最新章節(jié)

• Summary
• Testing the LKM
• __versions
• .gnu.linkonce.this_module
• .modinfo
• .rodata.str1.1

• Summary 更新時間：2021-08-20 10:24:04
• Testing the LKM
• __versions
• .gnu.linkonce.this_module
• .modinfo
• .rodata.str1.1
• .exit.text
• .init.text
• LKM source
• LKM structure
• A bit of kernel space
• The call obfuscation macro
• The call
• The original code
• Protecting the code
• Oh Almost Forgot
• Summary
• A shared object
• LD_PRELOAD
• ELF executables
• Fixing the call instruction
• Appending a new section
• Adjusting file headers
• Preparing the patch
• A complex scenario
• Applying the patch
• Shim code
• Patching calls
• Importing fgets()
• Preparing for the patch
• Locating calls to gets()
• Gathering information
• Imports
• Headers
• PE files
• The issue
• The executable
• Patching Legacy Code
• Summary
• The code
• Dynamic linking of ELF
• Producing the executable
• Object file
• Linking against object and/or library files
• Linux
• Importing procedures from DLL
• Producing the executable
• Object file
• Linking against object and/or library files
• Windows
• Using libraries
• Indirect system calls
• Direct system calls
• System call hardware interface
• System call
• The rings
• Operating System Interface
• Summary
• Importing from DLL/SO and function pointers
• Native structure versus managed structure
• Assembly and managed code
• Dynamic linking
• Static linking - GCC
• Static linking - Visual Studio 2017
• Interfacing with C/C++
• GetPointers()
• f_set_data_length
• f_set_data_pointer
• Setting the encryption/decryption parameters
• Encryption/decryption
• Core procedures
• Exporting symbols
• Conditional declaration of code and data sections
• Specifying the output format
• Portability
• Crypto Core
• Mixing Modules Written in Assembly and Those Written in High-Level Languages
• Summary
• Graphs
• Sparse matrices
• Tree balancing
• The loop
• Searching the tree
• The virtual processor
• Virtual code
• Adding support for a virtual processor to the Flat Assembler
• Virtual machine architecture
• Example - trivial cryptographic virtual machine
• A practical example
• Trees
• Summary for special cases of linked lists
• Cyclic linked list
• Priority queues
• Queue and deque
• Stack
• Special cases of linked lists
• Linked lists
• Arrays of pointers to structures
• Arrays of structures
• Addressing structure members
• Structures
• Arrays of words double words and quad words
• Simple byte arrays
• Arrays
• Data Structures
• Summary
• File directive
• The include directive
• Inclusion directives
• Repeat directives
• The conditional assembly
• Other assembler directives (FASM Specific)
• The GNU Assembler
• Microsoft Macro Assembler
• Macro instructions in MASM and GAS
• A note on Flat Assembler's macro capabilities
• AMD64 (64-bit)
• Microsoft x64 (64-bit)
• stdcall (32-bit)
• cdecl (32-bit)
• An introduction to calling conventions
• Variadic macro instructions
• Macro instructions with parameters
• How it works
• What are macro instructions?
• Macro Instructions
• Summary
• AVX-512
• Factorials
• Exponentiation
• Computing sine
• Adjustment of sine input values
• Calculation loop
• Data preparation steps
• The main() function
• Standard header
• The code
• Data section
• The algorithm
• The idea
• Biorhythm calculator
• Revisions
• Registers
• SSE
• Parallel Data Processing
• Summary
• Far pointers
• RIP addressing
• Scale index base and displacement
• Direct addressing
• Sequential addressing
• Addressing data
• RIP based addressing
• Indirect addressing
• Direct addressing
• Sequential addressing
• Addressing code
• Memory Addressing Modes
• Summary
• Example program
• SSE
• AES-NI
• Extensions
• FPU instructions
• Miscellaneous instructions
• Flag control instructions
• ENTER/LEAVE
• String instructions
• Execution flow transfer instructions
• Bit and byte instructions
• Shift and rotate instructions
• Logical instructions
• Decimal arithmetic instructions
• Binary Arithmetic Instructions
• Data transfer instructions
• General purpose instructions
• The instruction set summary
• A debugger
• Data types and their definitions
• The Linux Assembly template (32-bit)
• The Windows Assembly template (32-bit)
• Assembly source template
• Intel Instruction Set Architecture (ISA)
• Summary
• Linux
• Windows
• The first FASM program
• Installing the Flat Assembler
• Flat Assembler
• Step 2 - let's test
• Step 1 - installing GAS
• Installing GAS
• GNU Assembler (GAS)
• Setting up the Assembly project
• Installing Microsoft Visual Studio 2017 Community
• Microsoft Macro Assembler
• Setting Up a Development Environment
• Summary
• Remaining bits
• Bit #11 - overflow flag
• Bit #10 - direction flag
• Bit #9 - interrupt enable flag
• Bit #8 - trap flag
• Bit #7 - sign flag
• Bit #6 - zero flag
• Bit #4 - adjust flag
• Bit #2 - parity flag
• Bit #0 - carry flag
• The EFlags register
• Debug status register (DR6)
• Debug control register (DR7)
• Debug address registers DR0 - DR3
• Debug registers
• Control registers
• Long mode - paging
• Protected mode - paging
• Protected mode - segmentation
• Real mode
• Segment registers and memory organization
• XMM registers
• Floating point registers
• Instruction pointer
• Base pointer
• Source and destination indices
• Stack pointer
• Counter
• Accumulators
• General purpose registers
• Processor registers
• Intel Architecture
• Questions
• Piracy
• Errata
• Downloading the example code
• Customer support
• Reader feedback
• Conventions
• Who this book is for
• What you need for this book
• What this book covers
• Preface
• Customer Feedback
• Why subscribe?
• www.PacktPub.com
• About the Reviewer
• About the Author
• Credits
• Mastering Assembly Programming
• Copyright
• Title Page
• coverpage

• coverpage
• Title Page
• Copyright
• Mastering Assembly Programming
• Credits
• About the Author
• About the Reviewer
• www.PacktPub.com
• Why subscribe?
• Customer Feedback
• Preface
• What this book covers
• What you need for this book
• Who this book is for
• Conventions
• Reader feedback
• Customer support
• Downloading the example code
• Errata
• Piracy
• Questions
• Intel Architecture
• Processor registers
• General purpose registers
• Accumulators
• Counter
• Stack pointer
• Source and destination indices
• Base pointer
• Instruction pointer
• Floating point registers
• XMM registers
• Segment registers and memory organization
• Real mode
• Protected mode - segmentation
• Protected mode - paging
• Long mode - paging
• Control registers
• Debug registers
• Debug address registers DR0 - DR3
• Debug control register (DR7)
• Debug status register (DR6)
• The EFlags register
• Bit #0 - carry flag
• Bit #2 - parity flag
• Bit #4 - adjust flag
• Bit #6 - zero flag
• Bit #7 - sign flag
• Bit #8 - trap flag
• Bit #9 - interrupt enable flag
• Bit #10 - direction flag
• Bit #11 - overflow flag
• Remaining bits
• Summary
• Setting Up a Development Environment
• Microsoft Macro Assembler
• Installing Microsoft Visual Studio 2017 Community
• Setting up the Assembly project
• GNU Assembler (GAS)
• Installing GAS
• Step 1 - installing GAS
• Step 2 - let's test
• Flat Assembler
• Installing the Flat Assembler
• The first FASM program
• Windows
• Linux
• Summary
• Intel Instruction Set Architecture (ISA)
• Assembly source template
• The Windows Assembly template (32-bit)
• The Linux Assembly template (32-bit)
• Data types and their definitions
• A debugger
• The instruction set summary
• General purpose instructions
• Data transfer instructions
• Binary Arithmetic Instructions
• Decimal arithmetic instructions
• Logical instructions
• Shift and rotate instructions
• Bit and byte instructions
• Execution flow transfer instructions
• String instructions
• ENTER/LEAVE
• Flag control instructions
• Miscellaneous instructions
• FPU instructions
• Extensions
• AES-NI
• SSE
• Example program
• Summary
• Memory Addressing Modes
• Addressing code
• Sequential addressing
• Direct addressing
• Indirect addressing
• RIP based addressing
• Addressing data
• Sequential addressing
• Direct addressing
• Scale index base and displacement
• RIP addressing
• Far pointers
• Summary
• Parallel Data Processing
• SSE
• Registers
• Revisions
• Biorhythm calculator
• The idea
• The algorithm
• Data section
• The code
• Standard header
• The main() function
• Data preparation steps
• Calculation loop
• Adjustment of sine input values
• Computing sine
• Exponentiation
• Factorials
• AVX-512
• Summary
• Macro Instructions
• What are macro instructions?
• How it works
• Macro instructions with parameters
• Variadic macro instructions
• An introduction to calling conventions
• cdecl (32-bit)
• stdcall (32-bit)
• Microsoft x64 (64-bit)
• AMD64 (64-bit)
• A note on Flat Assembler's macro capabilities
• Macro instructions in MASM and GAS
• Microsoft Macro Assembler
• The GNU Assembler
• Other assembler directives (FASM Specific)
• The conditional assembly
• Repeat directives
• Inclusion directives
• The include directive
• File directive
• Summary
• Data Structures
• Arrays
• Simple byte arrays
• Arrays of words double words and quad words
• Structures
• Addressing structure members
• Arrays of structures
• Arrays of pointers to structures
• Linked lists
• Special cases of linked lists
• Stack
• Queue and deque
• Priority queues
• Cyclic linked list
• Summary for special cases of linked lists
• Trees
• A practical example
• Example - trivial cryptographic virtual machine
• Virtual machine architecture
• Adding support for a virtual processor to the Flat Assembler
• Virtual code
• The virtual processor
• Searching the tree
• The loop
• Tree balancing
• Sparse matrices
• Graphs
• Summary
• Mixing Modules Written in Assembly and Those Written in High-Level Languages
• Crypto Core
• Portability
• Specifying the output format
• Conditional declaration of code and data sections
• Exporting symbols
• Core procedures
• Encryption/decryption
• Setting the encryption/decryption parameters
• f_set_data_pointer
• f_set_data_length
• GetPointers()
• Interfacing with C/C++
• Static linking - Visual Studio 2017
• Static linking - GCC
• Dynamic linking
• Assembly and managed code
• Native structure versus managed structure
• Importing from DLL/SO and function pointers
• Summary
• Operating System Interface
• The rings
• System call
• System call hardware interface
• Direct system calls
• Indirect system calls
• Using libraries
• Windows
• Linking against object and/or library files
• Object file
• Producing the executable
• Importing procedures from DLL
• Linux
• Linking against object and/or library files
• Object file
• Producing the executable
• Dynamic linking of ELF
• The code
• Summary
• Patching Legacy Code
• The executable
• The issue
• PE files
• Headers
• Imports
• Gathering information
• Locating calls to gets()
• Preparing for the patch
• Importing fgets()
• Patching calls
• Shim code
• Applying the patch
• A complex scenario
• Preparing the patch
• Adjusting file headers
• Appending a new section
• Fixing the call instruction
• ELF executables
• LD_PRELOAD
• A shared object
• Summary
• Oh Almost Forgot
• Protecting the code
• The original code
• The call
• The call obfuscation macro
• A bit of kernel space
• LKM structure
• LKM source
• .init.text
• .exit.text
• .rodata.str1.1
• .modinfo
• .gnu.linkonce.this_module
• __versions
• Testing the LKM
• Summary 更新時間：2021-08-20 10:24:04