3

I just finished skimming the book Art of Assembly by Randall Hyde.

So now to get my feet wet in assembly/reverse engineering reading, I started the book Reverse Engineering for Beginners. The thing is when I write C samples and produce assembly code as author stated the assembly i get in GCC differs from what the one author provides. (I use gcc -S -O3 for the ones that are said to be optimized in book).

What can I do to get results like book or if getting results like author's is not the point how can I get the most out of this lovely book?

Improve this question
4
  • It is probably because your GCC version is different than his. Can you use the same version of GCC and disassembler and try it again?
    – Kerim Can Kalıpcıoğlu
    Jul 30, 2019 at 13:47
  • Well..idk what version he used... Right now i found out my problem is mostly those .cfi pre-suffixes.Found out how to disable them.
    – Krsh
    Jul 30, 2019 at 18:51
  • 1
    Hi and welcome to RE.SE. It's seriously a little difficult to give advice when you don't show us. How about editing your question to include an example of what the author gives and what you get from compiling with GCC? Also nice would be to know which GCC version you are using (even if there may be no info available on what the author uses). If I were you I'd also check out -fno-stack-protector (or generally check out gcc -dumpspecs output to see what security-related default flags your GCC may be using). Last but not least try -O2 ...
    – 0xC0000022L ♦
    Jul 31, 2019 at 20:09
  • 2
    ... -O2 on a recent GCC version may be closer to what -O3 used to be on older GCC versions. The simple reason being that several optimizations are given time to mature before they graduate up the optimization levels. In terms of library code (glibc aka the C runtime) you may also want to pass -D_FORTIFY_SOURCE=n to the gcc driver. Also check out the individual options behind the optimization levels. This particular document may actually provide a nice way of diffing them across GCC versions, too ...
    – 0xC0000022L ♦
    Jul 31, 2019 at 20:15

2 Answers 2

Reset to default
4

What can i do to get results like book?

Just use the same version of the compiler and compile the code for the same architecture as the Author. Usually, there is explicitly stated which compiler version was used to get a particular assembly. For example:

GCC_version

or

GCC_version2

So, there are several different versions of compiler used and if you want to get the same results, you have to use the version described at each listing.

or if getting results like author's is not the point

It's definitely not the point. The point is that you learn as much as possible when reading this book.

I would even say it may be better to get different results than these in the book. There are several reasons for it:

  1. You will learn how the newer versions of the GCC compiler deal with the same C code, so for example what are new optimization methods.
  2. You will see different assembly performing the same task as the previous one - when you'll see big differences, you will probably want to think or search for more information about it and this way you'll remember it better.
  3. It encourages you to understand the resulting assembly so you can compare it with the one presented by the Author - it's far more creative and productive work than just copying what you have already presented.

how can i get the most out of this lovely book?

I would say, by practice. If you don't practice what you have just learned, you will forget it very quickly. You can even omit some programs written there and just experiment on your own (like the Author suggested) - just write some code and try to find its fragments in disassembly.

Improve this answer
1

You just need a compiler like gcc and debug or static analysis to understanding the code doing

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.