Assembly Language for Beginners

6.5. WINDOWS NT _main PROC push ebp mov ebp, esp push -2 push OFFSET sehtable$_main push OFFSET excepthandler4 mov eax, DWORD PT ...

6.5. WINDOWS NT Listing 6.32: MSVC 2012: two try blocks example $SG85486 DB 'in filter. code=0x%08X', 0aH, 00H $SG85488 DB 'yes, ...

6.5. WINDOWS NT $LN12@main: $LN18@main: mov ecx, DWORD PTR __$SEHRec$[ebp+4] mov edx, DWORD PTR [ecx] mov eax, DWORD PTR [edx] m ...

6.5. WINDOWS NT _ep$ = 12 ; size = 4 _filter_user_exceptions PROC push ebp mov ebp, esp mov eax, DWORD PTR _code$[ebp] push eax ...

6.5. WINDOWS NT DD 030023206H DD imagerel __C_specific_handler DD 01H DD imagerel $LN9+8 DD imagerel $LN9+40 DD imagerel main$fi ...

6.5. WINDOWS NT DD imagerel $unwind$main pdata ENDS pdata SEGMENT $pdata$main$filt$0 DD imagerel main$filt$0 DD imagerel main$fi ...

6.5. WINDOWS NT mov rbp, rdx $LN10@main$filt$: mov rax, QWORD PTR [rcx] xor ecx, ecx cmp DWORD PTR [rax], -1073741819; c0000005H ...

6.5. WINDOWS NT Read more about SEH [Matt Pietrek,A Crash Course on the Depths of Win32™ Structured Exception Handling, (1997)]^ ...

6.5. WINDOWS NT The most important instruction in this code fragment isBTR(prefixed withLOCK): the zeroth bit is stored in the C ...

Chapter 7 Tools Now that Dennis Yurichev has made this book free (libre), it is a contribution to the world of free knowledge an ...

7.2 Live analysis. 7.1.2 Decompilers. There is only one known, publicly available, high-quality decompiler to C code:Hex-Rays: h ...

7.2. LIVE ANALYSIS 7.2.3 System calls tracing strace / dtruss It shows which system calls (syscalls(6.3 on page 747)) are called ...

7.3 Other tools. 7.3 Other tools Microsoft Visual Studio Express^27 : Stripped-down free version of Visual Studio, convenient fo ...

Chapter 8 8 Case studies ...

8.1 Task manager practical joke (Windows Vista). Instead of epigraph: Seibel:How do you tackle reading source code? Even reading ...

8.1. TASK MANAGER PRACTICAL JOKE (WINDOWS VISTA) Figure 8.1:IDA: cross references to NtQuerySystemInformation() Yes, the names a ...

8.1. TASK MANAGER PRACTICAL JOKE (WINDOWS VISTA) The byte is taken fromvar_C20. Andvar_C58is passed to NtQuerySystemInformation( ...

8.1. TASK MANAGER PRACTICAL JOKE (WINDOWS VISTA) Figure 8.4:Fooled Windows Task Manager The biggest number Task Manager does not ...

8.1. TASK MANAGER PRACTICAL JOKE (WINDOWS VISTA) ... mov rbp, [rsi+8] mov r8d, 20h lea r9, [rsp+98h+arg_0] lea rdx, [rsp+98h+var ...

8.2 Color Lines game practical joke 8.2 Color Lines game practical joke This is a very popular game with several implementations ...