メモリとレジスタの調査
実行中にメモリ領域を調べ、レジスタの値を確認し、プログラムの状態を変更する練習をします。
「メモリとレジスタの調査」はCoddyKit上の無料Reverse Engineering & Binary Analysis Basicsレッスンです。 これはレッスン3/4です。 下記で完全なレッスンを無料で読むことができます。その後、ブラウザ内の組み込みコードエディタと24時間対応のAIチューターでハンズオン演習できます。 これはReverse Engineering & Binary Analysis Basics学習パスの一部であり、ウェブとCoddyKitアプリ全体で進捗が同期されます。 Reverse Engineering & Binary Analysis Basicsコースには全4レッスンが含まれています。
このレッスンの一部はまだ翻訳されておらず、英語で表示されています。
Debugging's Core: Memory & Registers
When analyzing programs, especially during dynamic analysis, understanding what's happening inside the CPU is key. This means looking at registers and memory.
These are the CPU's direct workspaces, holding data and instructions that are actively being processed.
CPU's Scratchpad: Registers
Registers are tiny, super-fast storage locations directly within the CPU itself. Think of them as the CPU's "scratchpad" where it keeps data it needs immediately.
- They hold temporary values, addresses, and control information.
- Accessing data in registers is much faster than accessing RAM.
- Different architectures (like x86, ARM) have different sets of registers.
Common x86/x64 Registers
While there are many registers, some are crucial for reverse engineering:
- General-Purpose: RAX/EAX, RBX/EBX, RCX/ECX, RDX/EDX (used for data, function arguments, return values).
- Stack Pointer: RSP/ESP (points to the top of the stack).
- Base Pointer: RBP/EBP (points to the base of the current stack frame).
- Instruction Pointer: RIP/EIP (points to the next instruction to execute).
Viewing Registers in GDB
Let's see how to inspect registers using a debugger like GDB. We'll use a simple C program.
First, compile with debug info (-g): gcc -g -o myprog myprog.c
After compiling and starting GDB (e.g., gdb -q ./myprog), you can set a breakpoint (break main), run (run), and then use info registers.
#include <stdio.h>
int main() {
int a = 10;
int b = 20;
int sum = a + b;
printf("Sum: %d\n", sum);
return 0;
}Program's Workspace: Memory
Memory (RAM) is where your program stores larger amounts of data that aren't actively being processed by the CPU. This includes variables, program code, and other resources.
Every byte in memory has a unique address. When a program runs, it gets its own dedicated "virtual" memory space.
Simplified Memory Layout
A program's memory is typically divided into sections:
- Text/Code Segment: Contains the executable instructions.
- Data Segment: Stores global and static variables.
- Heap: Used for dynamically allocated memory (e.g., with
malloc). - Stack: Used for local variables, function arguments, and return addresses.
Viewing Memory in GDB
To inspect memory in GDB, we use the x command (examine memory). It has a flexible syntax:
x /NFS ADDRESS- N: Number of units to display (optional).
- F: Format (e.g.,
xfor hex,dfor decimal,sfor string,ifor instruction). - S: Size (e.g.,
bfor byte,hfor halfword (2 bytes),wfor word (4 bytes),gfor giant (8 bytes)).
Example: Viewing a Stack Variable
Let's use our previous program. Compile it and set a breakpoint before printf. Then, we can find the address of sum and examine its content.
Run this code, then attach GDB (gdb -q ./myprog), set a breakpoint at line 7 (break main.c:7), and run (run).
In GDB: p &sum to get its address. Finally, x /w ADDRESS_OF_SUM to view its 4-byte value.
#include <stdio.h>
int main() {
int a = 10;
int b = 20;
int sum = a + b; // Breakpoint here
printf("Sum: %d\n", sum);
return 0;
}Changing Register Values
A powerful debugging technique is to modify register values on the fly. This can change how a program behaves without altering its code.
In GDB, you can use the set command:
set $rax = 0x1234set $rip = *0x400500(jump to a new address)
This is useful for bypassing checks or redirecting execution flow.
Altering Memory Content
Just like registers, you can also modify memory content while debugging. This allows you to change variable values, strings, or even instructions in memory.
Using GDB's set command:
set var_name = new_value(if the variable is in scope)set {int}0x400000 = 123(change 4 bytes at address 0x400000 to 123)
Be careful, incorrect modifications can crash the program!
Debugger Challenge
You're debugging a program. You want to see the value of a 4-byte integer variable named counter located at memory address 0x7fffffff0000. What GDB command would you use?
Recap: Debugging's Core
Today, we explored how to examine and modify the core components of a running program: registers and memory.
- Registers are CPU's fast storage, viewed with
info registers. - Memory holds larger data, viewed with
x /NFS ADDRESS. - Both can be modified with
setto alter program state dynamically.
These skills are fundamental for understanding program execution and reverse engineering!
よくある質問
「メモリとレジスタの調査」レッスンは無料ですか？
はい。「メモリとレジスタの調査」の完全なテキストはこのウェブで無料で読めます。インタラクティブに演習し（組み込みコードエディタと24時間対応のAIチューター）、Reverse Engineering & Binary Analysis Basicsコースの残りをアンロックするには、CoddyKit PROにアップグレードしてください。 Reverse Engineering & Binary Analysis Basicsコースには全4レッスンが含まれています。
「メモリとレジスタの調査」で何を学びますか？
実行中にメモリ領域を調べ、レジスタの値を確認し、プログラムの状態を変更する練習をします。 ブラウザで直接実行するハンズオンコードでReverse Engineering & Binary Analysis Basicsを演習し、24時間対応のAIチューターがレッスンを進める中での質問に答えます。
Reverse Engineering & Binary Analysis Basicsを始めるのに経験は必要ですか？
事前経験は必要ありません。CoddyKitのReverse Engineering & Binary Analysis Basicsは初級者から上級者向けに構成されているため、ここから始めるか最初から始めて、自分のペースで進むことができます。 これはレッスン3/4です。
「メモリとレジスタの調査」レッスンにはどのくらい時間がかかりますか？
ほとんどのCoddyKitレッスンは約5～10分かかります。各レッスンはコンパクトでインタラクティブなので、着実に進歩し、ウェブとアプリ全体で正確に前回の場所から再開できます。
このReverse Engineering & Binary Analysis Basicsレッスンでコードを書いて実行できますか？
はい。すべてのReverse Engineering & Binary Analysis Basicsレッスンに組み込みコードエディタが含まれているため、ブラウザでリアルコードを書いて実行し、即座のAIフィードバックを取得できます。ローカル設定は不要です。