Skip to content

Commit

Permalink
New Numbering System
Browse files Browse the repository at this point in the history
  • Loading branch information
0xZ0F committed Jan 22, 2020
1 parent 353b6d5 commit a367b63
Show file tree
Hide file tree
Showing 145 changed files with 391 additions and 395 deletions.
17 changes: 0 additions & 17 deletions 0x000-Introduction/0x001-HowTo.md

This file was deleted.

17 changes: 0 additions & 17 deletions 0x100-BinaryBasics/0x100-BinaryBasics.md

This file was deleted.

17 changes: 0 additions & 17 deletions 0x200-Assembly/0x200-Assembly.md

This file was deleted.

14 changes: 0 additions & 14 deletions 0x300-Tools/0x300-Tools.md

This file was deleted.

15 changes: 0 additions & 15 deletions 0x400-BasicReversing/0x400-BasicReversing.md

This file was deleted.

21 changes: 0 additions & 21 deletions 0x500-DLL/0x500-DLL.md

This file was deleted.

28 changes: 0 additions & 28 deletions 0x600-Windows/0x600-Windows.md

This file was deleted.

2 changes: 1 addition & 1 deletion @BeforeYouBegin.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,4 +10,4 @@ This course is provided for free but if you want to support me you can do so on
## Course Content
This course is meant to teach you about reverse engineering. We'll be focusing on 64 bit Windows. A majority of what you learn here will either carry over or help you with other architectures. I will briefly cover other architectures at the end as well.

Everything else you need to know is covered in [0x000-Introduction](0x000-Introduction). Have fun!
Everything else you need to know is covered in [Chapter 1 - Introduction](Chapter%201%20-%20Introduction). Have fun!
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
# 0x000 - IntroductionAndSetup
# Chapter 1 - Introduction
This chapter will cover information you will need as well as how to get setup.

# [Table Of Contents](../TableOfContents.md)

# [Frequently Asked Questions (FAQ)](../FAQ.md)

## Resources Needed:
* Files mentioned in [0x002-Setup](0x002-Setup.md). These files can be found under [FilesNeeded](../FilesNeeded). More is covered in 0x002-Setup.
* Files mentioned in [1.2 Setup](1.2%20Setup.md). These files can be found under [FilesNeeded](../FilesNeeded). More is covered in [1.2 Setup](1.2%20Setup.md).
* The ability to run one virtual machine is recommended, but not required.

# Prerequisites
Expand All @@ -26,17 +26,17 @@ https://www.youtube.com/playlist?list=PLlrATfBNZ98dudnM48yfGUldqGD0S4FFb

## Important Notes:

THIS COURSE IS A WORK IN PROGRESS! I'm nowhere near done, but feel free to watch the course develop over time! If you have any feedback or suggestions let me know on Twitter! If you would like to know a little of what I have planned, check out [DOC](../DOC/DOC.md).
THIS COURSE IS A WORK IN PROGRESS! I'm nowhere near done, but feel free to watch the course develop over time! If you have any feedback or suggestions let me know on Twitter! If you would like to know a little of what I have planned, check out [_DOC](../_DOC/DOC.md).

I use some technical lingo and abbreviations. If you forget what they mean, or don't know what they mean, go to [Lingo.md](../Lingo.md).

[Next Lesson ->](0x001-HowTo.md)
[Next Lesson ->](1.1%20HowTo.md)

* ### [0x000 - Course Introduction and Setup](0x000-Introduction.md)
* [0x000 - IntroductionAndSetup](0x000-Introduction.md)
* [0x001 - HowTo](0x001-HowTo.md)
* [0x002 - Setup](0x002-Setup.md)
* ### [Chapter 1 - Introduction](1.0%20Introduction.md)
* [1.0 Introduction](1.0%20Introduction.md)
* [1.1 HowTo](1.1%20HowTo.md)
* [1.2 Setup](1.2%20Setup.md)

[Next Lesson ->](0x001-HowTo.md)
[Next Lesson ->](1.1%20HowTo.md)

[Chapter Home](0x000-Introduction.md)
[Chapter Home](1.0%20Introduction.md)
17 changes: 17 additions & 0 deletions Chapter 1 - Introduction/1.1 HowTo.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
# 1.1 - How To Follow This Course

## File Structure:

Any folders or files with a name surrounded with square brackets, such as "[ignore]", are not important. They usually contain things like images used in the course. You will notice that every chapter and lesson is numbered. Feel free to use these numbers when asking questions or making comments. Here's an example tweet: "@0xZ0F there is a spelling mistake in 1.1." Be cautious though, the number for a chapter or section may change in the future.

* Each folder (Ex. [Chapter 1 - Introduction](Chapter 1 - Introduction)) is a **chapter**.
* Each file (Ex. [1.1%20HowTo.md](1.1%20HowTo.md)) is a **lesson**.

I use some technical lingo and abbreviations. If you're unsure what they mean, go to [Lingo.md](../Lingo.md).

If you haven't already, please read [README.md](../README.md).

[<- Previous Lesson](Chapter 1 - Introduction.md)
[Next Lesson ->](1.2%20Setup.md)

[Chapter Home](1.0%20Introduction.md)
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# 0x002 - Setup
# 1.2 Setup
This course will focus on 64-bit Windows, but we will talk a little about 32-bit. Note: In this course x32 and x86 both refer to 32-bit.

## Operating System
Expand Down Expand Up @@ -31,7 +31,7 @@ All of the target software that I wrote and is used in this course can be found

**Warning: The files may change over time. I will try to update the course as needed.**

[<- Previous Lesson](0x001-HowTo.md)
[Next Lesson ->](../0x100-BinaryBasics/0x100-BinaryBasics.md)
[<- Previous Lesson](1.1%20HowTo.md)
[Next Lesson ->](../Chapter%202%20-%20BinaryBasics/2.0%20BinaryBasics.md)

[Chapter Home](0x000-Introduction.md)
[Chapter Home](1.0%20Introduction.md)
17 changes: 17 additions & 0 deletions Chapter 2 - BinaryBasics/2.0 BinaryBasics.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
# 2.0 BinaryBasics

This chapter will focus on the basics of binaries, bits, representations, and more. This chapter will give you a basic understanding of the math computers are built on.

* ### [Chapter 2 - BinaryBasics](2.0%20BinaryBasics.md)
* [2.0 BinaryBasics](2.0%20BinaryBasics.md)
* [2.1 NumberSystems](2.1%20NumberSystems.md)
* [2.2 ASCII](2.2%20ASCII.md)
* [2.3 BitsAndBytes](2.3%20BitsAndBytes.md)
* [2.4 ProgrammingLanguages](2.4%20ProgrammingLanguages.md)
* [2.5 Bitwise Operations](2.5%20BitwiseOperations.md)
* [2.6 Mindset](2.6%20Mindset.md)

[<- Previous Lesson](../Chapter 1 - Introduction/1.2%20Setup.md)
[Next Lesson ->](2.1%20NumberSystems.md)

[Chapter Home](2.0%20BinaryBasics.md)
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# 0x101 - Number Systems
# 2.1 Number Systems
#### Base 10:
We mortal humans use the **decimal (base 10)** system.
Base 10 includes 0, 1, 2, 3, 4, 5, 6, 7, 8, 9.
Expand Down Expand Up @@ -48,7 +48,7 @@ In order to distinguish between different number systems, we use prefixes or suf
* Hexadecimal is represented with a **prefix "0x"** or **suffix "h"**. Examples: 0x12 or 12h. Another way hexadecimal is represented is with the prefix of "\x". However, this is typically used per-byte. Two hexadecimal digits make one byte. Examples: \x12 or \x12\x45\x21. If bits and bytes seem a little weird we'll get into them soon so don't worry.
* Binary is represented with a **suffix "b"** or with a **padding of zeros at the start**. Examples: 100101b or 00100101. The padding at the start is often used because a decimal number can't start with a zero.

[<- Previous Lesson](0x100-BinaryBasics.md)
[Next Lesson ->](0x102-ASCII.md)
[<- Previous Lesson](2.0%20BinaryBasics.md)
[Next Lesson ->](2.2%20ASCII.md)

[Chapter Home](0x100-BinaryBasics.md)
[Chapter Home](2.0%20BinaryBasics.md)
Original file line number Diff line number Diff line change
@@ -1,13 +1,13 @@
# 0x102 - ASCII
# 2.2 ASCII
Computers only understand numbers. So how are you seeing this text on your screen? It's simple, and it's a technique used constantly. It all depends on how it's interpreted. The letter "AAAA" (capitalization matters) is 0x41414141 or 1000001010000010100000101000001b. 0x41414141 could be a memory address, or it could be a series of four A's. In this case "AAAA" is presented as four letters because the software has decided to present them that way.

## How Does It Work?
In order for 0x41414141 to be "AAAA" we need to have some sort of standard. This standard is called ASCII. When you interpret something as ASCII you are assigning values to some other form. For example, in ASCII 0x41 is "A", 0x42 is "B", etc. This standard allows all of us to see the same thing. There are of course many different standards, and some are used in different scenarios.

Here's a full ASCII table: http://www.asciitable.com/

[<- Previous Lesson](0x101-NumberSystems.md)
[Next Lesson ->](0x103-BitsAndBytes.md)
[<- Previous Lesson](2.1%20NumberSystems.md)
[Next Lesson ->](2.3%20BitsAndBytes.md)


[Chapter Home](0x100-BinaryBasics.md)
[Chapter Home](2.0%20BinaryBasics.md)
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# 0x103 - Bits and Bytes
# 2.3 Bits and Bytes
Computers "understand" binary (Ex. 10110010).

* **Bit is one binary digit**. So a bit can either be 0 or 1.
Expand All @@ -24,8 +24,8 @@ For more data types go here: https://www.tutorialspoint.com/cprogramming/c_data_
## Significance
The least significant digit is the lowest value. The most significant digit is the highest value. The least significant digit in 124 is 4. The most significant is 1 (100).

[<- Previous Lesson](0x102-ASCII.md)
[Next Lesson ->](0x104-ProgrammingLanguages.md)
[<- Previous Lesson](2.2%20ASCII.md)
[Next Lesson ->](2.4%20ProgrammingLanguages.md)


[Chapter Home](0x100-BinaryBasics.md)
[Chapter Home](2.0%20BinaryBasics.md)
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# 0x104 - Programming Languages
# 2.4 Programming Languages
There are many different programming languages including Python, Java, C, C++, C#, JavaScript, PHP, Lua, F#, Ruby, Go, Assembly, Fortran, COBOL, and many more. There are also variations of languages such as NodeJS and Ruby on Rails which are JavaScript frameworks. Some languages are also higher levels than others. The higher the level the further away it is from the hardware and typically the easier it is for humans to read and write. For example, C# is a very high-level language and Assembly is a low-level language. C/C++ is considered to be high level, but much lower than something like Java.

### Different Uses:
Expand All @@ -18,7 +18,7 @@ Another huge advantage of these kinds of languages is security. Everything runs

Some people consider Java or C# to be compiled, but they call Python interpreted. This is down to how the languages work, or rather, how they think they work. Python is very similar to Java and .NET because Python is actually compiled into bytecode. This bytecode is then interpreted by a VM just like Java and .NET. So really, they aren't that different. The reason why people don't consider Python as compiled is because there is no executable, just the .py script. In C# and Java you at least have some form of executable.

[<- Previous Lesson](0x103-BitsAndBytes.md)
[Next Lesson ->](0x105-BitwiseOperations.md)
[<- Previous Lesson](2.3%20BitsAndBytes.md)
[Next Lesson ->](2.5%20BitwiseOperations.md)

[Chapter Home](0x100-BinaryBasics.md)
[Chapter Home](2.0%20BinaryBasics.md)
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# 0x105 - Operations
# 2.5 Operations
There are a few binary operations that you should know about. They are used for all sorts of things as you will see throughout the course.

These operations include **NOT**, **AND**, **OR**, and **XOR**.
Expand Down Expand Up @@ -38,7 +38,7 @@ These operations include **NOT**, **AND**, **OR**, and **XOR**.
<img src="[ignore]/BOXor.png">
</p>

[<- Previous Lesson](0x104-ProgrammingLanguages.md)
[Next Lesson ->](0x106-Mindset.md)
[<- Previous Lesson](2.4%20ProgrammingLanguages.md)
[Next Lesson ->](2.6%20Mindset.md)

[Chapter Home](0x100-BinaryBasics.md)
[Chapter Home](2.0%20BinaryBasics.md)
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# 0x106 - Mindset
# 2.6 Mindset
Having the right mindset can be really helpful. Something to understand is that computers are extremely stupid. They operate on "blunt logic" and they don't make any assumptions (note that this only holds true as long as Skynet doesn't become a reality). You can think of computers as trains, they don't stop and only go in a very specific and direct path as designated by the tracks. If there's a child on the tracks it's up to the people controlling the track to divert the train. This is why Windows gives you the Blue Screen of Death (BSOD) when there is a kernel error. If the OS doesn't stop that error, catastrophic damage could occur.

### What is a Protocol?
Expand All @@ -18,7 +18,7 @@ I also want to point out the delimiters (the forward slashes) used for the numbe
### Is It Equal?
Because computers are stupid, they often do things in such a simple way that may not be obvious at first. For example, how does a computer decide if two values are equal? When you start looking at Assembly instructions there is a compare instruction. This instruction can decide if a value is greater than another, less than another, or equal to another. How does this instruction determine all of these things? It's actually quite simple, just subtract them. It's so simple it may not be obvious at first.

[<- Previous Lesson](0x105-BitwiseOperations.md)
[Next Lesson ->](../0x200-Assembly/0x200-Assembly.md)
[<- Previous Lesson](2.5%20BitwiseOperations.md)
[Next Lesson ->](../Chapter%203%20-%20Assembly/3.0%20Assembly.md)

[Chapter Home](0x100-BinaryBasics.md)
[Chapter Home](2.0%20BinaryBasics.md)
File renamed without changes
File renamed without changes
File renamed without changes
File renamed without changes
File renamed without changes
17 changes: 17 additions & 0 deletions Chapter 3 - Assembly/3.0 Assembly.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
# Chapter 3 - Assembly

This chapter will act as a crash course or refresher for the Assembly language. This course focuses on x64 Assembly. This is in no way a full Assembly course and you should take a full Assembly course before continuing. You do not need an advanced understanding of Assembly, but you should be able to write basic Assembly programs.

* ### [Chapter 3 - Assembly](3.0%20Assembly.md)
* [3.0 Assembly](3.0%20Assembly.md)
* [3.1 Registers](3.1%20Registers.md)
* [3.2 Memory Layout](3.2%20MemoryLayout.md)
* [3.3 Instructions](3.3%20Instructions.md)
* [3.4 Flags](3.4%20Flags.md)
* [3.5 Calling Conventions](3.5%20CallingConventions.md)
* [3.6 Final Notes](3.6%20FinalNotes.md)

[<- Previous Lesson](../Chapter%202%20-%20BinaryBasics/2.6%20Mindset.md)
[Next Lesson ->](3.1%20Registers.md)

[Chapter Home](3.0%20Assembly.md)
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# 0x201 - Registers
# 3.1 Registers
Depending on whether you are working with 64-bit or 32-bit assembly things may be a little different. As already mentioned this course focuses on 64-bit Windows. There are also two different syntaxes for x64 assembly: Intel and AT&T. AT&T is typically used on *NIX operating systems however the two are functionally the same, so you can translate between the two. We will focus on Intel because I think it's the easiest to read and it's the default for Windows.
> If you have previous experience with x32 but not x64 you may be confused that the registers start with an "R" instead of an "E". We will talk about this.
Expand Down Expand Up @@ -80,7 +80,7 @@ Examples:
* R8W - Lower word (2 bytes)
* R8B - Lower byte.

[<- Previous Lesson](0x200-Assembly.md)
[Next Lesson ->](0x202-MemoryLayout.md)
[<- Previous Lesson](3.0%20Assembly.md)
[Next Lesson ->](3.2%20MemoryLayout.md)

[Chapter Home](0x200-Assembly.md)
[Chapter Home](3.0%20Assembly.md)
Loading

0 comments on commit a367b63

Please sign in to comment.