Reverse Engineering master0Fnone Class | Episode 1.3: x86 Assembly Demystified

[@jeFF0Falltrades]

Corrections to this Part: 1:16:33 : I say that we add 1 to “str_ptr” but that it is using pointer arithmetic - this is (obviously) inaccurate as assembly will not take “shortcuts” like pointer arithmetic. In actuality, it adds 1 because a char in C is 1 byte. I blame late night recording, and my brain trying to make things make sense (thank you @Maximxls !)

[@DeborahRise]

Thank you Jeff. You are amazing. The information provided in Part 1 to 3 are so rich. And I like how you teach. Your voice is soothing.

[@jeFF0Falltrades]

So happy to hear you enjoyed; Thanks so much for watching!

[@dyarizadeh3]

The Koodos at 42 mins. I needed that. Thanks.

[@Caravaggic]

I just have finished the "crackme" challenge and you don't know how this made me happy. Thank you for the classes and please bring more content. 😁

[@jeFF0Falltrades]

CONGRATS and great work! More coming very soon ;-)

[@b213videoz]

I guess not happier than me "patching" Ultima II game for Atari 800 XE/XL and finally adding joystick support to it 😊 (it was keyboard only)

[@pat_1377]

Absolutely some of the best RE & malware content on youtube. Thanks so much for putting these videos together. You deserve so many subscribers and views -- wishing you nothing but the best.

[@jeFF0Falltrades]

You are too kind, Pat! I am wishing you back the same - thanks for the positivity and I'm so glad you enjoyed!

[@JWAM]

Are you kidding? I just got reason to start looking into RE, and here you come into existence.

[@jeFF0Falltrades]

*William Knight Appears* "There is no such thing as a coincidence." (So glad you're here and hope these help!)

[@gabrielferreira4948]

Same 😂

[@JWAM]

@@jeFF0Falltrades Infact, I started watching your older "Roller Coaster Tycoon" video (as I am interested in the debugger-functionality combined with Ghidra), and meanwhile I wanted to check what your activity has been otherwise. Got so happy when I saw that you made a return just now. Tonight won't be a night of sleep. I guess.

[@jeFF0Falltrades]

@@JWAM As someone who stayed up well into the wee hours recording this class - Know your limits and take a break if you need it when it comes to sleep 😂 Hope you find it helpful and invigorating though 🍻

[@palpitations00]

These are amazing you're doing God's work man

[@jeFF0Falltrades]

Thanks so much! Comments like these keep me inspired to make more!

[@ArielVolovik]

Just wanted to confirm/clear some things up for myself: At 18:59 I don't think this was ever mentioned, but is the address of variable function_name simply its offset from the base pointer? When we make room for variables with the following: SUB ESP, 0x18 Does that mean that we should now populate [ESP + XYZ] ? As we've just set everything from EBP to ESP as available space, and as the stack goes from high memory to low memory, that means that ESP is currently lower in memory than EBP, so we should only be able to access higher memory than ESP. Why do we do [ESP - XYZ]? (In our case, we're doing [ESP + local_18], but local_18 has a negative hex value of -0x18) 25:15 Between 401f31 and 401f38, the contents of EAX do not appear to change. Why do we perform a mov EAX two times? Is it simply not optimized?

[@jeFF0Falltrades]

Great observations and questions! To your first, Ghidra is doing a bit of unseen “manipulation” here to increase readability - it replaces local variable offsets with a readable name, but also makes it a bit confusing doing so because - as you said - it can look like you are subtracting or adding when you should be doing the opposite. In reality, if you open up the line containing [esp + local_18] in a debugger, you’ll see that instruction actually becomes [esp + 4] which is what we should expect after moving ESP at the start of the function. To your second question, I believe you are correct in that this is just a “compiler-ism” - it looks like it just wasn’t optimized, but I’m not qualified enough in the realm of compiler optimizations to say if or why this may be the case with certainty 😆 Thanks for the great questions! Let me know if anything else doesn’t make sense or needs clarification.

[@christianlijs1346]

Wow. After watching the whole series I was stoked to try and do the crackme. I managed to understand the program quite well, and even though I eventually looked at a write-up to actually get the flag, I knew exactly what to do and had traversed the rest of the program no problem, so I am calling that a win! Thank you again so much jeff for giving me the confidence to properly start trying reverse engineering, it has been extremely fun.

[@jeFF0Falltrades]

Congratulations! Not only is finishing the series itself an accomplishment, but that understanding throughout the crackme is incredible. You should be proud and I hope you continue to practice and - most of all - have fun with it!

[@Proferk]

Finished watching the 3 parts of this class Just finished the crackme (with name ItsProfessional) and a few days ago I thought that I'd never be able to understand assembly without googling every 3 seconds, and now I'm a bit more confident that i'll be able to reverse things without just relying on the decompiler. Huge thanks for this I tried to watch other videos and those videos were confusing, as they expected you have atleast some experience with x86asm before. Your videos are definitely one of the best videos about x86asm/RE. Thanks again, for helping me get started and learn a lot about x86asm

[@jeFF0Falltrades]

I’m so proud of you! It takes a lot of investment to go through these videos and especially to do the crackme! I see you on the Wall of Fame now and it’s well deserved - Congratulations and best of luck as you continue learning, and thank you for including me in your journey and for the kind words!

[@peterlustig9742]

I usually don't comment on videos, but I hope you read this: Thank you so much for this series and your previous content. Despite being familiar with a few programming languages I always had a hard time getting started with reverse engineering. This series helped to understand the fundamentals and basic tools in a few hours and after a week playing around with your challenge I finally cracked it! I'd love to see more content, you explain things in such a clear and concise manner, it's just awesome to listen!

[@jeFF0Falltrades]

Comments like yours are what keep me going - thanks so much, Peter! And congratulations on springboarding off of the videos to do some RE and solve the challenge!!! You should be proud! I hope the videos continue to challenge you (and I hope you had fun too :-))

[@mixcraft3578]

man u deserve millions of subscribers.....

[@jeFF0Falltrades]

I’m just here to have fun, hopefully teach something, and make memes. Thank you for the sentiment ❤️

[@plsgt]

I came to know about your videos from Reddit, and these lessons are an absolute goldmine. Thank you so much for taking the time to prepare and explain the concepts so beautifully.

[@jeFF0Falltrades]

So happy you found me here, Saugata! Thank you so much for the kind words and hope it was all helpful.

[@plsgt]

It really is helpful. I am now trying to solve the challenge flag question.

[@Maximxls]

Great series! I want to point out something: 1:16:33 I think this is a bit misleading, rather it's adding 1 because char is 1 byte

[@jeFF0Falltrades]

Ahhh this is a good catch! You are correct! I will add this to my pinned comment as a correction - thanks so much for catching that.

[@danielabay01]

Such a wholesome masterclass! I like your videos a lot, thank you so much!

[@jeFF0Falltrades]

@@danielabay01 So glad you are enjoying them! Thanks so much for the kind words and for being here!

[@luijia]

Awesome series

[@jeFF0Falltrades]

Thank you so much and thanks for watching!

[@ArielVolovik]

For 1:09:37 (the /= operation), I found it a tad weird how we're doing a SHR by 0XF1 bits (31). Thought I'd write out what it's doing here in case it helps others. Say if the C code that produced this disassembly was `int x = 3` (00000000 00000000 00000000 00000011) at 01b65 EAX = 3 at 01b67 EAX = 3, EDX = 3 at 01b6a EAX = 3, EDX = 0 at 01b6c EAX = 3, EDX = 0 at 01b6e EAX = 1, EDX = 0 (00000000 00000000 00000000 000000**11** turns to 00000000 00000000 00000000 0000000**1**) when finished, x = 1 Say if the C code that produced this disassembly was `int x = -3` (11111111 11111111 11111111 11111101). at 01b65 EAX = -3 at 01b67 EAX = -3, EDX = -3 at 01b6a EAX = -3, EDX = 1 at 01b6c EAX = -2, EDX = 1 (11111111 11111111 11111111 111111**01** turns to 11111111 11111111 11111111 111111**10**) at 01b6e EAX = -1, EDX = 1 (11111111 11111111 11111111 111111**10** turns to 11111111 11111111 11111111 111111**11**) when finished, x = -1

[@pandemiclevyraati4540]

I don't remember the last time I was this excited for a video to come out. I've been following your master0Fnone class and it has been one of the best intros to reverse engineering I've come across. I just wanted to say thank you for taking the time out to makes these videos. I hope you keep them coming!

[@jeFF0Falltrades]

Thank you so much for the kind words; Your excitement is contagious! I appreciate your patience throughout this one and hope you enjoy this final portion! More will follow, without a doubt.

[@pandemiclevyraati4540]

@@jeFF0Falltrades I'm very happy to hear that! I'm planning on dedicating my evening to this video. Learning something this complex has been a lot of fun.

[@jeFF0Falltrades]

@@pandemiclevyraati4540 Even in the most frustrating of RE tasks, I’ve always found the fun in the challenge of putting the puzzle together. It sounds like you have the same sentiment, and I hope it carries you forward as you continue learning and excel!

[@D3ltaLabs]

Hey love your content, I'm looking forward to watching another 15hrs of quality videos.

[@jeFF0Falltrades]

Be careful what you wish for…lol glad you enjoy! Hope they are worth the investment!

[@y1dtdr]

I'm begging you to make more tutorials on reverse engineering

[@jeFF0Falltrades]

You don’t have to beg - More coming soon 😉

[@alaamroue]

Hey jeff, I really love your videos, you lit a fire in me that i can't turn off, haha. ❤ i want to suggest a future video, reverse engineering the windows 10/11 clipboard history (the one that shows up when you press win+v) to make it store more than 20 (or 25) items in the clipboard. I tried a lot but failed, would love to see you doing it.

[@D_VAULTZ]

i wrote an undetected for a year dma hack for battlefield 2 x86 , that was the last time i looked at asm. Youre inspiring me to step up my x 64 ASM game. As i have finally gotten used to UNICODE by this point.

[@jeFF0Falltrades]

Good stuff - hope that inspo continues on to great things for you

[@Gaspa79]

I can't believe the hidden flag was on the last place I looked. I was getting discouraged. Thanks for making this, I really hope you make more. I'd buy you a coffee if you had superthanks enabled on the video.

[@jeFF0Falltrades]

What the heck?! Thank you for telling me because I thought I had it enabled! Should be working now - not that I ever expect it, but I also have a BMAC link on the channel. Thank you so much for watching and so glad to hear you enjoyed! We actually have another one of these coming up this month, focused on malware analysis, with another challenge!

[@Gaspa79]

@@jeFF0Falltrades Done. I ended up using buy me a coffee instead since I saw that the cut for that is 5% whereas youtube's is 30%. Thanks again!

[@jeFF0Falltrades]

@@Gaspa79 You didn’t have to do that but not only do I appreciate the donation, but the extra step of looking at the cut percentage is truly kind. Thank you so much and I hope you continue to enjoy the content!

[@civisj]

Subscribed!

[@jeFF0Falltrades]

Thanks so much! So glad you enjoyed!

[@robertisaiah7673]

You deserve more views honestly... Your amazing... Keep up🌟

[@jeFF0Falltrades]

I’m content just reading comments like these - Thank you so much!

[@swapnilsah3680]

❤‍🔥❤‍🔥❤‍🔥❤‍🔥

[@jeFF0Falltrades]

🙌

[@benjcalderon]

ok ok, so months in between videos (albeit 6 hours vids... but I digress) and now 3 vids in a few weeks!? what is this, Christmas?? 🙌 I'm watching these on 30 mins sections during lunch breaks... let me catch up! 😁 You sir are on 🔥 and I'm so looking forward to enjoying this series!

[@jeFF0Falltrades]

Hahaha, well as per usual, I filmed this all at once, but this time around, I thought the format of the 3 major sections in this class lended itself to be split across 3 separate videos (there was also a lot more editing required for this one than my previous vids). I'm so glad you're enjoying this series though, and comments like these tell me the work is worth it! And while I intend to go back on break for a bit now that this one is in the books, I'll be back soon with something new :-). Thanks for watching and thank you for your support and kindness!

[@hansisbrucker813]

Quick question: why do compilers often use the LEAVE instruction, but hardly ever the ENTER instruction? I found it in the Intel SDM on Vol 1. 6-20 🤔

[@jeFF0Falltrades]

Phenomenal question! It is because the ENTER instruction - even though it saves a few instructions of assembly - is very slow due to its implementation, and so most modern compilers will skip it altogether. LEAVE, on the other hand, is not as much of a hit on performance, and so it has remained a popular choice for stack cleanup.

[@hansisbrucker813]

@@jeFF0Falltrades thank you. Interesting answer. I wonder why it is so slow 🤔👍

[@BryanChance]

This is soooooo good!! thank you

[@jeFF0Falltrades]

So happy to hear you enjoyed! Thanks so much for watching!

[@rtzgf67games7]

What is your opinion on pseudocode (the one generated in cutter)? I chose cutter as my primary reverse engineering tool and I love it (it's powered by rizin), I've also found something that I wanted to ask you about. So in cutter, there's this option, that changes how the disassembly is shown and one of the options is pseudocode. I really like it since it is basically easier to understand assembly (mov eax, 0x6f is shown as eax = 0x6f). So my question is: Should I learn assembly really well and immidiately know what which instruction does, or should I use pseudocode, so that the reversing process is easier for me? I would guess it's probably that I should learn assembly well, but I figured I'd ask. I love the videos :)

[@jeFF0Falltrades]

I mean I would say use both in conjunction - similar to how Ghidra gives you the side-by-side, it can save a ton of time to see the pseudocode while confirming what’s going on in the assembly. I would say someone serious about reversing should still learn assembly and be able to understand what’s happening when the pseudocode may be wrong or doesn’t make sense, but as a learner, I think it can help a ton in filling knowledge gaps to have both available. Great question and thanks for watching!

[@kritikusi-666]

Good to see you back on TY. Are you only targeting Ghidra or will you touch on other RE tools? You provide quality content. I will be happy to pay a premium if you offer other RE tool. IDA is my go to tool since I use other extensions. Nonetheless, I am just happy you are back. Haha.

[@jeFF0Falltrades]

Yeah, I’ve mostly used Ghidra to learn it a bit myself, since I had just recently moved from primarily using IDA when I recorded this, but I’d be up for using some other tools in future videos - any specific ones you’d like to see, or just more IDA?

[@PhreakDarkSoul]

​@@jeFF0Falltrades Is SoftICE still a thing?

[@jeFF0Falltrades]

@@PhreakDarkSoul I think SoftICE is pretty much dead post-XP, but looks like there’s an OS project called BugChecker that has supposedly taken its place.

[@tumpes2636]

Thanks for the series! I think I'll have to watch all your other videos now :) Question: how long did it take you to learn all this?

[@jeFF0Falltrades]

Thank you for watching and I hope you enjoy! I want to say my first delving into assembly was in 2013/2014 or so at uni, and RE not too long after. But I didn’t seriously start diving into reversing until after I had my first job in malware analysis/triage ~2016 and i got lots of practice in subsequent years. Thing is, there is no timeframe where it all clicked - I learned as I went and I’m still learning; you all keep teaching me stuff via the comments on these videos, for example haha.

[@tumpes2636]

@@jeFF0Falltrades Oh, you've done this for a long time. I'm only about five months in so no wonder I'm clueless sometimes.

[@jeFF0Falltrades]

@@tumpes2636 HA! My brother - That hasn’t changed for me at all over time 😂 Just be sure to give yourself grace and come back to it when you feel overwhelmed :-)

[@Smoth48]

Why are certain values in registers moved over to EAX before being used for something, rather than just using them? Example: Why MOV EAX,EDX followed by MOV [ESP+par_4],EAX As opposed to simply MOV [ESP+par_4],EDX ? I assume that it just simply does not work that way? Edit: I see about 30 seconds later that it definitely does work that way - so is it safe to assume that it is just the compiler being less than 100% efficient?

[@jeFF0Falltrades]

Do you have a time stamp? Want to see exactly which part before answering

[@Proferk]

It's because the compiler decided it should be that way. It doesn't really matter

[@jordankostov7581]

Awesome series! Proposal for new one - how to make a DLL injection to mod a game and replace original exe function.

[@jeFF0Falltrades]

You can actually see a bit about DLL injection in my Solitaire video on this channel - we do exactly that, but with a very small troll mod to XP solitaire! Let me know if there are more specific things you’d like to see in a future video though!

[@jordankostov7581]

@@jeFF0Falltrades Thank you Jeff, will check it out right now! the answer is probably yes i will need something specific because i am trying to do some complex stuff but i need to invest some time in learning the basics first. When/if I hit any interesting bottlenecks i will drop a line :). Thank you again for the descriptive videos!

[@Proferk]

@@jeFF0Falltrades Not sure if I understood anything wrong, but you used DLL hijacking, not dll injection in that video. DLL Hijacking is getting your dll to get loaded rather than some other dll that the process would load otherwise DLL Injection is similar, but instead of overriding some dll that the process uses, you get the process to load your new dll alongside other dlls. This does not replace any other dll, it loads a new one. This is done by injecting the dll into the process, usually in the following method: - allocate memory on a process (VirtualAllocEx) - write the path to your dll to that allocated memory (WriteProcessMemory) - create a thread on that process (CreateRemoteThread) which calls "LoadLibrary" to load the dll path allocated to memory above DLL Hijacking hijacks a dll that the process uses, replacing it with your own dll DLL Injection loads your dll, and doesn't replace/overwrite anything else

[@worldslayer100]

I like your videos! Also I was wondering about something.. I been trying to get into computer science and learn but I always seem to run into the issue of not knowing what to make with the tools but I noticed I always like watching malware analysis and I do like to know how things work. Is it realistic to study the languages like assembly C and C++ before getting experience with building but with the intent of learning how to disassemble and understand how it operates? I like the look of reverse engineering Im just not sure if its too far a stretch before knowing how to build software. I hope this makes sense also thank you for the content.

[@jeFF0Falltrades]

Thank you so much! I’m glad you enjoy them. I think I understand what you’re asking, but let me know if I’m off base: I think you’re asking is it realistic to study languages like C/C++/assembly from the angle of reversing software made with those languages rather than focusing on learning them for the sake of developing software/tools/programs. I would say you can *to a degree* - trying to reverse without knowing some common patterns used in development will make the journey to learning reversing more difficult, but I don’t know if I would say it would be impossible to do. I would say if you’re passionate about reversing, pursue that as far as you’d like, and when it seems like things are taking longer to understand, maybe take a step back and focus more on learning the high-level development concepts. Hope that makes sense too and best of luck in your learning journey!

[@worldslayer100]

@@jeFF0Falltrades It did, thank you for reply Have a nice day!

[@willyanlouis9213]

I just want to make sure I'm reading this right @26:18 Normally, LEA is used to load the address to the destination operand. But (after a quick searching), it can be used to do a normal arithmetic operation. In this case, LEA edx, dword ptr ds:[eax + 1] Uses the square bracket [ ] therefore, the square bracket will act as sort of a pointer. In C code it would look something like: int eax = 0; int *pointer_eax = &eax; *pointer_eax = *pointer_eax + 1; int edx = *pointer_eax; Explanation: - First, initialize the integer named eax with the value 0 (Which is the duty of both 00141F01 and 00141F0B) - Second, initialize a pointer to an integer named pointer_eax with the memory address of eax - Third, do arithmethic operation by reference - Fourth, initialize an integer named edx (The value we want to put to the array) and set it to the value pointed by pointer_eax On the contrary, if the instruction looks like: LEA edx, eax + 1 It will copy the address of eax to edx Is this correct? Thank you for the video btw. Amazing for beginners like me learning RE

[@willyanlouis9213]

Actually, I'm dumb, after reviewing part 1 @42:44 of this tutorial, you explain it very well.. For example if I have something like: lea eax, [0x12345678] Instead of moving the value at memory address 0x12345678 to eax,, We're literally going to to put the value 0x12345678 into eax.. So, for my previous question: LEA edx, dword ptr ds:[eax + 1] We're literally going to to put the result value of eax+1 into edx

[@jeFF0Falltrades]

I was just about to respond and saw you found it yourself - Exactly right! LEA is oblivious to whether it’s using a pointer or a raw value, so you can use it to load an actual address, or just as a shortcut to do multiple arithmetic ops in a single instruction. Well done in finding the answer! And hope you enjoy the series!

[@doelhasan7310]

What version of ghidra are you using?

[@jeFF0Falltrades]

@@doelhasan7310 In this video, we were using 10.2.3

[@D_VAULTZ]

master of one! (and zero)

[@jeFF0Falltrades]

🙌 NICE! Thanks for watching!

[@LordnuggetorxD]

I love you

[@jeFF0Falltrades]

I love you too, total stranger ❤️

[@u0000-u2x]

4:25 I always mix it up and you got it right, but then "corrected" yourself :D Disassembler (from assembly to high language code; in the right pannel) and Decompiler (from compiled (i.e. machine code) to assembly - left panel).

[@ganeshborade3706]

Hi Your videos are very comprehensive. Can you please make a video on How to reverse Engineer a PS2 Game? And If you are making tutorial , so please take Urban Reign 2005 game to reverse engineering. Thanks

[@uttekarlsson3265]

Should be nice to see another video with a new game cheat. Should be nice with a popular game like command and conquer remastered. There exist already memory addresses for cheat engine. But should be nice to see the structure of the code.

[@b213videoz]

25:08 I do not understand why this line is even there, the very same instruction already executed: EAX has retained its value as LEA did not affect EAX. You just so very casually skipped it and didn't explain at all. 25:45 once again so casually & happily skipped 1) what is that 0x34 for ? 2) how does it relate to +3 and that stack label 3) au_stack_4f ?!! - nothing, no explanation whatsoever Come on, this video is for complete beginners, right ? I was able to tug along but only because I know this stuff already (kind of) - if I didn't your happy casual skippings & omissions would have got me completely confused. Yes, you do explain most things well - but hey, really important stuff you just skip.

[@jeFF0Falltrades]

Thanks again for this (and I mean sincerely - I appreciate candid feedback and I get scared when I only hear praise or general feedback) and your other comments. I'll also add these clarifications to the pinned comment in hopes that will help others who may have been confused by these segments: 25:08: Apologies for not calling it out; You're right in that it's important for beginners to understand the "why", and I think I was focused on switching to demo'ing it in the debugger and glossed over the extra instruction: This kind of "duplicative instruction" can happen due to compiler optimizations - Different compilers can hold themselves to different "guarantees" and rules around how they compile code, and I think in this instance, we humans can see that the extra instruction is not needed, but the compiler decided for some reason to include it. Why? It's very difficult to say without knowing a LOT about how the compiler is written to work. It could be accounting for optimizations in speed, or scheduling of instructions, or because it uses some standard pattern of instructions for this type of loop, and applies those rules regardless. 25:45: Apologies again as I was not as focused on the decompilation view vs the disassembly view in this segment. To answer your questions: The 0x34 is added to ESP because that happens to be where this array was placed on the stack by the compiler: 0x34 == 52 in decimal, which divided by 4 bytes is 13, so you can think of it as there are 13 other 4-byte segments between ESP and the array, which are other values on the stack. But put more plainly, the array starts at 0x34 past ESP, so we must add 0x34 PLUS our index*4 bytes (because every int is 4 bytes) to access each element of the array. Now (2) and (3) of your question are interesting: The additional "+ 3" of the decompilation you see there does not appear in other decompilers I used, and it's likely just a case of the decompiler "hallucinating" - meaning that it tried to decompile this segment, but realized the way it decompiled the address to the array was out of alignment, and so it compensated by just tacking on a "+ 3" to make the math work. Sounds silly, but this is why decompilers are not perfect. To see this practically, you can check the values in the debugger: The decompiler says that auStack_4f should be at EBP-0x4f But in the debugger, if EBP is at address 0x9FFB98, EBP-0x4f would be at 0x9FFB49, which is right after the first byte of a DWORD, so the decompiler adds 3 more bytes to align the array to the start of the next DWORD (4-byte) address. In reality, the array starts at EBP-0x44 in the debugger. That value makes more sense because according to our disassembly and decompiler math: auStack_4f + 3 should equal ESP+0x34 auStack_4f+3 should actually be auStack_44 because when we make that change, the math works: ESP == EBP-0x78 auStack_44 == ESP+0x34 == EBP-0x44== EBP-0x78+34 == EBP-0x44 == EBP-0x44 So why did the decompiler misinterpret the disassembly? Again, could be a number of reasons based on the decompiler logic/optimizations. I know that was a long answer to a short question, but please let me know if that helps, and I will add this to the correction pinned comment as well - Thank you again for calling out some great clarifying points!