This document discusses techniques for recognizing C constructs in assembly code, including function calls, variables, arithmetic operations, and branching. It explains that function arguments are pushed onto the stack in reverse order before a call instruction launches the function. Global variables are stored in memory and available to all functions, while local variables are stored on the stack and only available within their local function. Arithmetic operations move variables into registers, perform operations like addition and subtraction, and move results back to variables. Branching compares values and uses conditional jump instructions like jz and jnz to follow red or green arrows for false or true outcomes.

1. Practical Malware Analysis
Ch 6: Recognizing C Constructs in
Assembly

2. Function Call

3. Finding the Code in
IDA Pro
• IDA
shows
only the
entry
point
• Link Ch
6a

4. Trick: Use Strings, then XREF

5. Disassembly
in IDA Pro
• 4 arguments
for printf()
function
• Pushed onto
stack
• Reverse order
• call launches
function

6. Global vs. Local Variables
• Global variables
– Available to any function in the program
• Local variables
– Defined in a function and only available to that
function

7. Global vs. Local Variables

8. Global vs. Local Variables
Local – on stack
Local – on stack
Global – in memory

9. Arithmetic Operations

10. Arithmetic Operations

11. Arithmetic Operations

12. Branching (if)

13. Branching (if)

14. Summary
• Finding the Code
– Strings, then XREF
• Function Call
– Arguments pushed onto stack
– Reverse order
– call
• Variables
– Global: in memory, available to all functions
– Local: on stack, only available to one function

15. Summary
• Arithmetic
– Move variables into registers
– Perform arithmetic (add, sub, idiv, etc.)
– Move results back into variables
• Branching
– Compare (cmp, test, etc.)
– Conditional jump (jz, jnz, etc.)
– Red arrow if false, green arrow if true