Here’s some things I learned from watching the 0x00sec livestream.
(The challenge being reversed was applestore) :apple:

Global Variables

They can be seen in IDA because they appear with something like:

mov eax, offset myCart


STRUCTS

IDA Structs Tab

Can be used to actually define a struct in IDA which will help it (and you) recognize field referrences in the remaining disassembly!

In this case it was used to create an ITEM struct:

typedef struct _item ITEM {
   char * name;
   int price;
   ITEM *next;
   ITEM *prev;
}

The way to call this is:

  • Change Fieldtype
  • Offset
  • Struct
  • ITEM*

Assembly dealing with structs

Something to note is that when referrencing structs:

# Assuming all fields have size of 4 bytes here  

# eax is the address of an ITEM struct  

mov edx, [eax] -> field1    <---- this is not the whole struct!  
mov edx, [eax+4] -> field2
mov edx, [eax+8] -> field3


Linked lists

You can tell when the struct has 4/8 bytes and is referrenced in a way which doesnt quite fit other data types ie. str, int. This can be identified by offset + 8

_mycart = _mycart[8]


lea is fancy mov

In cases where optimization is turned on for the compiler. A statement such as var++ will be done with a lea instruction compared to the usual mov, which saves one or two lines of instructions… :thinking: