Binary Code Analysis
IAN Acad. year 2018/2019 Summer semester 4 credits
Language of instruction
Subject specific learning outcomes and competences
Generic learning outcomes and competences
Why is the course taught
- Operating Systems (IOS)
Prerequisite kwnowledge and skills
- Intel Corporation: Intel 64 and IA-32 Architectures Software Developer Manuals, 2015.
- Matz, M., Hubicka, J., Mitchell, M.: System V Application Binary Interface, AMD64 Architecture Processor Supplement, 2013.
- Ljubuncic, I.: Linux Kernel Crash Book, 2011.
- Drake, C., Brown, K.: Panic! UNIX System Crash Dump Analysis, Prentice Hall, 1995.
- Hofmann, F.: The Solaris Operating System on x86 Platforms, Crashdump Analysis, Operating System Internals, 2005.
Syllabus of lectures
- Computer architectures in general, registers, implicit and explicit stack operations. The x86 and x86_64 computer architectures, common instructions. System V ABI on x86_64 architecture, red zone.
- Compilation, linking, and running code. Examples of compiler optimizations, stack optimizations (leaf and tail calls, function inlining), linker script, understanding of the Unix binary file (ELF, objdump).
- Linux crash dump analysis, DWARF debug symbols, using the crash(8) tool.
- Linux crash dump analysis, understanding kernel Oops, kernel flags, sysrq.
- Kernel process and memory management, task_struct, vmas, SLAB allocator.
- Interrupt processing, postponing work, bottom halves, softirqs and tasklets, work queues.
- Live kernel tracing (SystemTap, ftrace), locks, deadlocks and hangs and their analysis and reconstruction.
Syllabus of computer exercises
- Decomposition of an ELF binary file, decoding its sections, and code disassembling.
- Using the crash(1) tool on Linux.
- Crash dump analysis of a Linux system on the IA-32 architecture.
- Crash dump analysis of a Linux system on the AMD64 architecture.
- System tracing using SystemTap and ftrace.
- Tracing and analysis of system deadlocks.
Syllabus - others, projects and individual work of students
- Analysis of a crash dump on the IA-32 architecture.
- Analysis of a crash dump on the AMD64 architecture.
- Monitoring of a running system using SystemTap.
Course inclusion in study plans