Hello, this is Dr. Miller, and this
is Episode thirteen point one of
Assembly.
Today, we're going to talk about the
compilation process and then some
tools like Binary Format
Readers and dissemblers.
Compilation process.
So we have a few examples of
some different compilers, like
Visual Studio or
GW, which is a DCC
compiler and a compiler, is just
a program that translates some
computer code that somebody has
written from one programing
language into another.
And so we have our source, which
is generally written in in a high
level language, and then we have
some sort of target.
And generally what we're going to do
is we're going to take high level
code and we're going to turn it into
a binary machine readable
code that we can then execute on
a system.
So the process is it takes in a high
level program and then will
generally produce an intermediate
representation so that you could
have multiple
different inputs and be able
to apply the same optimizations
to different inputs.
So, for example, C Sharp allows you
to write something in a variety of
different languages and then
it compiles them all down to
a common intermediate representation
and then is able to apply
optimizations to any code written
despite the language it's written
in.
And then it generates the output
program or the binary file.
So the output that's going to depend
on the target architecture,
so few examples here,
so you might be running Windows XP
86 or OS 10 x 86
or Android UNarm
or iOS unarm.
And you could have also Linux on ARM
or six.
And so your output is going to
highly depend on what architecture
you're wanting to save for.
So we've seen to this course
it's six code and then arm code
and those are going to be different
pieces of code that are generated.
And what's generated is
a binary file format,
and so what we have
is we have a format defined by
the operating system, something that
is readable by each of us.
So some examples.
So we have the format which is used
for Linux.
We have the cough or some common
object file format or file
for Windows.
And then Austin has Mocho.
So here's some examples, so
if we look on the left hand side
here, we can see that we have the
actual ASCII
characters or hex characters.
So these are aski these
are going to be hacks that show
exactly what is in the file
at exactly what offset.
So we can see offset zero,
we have an M and a Z.
Additionally, inside of here, we can
see there's a P and an E and those
are going to relate
to these different headers.
And so the header is basically tell
the operating system exactly
how the files laid out.
So in a portable executable or a p
e we have a DOS header and then we
have a P header.
Right. And as it says here.
Right, the doctor says this is a
binary file and then the P
header says, oh, it's by the way,
it's not DOS, it's this new version
called P.
And then inside of that we have
additional headers or optional
headers and those will give it
information about what system it can
run on what
what is the image base that was used
to compile this and link it.
And then we have the final part,
which is the code.
And so inside the code, then
we would have the binary for
move X 42 and we
can see that in here.
And then the return is going to
be C three.
And so this is an example
of a pedophile and
the designer of this does the
basically the smallest pedophile he
can get, which is why it's called.
But we can see that the format
really specifies exactly
what we need in binary.
Now, here, the same designer here
we have the Moscow file format.
And again, we have different
what we call magic numbers.
So we can see inside of this one,
it says feed face.
So that's the magic number for AMOC.
Oh, I don't know why they did
it, but that's what they did
back here. A little bit of history.
So MSG's stands for
Mark and then I think Zippel Wig is
the name of the guy.
And so he designed the format.
So he put his initials in it.
And here we have feed face and
then we have different segments,
threads, and then at the end we
have our code.
And so, again, you can see that
when it's going to do an exit right
here, it's doing an entity versus
our previous one.
We just did see three or
return end.
And so the output format
is highly dependent on the
architecture that you are saving
to.
And then finally, we have the ELF
format or executable and linkable
format, and we can see inside
of it it has the magic number seven
F and then the ASCII
letters, L.F..
And again, we have some headers
and a table and then we have
a code.
And so each one of these
is the smallest sort of
representation that you can have or
minimal representation of that
binary format.
So some tools, so
if you want to look into exactly
what code is generated by a high
level, you can use several different
ones so we can use preview
on windows.
And so that allows us to look at P
files and see the internal structure
of them.
Additionally, we have object dump.
And so this is going to display
information about object files
and also some binary
files and then we'll have some
dissemblers.
So, again, object dump is a
dissembler, it has the ability to do
disassembly for it, it's
free, it's on all versions of
Lendix. And so it's pretty easy to
use, but it's very basic.
It just does some text,
whereas these three so either pro,
binary ninja and Ghidorah
are all commercial
dissemblers. And so they have a lot
more features like being able to
rename things and color coding.
Usually Eita Pro is sort of
the default standard, but the
price tag on it is a little bit
prohibitive.
You know, nine hundred twenty eight
hundred is a little bit of a lot of
people's range.
Binary ninja is a little cheaper.
It doesn't have quite as many
features as I do pro.
It's about three hundred dollars and
then Ghidorah is free and
it has been developed by the NSA and
then released.
And so it's sort of a new tool that
just came out recently.
And so a lot of people are looking
into it as a alternative
to either pro.
But any of these are going to allow
you to disassemble or
look at the code that gets
generated.
And then, heck, senators allow you
to view and edit possibly
and save files that are
in hexadecimal representation.
So HEX is numbers
zero through nine and A through F,
and those represent four bits
for each one of those.
So some examples, hÃÂ¸st
or cheat engine.
So those are
just do hex editing,
but also all of the dissemblers will
actually show you hexadecimal
dump's.
And so this one's from Binary Ninja
showing a hex dump of a binary
that I loaded.
And then if you want to, you can
also read these binary formats using
libraries, so I just pick some
example Python ones here
so you can read a p e file or
an L file or a mock file
all from within Python.
And so these have the ability to
parse those files and then to
understand what the different
parts are and give you
representation so that if you want
to do some programing on it, you
have that ability.
Additionally, there are a lot of
other languages. I just picked some
some examples here.
So today, we talked about
compilers and what they do and their
process and then some tools
like binary format readers and
binary formats and what they were,
and then some disassembly tools that
you can use.
So looking forward, we're going to
look at the reverse engineering
process so that we can understand
how to break apart binaries if we
write something new and we don't
understand how it works and
we'll set up a miniature reverse
engineering lab so that we can look
at some of these sea constructs that
are high level constructs within the
sea language.
So what does a compiler do?
It turns high level code into
machine readable code that is
executable on a system.
If you have questions, you can email
me Miller, MJ at Unclutter
Edu, and you can find me on Twitter
at Milhouse 30.