Capstone Review & Reading Any Assembly
A method for disassembling anything
- › Apply a repeatable method to read any small binary you've never seen
- › Recognize functions, the ABI, control flow, data access, and calls on sight
- › Consolidate the whole spine into one working mental model of the machine
- › Prove the promise: read a binary you didn't write and explain what it does
You can read the machine now
Thirty days ago you couldn't have read a single line of disassembly. Today you can read most of a small program's, and — more importantly — you have a *method* for the parts you don't recognize. This final lesson isn't new material; it's the method that turns everything you learned into a repeatable skill: given any small binary, how do you figure out what it does? That skill — reading the machine — is the foundation the entire rest of your path (systems, and especially offensive security) stands on.
The method: reading any small binary
A repeatable procedure. Follow it top to bottom and even unfamiliar code yields:
1. FIND THE FUNCTIONS look for prologues (push rbp; mov rbp,rsp)
and epilogues (leave/pop rbp; ret). Each is a function.
2. NAME THE ARGUMENTS at a function's start, values read from rdi, rsi,
rdx, rcx, r8, r9 are its 1st..6th arguments (ABI, day 13).
3. MAP THE LOCALS [rbp-N] / [rsp+N] slots are local variables (day 14).
4. TRACE CONTROL FLOW cmp + conditional jump = an if (day 9);
a backward jump = a loop (day 10).
5. READ DATA ACCESS [base + index*scale] = array a[i], scale=element size (17);
[reg + fixeddisp] = a struct field (day 18) or a local.
6. FOLLOW THE CALLS 'call X' with args set up in rdi/rsi/... before it;
result used from rax after (day 13). Name X if you can.
7. FIND THE RETURN what's in rax/eax at 'ret' is the return value (day 13).The whole spine, in one paragraph
Here is everything, connected: A computer is switches (day 1); we impose meaning on their patterns to get numbers, including negatives via two's complement (day 2). The CPU (day 3) moves those patterns between registers and memory (days 4, 6), doing arithmetic that sets flags (day 8), which conditional jumps read to make branches (day 9) and loops (day 10). The stack (day 11) holds return addresses so functions can call and return (day 12) under a calling convention (day 13), each in its own frame (day 14). C is a human-readable skin over exactly this: types are sizes (day 15), pointers are addresses (day 16), arrays are pointer arithmetic (day 17), structs are laid-out fields (day 18), and functions compile to the assembly you can now read (day 19) — including function pointers, which are code addresses as data (day 20). Beyond the stack lies the heap (day 22) and its bugs, strings are bytes with a zero (day 23), you manipulate bits directly (day 24), you ask the kernel for the world via syscalls (day 25), all built by a four-stage pipeline (day 26), inspected with gdb (day 27), and made dangerous by undefined behavior (day 28) — which you can now reason about instead of fear. That paragraph is the machine. You own it.
The promise, kept
Day 1 made a promise: in a year you'd understand computers and write code like drinking water, and this first month would let you *read any small binary and write C fluently while reasoning about its memory*. Look back at what you built: a bit printer, arithmetic and flags by hand, loops and functions in raw assembly, C mapped to its assembly line by line, a dynamic array, a program that talks straight to the kernel, and a working virtual CPU. You didn't learn *about* the machine — you built pieces of it. Everything after this (the branches: math, algorithms, AI, and the offensive path) stands on this foundation. The spine is complete.
push rbp; mov rbp,
rsp; sub rsp, 0x20, and shortly after you see mov [rbp-0x14], edi and a cmp followed by jle.
Using the method, what have you already learned about this function without reading further?Read a binary you didn't write
Get a small binary you did NOT write the source for: compile a short C program a friend wrote, or (cleaner) write 3-4 small functions, compile at -O2, and then WITHOUT looking at the source, disassemble one function with objdump -d -M intel and apply the seven-step method to reconstruct what it does — its arguments, any locals, its control flow (ifs/loops), its data accesses, any calls, and its return value. Write a plain-English paragraph describing the function, then reveal the source and check yourself. Finally, extend your day-29 stack machine with one new opcode as a victory lap. This is the whole spine, applied.
$ gcc -O2 mystery.c -o mystery$ objdump -d -M intel mystery # pick a function; apply the 7-step method- › You identified a function's prologue/epilogue and its arguments from the ABI registers
- › You traced at least one branch or loop and named it
- › You reconstructed roughly what the function does BEFORE seeing the source
- › Your reconstruction matched the actual source (or you found exactly where you were off)