The code files for this chapter can be found at https://github.com/PacktPublishing/Binary-Analysis-Cookbook/tree/master/Chapter-02.

When working with 32-bit assembly on our Ubuntu virtual machines, we will encounter two primary syntaxes. The default configuration of our tools follows the AT&T syntax format, but we will use the Intel syntax throughout each recipe in this book. In later chapters, we will include recipes for configuring some of our tools to display the Intel syntax.

This recipe will walk us through the subtle differences between AT&T syntax, the default, and the Intel syntax, the format we will use going forward. Don't worry about some of the tools that are used in this recipe just yet as we will cover them in detail in Chapter 5, Linux Tools for Binary Analysis.

To...

Before we jump into 64-bit assembly on Linux, it's important to learn about 32-bit x86 assembly on Linux since it will make the transition to 64-bit go much more smoothly. While I understand most modern hosts run 64-bit operating systems, I'm a firm believer in solidifying basic knowledge before moving on to the current standard. With that said, I also don't believe we need to go too far back for the purposes of preparing you for the examples in this book. We'll go over the 8-bit and 16-bit registers while covering the 32-bit registers.

In modern 32-bit x86 processors, there are a total of eight general-purpose registers, six segment registers, an EFLAGS register, and an instruction pointer register. Some processors even contain additional registers to handle floating-point mathematical operations and extended registers for...

Whether you plan to develop your own shellcode in assembly or get better at understanding disassembled binaries, the following instructions will serve you well. In this section, we'll learn about instructions that copy values; instructions that will allow us to redirect program flow by jumping elsewhere in the program; instructions that allow us to add or subtract, multiply, or divide; instructions that show us how to safely zero out registers to avoid pesky NULL bytes; instructions that allow us to interact with and manipulate the stack; and many, many more. Just a word of warning: this will be a long recipe because I want to make sure we cover as many instructions in detail as possible. This will not be a complete list of instructions but will be more than enough to get us started.

This recipe will help to solidify our knowledge of...

Now that we have a very rudimentary understanding of IA-32 registers and instructions, we can move on to the next very interesting topic when it comes to assembly. That is, how do we make system calls on Linux in our assembly programs? If you're into shellcode, know what a reverse shell is, and have used commercial or open-source tools to generate shellcode of this nature, then this recipe will help you to develop your own. We won't necessarily develop a reverse shell in this recipe; instead, we will go over the necessary knowledge for you to accomplish that kind of task. Believe me, I would enjoy writing a book on various techniques to weaponize assembly for the benefit of those who, like me, gravitate toward the offensive side of information security. Nonetheless, what you will learn in this recipe will definitely serve you well and...

The executable and linking format, or ELF for short, and its widespread use on Linux is the focus of this book. In this recipe, we will learn how to extract the important pieces of information in regards to the ELF specification as we dive into analyzing the binaries in this book. While there will be a heavy emphasis on disassembly throughout the later recipes in this book, the information that we'll gain by knowing the ELF specification will only aid us in gathering the information that's necessary for us to understand the important parts of any binary we analyze.

I also want to be clear that this particular recipe could have been expanded into a book itself, but I intentionally condensed the ELF 32-bit specification down to the absolutely necessary information for working through the later recipes. I encourage you to read the...