Binary analysis revolves around the examination and evaluation of binaries.
To understand this field better, let's delve into the fundamental concepts of binary formats and life
cycle of binaries.
Once you grasp these concepts, you will be well prepared to tackle the subsequent sections which we
will delve into Elf and P binaries in next sections.
So these two formats are extensively utilized on Linux and Windows Systems, making them crucial for
comprehensive binary analysis in the realm of modern computing.
Computations are carried out using the binary numerical systems, which represents numbers as sequences
of ones and zeros.
The binary code, also known as machine code, is a language executed by these computer systems.
So a program comprises a combination of machine instructions which, as the name and binary code and
data such as variables and constants to manage the multitude of programs on a given system effectively,
it becomes essential to store the code and data belonging to each program within a single fine and self-contained
file.
So these files contain executable binary programs are referred as binary executable files or simply
binaries.
So the primary objective of this course is to of this section is to explore and analyze these binaries
comprehensively for malware analysis and reverse engineering.
So before we dive into the intricacies of binary formats like Elf and PE, let's begin with a broad
overview of how executable binaries are generated from source code.
Following that, we will dissect a sample binary, allowing you to gain a solid understanding of the
code and data encapsulated within binary files.
Armed with this knowledge, you will proceed to explore Elf and P binaries in next sections and also
in next sections.
You will have the opportunity to construct your own binary loader, enabling you to parse and analyze
binaries.
So firstly we will understand this compilation phase.
So the production of binaries involves a process called compilation, right?
Which translates human readable source code such as C or C plus plus into machine executable by processor.
So here we are.
I draw some diagram and this illustrates an overview of these steps typically involved in the compilation
process for C code or C plus plus code.
Similar steps apply to some languages as well and compiling C code in encompasses four phases here the
preprocessing compilation assembly.
And linking.
So interestingly, one of these phases is also known as compilation and creating a particular overlap
in terminology.
Other modern compilers often merge some or all of these phases.
We will examine them individually for the sake of clarity and demonstration.
So firstly we have the preprocessing, which you will also learn more deeply in next lectures.
So this initial phase involves the preprocessing of the source code.
It includes the operations such as macro expansions, file inclusion and conditional compilation.
So Preprocessing ensures that the code is ready for subsequent stages of compilation.
We also have the compilation in this phase.
The Preprocessed source code is translated into assembly language specific to the target architecture,
so the compiler analyzes the code syntax checks for errors and generates assembly instructions accordingly.
In third we have assembly.
During assembly, the compiler further translates the assembly code into the object code consisting
of binary instructions and data representations specific to the target processor.
This step involves resolving memory addresses and generating relocation information and lastly linking.
Finally, the linking phase combines the generated object code with the necessary libraries and object
files to create a fully functional binary executable.
The linker resolves symbol references, performs memory address fixing and generates the final binary
file ready for execution.
And it's important to note that although the four phases mentioned here are typically distinct, modern
compilers often optimize and streamline the process by merging some or all of these steps.
So nonetheless, understanding each phase individually provides a solid foundation of for comprehending
the intricacies of the binary analysis process.
And by familiarizing yourself with the compilation process and the anatomy of binaries, you are now
equipped to delve deeper into specific formats of Elf and P binaries.
So these values formats hold a wealth of information waiting to be explored and analyzed, offering
valuable insights into the inner workings of executable programs.
And here we have this diagram here.
So now let's delve deeper into the pre-processing phase.
In next lecture.