REVE1 Logs
Use gcc -S to emit assembly text from C source, or objdump -d / GDB's disassemble to read the machine code back out of a compiled binary.
There are two directions, and both are essential for reverse engineering practice:
Forward — C to assembly text:
gcc -S -O2 example.c...
Q Why does the compiler convert while and for loops into do-while form internally?
Because do-while — "run the body, then conditionally jump back" — is the only loop shape the hardware directly provides; everything else is built on top of it.
Hardware offers straight-line execution plus conditional branches. The do-while pattern maps onto that with zero overhea...
Q How does structure member ordering affect the struct's size, and how can you minimize padding?
Poor ordering scatters padding between members; ordering members from largest/strictest alignment to smallest packs them tightly and shrinks the struct.
* Member ordering changes padding: declare fields in decreasing alignment order to shrink the struct. *
Because each member mu...
Q What is the difference between caller-saved and callee-saved registers, and when do you use each?
Caller-saved: the called function is free to clobber them, so the caller must save anything it still needs. Callee-saved: the function must preserve them, restoring their original values before returning.
* Caller-saved may be clobbered by the callee (temporaries); callee-saved...
Q What do cqto (and the related cdq/cltd) do, and why does signed division need them?
They sign-extend the value in %rax/%eax into the full %rdx:%rax/%edx:%eax pair, building the high half a signed idiv requires.
* cqto sign-extends rax into rdx to build the 128-bit rdx:rax dividend; unsigned div zeroes rdx with xor instead. *
x86 signed division (idivq) divides...
Q What are the big-picture takeaways for how C is translated into assembly?
Assembly has no high-level constructs at all — every loop, branch, and data structure dissolves into compares, jumps, and fixed memory offsets that the compiler computes ahead of time.
The whole topic reduces to three lessons about what disappears when C becomes machine code:
Con...
Q How does GDB's x (examine) command format work for reading memory, such as a jump table?
x/NFU address — examine N items, in Format (x=hex, d=dec, i=instruction, s=string…), of Unit size (b/h/w/g = 1/2/4/8 bytes) — starting at address.
GDB's x is the Swiss-army knife for inspecting raw memory while reverse-engineering. The count, format, and unit are bundled into one...
Q What does the lea (Load Effective Address) instruction do, and why do compilers love it?
lea computes an address expression and stores the address itself — it does not read memory, and unlike arithmetic it leaves the condition flags untouched.
* lea computes an address (no memory access, no flags set) while mov dereferences it; lea doubles as cheap multiply-add. *
l...
Q What are the common conditional-jump instructions and how do you read their conditions after a cmp?
Each j<cc> jumps based on the flags from the preceding cmp/test; signed comparisons use g/l (greater/less), unsigned use a/b (above/below).
* Conditional jumps after cmp fall into signed, unsigned, and equality families; seeing ja/jb signals an unsigned type. *
After cmp b, a (w...
Q What does the capture list [] do in a C++ lambda?
It specifies which variables from the surrounding scope the lambda can use — and whether it grabs each by value (a copy) or by reference.
Capture
Meaning
[]
Capture nothing
[x]
Capture x by value (copy)
[&x]
Capture x by reference
[=]
Capture all used variables by va...