteristics:

  • System-level control
  • Processor state manipulation
  • Hardware interaction
  • Debug support
  • Performance optimization

Common Use Cases:

  • System initialization
  • Power management
  • Debugging support
  • Hardware control
  • Performance tuning

Processor Control Instructions

Basic CPU control operations.

1
2
3
4
5
6
7
8
9
10
11
12

; System control
nop                    ; No operation (1 cycle delay)
hlt                    ; Halt processor
wait                   ; Wait for FPU

; Multiple NOPs
times 10 nop           ; Insert 10 NOPs

; Processor feature detection
mov eax, 1            ; CPUID function 1
cpuid                 ; Get processor info
test edx, 0x10        ; Test for specific feature

Equivalent C Code:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

// CPU delay simulation
void cpu_delay(int cycles) {
    while (cycles--)
        __asm__("nop");
}

// CPU halt wrapper
void cpu_halt(void) {
    __asm__("hlt");
}

// CPUID wrapper
void get_cpu_info(uint32_t* eax, uint32_t* ebx, 
                  uint32_t* ecx, uint32_t* edx) {
    __asm__ __volatile__(
        "cpuid"
        : "=a"(*eax), "=b"(*ebx), "=c"(*ecx), "=d"(*edx)
        : "a"(1)
    );
}

Flag Control Instructions

Manipulate processor flags directly.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

; Carry flag operations
clc                    ; Clear carry flag
stc                    ; Set carry flag
cmc                    ; Complement carry flag

; Direction flag control
cld                    ; Clear direction (forward)
std                    ; Set direction (backward)

; Example: String operation with direction
cld                    ; Ensure forward direction
rep movsb             ; Copy forward
std                    ; Switch to backward
mov esi, strend       ; Point to string end
mov edi, destend      ; Point to destination end
rep movsb             ; Copy backward

Equivalent C Code:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

// Flag manipulation wrappers
void clear_carry(void) {
    __asm__("clc");
}

void set_carry(void) {
    __asm__("stc");
}

void set_direction_forward(void) {
    __asm__("cld");
}

void set_direction_backward(void) {
    __asm__("std");
}

// Example string copy with direction
void copy_string_reverse(char* dest, const char* src, size_t len) {
    dest += len - 1;
    src += len - 1;
    while (len--)
        *dest-- = *src--;
}

Final C Code For String And Miscellaneous Operations In C

This Is The Final Code In C Programming Lang With Comments To See The Compinations Of These Instructions In One High Level Code In C Programming Language :

Final Equivalent C Code For All Instructions:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

#include <stdio.h>
#include <string.h>

int main() {
    // Initialize some arrays for string operations
    char src[10] = "abcdefghi";  // Source string
    char dst[10];                // Destination string
    char pattern = 'd';          // Pattern to search for
    int count = 10;              // Number of elements

    // MOVS equivalent: Copy src to dst (memcpy should result in MOVS with REP prefix)
    memcpy(dst, src, count);

    // STOS equivalent: Set all values in dst to 'z' (memset should result in STOS with REP prefix)
    memset(dst, 'z', count);

    // SCAS equivalent: Search for 'd' in src (strchr may use SCAS in assembly)
    char *found = strchr(src, pattern);
    if (found) {
        printf("Character '%c' found at position %ld\n", pattern, found - src);
    } else {
        printf("Character '%c' not found\n", pattern);
    }

    // Miscellaneous instructions
    asm volatile (
        "cld;"          // Clear direction flag (CLD)
        "std;"          // Set direction flag (STD)
        "stc;"          // Set carry flag (STC)
        "clc;"          // Clear carry flag (CLC)
        "cmc;"          // Complement carry flag (CMC)
        "nop;"          // No operation (NOP)
        :                // No outputs
        :                // No inputs
        : "cc"           // Clobber condition codes
    );

    // Output to verify operations
    printf("Source: %s\n", src);
    printf("Destination after MOVS and STOS equivalent operations: %s\n", dst);

    return 0;
}

📚 Must-Read Books for Assembly Language and Reverse Engineering

To get started, there are several books that offer detailed explanations of assembly language, reverse engineering techniques, and malware analysis. These books are perfect for both beginners and experienced practitioners.

📖 Foundational Assembly Language Books

  1. The Art of Assembly Language by Randall Hyde
    • A comprehensive guide to assembly, covering key concepts, instructions, and syntax across multiple platforms. Perfect for beginners and intermediate learners.
  2. Programming from the Ground Up by Jonathan Bartlett
    • This book teaches assembly language in the context of Linux and x86 architecture, focusing on low-level programming and the mechanics of how software works.
  3. Reverse Engineering for Beginners by Dennis Yurichev
    • A detailed guide to reverse engineering using assembly. This book covers x86 and x64 architectures, debugging, and analysis techniques.
  4. The IDA Pro Book by Chris Eagle
    • While primarily focused on IDA Pro, this book dives deep into disassembly and reverse engineering with assembly code. It’s a must-read for reverse engineers using IDA Pro.
  5. Practical Reverse Engineering by Bruce Dang
    • Offers practical guidance on applying reverse engineering techniques, including assembly-level analysis of real-world programs.
  6. Hacking: The Art of Exploitation by Jon Erickson
    • This book explains how exploit development ties into reverse engineering, with a strong focus on assembly language and understanding low-level program behavior.
  7. Gray Hat Hacking by Daniel Regalado
    • This book covers a range of hacking techniques, including exploiting vulnerabilities using assembly and understanding how assembly fits into the exploitation process.
  8. Malware Analyst’s Cookbook by Michael Ligh
    • A fantastic resource with practical recipes for malware analysis, including disassembly and understanding malicious code at the assembly level.
  9. Introduction to 80x86 Assembly Language and Computer Architecture by Richard C. Detmer
    • Ideal for beginners, this book explains the basics of x86 assembly language and lays a solid foundation for reverse engineering.
  10. Assembly Language for x86 Processors by Kip R. Irvine
    • A popular textbook on x86 assembly, covering a wide range of topics, from basic to advanced concepts, with practical examples.
  11. x86 Assembly Language and C Fundamentals by Joseph M. Carthy
    • Blends x86 assembly with C programming fundamentals to help you understand low-level programming from both perspectives.

📘 Advanced Assembly Language and Reverse Engineering Books

  1. Reversing: Secrets of Reverse Engineering by Eldad Eilam
    • A detailed exploration of reverse engineering that includes assembly-based techniques, focusing on common x86 and x64 architectures.
  2. Practical Malware Analysis by Michael Sikorski and Andrew Honig
    • Focuses on both static and dynamic analysis of malware. This book is a must-have for anyone learning how to disassemble and analyze malware at the assembly level.
  3. The Art of Computer Virus Research and Defense by Peter Szor
    • This book focuses on computer viruses and malware from a reverse engineering perspective, with plenty of assembly-level discussions.
  4. Rootkits: Subverting the Windows Kernel by Greg Hoglund
    • Learn how rootkits operate at the kernel level using assembly to manipulate the operating system.
  5. The Shellcoder’s Handbook by Chris Anley, John Heasman, Felix Lindner, and Gerardo Richarte
    • This book focuses on shellcode, which is often written in assembly language. A must-read for anyone looking to understand buffer overflows and exploit development.
  6. The Windows Internals Series by Mark Russinovich, David Solomon, and Alex Ionescu
    • Although not exclusively about assembly, this series provides a deep dive into Windows internals, making it an invaluable resource for understanding how assembly interacts with the operating system’s internals.
  7. Advanced Windows Debugging by Mario Hewardt and Daniel Pravat
    • An excellent resource for learning advanced debugging and reverse engineering on Windows, with a focus on assembly and Windows internals.
  8. The Binary Audit by Saif El-Sherei
    • A recent addition, this book delves into binary analysis, exploitation, and malware analysis using assembly techniques, making it valuable for modern-day reverse engineering tasks.

📚 Additional Books on Assembly Language

  1. Assembly Language Step-by-Step: Programming with Linux by Jeff Duntemann
    • This book provides an easy-to-understand guide for beginners, focusing on Linux and x86 assembly, ideal for those new to assembly programming.
  2. Introduction to Assembly Language Programming by Joerg Mayer
    • A straightforward introduction to assembly language programming, covering Intel x86 architecture and useful for understanding fundamental assembly concepts.
  3. Computer Systems: A Programmer’s Perspective by Randal E. Bryant and David R. O’Hallaron
    • Although not strictly about assembly, this book dives into computer systems and includes a strong focus on low-level programming concepts, assembly, and machine code.

🔧 Essential Tools for Disassembling and Analyzing Assembly Code

🛠️ Disassemblers & Debuggers

Disassemblers convert machine code into human-readable assembly language, while debuggers allow you to trace the execution flow and inspect memory, registers, and stack content.

  1. IDA Pro
    • The gold standard for disassembly and reverse engineering. IDA Pro is widely used for analyzing binaries, including malware. It disassembles code and translates it into assembly instructions for further analysis.
  2. Ghidra
    • A free tool developed by the NSA for reverse engineering. It supports disassembly, decompilation, and debugging, making it ideal for assembly analysis.
  3. OllyDbg
    • A popular debugger for 32-bit Windows executables. OllyDbg allows you to debug and analyze assembly code in real-time.
  4. x64dbg
    • A modern open-source debugger for x86 and x64 Windows applications. It provides powerful debugging features tailored for analyzing assembly and binary exploitation.
  5. Radare2
    • An open-source reverse engineering framework that includes a disassembler, debugger, and decompiler. Radare2 is a powerful tool for analyzing assembly code at a low level.
  6. Immunity Debugger
    • A debugger often used for exploit development and binary analysis. It allows real-time inspection of assembly code and is useful for reverse engineering malware.
  7. Binary Ninja
    • A commercial reverse engineering platform that offers disassembly and decompilation. It provides a sleek UI and is used for vulnerability research and malware analysis.
  8. WinDbg
    • Microsoft’s own debugger for Windows. Useful for debugging at both user mode and kernel mode, it’s ideal for Windows internals analysis.
  9. Cutter
    • A user-friendly front-end for Radare2, Cutter provides an intuitive UI for Radare2’s features, making it easier to work with disassembly, debugging, and decompilation.
  10. Hopper
    • A disassembler and debugger for macOS and Linux. It offers decompilation and scripting capabilities, ideal for macOS binary analysis.

🔄 Decompilers

Decompilers convert assembly or machine code back into higher-level languages, which can aid in understanding complex functions.

  1. Hex-Rays Decompiler
    • An extension for IDA Pro, Hex-Rays decompiles assembly into pseudo-C code. It’s popular among reverse engineers for complex binary analysis.
  2. RetDec
    • An open-source decompiler for x86, x64, ARM, and other architectures. RetDec provides C-like pseudocode from binary files, making reverse engineering easier.
  3. Snowman
    • A lightweight, open-source C++ decompiler that works with several disassembly frameworks, including IDA Pro, to produce readable C code.

🧬 Binary Analysis Tools

These tools help inspect binaries for potential security flaws, such as vulnerabilities and misconfigurations.

  1. Angr
    • A powerful binary analysis framework that supports symbolic execution and vulnerability research. Angr is widely used in academic research and CTF competitions.
  2. Binwalk
    • A tool primarily for analyzing and extracting firmware images. Binwalk is widely used in embedded systems analysis.
  3. Dyninst
    • A toolkit for binary instrumentation, allowing dynamic modifications of binary executables. Useful in software security research.
  4. Binary Analysis Platform (BAP)
    • A binary analysis toolkit developed by Carnegie Mellon. BAP is designed for advanced static analysis and binary instrumentation.

🧪 Emulators & Sandboxes

Emulators and sandboxes simulate execution environments, allowing you to observe program behavior without affecting the host machine.

  1. QEMU
    • A generic and open-source machine emulator and virtualizer, often used for testing assembly code on different architectures.
  2. Cuckoo Sandbox
    • An open-source malware analysis sandbox. Cuckoo Sandbox runs binaries in a safe environment and provides detailed behavioral reports.
  3. Unicorn Engine
    • A lightweight, multi-architecture CPU emulator that supports x86, ARM, MIPS, and SPARC architectures. Useful for quick code testing and debugging.

⚙️ Hex Editors

Hex editors allow low-level manipulation of binary data and can be useful when modifying executable files directly.

  1. HxD
    • A fast and reliable hex editor for Windows that enables easy editing of large files, often used in malware analysis.
  2. 010 Editor
    • A professional hex editor with templates for parsing binary file formats, making it a great choice for reverse engineering.
  3. Hex Fiend
    • A fast, open-source hex editor for macOS. Hex Fiend can handle large files, and its search functionality is useful for analyzing binaries.
  4. Bless
    • A hex editor for Linux with features such as find and replace, allowing easy inspection of binary content.
  5. HxE Hex Editor
    • An alternative hex editor with lightweight functionality for Windows, useful for quick edits to binary files.

🛠️ Additional Reverse Engineering Tools

  1. Frida
    • A dynamic instrumentation toolkit for developers, reverse engineers, and security researchers. Frida injects JavaScript into native apps for deep analysis.
  2. API Monitor
    • A tool that allows you to monitor and record API calls made by applications. It’s beneficial for analyzing function calls at runtime.
  3. SysInternals Suite
    • A collection of tools for Windows system diagnostics, including Process Explorer, Process Monitor, and others for low-level system monitoring.
  4. Lighthouse
    • A code coverage visualization plugin for IDA Pro and Binary Ninja, allowing you to see which parts of a binary were executed.
  5. Firmadyne
    • A framework for analyzing embedded Linux firmware. Useful for security analysis of IoT devices and embedded systems.
  6. Androguard
    • A reverse engineering tool for Android applications that helps in analyzing APK files and understanding app behavior.

📺 Recommended Video Tutorials & YouTube Channels

  1. BlackSilence
    • Offers in-depth Arabic tutorials on malware analysis, reverse engineering, and binary exploitation. Known for its detailed explanations of assembly language in practical reverse engineering scenarios.
  2. Malware Unicorn
    • Covers various aspects of binary exploitation and reverse engineering, including assembly walkthroughs of real-world vulnerabilities.
  3. John Hammond
    • Focuses on CTF challenges and malware analysis, explaining assembly-level techniques to dissect binaries and exploits.
  4. OALabs
    • Specializes in malware analysis and reverse engineering, with tutorials that dive into assembly-level disassembly and debugging techniques.
  5. LiveOverflow
    • Focuses on binary exploitation and provides in-depth explanations of assembly usage in solving real-world challenges.
  6. The Modern Security Training
    • Offers a variety of tutorials on malware analysis and binary exploitation with plenty of emphasis on assembly programming.
  7. Open Security Training
    • Features detailed courses on x86 assembly, computer architecture, and reverse engineering fundamentals. A great channel for in-depth assembly learning.
  8. Gynvael Coldwind
    • Known for live coding sessions and CTF challenge walkthroughs, with a focus on low-level programming and assembly language.
  9. Zachary Minneker
    • A channel dedicated to reverse engineering and malware analysis tutorials, with an emphasis on disassembling and understanding assembly code.
  10. Azeria Labs
    • Focuses on ARM assembly language and reverse engineering for mobile platforms. Known for easy-to-follow tutorials on ARM exploitation.
  11. Cyber Mentor
    • Provides courses on cybersecurity and hacking, with some tutorials covering low-level programming and assembly basics.
  12. The Cyber Plumber
    • A channel that goes through binary exploitation and reverse engineering with step-by-step assembly explanations.
  13. Brutal CTF
    • Walkthroughs of binary exploitation challenges, explaining assembly and disassembly in detail for CTF prep.
  14. Tech Raj
    • Focuses on computer architecture and low-level programming, including introductory assembly tutorials.
  15. Jeffrey Walton
    • Tutorials on programming, debugging, and reverse engineering with a focus on Intel x86 assembly.
  16. CodeBullet
    • Covers some low-level programming topics, including assembly language in the context of projects and challenges.

💬 Final Thoughts

Mastering assembly language in reverse engineering is a critical skill that will greatly enhance your ability to analyze and understand malware. The resources, books, tools, and tutorials listed above will guide you in your journey towards mastering assembly language and its application in the real world of malware analysis.

By consistently practicing and engaging with the resources provided here, you will deepen your understanding of assembly and gain the expertise necessary to tackle more complex reverse engineering challenges. Keep learning, stay curious, and never stop exploring the vast world of cybersecurity!

Stay motivated and good luck on your assembly language journey!

Feel free to share and let others benefit from this guide! 😎

malware-analysis, reverse-engineering, assembly-language, cybersecurity
assembly reverse-engineering malware-analysis debugging tools books forensics disassembly reverse-engineering-skills exploit-development
This post is licensed under CC BY 4.0 by the author.