REVE1 Logs
Endianness is the order in which the bytes of a multi-byte value are stored in memory: little-endian puts the least significant byte at the lowest address, big-endian the most significant.
* Little-endian (x86) stores the least-significant byte at the lowest address; big-endian...
Q What's the difference between SAR (arithmetic right shift) and SHR (logical right shift)?
SAR fills the vacated upper bits with copies of the sign bit (preserving sign), while SHR fills them with zeros — so SAR is for signed values and SHR for unsigned.
* Right-shift differs in the vacated top bit: sar copies the sign bit (correct for signed), shr shifts in a 0 (corr...
Q What is the purpose of the .text, .data, .rodata, and .bss sections?
Programs are split into sections by content type so the OS can give each the right permissions — code read-only and executable, constants read-only, variables writable.
* Each section gets the permissions it needs: code read-only and executable, constants read-only, globals writ...
Q What are the three types of object files in the ELF format?
Relocatable (.o), executable, and shared object (.so) — all three use the ELF format, differing mainly in how their addresses are represented.
Type
Extension
Description
Relocatable
.o
Compiled from one source file; contains code and data that can be combined with other .o...
Q What is the .bss section and why does it exist?
.bss holds uninitialized (zero) globals and statics; it takes no space in the file — just a recorded size — and the loader zero-fills it in memory.
* .data carries real bytes on disk; .bss carries only a size — the loader materialises its zeros in memory at startup. *
// Goes in...
Q What are the two main sections in an x86 assembly program and what does each contain?
.text holds the executable code (functions and instructions); .data holds initialized global/static variables.
* The main assembler sections: .text holds executable code, .data holds initialized read/write globals, and .rodata holds read-only constants. *
An assembly file has no...
Q What is the difference between the cmp and test instructions?
cmp sets flags from a subtraction (S1 - S2); test sets flags from a bitwise AND (S1 & S2); neither stores the result — they only update the flags.
Both are "throwaway-result" instructions: they perform an operation purely to set the condition flags, then discard the numeric answe...
Q How does GDB's x (examine) command format work for reading memory, such as a jump table?
x/NFU address — examine N items, in Format (x=hex, d=dec, i=instruction, s=string…), of Unit size (b/h/w/g = 1/2/4/8 bytes) — starting at address.
GDB's x is the Swiss-army knife for inspecting raw memory while reverse-engineering. The count, format, and unit are bundled into one...
Q What is assembly language and how does it relate to machine code?
Assembly is a human-readable, essentially one-to-one notation for machine code — each assembly instruction maps to one binary machine instruction.
Machine code is just bytes; assembly is those same bytes written with names. The mapping is direct:
add %rbx, %rax → 48 01 d8
mov...
Q What are the single-operand arithmetic instructions in x86-64?
They modify one operand in place: inc (+1), dec (−1), neg (two's-complement negate), and not (bitwise complement).
These are compact, common operations on a single value:
Instruction
Effect
inc D
D ← D + 1
dec D
D ← D − 1
neg D
D ← −D (two's complement)
not D
D ← ~D...