{ "id": 12732, "title": "What are meanings of the sections of given bytes and asm files?", "url": "/competitions/malware-classification/discussion/12732", "author_name": "", "post_date": "2015-03-08T21:58:03.627Z", "votes": 1, "comment_count": 5, "views": 3037, "content": "

I am not very familiar to bytes and asm file representations. As I understand, asm file includes the disassembler output given the bytes representation of the particular file.

\n

Beside this what are the meanings of the particular sections of these files?

\n

My understanding is;

\n

for bytes files left most column is like line counter (maybe the memory location of that segment) and the remaining columns are the hexadecimal representation of the binary content of that file.

\n

in asm files there are assembly codes of the binary files but also we have lots of repetitions of such rows

\n

.data:0063800D D7 db 0D7h ; ×

\n

what is the meaning of such rows and how the asm files are structured in particular?

", "messages": [ { "id": "65730", "postDate": "03/08/2015 21:58:03", "content": "

I am not very familiar to bytes and asm file representations. As I understand, asm file includes the disassembler output given the bytes representation of the particular file.

\n

Beside this what are the meanings of the particular sections of these files?

\n

My understanding is;

\n

for bytes files left most column is like line counter (maybe the memory location of that segment) and the remaining columns are the hexadecimal representation of the binary content of that file.

\n

in asm files there are assembly codes of the binary files but also we have lots of repetitions of such rows

\n

.data:0063800D D7 db 0D7h ; ×

\n

what is the meaning of such rows and how the asm files are structured in particular?

", "rawMarkdown": "", "votes": null }, { "id": "65749", "postDate": "03/09/2015 04:30:30", "content": "

.text: Code
.data: Initialized data
.bss: Uninitialized data
.rdata: Const/read-only (and initialized) data
.edata: Export descriptors
.idata: Import descriptors

\n

from here : )

", "rawMarkdown": "", "votes": null }, { "id": "69258", "postDate": "04/01/2015 03:54:34", "content": "

In the same context, Could some one explain what do the Hexa code representation in the .bytes files mean?

\n

For example how should I interpret the line below?

\n

00401000 56 8D 44 24 08 50 8B F1 E8 1C 1B 00 00 C7 06 08

\n\n

Thanks

", "rawMarkdown": "", "votes": null }, { "id": "69294", "postDate": "04/01/2015 10:12:28", "content": "

[quote=MalNuggets;69258]

\n

For example how should I interpret the line below?

\n

00401000 56 8D 44 24 08 50 8B F1 E8 1C 1B 00 00 C7 06 08

\n

[/quote]

\n

I was taught by an alien tribe to read this and it means:

\n

" There are 99 little bugs in my code, take one down, patch it around,

\n

   Now There are  1,124,002,124 little bugs in my code, take one down, patch it around!

\n

... Now There are 189,114,022,934... "

\n

Kidding aside, I do not think you need to interpret this as something that has "meaning", but as a bag of words or something. For example, does "F1" or "8B" appears in all Classes or mostly in class_1 virus?

", "rawMarkdown": "", "votes": null }, { "id": "69325", "postDate": "04/01/2015 15:36:56", "content": "

@MalNuggets :

\n

00401000h is often the code section base of the PE EXE (32bit) module.

\n

you need the main entry point to get the instructions.

\n

for that you have the .asm files.

\n

So look at 00401000h in the corresponding .asm file,

\n

there you find the instructions.

\n

if 00401000h is a code label address, then these bytes

\n

00401000 56 8D 44 24 08 50 8B F1 E8 1C 1B 00 00 C7 06 08

\n

00401010 00 00

\n

would be in x86 (32bit) instructions:

\n

56                    push esi                                              ; push ESI register onto stack

\n

8D442408        lea eax,[esp+8]                                   ; assign EAX register with ESP register + 8

\n

50                     push eax                                            ; push EAX register onto stack

\n

8BF1                mov esi,ecx                                        ; assign ESI register with ECX register

\n

E81C1B0000   call function@00411139h                   ; call sub function

\n

C70608000000  mov DWORD PTR [esi],00000008h ; assign memory @ address mode [esi] with 8

\n

...

\n

if 00401000h is not a code label address, IDA may have recognized them as data:

\n

56 db 56h

\n

8D db 8Dh

\n

44 db 44h

\n

...

\n

then the bytes can mean anything, so for example it can be any datatype of any size

\n

you can imagine (int, float, double, textstrings, ...), so for example bytes, words, dwords

\n

if such bytes are referenced, as for example as 00411139h in case above, that

\n

is another code label.

\n

it also could be a jumptable, then each dword of them contains another virtual address

\n

of a code Label.

", "rawMarkdown": "", "votes": null }, { "id": "69674", "postDate": "04/04/2015 22:08:31", "content": "

Thank you @m and @Μαριος Μιχαηλιδης KazAnova for the information.

", "rawMarkdown": "", "votes": null } ], "comments": [ { "id": 65749, "author_name": "jiweiliu", "author_url": "", "post_date": "03/09/2015 04:30:30", "content": "

.text: Code
.data: Initialized data
.bss: Uninitialized data
.rdata: Const/read-only (and initialized) data
.edata: Export descriptors
.idata: Import descriptors

\n

from here : )

", "votes": null, "replies": [] }, { "id": 69258, "author_name": "malnuggets", "author_url": "", "post_date": "04/01/2015 03:54:34", "content": "

In the same context, Could some one explain what do the Hexa code representation in the .bytes files mean?

\n

For example how should I interpret the line below?

\n

00401000 56 8D 44 24 08 50 8B F1 E8 1C 1B 00 00 C7 06 08

\n\n

Thanks

", "votes": null, "replies": [] }, { "id": 69294, "author_name": "kazanova", "author_url": "", "post_date": "04/01/2015 10:12:28", "content": "

[quote=MalNuggets;69258]

\n

For example how should I interpret the line below?

\n

00401000 56 8D 44 24 08 50 8B F1 E8 1C 1B 00 00 C7 06 08

\n

[/quote]

\n

I was taught by an alien tribe to read this and it means:

\n

" There are 99 little bugs in my code, take one down, patch it around,

\n

   Now There are  1,124,002,124 little bugs in my code, take one down, patch it around!

\n

... Now There are 189,114,022,934... "

\n

Kidding aside, I do not think you need to interpret this as something that has "meaning", but as a bag of words or something. For example, does "F1" or "8B" appears in all Classes or mostly in class_1 virus?

", "votes": null, "replies": [] }, { "id": 69325, "author_name": "", "author_url": "", "post_date": "04/01/2015 15:36:56", "content": "

@MalNuggets :

\n

00401000h is often the code section base of the PE EXE (32bit) module.

\n

you need the main entry point to get the instructions.

\n

for that you have the .asm files.

\n

So look at 00401000h in the corresponding .asm file,

\n

there you find the instructions.

\n

if 00401000h is a code label address, then these bytes

\n

00401000 56 8D 44 24 08 50 8B F1 E8 1C 1B 00 00 C7 06 08

\n

00401010 00 00

\n

would be in x86 (32bit) instructions:

\n

56                    push esi                                              ; push ESI register onto stack

\n

8D442408        lea eax,[esp+8]                                   ; assign EAX register with ESP register + 8

\n

50                     push eax                                            ; push EAX register onto stack

\n

8BF1                mov esi,ecx                                        ; assign ESI register with ECX register

\n

E81C1B0000   call function@00411139h                   ; call sub function

\n

C70608000000  mov DWORD PTR [esi],00000008h ; assign memory @ address mode [esi] with 8

\n

...

\n

if 00401000h is not a code label address, IDA may have recognized them as data:

\n

56 db 56h

\n

8D db 8Dh

\n

44 db 44h

\n

...

\n

then the bytes can mean anything, so for example it can be any datatype of any size

\n

you can imagine (int, float, double, textstrings, ...), so for example bytes, words, dwords

\n

if such bytes are referenced, as for example as 00411139h in case above, that

\n

is another code label.

\n

it also could be a jumptable, then each dword of them contains another virtual address

\n

of a code Label.

", "votes": null, "replies": [] }, { "id": 69674, "author_name": "malnuggets", "author_url": "", "post_date": "04/04/2015 22:08:31", "content": "

Thank you @m and @Μαριος Μιχαηλιδης KazAnova for the information.

", "votes": null, "replies": [] } ], "raw_markdown_by_id": { "65730": "", "65749": "", "69258": "", "69294": "", "69325": "", "69674": "" }, "source": "meta" }