For those of you who have been following my eventful career, you already know that this is actually my second published tutorial. Just to bring you up to date, my first tutorial was titled Pas à Pas vers l’Assembleur and was originally written in April, 2009.
After that, I made a small project called asmguru – a knowledge base & library for assembly developers.

Now, welcome to Getting Your Hands Dirty in x86 Assembly Code.  Another tutorial? How come?

There are lots of books concentrating on the topic of Assembly programming in general and Windows programming using the Assembly language in particular. This saga is intended for everybody who wants to master the art of x86 assembly language under the Win32 platform and start exploiting the security part of the Windows operating system.

Many people believe that assembly language is dead and useless when it comes to writing real programs. Somehow I do agree, but assembly is not only for coding, it is for Software vulnerability Analysts, Bug Hunters, Shell-coders, Exploit Writers, Reverse Code Engineers, Virus Authors, and Malware Analysts. Indeed, when you spend your day reading ASM routines, then ASM becomes a must.

This saga is more code oriented than theory, so you will be provided with all materials and resources in the first of each part. I really don’t support theory when it comes to programming. In others words, blabla is in the books, code is what you’ll find mostly here. Additionally, code will be highly commented and structured, written with the JWasm Assembler, for the Intel x86 architecture and can run under the Windows 32-bit platform.

First and foremost, our objective is to learn:

  • Windows System Programming
  • Portable Executable Format
  • Self-Modifying Code
  • Code Protection, Anti-Reverse Code Engineering

However, many people should not be familiar with:

  • IA-32 Instruction Set
  • Assembly Language Foundations
  • JWasm Assembler Syntax
  • Win32 Programming
  • Tools of The Trade (IDA Pro, Immunity Debugger, WinDBG, …)

As a consequence, before getting directly to discovering the security of Windows, we need to have a solid background and handle some prerequisites. So, we will start by giving you a complete look at the assembly basics and the Windows API Programming, then we will move to the hearth of windows at kernel mode level and Windows internal related stuff. Afterwards, we will explore the Portable Executable File Format, and we will try to write self-modifying code, polymorphic and metamorphic engine. Finally, we will end our journey by looking closer at some advanced anti-reverse engineering techniques and code tampering.

Each code will be structured in the following way:

  • New Concepts
  • New APIs
  • Key Notes
  • ASM Code
  • Output

In some cases, as in the Part I, there is a book called Programming Windows from Charles Petzold, It’s an amazing book and it teaches Windows programming; unfortunately, it’s in the C language. I said to myself instead of writing ASM code directly, why not reconstruct the code from the disassembled C code. You’ll look how C Code is disassembled, you’ll reconstruct it in ASM, then you’ll look at it again to see how much closer your code looks to the disassembled one.

We will follow this Reversing – Coding – Reversing approach as much as possible.

Before we go on with this saga, every time that you read it, it’s going to make more sense to you. Every time that you go back to the principles that you’ll learn here, it is going to hit you in a different level. What that means is like: if you go out now, maybe the surface level principles are hitting you and a year from now the same principles that you learn from here will take on a different meaning, and five years from now – the time it took me to master assembly- it’s gonna have an entirely different meaning.

Happy ASM Coding !

Part 0×00 : Assembly vs Itself Getting The Basics

0×00 A Few Words About Assembly
0×01 Set Up The Environment And Tools
0×02 Basic Computer Organization
0×03 Assembly Language Fundamentals
0×04 Data Transfers, Addressing, and Arithmetic
0×05 Arrays and Strings
0×06 Branching and Looping
0×07 Procedural Calls, Calling Convention, Stack Frame and Heap Structure.
0×08 Structures, Macros, and Unions.
0×09 Could You Solve This ?
0×10 Appendix and References

Part 0×01 :  Assembly vs Win32 API Programming

Want to learn more?? The InfoSec Institute Advanced Hacking course aims to train you on how to successfully attack fully patched and hardened systems by developing your own exploits. You will how to circumvent common security controls such as DEP and ASLR, and how to get to confidential data. You take this knowledge back to your organization and can then formulate a way to defend against these sophisticated attacks. Some features of this course include:
  • Create 0day attacks as part of the Advanced Persistent Threat
  • 5 days of Intensive Hands-On Labs
  • Use fuzzers and dynamic analysis to attack custom and COTS apps
  • Reverse engineer binaries to find new vulnerabilities never discovered before
  • Attack and defeat VPNs, IDS/IPS and other security technologies

Getting Started
0×11. Message Box
0×12. First Windows Program
The GDI Philosophy
0×13. Painting with Text using

……