RE Week 2
Tags: hacking
Published: 2019-10-28 02:14:01

---
title: RE Week 2
published: true
description: Week 2 of reverse engineering
tags: #hacking
cover_image: https://i.redd.it/p334wphc5wu21.png
series: RE
---

This has been week #2 learning reverse engineering, this time I've gone over some basics:

- The call stack
  - What is it? How does it work?
- Assembly
  - Learning more about assembly x86
  - How does assembly work

Week #2 has been all about `the stack` and `assembly`. Going over the [preparations](https://www.begin.re/assignment-2) section of the workshop, I went over the purpose of `the stack` as well as `assembly`:

### What is the stack? 
  - `The stack` is a data structure, it gets assigned an area of memory which it uses to store information about the executing program, it uses `registers`(storage areas, `esp`, `ebp`,`eax`, `nop` etc) to know what's executing by storing data & memory addresses, we can use `instructions`(actions we can perform using `assembly language` like `push`, `pop`, `mov`, `jmp` and more) to interact with `the stack`
  - The stack grows down to higher memory addresses, which also means `the stack` starts at lower memory addresses.
  - `The stack` keeps track of everything that happens when a program executes, it knows exactly what variables the program will use and which functions are running by using `registers` like `ebp`(which points to the base of the stack) and `eip`(which points to the next instruction to perform).

{% youtube vcfQVwtoyHY %}

### What is assembly?
- Low-level programming language
- Gets turned into `machine language`
- `Instruction set` is used to write programs which use `registers` and `instructions`
  - some `instructions` include:
      - `nop` `push` `pop` `mov` `add` `call` `ret`
    - all instructions performs actions using `registers`
      - `mov eax, [ebx]`: move the 4 bytes in memory at the address contained in `ebx` into `eax`
  - instruction format
    - `operation argument`
    - `operation argument, argument`
     - `mov eax, [ebp-8]` *square brackets acts as the de-reference operator in `c` so the `mov` instruction "moves" the value that's at `ebp-8` and stores it inside `eax`* [Intel Syntax]

![x86 ASM](https://external-preview.redd.it/9WDnA-wfi7dkz49F80RaJGi_UE_0lAvTG4SIsBizwr4.png?auto=webp&s=afa7e964279f11a3ad39dcb789ecede6d85ddf8e)

**Next week**: Going over some basic `C`, installing tools, trying some exercises

### Resources

[azeria-labs](https://azeria-labs.com/functions-and-the-stack-part-7/) more about the stack
[OALabs](https://www.youtube.com/channel/UC--DwaiMV-jtO-6EvmKOnqg): youtube channel
[Discord](https://discord.gg/weKN5wb): resources, and community
[Awesome RE](https://github.com/wtsxDev/reverse-engineering): Github repo
[ROP beginers](https://ropemporium.com/): return-oriented programming (here for later reference)    
[Modern X86 ASM](https://www.youtube.com/watch?v=rxsBghsrvpI)
[x86 ASM](https://cs.lmu.edu/~ray/notes/x86assembly/)

[**cover image**](https://i.redd.it/p334wphc5wu21.png)
[asm cheatsheet](https://www.reddit.com/r/ReverseEngineering/comments/3zpkde/reverse_engineering_for_malware_analysis_cheat/)
[x86 Intro](https://www.youtube.com/watch?v=75gBFiFtAb8&feature=youtu.be)