Skip to content

Commit

Permalink
Wording
Browse files Browse the repository at this point in the history
  • Loading branch information
0xZ0F committed Jan 22, 2020
1 parent e0d6b83 commit 8e52050
Show file tree
Hide file tree
Showing 13 changed files with 13 additions and 15 deletions.
2 changes: 1 addition & 1 deletion Chapter 1 - Introduction/1.1 HowTo.md
Expand Up @@ -2,7 +2,7 @@

## File Structure:

Any folders or files with a name surrounded with square brackets, such as "[ignore]", are not important. They usually contain things like images used in the course. You will notice that every chapter and lesson is numbered. Feel free to use these numbers when asking questions or making comments. Here's an example tweet: "@0xZ0F there is a spelling mistake in 1.1." Be cautious though, the number for a chapter or section may change in the future.
Any folders or files with a name surrounded with square brackets, such as "[ignore]", are not important. They usually contain things like images used in the course. You will notice that every chapter and lesson is numbered. Feel free to use these numbers when asking questions or making comments. Here's an example tweet: "@0xZ0F there is a spelling mistake in 1.1." Be cautious though, the number for a chapter or lesson may change in the future.

* Each folder (Ex. [Chapter 1 - Introduction](Chapter 1 - Introduction)) is a **chapter**.
* Each file (Ex. [1.1%20HowTo.md](1.1%20HowTo.md)) is a **lesson**.
Expand Down
2 changes: 1 addition & 1 deletion Chapter 1 - Introduction/1.2 Setup.md
Expand Up @@ -2,7 +2,7 @@
This course will focus on 64-bit Windows, but we will talk a little about 32-bit. Note: In this course x32 and x86 both refer to 32-bit.

## Operating System
You will need a 64-bit Windows OS. You can use a virtual machine (VM) if you want. It's typically best to use a VM for security reasons, but you don't need to worry about that until the malware section. If you plan on making reverse engineering part of your life then you will probably want to set up a reversing VM anyways. Having a VM will allow you to better isolate the software you are reversing. This can be extremely helpful if you are analyzing a program's network traffic, disk usage, registry modifications, etc. Also, if you mess anything up you can revert the VM. Again, you don't need one for this course but in the future, I would recommend you get one.
You will need a 64-bit Windows OS. You can use a virtual machine (VM) if you want. It's typically best to use a VM for security reasons, but you don't need to worry about that until the malware chapter. If you plan on making reverse engineering part of your life then you will probably want to set up a reversing VM anyways. Having a VM will allow you to better isolate the software you are reversing. This can be extremely helpful if you are analyzing a program's network traffic, disk usage, registry modifications, etc. Also, if you mess anything up you can revert the VM. Again, you don't need one for this course but in the future, I would recommend you get one.

## Reversing Tools:
Most of the software can be replaced with anything you like. The software I will be using is listed (all of it's free):
Expand Down
2 changes: 1 addition & 1 deletion Chapter 3 - Assembly/3.2 MemoryLayout.md
Expand Up @@ -46,7 +46,7 @@ Here is the layout of a stack frame:
</p>
Note the location of everything. This will be helpful in the future.

> If this section was confusing, read through [3.3 Instructions](3.3%20Instructions.md) then re-read this section. After you re-read this section you might want to read 3.3%20Instructions.md again. I apologize for this but there really isn't a good order to teach this stuff in since it all goes together.
> If this lesson was confusing, read through [3.3 Instructions](3.3%20Instructions.md) then re-read this lesson. After you re-read this lesson you might want to read 3.3%20Instructions.md again. I apologize for this but there really isn't a good order to teach this stuff in since it all goes together.
## Endianness
> A is 0x41, B is 0x42, etc.
Expand Down
2 changes: 1 addition & 1 deletion Chapter 3 - Assembly/3.3 Instructions.md
Expand Up @@ -75,7 +75,7 @@ mul RAX, RBX
* **IDIV**: https://www.felixcloutier.com/x86/idiv

### Flow:
**CMP** compares two operands and sets the appropriate flags depending on the result. The following would set the Zero Flag (ZF) to 1 which means the comparison determined that RAX was equal to five. Flags are talked about in the next section [3.4 Flags](3.4%20Flags.md).
**CMP** compares two operands and sets the appropriate flags depending on the result. The following would set the Zero Flag (ZF) to 1 which means the comparison determined that RAX was equal to five. Flags are talked about in the next lesson, [3.4 Flags](3.4%20Flags.md).
```asm
mov RAX, 5
cmp RAX, 5
Expand Down
2 changes: 1 addition & 1 deletion Chapter 3 - Assembly/3.5 CallingConventions.md
Expand Up @@ -31,7 +31,7 @@ If you want to learn more about this calling convention you can here:
https://docs.microsoft.com/en-us/cpp/build/x64-calling-convention?view=vs-2019
https://docs.microsoft.com/en-us/cpp/build/x64-software-conventions?view=vs-2019

> If this section was confusing, read through [3.3%20Instructions.md](3.3%20Instructions.md) then re-read this section. After you re-read this section you might want to read 3.3%20Instructions.md again. I apologize for this but there really isn't a good order to teach this stuff in since it all goes together.
> If this lesson was confusing, read through [3.3%20Instructions.md](3.3%20Instructions.md) then re-read this lesson. After you re-read this lesson you might want to read 3.3%20Instructions.md again. I apologize for this but there really isn't a good order to teach this stuff in since it all goes together.
### Sources
* https://docs.microsoft.com/en-us/cpp/build/x64-software-conventions?view=vs-2019
Expand Down
2 changes: 1 addition & 1 deletion Chapter 4 - Tools/4.3 ToolGuides.md
@@ -1,5 +1,5 @@
# 4.3 Tool Guides
It's important to know how to use the software you are using. This section will cover some tool basics. It's best to use this section as a reference when the tools first get introduced.
It's important to know how to use the software you are using. This lesson will cover some tool basics. It's best to use this lesson as a reference when the tools first get introduced.

# x64dbg
<p align="center">
Expand Down
4 changes: 2 additions & 2 deletions Chapter 5 - BasicReversing/5.2 FunctionCall.md
Expand Up @@ -5,7 +5,7 @@
* Parameters don't have to be passed through the 64-bit registers. For example, you can pass a parameter through RCX, ECX, CX, etc.
* You'll see new instructions that are variants on other instructions you know. For example, MOVAPS is new, but it's just a variant on the MOV instruction. MOVAPS is used for moving single precision values around. **Single-precision values are floats, and double-precision values are doubles.** Unless I'm trying to figure out exactly what the data type of some value is, I usually ignore the variant and just focus on the main idea. In other words, I don't really care that MOVAPS works with single precision, for now I just care that it moves some data.

You should be able to follow this section without the binary, but if you want to compile your own version of the code we will be reversing here is the code:
You should be able to follow this lesson without the binary, but if you want to compile your own version of the code we will be reversing here is the code:
```c
#include <iostream>
int main() {
Expand All @@ -15,7 +15,7 @@ int main() {
```

## Analyzing The Function Call
Let's take a look at a function call. In this case the function being called is `printf()`. Look back at the [calling convention section](../Chapter 3 - Assembly/3.2%20MemoryLayout.md#windows-x64-calling-convention) if you need to.
Let's take a look at a function call. In this case the function being called is `printf()`.
<p align="center">
<img src="[ignore]/Function.png">
</p>
Expand Down
2 changes: 0 additions & 2 deletions Chapter 6 - DLL/6.10 FinalNotes.md
@@ -1,7 +1,5 @@
# 6.10 Final Notes

> This section is numbered 0x510 instead of 0x50A because I want the course to be in the right order when it's sorted by name.
I would consider this to be our first real reversing project. There was a significant amount of information covered. If you're confused by anything please reach out on [Twitter](https://twitter.com/0xZ0F). There are no dumb questions! You should be able to DM me, if not just tweet at me asking to DM. I encourage you to write your own programs and reverse them. That's by far the best way to learn this stuff. We will now be moving on to reversing executables. If you haven't already, take a break!

[<- Previous Lesson](6.9%20ImplementingPlayer.md)
Expand Down
2 changes: 1 addition & 1 deletion Chapter 6 - DLL/6.4 SayHello.md
Expand Up @@ -58,7 +58,7 @@ So we've reversed the function, now let's use it. Before we use it we need to kn
<img src="[ignore]/SayHello/UseSayHello.png">
</p>

> There is a version of this code you can copy/paste at the bottom of the section.
> There is a version of this code you can copy/paste at the bottom of the lesson.
Don't worry if you don't fully understand the code. If you've never done anything like this, then that code may be pretty intimidating. I'll walk you through it.
* The code is using the Windows library (Windows.h).
Expand Down
2 changes: 1 addition & 1 deletion Chapter 6 - DLL/6.5 PrintArray.md
Expand Up @@ -87,7 +87,7 @@ Here is the output of the function:
</p>

# Final Notes
That was a good amount of work, I hope you enjoyed it. This section dabbled in some problem solving and I can assure you we have much more of that coming soon. One of the thrills of reversing is figuring it all out and putting the puzzle together with all the information you have gathered. You can go take a well-earned break now.
That was a good amount of work, I hope you enjoyed it. This lesson dabbled in some problem solving and I can assure you we have much more of that coming soon. One of the thrills of reversing is figuring it all out and putting the puzzle together with all the information you have gathered. You can go take a well-earned break now.

# Copy/Paste Code
```c++
Expand Down
2 changes: 1 addition & 1 deletion Chapter 6 - DLL/6.8 MysteryFunc.md
Expand Up @@ -101,7 +101,7 @@ extern "C" __declspec(dllexport) void* MysteryFunc(Player* player, int* arr[]) {
As you can see, we pretty much nailed it. The actual code reveals that both a class and array were used. More specifically, the contents of a class are copied into an array. In this case there isn't any way we could have known if the parameters were classes or arrays with just static analysis. On a low-level, both structures and arrays are accessed the same way. We knew that the parameters were data structures, but it was impossible for us to know what kind. The only way we could have been more precise is by debugging a program that uses the DLL and analyzing how it uses `MysteryFunc()`.
I really enjoyed this section. This sort of problem/puzzle solving is why I enjoy reversing so much. This was a simple example, I assure you that we will look at more complex examples soon.
I really enjoyed this lesson. This sort of problem/puzzle solving is why I enjoy reversing so much. This was a simple example, I assure you that we will look at more complex examples soon.
[<- Previous Lesson](6.7%20PrintPlayerStats.md)
[Next Lesson ->](6.9%20ImplementingPlayer.md)
Expand Down
2 changes: 1 addition & 1 deletion Chapter 7 - Windows/7.0 Windows.md
Expand Up @@ -2,7 +2,7 @@

## [7.1 VirtualMemory](7.1%20VirtualMemory.md) is finished.

## This section is currently in development and is **NOT** ready.
## This lesson is currently in development and is **NOT** ready.

This chapter will discuss some of the inner workings of Microsoft Windows. The chapter will focus on what is relevant to the field of reverse engineering. We'll cover things such as processes, memory, threads, the kernel, data structures, and more.

Expand Down
2 changes: 1 addition & 1 deletion Lingo.md
Expand Up @@ -8,7 +8,7 @@
* **x64** is 64 bit.
* **x32** and **x86** are 32 bit.
* **MB** is megabyte, **GB** is gigabyte, etc.
* For **number system prefixes and suffixes**, see the prefixes section in [2.1 NumberSystems](Chapter%202%20-%20BinaryBasics/2.1%20NumberSystems.md).
* For **number system prefixes and suffixes**, see the prefixes lesson in [2.1 NumberSystems](Chapter%202%20-%20BinaryBasics/2.1%20NumberSystems.md).

### Programming Language Related
* **JRE** - Java Runtime Environment
Expand Down

0 comments on commit 8e52050

Please sign in to comment.