Notes - MCS
Reverse Engineering
Notes - MCS
Reverse Engineering
  • Reverse Engineering
  • Introduction to Reverse Engineering
    • What is Reverse Engineering (RE)
    • RE Concepts
    • When do we have RE activities?
    • Why RE is Relevant and Required
    • Limitations of RE
    • Legal Framework
    • What RE Recovers?
    • Software Reversing
    • Low-level languages
  • Files and Filetypes
    • Files
    • File extensions
    • File Signature
    • Content Type Obfuscation
  • Android – Static Analysis
    • Java Language
    • Application Entry Points
    • Application Structure
    • AndroidManifest.xml
    • Exercise 1
    • Exercise 2
    • Exercise 3
    • Exercise 4
    • Native Applications
    • Java Native Interface
    • Android Native Development Kit (NDK)
    • Android binary libraries
    • JNI Dynamic Linking
    • JNI Static Linking
    • Exercise 5 and 6
    • Web and Hybrid applications
  • Android – Dynamic Analysis
    • Dynamic Analysis
    • Logs
    • Network MiTM
    • Certificate Pinning
    • Dynamic Code Instrumentation
    • Dynamic Binary Instrumentation
    • FRIDA
  • Binary Analysis
    • Binary Objects
    • Executable Symbols
    • What is inside an Object File?
    • ELF Files
    • ELF Program Headers
    • Dynamic Linker
      • Example
    • Binary Analysis Process
    • Function detection
    • Calling Conventions
    • Common Logic Structures
    • C++ code
  • Emulation and Instrumentation
    • Dynamic Binary Analysis
    • Considerations
    • Processes
    • Dynamic Binary Instrumentation (DBI)
    • DBI with Qiling
  • Obfuscation Techniques
    • Obfuscation Techniques
    • Content Type Obfuscation
    • Code Obfuscation
  • Serial Communication
    • Comunicação paralelo
    • Comunicação série
    • Sincronização entre transmissor e recetor
    • Sincronização de relógio
    • Transmissão de dados
    • Topologias de comunicação série
    • Elementos de uma ligação série
  • A interface RS-232C
    • RS-232C
    • Estrutura da trama
    • Camada física
    • Taxa de transmissão (baudrate)
    • Receção de dados
    • Identificar parâmetros de comunicaçãoIdentificar parâmetros de comunicação
    • Encontrar a UART
    • Captura de sinais
  • Norma SPI
    • Introdução
    • Descrição geral
    • Operação
    • Simulação do master SPI
    • Arquiteturas de ligação
    • Tipos de transferências
    • Configuração de um master SPI
    • Procedimento para identificação dos sinais
    • Exemplo
  • Norma I2C
    • Introdução
    • Caraterísticas básicas
    • Exemplo de interligação num barramento I2C
    • Terminologia
    • Masters e Slaves
    • Sinalização
    • Endereçamento
    • Transferência de dados
    • Clock stretching
    • Múltiplos masters
    • Arbitragem
    • Endereços reservados
Powered by GitBook
On this page
  • cdecl
  • stdcall
  • fastcall
  • Fastcall for 64bits (Windows)
  • System V AMD64 ABI
  1. Binary Analysis

Calling Conventions

Compilers handle the function calling processes differently, and we have several conventions.

  • Adapted to how programmers use the languages (number of arguments).

  • Adapted to several registers and other architectural details.

These dictate:

  • How arguments are passed to the callee.

  • How return codes are passed to the caller.

  • Who allocates the stack?

  • Who stores important registers such as the Program Counter.

cdecl

Created by Microsoft compilers, widely used in x86, including GCC.

  • The standard method for most code in x86 environments.

Arguments: passed in the stack, in inverted order (right to left).

  • First argument is pushed last.

Registers: Mixed

  • Caller saves RIP, A, C, D.

  • Callee saves BP, and others and restores RIP

stdcall

Official call convention for the Win32API (32 bits).

Arguments: passed in the stack from right to left.

  • Additional arguments are passed in the stack.

Registers: Callee saves.

  • Except EAX, ECX and EDX which can be freely used.

Stack Red Zone: Leaf functions have a 128-byte area kept safe which doesn’t need to be allocated.

  • Can be used for local variables, and avoids the use of two operations (sub rsp, add rsp).

  • Leaf functions are functions that do not call others.

fastcall

Official call convention for Win32API 64bits.

Arguments: left to right, first as registers.

  • Additional arguments are passed in the stack.

Registers: Caller saves.

Stack Shadow Zone: Leaf functions have a 32 byte area kept safe which doesn’t need to be allocated.

  • Can be used for local variables, and avoids the use of two operations (sub rsp, add rsp).

  • Leaf functions are functions that do not call others.

Fastcall for 64bits (Windows)

Official convention for x86_64 architectures with MSVC (Windows).

  • Mandatory if compiling for x86_64 in Windows.

Arguments: passed as RDX, RCX, R8, R9.

  • Additional arguments are passed in the stack (right to left).

Registers: Mixed.

  • Caller save: RAX, RCX, RDX, R8, R9, R10, R11.

  • Callee save: RBX, RBP, RDI, RSI, RSP, R12, R13, R14, and R15.

Stack Red Zone: Leaf functions have a 32 byte area kept safe, allocated by the callee.

  • Can be used to store RDX, RCX, R8, R9.

  • (Leaf functions are functions that do not call others).

System V AMD64 ABI

Official convention for x64 architectures using Linux, BSD, Unix, and Windows.

Arguments: passed as RDI, RSI, RDX, RCX, R8, R9.

  • Additional arguments are passed in the stack.

Registers: Caller saves.

  • Except for RBX, RSP, RBP, R12-R15 which callee must save if they are used.

Stack Red Zone: Leaf functions have a 128-byte area kept safe which doesn’t need to be allocated.

  • Can be used for local variables, and avoids the use of two operations (sub rsp, add rsp).

  • Leaf functions are functions that do not call others.

Last updated 1 year ago