2 structures d’exécutables / binaires

Window ⇒ PE (Portable Executable)

Linux/Unix ⇒ ELF (Executable and Linkable Format)

• A code section:

  This section contains the instructions that the CPU will execute

• A data section:

  This section contains information such as variables, resources (images, other data), etc

• Import/Export tables: These tables reference additional libraries used (imported) or exported by the binary. Binaries often rely on libraries to perform functions.

  For example, interacting with the Windows API to manipulate files

  Désassemblage ou Décompilation

  

  Outils

  

Radar

r2 -d ./program-namen

Analyse

aa

Liste des functions

afl

décompilation fonction main

pdf @main

• db memory-address —> pose de breakpoint
• dc —> aller jusqu’au breakpoint
• ds —> step suivant
• ood —> retour au début
• dr —> voir les registres