From 6209db48e8d2968619b1d2ed134051f90db86262 Mon Sep 17 00:00:00 2001 From: Amanda Rousseau Date: Wed, 8 Mar 2017 13:02:06 -0800 Subject: [PATCH] updating navigation --- fundamentals2.md | 11 +++++++---- fundamentals3.md | 24 ++++++++++++++++++++++++ 2 files changed, 31 insertions(+), 4 deletions(-) create mode 100644 fundamentals3.md diff --git a/fundamentals2.md b/fundamentals2.md index 5f69ce2..e290f56 100644 --- a/fundamentals2.md +++ b/fundamentals2.md @@ -7,13 +7,16 @@ title: Fundamentals # Section 1.2: Fundamentals # -## Anatomy of a C program ## +## Anatomy of a Windows PE C program ## + +Typical windows programs are in the Portable Executable (PE) Format. It’s portable because it contains information, resources, and references to dynamic-linked libraries (DLL) that allows windows to load and execute the machine code. ![alt text](https://securedorg.github.io/images/Cprogram.gif "C Program") -## x86 Assembly ## +## PE Header ## -### Registers ### +## Memory Layout ## -### Opcodes ### +## The Stack ## +[Environment Setup <- Back](https://securedorg.github.io/RE101/section1) | [Next -> x86 Assembly](https://securedorg.github.io/RE101/section1.3) diff --git a/fundamentals3.md b/fundamentals3.md new file mode 100644 index 0000000..53a6322 --- /dev/null +++ b/fundamentals3.md @@ -0,0 +1,24 @@ +--- +layout: default +permalink: /RE101/section1.3/ +title: Fundamentals +--- +[Go Back to Reverse Engineering Malware 101](https://securedorg.github.io/RE101/) + +# Section 1.3: Fundamentals # + +## x86 Assembly ## + +### Opcodes and Instructions ### + +### Registers ### + +## A Function and Calling a Function ## + +### Arguments ### + +### Local Variables ### + +### The Stack ### + +[Intro <- Anatomy of PE](https://securedorg.github.io/RE101/section1.2) | [Next -> Malware Techniques](https://securedorg.github.io/RE101/section2)