01 Navigation
| G | Go to address / name |
| Enter / Esc | Follow / back |
| Ctrl↵ | Forward |
| CtrlP | Jump to function |
| X | Who references this |
| Space | Text ↔ graph |
| F5 | Pseudocode |
02 Edit & mark up
| N | Rename |
| ; / : | Comment / repeatable |
| C / D / A | Make code / data / string |
| U | Make undefined |
| P | Create function |
| H / O | Hex↔dec / toggle offset |
| F2 | Hex edit mode |
03 Patch bytes
| Want | Do | Byte |
|---|
| Invert branch | jz↔jnz | 74↔75 |
| Never jump | NOP it | 90 |
| Always jump | jcc→jmp | →EB |
| Force return | write ret | C3 |
| Return 1 | mov eax,1;ret | B8 01 00 00 00 C3 |
| Return 0 | xor eax,eax;ret | 31 C0 C3 |
04 Flow in assembly
if (x == 0)
test eax, eax
jnz else ; not 0 → skip
while / for
top: ; body...
cmp ecx, edx
jl top ; back-edge = loop
switch
jmp [rax*8 + table]
05 Calling conventions
| ABI | Arguments |
|---|
| x64 (Windows) | rcx, rdx, r8, r9, then stack |
| x64 (System V) | rdi, rsi, rdx, rcx, r8, r9 |
| x86 cdecl/stdcall | all on stack (right→left) |
| x86 fastcall | ecx, edx, then stack |
| Return value | rax / eax |
x64 callers leave 32 bytes of shadow space.
06 Opcodes worth knowing
C3 / C2 | ret / ret n |
E8 / E9 | call / jmp rel32 |
EB | short jmp |
74/75 | je/jne |
90 | nop |
55 8B EC | x86 prologue (push ebp;mov ebp,esp) |
CC | int3 (breakpoint / padding) |
07 Triage signals
| Signal | Reading |
|---|
| Entropy > 7.5 (code) | packed / encrypted |
UPX0/.vmp/.themida | packer section name |
< 12 imports + GetProcAddress | runtime-resolved API |
| imphash match | same family / toolkit |
| W+X section | self-modifying code |
| no digital signature | publisher unverified |
08 API → capability
VirtualAllocEx + WriteProcessMemory + CreateRemoteThread | process injection |
SetWindowsHookEx / GetAsyncKeyState | keylogging |
IsDebuggerPresent / NtQueryInformationProcess | anti-debug |
InternetOpen / URLDownloadToFile / socket | network / C2 |
RegSetValue / CreateService | persistence |
CryptEncrypt + file walk | possible ransomware |
For authorized analysis, education and research only. Patch/unpack only software you own or are
allowed to study.
tlk