Skip to content

Definitions

Assembly

Set of (usually) simple instructions such as addition or division which operate on either memory or registers.

Registers

Small (up to 8 bytes) but extremely fast memory slots which are used for storing storing data on the CPU itself instead of ram.

Check out this page! -> List of registers on x86_64

PE

Portable Executable is a format for packaging assembly and its associated data in a way that operating systems understand.

In Windows these are most commonly seen as .exe .dll and .sys files.

Check out this page! -> Exact specification of the Windows PE format

Signature

Compilers programs in higher level languages such as C or Rust into assembly.

A great example of this conversion is the c.godbolt.org website.

The behavior of basic assembly instructions is largely documented here.

The general process to create a signature is:

    1. Start at the first instruction of interest.
    1. Check if its unique, if yes this sequence of instructions if your signature.
    1. If an instruction is rip relative mask out the relative bytes.
    1. If not unique, add one more instructions.
    1. If a ret is encountered, stop - this signature is will break.
    1. Continue from step 2.

Data Types

Data types are constructs within a programming language.

As a rule of thumb:

  • Unsigned data types and positive values of signed data types are stored as base 2.
  • Negative values of signed data types are stored as 2s complement.

List of common data types:

  • Basic integer types u8/i8 through u64/i64
    • Rust names just make sense - ‘u’ for unsigned, ‘i’ for signed. The number represents the bit count.
  • f32/f64
  • Struct
    • Amalgamations of other data types padded to alignment.
  • Array
    • Contiguous memory region in sections of a padded to alignment data type stored in said array.
  • Vector
    • A u64 pointer to an Array followed by a u32 size usually counting the number of elements in the array.
  • String
    • an array or vector containing bytes (ending with a 0) that represent valid UTF-8 or UTF-16

Hash

A short string like b9e3354f9ddc408d00999d64fba92d53f7638dfd7578049f11926234fe8dd851 that is computed for every byte of a file, it is unique to that file and can be used to identify it.