Basic inverse knowledge

 

Sort By LengF from the third edition of encryption and decryption

1. character storage Sequence

This is a problem that needs to be considered for multi-byte data storage. The actual situation is related to the CPU. The microcomputer processing involves Big-Endian and Little-Endian, we usually use reverse-order storage. Only a few CPUs in a special CPU architecture use the forward sequence, such as IBM's Power-PC. The differences between the two are as follows:

Big-Endian: High-byte storage low address, low-byte storage high address

Little-Endian: on the contrary, low-level bytes are saved to the low-level address, and high-level bytes are saved to the high-end address.

For example, if the hexadecimal number 12345678h is written to the memory starting from 1000h, the two storage structures are as follows:

Data Address data address

+ ----------- ++ ----------- +

+ 12 H + --> 1000 H + 78 H + --> 1000 H

+ ----------- ++ ----------- +

+ 34 H + --> 1001 H + 56 H + --> 1001 H

+ ----------- ++ ----------- +

+ 56 H + --> 1002 H + 34 H + --> 1002 H

+ ----------- ++ ----------- +

+ 78 H + --> 1003 H + 12 H + --> 1003 H

+ ----------- ++ ----------- +

+ Others + --> 1004 H + others + --> 1004 H

Big-Endian Little-Endian

 

2. ASCII and Unicode character sets

ASCII is an American Information Exchange Standard Code. It is a 7-bit encoding standard, that is, the 7th Power of 2 equals the 128 character set. ANSI is an extended ASCII code, which is an 8-bit binary representation and can contain 256 characters.

At the same time, Unicode is an extension of the ASCII character encoding. It is encoded in two bytes in the window, also known as the width Byte encoding. The original 7-bit ASCII encoding is also expanded to 16 bits, and the high position is supplemented with zero

3. Basic knowledge of Window System

We often hear that Win32 programming uses 32-bit Windows system API functions during the programming process. In the early stage, there were 16-bit APIs that are compatible with all 16-bit APIs in Win32. However, note that some platforms work in different ways.

For example, in Windows NT/2000/xp, The Win15 API function is converted to a Win32 function call by calling a conversion function, and then processed by the operating system. In Windows 9x, the opposite is true.

Windows core dynamic link library DLL

Kernel: core features of the operating system, including process and thread control, memory management, and file access.

User: handles User interfaces, including keyboard, mouse, window, and menu management.

GDI: graphic interface, printing function, display, etc.

Programming knowledge:

API functions distinguish character sets. Generally, the called functions are not in the original definition. Instead, they call functions of different character sets through system judgment, for example, we often use the MessageBox function in C language. This function cannot find the entry point in User32.dll, but there are two functions MessageBoxA and MessageBoxW. The main difference is that the former uses ANSI encoding, the latter adopts unicode (also known as wide bytes ). Understanding this is helpful for cracking, because we often use it. For example, when a user enters a registration code, the program will obtain the information entered by the user, therefore, the implementation in the system is to call functions similar to GetWindowText or GetDlgItem. Therefore, we can perform breakpoint analysis on these functions, which can effectively improve the cracking speed.

Unicode character conversion between ANSI is the WideCharToMutiByte function and MutiByteToWideChar function.

 

Currently, we usually use Win32, so you must know that in the NT architecture, Win32 APIs can accept Unicode and ASCII character sets, however, Unicode can only be used in the kernel. Therefore, if ANSI programs are used, one-step Character Set conversion is required. Therefore, the program will temporarily use more memory and CPU resources to draw a conclusion, using unicode programming in Win32 is a wise choice.

 

Window message mechanism

Windows is a message-driven system. We are very important to understand it when learning MFC. There are two types of Message Queues: system message queues and application message queues. So what is the process? For example, when an event occurs, window puts the input message in the system message queue, and then copies the input message to the corresponding application queue, the message loop in an application retrieves each message from its message queue and sends corresponding window functions. The message queue adopts the queue mechanism first-in-one processing. There is an important SendMessage function in Window message processing. This function logs in to the Message Processing and returns the result.

 

Window Protection Mechanism

The 80x86 series CPUs can run in real mode, protection mode, and virtual 86 mode. In addition, in Win32, registers are extended from 16-bit to 32-bit, and some new registers are added. The current Window system works in protection mode. Why? Because if you use the real mode can only use the first 16 bit in the 32-bit register after the 16 bit is wasted, this is also called the MS-DOS runtime environment. Understanding the window protection mechanism is also important for reverse learning, because there are different CPU addressing methods in different modes. In the protection mode, the memory is linear, and the block register has special significance. It stores segments instead of the base address. Instead, it selects sub-segments and does not directly participate in site selection, it is just a pointer to a Global Descriptor Table (GDT) or Local Descriptor Table (LDT). The read and write permissions for different segments of registers are also different. In Win32, each process has a 4 GB independent virtual space with a range of bytes running H ~ FFFFFFFFh. At this time, the program code and data are stored in the same address space, so you do not have to distinguish between code segments and data segments.

Virtual Address: (VM)

The virtual address is not the real memory. By ing the MAP method, the available virtual address reaches 4 GB. The application can only use 2 GB for the moment, and the remaining 2 GB for the system, in Window NT, applications may temporarily use up to 3 GB. In the physical memory, the operating system and DLL code are mapped, but those unrelated to the application are not mapped, but you must understand that, the user's EXE program is mapped only in the CPU time slice, And the User-Defined DLL is selectively mapped.

 

Briefly summarize the above points:

(1) The application does not directly access the physical address.

(2) the virtual memory manager controls access from all physical addresses through access requests from virtual addresses.

(3) Each application is assigned an independent 4 GB addressing space, and the address space of different applications is isolated.

(4) DLL does not have its own private space. They are always mapped to the address space of other applications.

4. Basic concepts of PE Structure

(1) entry point: the entry point for execution of executable programs. The common point is the address of the first line of code during execution.

(2) file offset address: When the PE is stored on the disk, the address of each data is counted from the first byte, And the start value is 0.

(3) virtual address (VA): As mentioned above, the windows program runs in Protected Mode and adopts a virtual address, that is, the logical address used by the program to access the memory, also known as the memory offset address.

(4) base address: the initial memory address mapped to the specified memory address when the file is executed

The above information can be viewed by PEid or LoadPE.