Hello, everyone, welcome to our first video of our binary exploitation series, we'll first begin
with some concepts about CPU registers, machine code and some assembly language to make it easier for
you to understand everything in this module.
The CPU is a center process unit or central processing unit is in charge of executing machine code,
which is in excess of any program.
This machine code or sometimes called machine language is set of instructions in X.
These instructions could be anything from moving data from one register to another, jump from one section
of the code to another, or some arithmetic or logic operations like subtraction or addition.
Since Hex itself is hard to read and understand, we tend to translate it to minimal code, also called
assembly language.
The program responsible of translating is called Assembler.
The most popular one in Linux is called Nazan a.m. and when one is called message and it sent, let's
take a look at Hello World Program in assembly and compared with the machine code we get from object
dump.
This is the machine code on the left side and our slides compared to what we saw in your simplifier
here.
An object dump, we use the dash cam until 4:00, showing until Syntex in this module, we will only
cover it until eighty, eighty six instructions.
You often hear people say 32 or 64 bits.
Right.
So now eighty eighty six process is is the three.
Two bits one.
And that's the size of the CPU registers, peace register is 32 bit in size, CPU registers are like
small memory, like you read your random access memory.
They are accessed by your CPU store and fetch temporary variables that and they are also very, very
fast, much, much faster than your REM.
Let's take a look at some of the general-purpose registers here in our slide index, Ebix E, DBP,
CI Eddi.
We can access the second half of each register.
Sofra as the second half of year X is X and that's a sixteen bit of the register, not the whole 32.
The added to it is only 432, a bit short for extended, so the helix will be extended accumulator register,
but the 16 registers AICS same thing for X register.
If you if we want to access the second half of it, it will be six only without it.
What if we want to access half of the X in order to access the first half and X is called H.
H is second to the mean it's called.
It's the second half of the of X is called El.
H stands for high and L stands for low.
Keep that in mind, we will need that later.
There is also another important register called IP or extended instruction pointer.
This register controls the program, execution its source a pointer to the next instruction in memory,
and it's often controlled by hackers to exploit a binary program.
So when we run a program, it will be organized in memory, like this picture from our slide.
Keep that in mind, since we will need this later.
But that text section contains your actual code, and it's marked as read only the HEAP'S section contains
variable used by functions like Mellark or Retallack and Free or maybe Callick because it works the
same as mallock.
These functions will request a memory space to assign for this specific variable.
Then finally, the Steck, which is the main ingredient of our recipe.
Think of Steck as a stack of dishes, if you put one plate on top of the other, then when you want
to take one of them out, you will start from the last one you added.
Right.
This is called litho or last in, first out.
The stack is used to store return addresses and function arguments and storing local variables.
We will get to this later in detail.
That he experiencers also called stack pointer, it points to the top of the stack each time we push
value on the stack, the VSP points to the next one.
Same thing, if you remove something from the stack, it will point to the one we just added before
it.
First thing we need to know about STAC that it goes downward, not upward, like a rheostat.
So if the address is zero, x, f, f, f, f, f, then Stack will grow.
Towards zero zero, right, let's go back and take a look at the picture here.
In our next video, we will take a look at the effect of push instruction on this stack using GDB debugger.
Thanks for watching.
See you in the next one.