Reverse Engineering for Beginners

(avery) #1

Glossary Glossary


loop unwindingIt is when a compiler, instead of generating loop code forniterations, generates justncopies of the loop
body, in order to get rid of the instructions for loop maintenance. 176


name manglingused at least in C++, where the compiler needs to encode the name of class, method and argument types in
one string, which will become the internal name of the function. You can read more about it here:51.1.1 on page 522.
523 , 626 , 627


NaNnot a number: a special cases for floating point numbers, usually signaling about errors. 222 , 244 , 868


NEONAKA“Advanced SIMD”—SIMDfrom ARM. 899


NOP“no operation”, idle instruction. 646


NTAPIAPIavailable only in the Windows NT line. Largely not documented by Microsoft. 710


PDB(Win32) Debugging information file, usually just function names, but sometimes also function arguments and local
variables names. 625 , 674 , 710 , 711 , 718 , 722 , 791


POKEBASIC language instruction for writing a byte at a specific address. 646


register allocatorThe part of the compiler that assigns CPU registers to local variables. 190 , 292 , 404


reverse engineeringact of understanding how the thing works, sometimes in order to clone it.v, 893


security cookieA random value, different at each execution. You can read more about it here:18.3 on page 268. 691


stack frameA part of the stack that contains information specific to the current function: local variables, function arguments,
RA, etc. 60 , 90 , 448 , 691


stdoutstandard output. 15 , 27 , 145


thunk functionTiny function with a single role: call another function. 16 , 376 , 732 , 740


tracerMy own simple debugging tool. You can read more about it here:70.3 on page 703. 178 – 180 , 630 , 640 , 644 , 687 ,
696 , 792 , 799 , 803 , 805 , 857


user modeA restricted CPU mode in which it all application software code is executed. cf.kernel mode. 747 , 913


Windows NTWindows NT, 2000, XP, Vista, 7, 8. 278 , 402 , 575 , 633 , 662 , 673 , 700 , 812 , 893


worddata type fitting inGPR. In the computers older than PCs, the memory size was often measured in words rather than
bytes. 546


xoringoften used in the English language, which implying applying theXORoperation. 691 , 743 , 745

Free download pdf