-
Book Overview & Buying
-
Table Of Contents
Reverse Engineering Armv8-A Systems
By :
When analyzing assembly instructions, you may often come across instructions related to data structures. This is common when analyzing unfamiliar data structures in kernel binaries. The Linux kernel has many subsystems that use different data structures.
Many software developers think it is impossible to recreate certain data structures exactly during reverse engineering. While this can be true in some cases, we can often predict or recognize patterns in the instructions that access fields inside a struct—especially if we already know which data types are used or if debug information is available.
In this section, we will explore offsets in struct and examine the instruction patterns used to access fields in struct.
Before we dive into the instructions for accessing elements in a struct, let’s look at a sample struct and a related function.
struct process_struct...