Gain insights into using GDB for debugging in Linux. Explore disassembly, memory investigation, and register updates. Learn about pointers, stack, and function parameters in x64 architecture.

gdb.tar.gz

C2-LA

C4-L2

C4-L3

C4-L4

C4-L5

C6-L3

C8-L1

C9-L3

C10-L2

C10-L3

C11-L2

C13-L1

test

GNU Debugger (GDB) is used for debugging C/C++ programs in LINUX/UNIX environments. It is a good tool to investigate what is happening inside a program, and how the contents inside the memory are changed with the execution of the program.

The main focus of the course is the disassembly of the program, where we'll use simple operations in C. With the help of GDB, we'll examine the contents of the registers and memory. We'll also learn how they are changed while executing basic operations. We’ll then explore the use of pointers, stack, and function parameters, and analyze how different registers update their values. With the help of disassembly output, we’ll learn how a simple C program can be reconstructed. The disassembly output is important for debugging and core dump analysis. We’ll use assembly language for x64 architecture.

By the end of this course, you should be able to debug the programs and memory contents at assembly level when a program executes or probe into the problem when a program crashes.

Debugging, Disassembly & Reversing in Linux for x64 Architecture

## Hexadecimal representation (base sixteen)
If we can count up to sixteen, twelve stones fit in one group, but we need more symbols:

$A, B, C, D, E,$ and $F$ for ten, eleven, twelve, thirteen, fourteen, and fifteen, respectively.

**Examples:**

* $12_{\text{dec}} = C\space\space$ in hexadecimal representation (notation)

* $123_{\text{dec}} = (7*16^1 + 11*16^0)_{\text{dec}} = (7B)_{\text{hex}}$

**Formulas:**

Using the summation symbol, we have this formula:

$N_{\text{dec}}=\sum_{i=0}^n a_i*16^i$

### Why are hexadecimal numbers used?
Consider a number written in binary notation: $110001010011_2$. Its equivalent in decimal notation is $3155$. We can decompose the number with binary coefficients as follows:

$3155_{\text{dec}} = 1*2^{11} + 1*2^{10} + 0*2^9 + 0*2^8 + 0*2^7 + 1*2^6 + 0*2^5 + 1*2^4 + 0*2^3 + 0*2^2 + 1*2^1 + 1*2^0$



# Hexadecimal representation (base sixteen)
If we can count up to sixteen, twelve stones fit in one group, but we need more symbols:

$A, B, C, D, E,$ and $F$ for ten, eleven, twelve, thirteen, fourteen, and fifteen, respectively.

**Examples:**

* $12_{\text{dec}} = C\space\space$ in hexadecimal representation (notation)

* $123_{\text{dec}} = (7*16^1 + 11*16^0)_{\text{dec}} = (7B)_{\text{hex}}$

**Formulas:**

Using the summation symbol, we have this formula:

$N_{\text{dec}}=\sum_{i=0}^n a_i*16^i$

## Why are hexadecimal numbers used?
Consider a number written in binary notation: $110001010011_2$. Its equivalent in decimal notation is $3155$. We can decompose the number with binary coefficients as follows:

$3155_{\text{dec}} = 1*2^{11} + 1*2^{10} + 0*2^9 + 0*2^8 + 0*2^7 + 1*2^6 + 0*2^5 + 1*2^4 + 0*2^3 + 0*2^2 + 1*2^1 + 1*2^0$



Learn to represent numbers in a hexadecimal base system and why this number system is so useful.

Introduction to the Course

Memory, Registers, and Simple Arithmetic

Code Optimization

Number Representations

Pointers

Bytes, Words, Double, and Quad Words

Pointers to Memory

Logical Instructions and RIP

Reconstructing a Program with Pointers

Memory and Stacks

Frame Pointer and Local Variables

Function Parameters

More Instructions

Function Pointer Parameters

Summary of Code Disassembly Patterns

x64 Debugging, Disassembly & Reversing Exam

Hexadecimal Number Representations

Hexadecimal representation (base sixteen)