Slides for a college course at City College San Francisco. Based on "Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software", by Michael Sikorski and Andrew Honig; ISBN-10: 1593272901. Instructor: Sam Bowne Class website: https://samsclass.info/126/126_S17.shtml

1. Practical Malware Analysis
Ch 6: Recognizing C Constructs in
Assembly
Updated 2-27-17

2. Function Call

3. Finding the Code in
IDA Pro
• IDA
shows
only the
entry
point
• Link Ch
6a

4. Trick: Use Strings, then XREF

5. Disassembly
in IDA Pro
• 4 arguments
for printf()
function
• Pushed onto
stack
• Reverse
order
• call launches
function

6. Global vs. Local Variables
• Global variables
– Available to any function in the program
• Local variables
– Defined in a function and only available to
that function

7. Global vs. Local Variables

8. Global vs. Local Variables
Local – on stack
Local – on stack
Global – in memory

9. Arithmetic Operations

10. Arithmetic Operations

11. Arithmetic Operations

12. Branching (if)

13. Branching (if)

14. Finding for Loops
• Four components
• Initialization: i starts at 0
• Comparison: is i<100 ?
• Execution: printf
• Increment/decrement: i++

16. Arrays

18. Summary
• Finding the Code
– Strings, then XREF
• Function Call
– Arguments pushed onto stack
– Reverse order
– call
• Variables
– Global: in memory, available to all functions
– Local: on stack, only available to one function

19. Summary
• Arithmetic
– Move variables into registers
– Perform arithmetic (add, sub, idiv, etc.)
– Move results back into variables
• Branching
– Compare (cmp, test, etc.)
– Conditional jump (jz, jnz, etc.)
– Red arrow if false, green arrow if true