Now, welcome to Getting Your Hands Dirty in x86 Assembly Code. Another tutorial? How come? There are lots of books concentrating on the topic of Assembly programming in general and Windows programming using the Assembly language in particular. This saga is intended for everybody who wants to master the art of x86 assembly language under the Win32 platform and start exploiting the security part of the Windows operating system. Many people believe that assembly language is dead and useless when it comes to writing real programs. Somehow I do agree, but assembly is not only for coding, it is for Software vulnerability Analysts, Bug Hunters, Shell-coders, Exploit Writers, Reverse Code Engineers, Virus Authors, and Malware Analysts. Indeed, when you spend your day reading ASM routines, then ASM becomes a must. This saga is more code oriented than theory, so you will be provided with all materials and resources in the first of each part. I really don’t support theory when it comes to programming. In others words, blabla is in the books, code is what you’ll find mostly here. Additionally, code will be highly commented and structured, written with the JWasm Assembler, for the Intel x86 architecture and can run under the Windows 32-bit platform. First and foremost, our objective is to learn:
Windows System Programming
Portable Executable Format
Self-Modifying Code
Code Protection, Anti-Reverse Code Engineering
However, many people should not be familiar with:
IA-32 Instruction Set
Assembly Language Foundations
JWasm Assembler Syntax
Win32 Programming
Tools of The Trade (IDA Pro, Immunity Debugger, WinDBG, …)
As a consequence, before getting directly to discovering the security of Windows, we need to have a solid background and handle some prerequisites. So, we will start by giving you a complete look at the assembly basics and the Windows API Programming, then we will move to the hearth of windows at kernel mode level and Windows internal related stuff. Afterwards, we will explore the Portable Executable File Format, and we will try to write self-modifying code, polymorphic and metamorphic engine. Finally, we will end our journey by looking closer at some advanced anti-reverse engineering techniques and code tampering. Each code will be structured in the following way:
New Concepts
New APIs
Key Notes
ASM Code
Output
In some cases, as in the Part I, there is a book called Programming Windows from Charles Petzold, It’s an amazing book and it teaches Windows programming; unfortunately, it’s in the C language. I said to myself instead of writing ASM code directly, why not reconstruct the code from the disassembled C code. You’ll look how C Code is disassembled, you’ll reconstruct it in ASM, then you’ll look at it again to see how much closer your code looks to the disassembled one. We will follow this Reversing – Coding – Reversing approach as much as possible. Before we go on with this saga, every time that you read it, it’s going to make more sense to you. Every time that you go back to the principles that you’ll learn here, it is going to hit you in a different level. What that means is like: if you go out now, maybe the surface level principles are hitting you and a year from now the same principles that you learn from here will take on a different meaning, and five years from now – the time it took me to master assembly- it’s gonna have an entirely different meaning. Happy ASM Coding ! Part 0x00 : Assembly vs Itself Getting The Basics 0x00 A Few Words About Assembly 0x01 Set Up The Environment And Tools 0x02 Basic Computer Organization 0x03 Assembly Language Fundamentals 0x04 Data Transfers, Addressing, and Arithmetic 0x05 Arrays and Strings 0x06 Branching and Looping 0x07 Procedural Calls, Calling Convention, Stack Frame and Heap Structure. 0x08 Structures, Macros, and Unions. 0x09 Could You Solve This ? 0x10 Appendix and References Part 0x01 : Assembly vs Win32 API Programming Getting Started 0x11. Message Box 0x12. First Windows Program The GDI Philosophy 0x13. Painting with Text using ……
