REMAEP 01

11 May 2026

The Binary Physics of Memory Corruption

Two cybersecurity experts break down the foundations of malware analysis and reverse engineering using simple, real-world analogies. From malware taxonomy to x86 architecture and stack manipulation — whether you are a fresher or a seasoned IT professional, this episode will change how you look at a malicious binary.

0:00 / 0:00

EpochZero Tech Talks — The Binary Physics of Memory Corruption

Transcript

Conversation between Alex and Maya

Alex — leftMaya — right

Alex

Imagine you are just, you know, staring at a massive monitor wall in a security operations center.

Maya

It is, let's say, a Tuesday back in 2017.

Alex

Oh, yeah, I know exactly where this is going.

Maya

Right.

Alex

In the span of just 48 hours, something like 230,000 computers across 150 countries suddenly go completely dark.

Maya

Screens lock up.

Alex

Ransom notes pop up everywhere.

Maya

Yeah, absolute chaos.

Alex

Total chaos.

Maya

Entire hospital networks in the UK paralyzed.

Alex

Logistics companies are crippled.

Maya

And you've got telecom providers literally pulling physical network cables out of the walls to stop it.

Alex

Want to cry.

Exactly.

Maya

But here's the thing that always gets me about that week and really about incident response in general.

Alex

Exactly.

Maya

The terrifying part wasn't what was happening on the screens or, you know, the panic in those management bridge calls.

Alex

The true horror was what was happening microscopically down on the silicon, down where the machine logic itself was just being twisted.

Maya

Yeah, see, that's the thing.

Alex

That is where the actual battle happens.

Maya

It is not on the dashboards.

Alex

It is not in the executive summaries.

Maya

It's happening right there in the memory registers of the CPU.

Alex

Exactly.

Maya

So welcome, everyone.

Alex

And by everyone, I mean you, the listener, sitting right there with us.

Maya

Think of this deep dive as your shortcut.

Alex

We are bypassing all the dry textbooks today.

Maya

Yeah.

Alex

No textbooks, please.

Maya

None.

Alex

We are giving you the raw, unfiltered reality of reverse engineering.

Maya

I've got my tea right here.

Alex

It's got the...

Maya

That late-night shift vibe.

Alex

And we are just two techies sitting down to unpack how malware fundamentally works.

Maya

Because it is the only way to truly understand what we are actually up against, right?

Alex

If you only understand the high-level buzzword...

Maya

And we're going to do it.

Alex

Yeah.

Maya

Right.

Alex

If you only know how to read an alert from your SIEM dashboard, you are just a spectator.

Maya

You are a passenger.

Alex

Yeah.

Maya

That's a good way to put it.

Alex

To actively defend a network or to, you know, tear apart a piece of malware in a sandbox to see how it ticks, you have to understand the mechanics.

Maya

You have to understand why the machine actually obeys the malware.

Alex

So, let's start with the chaos.

Maya

Because anyone who has sat in an SOC, whether in Poon or Bengaluru at 2 in the morning, knows exactly what I'm talking about.

Alex

Alert fatigue.

Maya

Oh, massive alert fatigue.

Alex

You look at these incident response playbooks, and the sheer volume of terminology is just overwhelming.

Maya

I was looking through our source materials before we started, and they list this massive taxonomy table.

Alex

Oh, the 18 categories?

Maya

Yes.

Alex

18 different categories of malware.

Maya

Viruses, worms.

Alex

Trojans, ransomware, rootkits, RATs, key loggers, downloaders, backdoors, botnets, wipers, spyware.

Maya

Handware, fileless malware, logic bombs.

Alex

Yeah.

Maya

Yeah, I know the list.

Alex

Scareware, crimeware.

Maya

I mean, if you are a tier one analyst and alert fires, trying to figure out which of those 18 boxes the threat fits into is going to induce total paralysis.

Alex

And see, paralysis is the absolute worst outcome in the first hour of an incident.

Maya

Right.

Alex

You just freeze.

Maya

Exactly.

Alex

And the reality is, that kind of rigid taxonomy, well, it's great for a university exam, but it is fundamentally broken in the real world.

Maya

How so?

Alex

I mean, turns mean things, right?

Maya

Sure.

Alex

But modern malware developers don't sit down and say, you know, today, I am going to code a pure downloader.

Maya

Ah.

Alex

They build modular platforms.

Maya

WannaCry is actually the perfect example of that, because it is universally known as ransomware, right?

Alex

That's what the news calls it.

Maya

Yeah, but the only reason it took down 230,000 machines is because it was...

Alex

...simultaneously a worm.

Maya

Right.

Alex

It used the eternal blue exploit to spread itself automatically.

Maya

Right.

Alex

Or, look at Emotet.

Maya

It started years ago as a banking trojan, designed specifically to steal financial credentials.

Alex

But then the operators realized they had such a massive footprint, they evolved it into a spam botnet.

Maya

And eventually they just turned it into a dropper for hire platform, literally leasing out access to other ransomware gangs.

Alex

TrickBot followed the exact same trajectory, actually.

Maya

Depending on the modules the operators push down to the top, down to the infected machine.

Alex

It could be spyware, a credential harvester, or a lateral movement framework.

Maya

So it's everything all at once.

Alex

Basically, yeah.

Maya

So if your incident response team spends 45 minutes on a bridge call, arguing about whether TrickBot is technically a downloader or a backdoor...

Alex

It's game over.

Maya

Game over.

Alex

The adversary has already exfiltrated your Active Directory database.

Maya

Which raises a highly practical question.

Alex

If everything overlaps now, and every piece of malware is essentially a Swiss army knife, why do we even care about the old terminology?

Maya

Why not just call it all bad code and move on?

Alex

How do you actually triage?

Maya

Well, when that server starts beaconing out to an unknown IP, your operational mindset has to shift.

Alex

You abandon the textbook definitions entirely.

Maya

Okay, so what do you use instead?

Alex

Experience analysts use a functional framework.

Maya

We call it the three-question triage.

Alex

Three-question triage.

Maya

I like the sound of that.

Alex

Yeah, you ignore the 18 categories.

Maya

Instead, you look at the raw data and you ask three very specific questions.

Alex

Questions in order.

Maya

Question one.

Alex

How did it arrive?

Maya

Okay, so we are talking about the initial access vector here.

Alex

Like, did a user click a link in a phishing email?

Maya

Was it a supply chain compromise where a software update was poisoned?

Alex

Or, you know, did someone find a rogue USB stick in the parking lot and just plug it right into a workstation?

Maya

Correct.

Alex

You have to establish the vector so you can stop the bleeding.

Maya

Makes sense.

Alex

If it came via email, you purge the Exchange server.

Maya

If it came via an open RDP port, you sever the external connection.

Alex

Right, cut off the oxygen.

Maya

Exactly.

Alex

Once the bleeding is stopped, you move to question two.

Maya

What does it do once it is running?

Alex

The objective.

Maya

So, is it encrypting the file system?

Alex

Is it quietly archiving intellectual property to send out?

Maya

Or is it just trying to establish a persistent backdoor so the attacker can come back next week?

Alex

Yes, that answers the operational threat.

Maya

That dictates your containment strategy.

Alex

And finally, the third question, which is, what really separates the standard malware from the truly advanced threats?

Maya

What's the third one?

Alex

How does it hide?

Maya

Ah, the evasion layer.

Alex

Precisely.

Maya

Is the binary packed or compressed to change its signature?

Alex

Is it operating entirely in volatile memory?

Maya

Meaning, if we just reboot the server, the evidence vanishes completely.

Alex

Right.

Maya

Or is it living off the land?

Alex

Meaning, is it using legitimate administrative tools that are already installed on Windows like PowerShell or WMI to do its dirty work?

Maya

So, answering those three questions, arrival, action, evasion instantly gives you the operational context you actually need.

Alex

It grounds the investigation in reality.

Maya

I'll tell you what, that makes a lot of sense.

Alex

Think about it like a troubleshooting analogy.

Maya

Let's say you're driving on the Mumbai-Poon Expressway.

Alex

Oh, classic route.

Maya

Right.

Alex

It's pouring rain, you're in the GATS, and suddenly your car's engine dies.

Maya

The mechanic who drives out in the tow truck doesn't pull out the manufacturer's 5,000-page engineering manual to study the aerodynamics of the chassis.

Alex

No, of course not.

Maya

They would be wasting precious time.

Alex

Exactly.

Maya

They ask fundamental functional triage questions.

Alex

Did the engine overheat?

Maya

Is there fuel in the tank?

Alex

Did a tire burst?

Maya

Right.

Alex

Answering those tells the mechanic exactly which wrench to grab.

Maya

And the three-question triage does the exact same thing for the SOC analyst.

Alex

It tells you if you need to pull memory captures, block a firewall port, or just shut down the domain controller entirely.

Maya

That is a great analogy.

Alex

Now, with that functional mindset established, we can actually look at the behaviors of specific threats without getting bogged down in all the semantics.

Maya

Right.

Alex

So let's look at three specific profiles that historically cause a lot of confusion but represent entirely different philosophies of attack.

Maya

Worms, Trojans, and rootkits.

Alex

Yes.

Maya

Okay.

Alex

Let's start with worms because I think we assume everyone knows what a phishing email is, but the mechanics of a worm are completely different.

Maya

The defining characteristic of a worm isn't just that it spreads, right?

Alex

It's that it is completely self-propagating.

Maya

That is the terrifying distinction.

Alex

It needs zero human interaction.

Maya

A worm does not need a host file to attach itself to.

Alex

It is a stand-alone, self-contained, executable program.

Maya

So how does it actually move?

Alex

It scans the network, identifies vulnerable machines, exploits those vulnerabilities automatically, copies its own payload into the memory of the target, and then executes itself.

Maya

And then cycle repeats.

Alex

Exactly.

Maya

Then, that newly-used...

Alex

infected machine starts scanning for more targets.

Maya

It is pure exponential growth.

Alex

So wait, what is the exact difference between a virus and a worm?

Maya

People use those words interchangeably all the time.

Alex

They do, but they are very different.

Maya

Think of a virus as a parasite.

Alex

It has to attach itself to a healthy, legitimate file, and it needs you to physically carry it.

Maya

Like handing someone an infected USB drive or emailing them a bad file.

Alex

Exactly.

Maya

A worm, on the other hand, is an airborne infection.

Alex

It travels through the network vents, so to speak, and infects the machine, whether anyone is sitting at the keyboard or not.

Maya

So if I am an employee sitting at my desk, I don't have to click a bad link.

Alex

I don't have to download a PDF.

Maya

I could literally be staring at my desktop background, drinking coffee, not even touching the mouse.

Alex

Zero clicks.

Maya

And because my machine is connected to the corporate network, and maybe my Windows machine hasn't been patched for the latest SMB vulnerability, the worm just reaches right through the network cable, compromises the memory buffer, and takes over.

Alex

Yeah.

Maya

It operates entirely at machine speed.

Alex

By the time a human analyst sees the first alert, thousands of machines are already compromised.

Maya

That is wild.

Alex

Now, contrast that behavior directly with a Trojan.

Maya

A Trojan is the complete opposite philosophy.

Alex

Right.

Maya

It's the classic wooden horse trick, deception.

Alex

Yes.

Maya

A Trojan relies entirely on human psychology and deception.

Alex

It cannot self-replicate, and it cannot spread on its own.

Maya

The attackers build something that looks like a gift, maybe a legitimate software application.

Alex

It can be an update, an urgent invoice from HR, a free utility tool.

Maya

But inside, the malicious payload is just waiting.

Alex

And here is the crucial technical difference for the analyst, right?

Maya

Trojan requires the user to actively execute it.

Alex

If a Trojan lands in your inbox, it just sits there.

Maya

It is totally inert.

Alex

It's waiting for you to pull the trigger.

Maya

Exactly.

Alex

It relies on the user downloading the attachment and double-clicking it.

Maya

So, practically speaking, if I'm looking at telemetry and an endpoint detection tool, what does a Trojan actually look like when it triggers?

Alex

You are looking for anomalous process trees.

Maya

Walk me through that.

Alex

Let's say the Trojan is an Excel file with malicious macros.

Maya

The user double-clicks the file.

Alex

The operating system naturally launches winword.exe or excel.exe.

Maya

Which is totally normal.

Alex

That is normal.

Maya

But then, the user clicks enable content.

Alex

The macro executes.

Maya

Suddenly, the endpoint telemetry shows excel.exe spawning a child process of cmd.exe or powershell.exe.

Alex

Which makes zero sense.

Maya

In a normal business context, why on earth would a spreadsheet need to open a command line terminal?

Alex

It wouldn't.

Maya

And then that powershell process initiates an outbound network connection to some unknown IP address to download a secondary payload.

Alex

Wow.

Maya

That specific sequence, a document reader spawning a command shell, which then initiates a network download.

Alex

That is the behavioral signature of a Trojan.

Maya

Okay.

Alex

So, we have the worm, which is a network level infection spreading automatically.

Maya

We have the Trojan, which is a deception required.

Alex

And then we move to the third profile.

Maya

The one that gives incident responders actual nightmare.

Alex

Rootkits.

Maya

Rootkits, yes.

Alex

Because their primary goal is not necessarily to steal data or encrypt files directly, right?

Maya

Their goal is persistent, undetectable concealment.

Alex

Concealment is everything for a rootkit.

Maya

They want to hide the attacker's presence from the system administrators, from the antivirus software, and frankly, from the operating system itself.

Alex

And they don't just do this by hiding it?

Maya

They don't just do this by hiding a file in some deeply nested hidden folder.

Alex

They fundamentally compromise the trust model of the machine.

Maya

I really want to unpack this because the way Rootkits manipulate the operating system API is fascinating.

Alex

It is brilliant, maliciously speaking.

Maya

Yeah.

Alex

Let's trace how an operating system normally works.

Maya

Right.

Alex

If you open the task manager in Windows to see what programs are running, the task manager application doesn't just magically know what's in the CPU.

Maya

Right.

Alex

It has to ask the boss.

Maya

It has to ask the operating system kernel.

Alex

It makes an API call.

Maya

It does something like inquiry system information.

Alex

Okay.

Maya

The kernel looks at its internal data structures, compiles a list of all the active processes, and hands that list back up to task manager.

Alex

It's a chain of trust.

Maya

The user application implicitly trusts the kernel to provide the ground truth.

Alex

Exactly.

Maya

What a rootkit does is intercept that communication.

Alex

A kernel-level rootkit actually loads itself into the deepest privilege ring of the operating system.

Maya

Ring zero.

Alex

Yes.

Maya

And it hooks into those specific API calls.

Alex

So when task manager asks the kernel for the list of running processes, the kernel complies.

Maya

It compiles the list, which actually includes the malicious rootkit processes.

Alex

Because the kernel sees everything.

Maya

Right.

Alex

But before that list is handed back to task manager, the rootkit intercepts it.

Maya

So the rootkit is literally intercepting the kernel's own internal mail.

Alex

It acts as an invisible filter.

Maya

It scans the list, finds its own malicious process IDs, and simply deletes them from the data structure.

Alex

Then it passes the newly scrubbed, totally clean-looking list.

Maya

Up to the task manager.

Alex

So the antivirus software is asking the operating system, hey, is everything okay in here?

Maya

And the OS, which is being actively manipulated by the rootkit, says, I just checked the kernel, and yes, everything is perfectly fine.

Alex

Exactly.

Maya

The security tools are flying completely blind because the instruments they rely on are lying to them.

Alex

Think of it like the inside man erasing the CCTV footage.

Maya

Oh, that's a great way to picture it.

Alex

The thieves are actively emptying the vault.

Maya

Right.

Alex

But the inside man isn't.

Maya

The inside man has spliced a loop of an empty, peaceful hallway into the CCTV feed.

Alex

The security guards are staring at the monitors, completely unaware that the system they trust has been compromised at the root level.

Maya

That is why they are called rootkits.

Alex

Finding them often requires specialized memory forensics, where you bypass the OS APIs entirely and look at the raw physical memory to find the discrepancies.

Maya

Right, checking what the OS claims is running against what is actually taking up space in RAM.

Alex

That is incredibly insidious.

Maya

And, you know, it brings us to a message.

Alex

It brings us to a massive realization.

Maya

We've talked about how malware arrives, how it behaves, how it hides.

Alex

But all of these behaviors, the worm spreading, the rootkit hooking an API, the Trojan spawning a shell.

Maya

None of that is magic.

Alex

None of it.

Maya

It is just code.

Alex

It is just binary code executing on a physical silicon processor.

Maya

Right.

Alex

And if we really want to understand reverse engineering, if you, the listener, want to understand how an exploit actually works, we have to leave these high-level concepts behind.

Maya

Right.

Alex

And if we really want to understand reverse engineering, if you, the listener, want to understand how an exploit actually works, we have to leave these high-level concepts behind.

Maya

Right.

Alex

We need to go down to the bare metal.

Maya

You have to look at the architecture of the CPU itself.

Alex

Yes.

Maya

We need to understand the Bi-86 architecture.

Alex

And whenever we talk about Bi-86, or really almost any modern computing architecture, we have to go back to the 1940s.

Maya

Ah, John von Neumann.

Alex

Yes.

Maya

John von Neumann and the von Neumann architecture model.

Alex

When I first read about the implications of this design choice in our source material, it completely changed how I view cybersecurity.

Maya

It is the foundational paradox of modern computing, honestly.

Alex

The von Neumann architecture was brilliant.

Maya

It allowed computers to be general-purpose machines rather than just fixed-function calculators.

Alex

Right.

Maya

But it contains a design choice that is the root cause of almost every major memory corruption exploit today.

Alex

Let's break that design choice down because it's crucial.

Maya

Before von Neumann, early computers often had physically separate storage for the program instructions and the data.

Alex

Yes.

Maya

You had one tape or memory bank feeding the machine its commands, and a completely different physical memory bank holding the numbers the machine was supposed to crunch.

Alex

A very rigid, isolated structure.

Maya

Safe, but inflexible.

Alex

But the von Neumann model introduced the concept of the stored program computer.

Maya

And the critical, world-changing decision was this.

Alex

In the von Neumann model, both the executable code, the instructions telling the CPU what to do, and the data, the user inputs, the text strings, they all share the exact same address space in a single, unified memory.

Maya

They share the same RAM.

Alex

They serve the same memory.

Maya

They serve the same RAM.

Alex

They serve the same memory.

Maya

They serve the same memory.

Alex

They serve the same memory.

Maya

They serve the same memory.

Alex

They serve the same memory.

Maya

They serve the same memory.

Alex

They serve the same memory.

Maya

They serve the same memory.

Alex

They serve the same memory.

Maya

They serve the same memory.

Alex

They serve the same memory.

Maya

They serve the same memory.

Alex

They serve the same memory.

Maya

They serve the same memory.

Alex

They serve the same memory.

Maya

So why is that a security nightmare?

Alex

Because the central processing unit, the CPU itself, is fundamentally blind.

Maya

The CPU does not possess the context to distinguish between a byte of memory that represents a legitimate instruction and a byte of memory that represents a piece of text data.

Alex

Wait, really?

Maya

It just can't tell the difference?

Alex

No.

Maya

A byte is just eight bits.

Alex

It's just ones and zeros.

Maya

If you point the CPU at a memory address, it will fetch those bytes, attempt to decode, decode them into an assembly instruction, and execute them.

Alex

It does not pause to ask, you know, wait, is this executable code compiled by the developer, or is this just user data typed in its form?

Maya

Okay, let me make sure I'm visualizing this correctly.

Alex

Let's say I have a program that takes a user's name as input.

Maya

I type in the letter A.

Alex

The computer stores that in memory as the hexadecimal value 0x41.

Maya

Correct.

Alex

ASCII value 65, or 0x41 in hex.

Maya

But that's just data.

Alex

It represents a letter.

Maya

But if an attack is made, it's not a code.

Alex

If an attacker can somehow trick the CPU into pointing its execution mechanism at that exact same memory location, the CPU will fetch that 0x41, but it won't read it as the letter A.

Maya

Exactly.

Alex

It will read it as in BY-86 assembly instruction.

Maya

In BY-86 instruction sets, the opcode 0x41 translates to the instruction INCECX.

Alex

Increment ECX.

Maya

Right, which means increment the value in the ECX register by one.

Alex

The CPU just blindly executes it.

Maya

It takes your text data and runs it as a memory.

Alex

And runs it as a machine command.

Maya

That is wild.

Alex

It is just blind, absolute obedience.

Maya

I like to use an analogy to explain this shared memory vulnerability.

Alex

Think of the CPU as a highly efficient, but completely blindfolded chef working on a fast-paced assembly line in a commercial kitchen.

Maya

Okay.

Alex

A blindfolded chef.

Maya

I'm with you.

Alex

The conveyor belt in front of the chef is the system RAM.

Maya

Now, in the von Neumann architecture, both the cooking instructions, the recipe steps, and the actual physical ingredients, the salt, the flour, the sugar, and the other ingredients, are all connected to the system RAM.

Alex

And that's what we're going to talk about in this video.

Maya

So, let's get started.

Alex

Let's get started.

Maya

Let's get started.

Alex

Let's get started.

Maya

Let's get started.

Alex

Let's get started.

Maya

The flour, the sugar.

Alex

They are stored together.

Maya

Yes.

Alex

They're stored in the exact same type of identical plastic containers on that conveyor belt.

Maya

That sounds like an OSHA violation waiting to happen.

Alex

It absolutely is.

Maya

The blindfolded chef operates purely on positional tracking.

Alex

A supervisor tells him, the next recipe step is located in container number 50.

Maya

The chef feels along the belt, finds container 50, opens it, and executes whatever is inside.

Alex

Because they implicitly trust the supervisor's coordinates.

Maya

Yes.

Alex

Now, imagine a malicious actor sneaks into the kitchen.

Maya

They find container 50, which is supposed to contain an instruction that says, stir the soup.

Alex

Okay.

Maya

They take that container out, and they replace it with a container full of their own poison ingredients, but arranged in a way that looks like an instruction.

Alex

An instruction that says, throw the soup on the floor and burn down the kitchen.

Maya

And the blindfolded chef.

Alex

The chef reaches container 50.

Maya

They open it.

Alex

Because they cannot see the difference between a legitimate recipe step and a cleverly disguised, malicious ingredient, they simply follow their programming.

Maya

They decode the poison data as an instruction, and they burn down the kitchen.

Alex

The system has no inherent ability to say, wait, this feels like data, not code.

Maya

That is the fundamental exploitability of the von Neumann architecture.

Alex

That analogy is perfect, and it makes me realize how fragile the whole system actually is at its core.

Maya

Now, Bionics 6 architecture has a few other quirks that make reverse engineering a real headache.

Alex

Oh, absolutely.

Maya

I was looking at the notes on instruction sets.

Alex

Bionics 6 is a CISC architecture, complex instruction set computer.

Maya

We don't need to go too deep into microprocessor design, but what does that practically mean for someone analyzing malware?

Alex

Well, in an RISC architecture, reduced instruction set computer, like the ARM chips in our phones, instructions are very simple and uniform.

Maya

One instruction might load a value.

Alex

Another instruction might add them.

Maya

It takes multiple lines of code to do anything meaningful.

Alex

Very step by step.

Maya

Right.

Alex

But Bionics 6, By 86 uses CISC.

Maya

This means the instruction set is massive, and individual instructions can be incredibly complex.

Alex

They do a lot of heavy lifting under the hood.

Maya

Okay, give me an example.

Alex

For instance, in by 86, there is an instruction prefix called REP, which repeats the following instruction, usually combined with something like MOVSB, which moves a string of bytes from one memory location to another.

Maya

Okay.

Alex

So, a single line of disassembled by 86 code, REP, MOVSB, can effectively operate like a complete while loop, copying thousands of bytes across memory, updating internal pointers, and changing the state of multiple registers all at once.

Maya

So, if you are an analyst tracing through the code line by line in a debugger, you can't just glance at it.

Alex

One instruction can radically alter the entire landscape of the machine's memory.

Maya

Exactly.

Alex

You have to meticulously track the side effects of every single complex instruction.

Maya

Okay, let's talk about the quirk that truly breaks my brain every time I look at a hex dump.

Alex

Little endian by ordering.

Maya

Ooh, little endian.

Alex

Yes.

Maya

The sources emphasize that by 86 uses a little endian memory layout.

Alex

I want to reason this out, because at first glance, it seems like pure madness.

Maya

It is the bane of every junior reverse engineer's existence, I promise you.

Alex

Right.

Maya

So, let's say I have a 32-bit hexadecimal value.

Alex

Four bytes.

Maya

Let's use 0x12345678.

Alex

Now, as a human, I read that left to right.

Maya

The 12 is the most significant byte, like the millions column in a decimal number.

Alex

The 78 is the least significant byte, like the ones column.

Maya

Correct.

Alex

That is how we represent numbers.

Maya

Big endian format.

Alex

But by 86 doesn't store it that way in memory.

Maya

If I look at the physical RAM addresses, say, starting at address 0x1000, the architecture stores that value in reverse byte order.

Alex

Yes, it does.

Maya

So, at address 1000, it puts 78.

Alex

At 1001, it puts 56.

Maya

At 1002, it puts 34.

Alex

And at 1003, it puts the 12.

Maya

It stores the least significant byte at the lowest memory address.

Alex

Exactly backwards.

Maya

Why?

Alex

I mean, why on earth would the engineers at Intel design a processor to store multi-byte numbers backwards?

Maya

It forces the analyst to mentally flip every single memory address they read.

Alex

You have to step out of the human perspective and look at it from the perspective of the silicon logic gates doing the actual arithmetic.

Maya

Okay, I'm trying.

Alex

Let's take it back to primary school math.

Maya

When you add two large numbers...

Alex

When you add two large numbers together on a piece of paper, where do you start?

Maya

Do you start on the left side with the largest numbers?

Alex

No, I start on the right side, the ones column.

Maya

I add the ones together, write down the result.

Alex

And if it's over 10, I carry the one over to the tens column on the left.

Maya

Precisely.

Alex

You start with the least significant digits.

Maya

Yeah.

Alex

Because you have to propagate the carry bit, a microchip has to do the exact same thing.

Maya

By storing the least significant byte at the lowest memory address, which is what little endian means, the CPU can fetch that very first number.

Alex

It can fetch that very first byte from the base address and immediately begin its arithmetic operation.

Maya

It calculates the first part, determines if there is a carry bit, and then fetches the next byte from the next address up.

Alex

Oh, wow.

Maya

I see it now.

Alex

It streams it.

Maya

It allows the CPU to stream the arithmetic naturally.

Alex

If it were big endian, the CPU would have to figure out the total lengths of the number, jump all the way to the end of it, read the least significant byte, do the math, and then work its way backwards through memory.

Maya

Little endian was a brilliant, elegant, and easy optimization for the early processors to make math faster.

Alex

Hardware optimization at the expense of human readability.

Maya

Exactly.

Alex

But you must remember a crucial caveat here.

Maya

This backward storing only applies to multi-byte numeric values, like integer variables or memory addresses.

Alex

It does not apply to arrays of individual bytes, like a text string.

Maya

Oh, really?

Alex

Yes.

Maya

If a malware author stores the word malware in ASCII, it is stored sequentially, M, then A, then L.

Alex

You don't read strings backwards.

Maya

OK, that is a huge relief.

Alex

That would be completely unreadable.

Maya

So we have this little endian CISC-based blind CPU executing out of a shared von Neumann memory space.

Alex

But the CPU isn't just fetching things directly from RAM for every single tiny operation, right?

Maya

RAM is way too slow for that.

Alex

Far too slow.

Maya

If the CPU is our blindfolded chef, how does it actually hold its tools?

Alex

How does it keep track of variables from one microsecond to the next without walking all the way over to the conveyor belt every single time?

Maya

It uses registers.

Alex

If the RAM is the massive warehouse conveyor belt, the registers are the chef's pockets.

Maya

They are ultra-fast, tiny storage locations built directly into the silicon of the CPU core itself.

Alex

And the speed difference is monumental, right?

Maya

It is the difference between reaching into your pocket versus driving to a storage locker across town.

Alex

Accessing a value in a register takes roughly one single clock cycle.

Maya

Reaching out to main RAM might take hundreds of clock cycles.

Alex

That's a massive bottleneck.

Maya

Right.

Alex

So compile programs.

Maya

And by extension, malware.

Alex

They want to move data into registers, perform their operations, and only write back to RAM when absolutely necessary.

Maya

Okay.

Alex

The sources highlight three specific 32-bit registers in the GAI86 architecture that we really need to understand to grasp exploitation.

Maya

We have EAX, ESP, and EIP.

Alex

Let's break these down, starting with EAX.

Maya

It's known as the accumulator register.

Alex

EAX is incredibly versatile.

Maya

But in the context of reverse engineering and malware analysis, it has one big advantage.

Alex

It has one big advantage.

Maya

It has dominant conventional use.

Alex

It holds the return values of function calls.

Maya

Let me visualize that.

Alex

Let's say a piece of malware is trying to be sneaky.

Maya

Before it unpacks its payload, it wants to check if a security analyst is actively monitoring it in a sandbox.

Alex

So it makes a call to a Windows API function.

Maya

Maybe is debugger present?

Alex

A very, very common anti-analysis technique.

Maya

That Windows function does its check, and it has to report the answer back to the malware.

Alex

It returns a one if a debugger is attached and a zero if the coast is closed.

Maya

If the coast is clear, does that one or zero go into RAM?

Alex

No, it goes directly into the EAX register.

Maya

The operating system places the return value in EAX and then control hands back to the malware.

Alex

The very next instruction the malware executes will almost certainly be a test or a compare instruction checking the value currently sitting inside EAX.

Maya

Like test EAX, EAX.

Alex

If it's zero, proceed.

Maya

If it's one, terminate the process immediately.

Alex

Exactly.

Maya

So if you are analyzing the malware in a debugger and you see a call to an AQI, your eyes immediately drop to the EAX register to see what the system answered.

Alex

EAX is the decision maker.

Maya

Okay, next is ESP, the stack pointer.

Alex

We're going to dive incredibly deep into the stack in a moment, but for now, just understand the definition.

Maya

ESP is a register that holds a memory address, and that memory address is always constantly dynamically pointing to the very top of the current stack.

Alex

So it tracks the top.

Maya

Right.

Alex

As data is added or removed from the stack, the CPU automatically updates the ESP register, so it knows that it's in the stack.

Maya

It never loses track of where the top is.

Alex

It is the anchor for temporary memory.

Maya

And finally, we arrive at the third register, the holy grail, the most important concept in all of exploitation, EIP, the instruction pointer.

Alex

EIP is the steering wheel of the processor.

Maya

It is the absolute core of the execution cycle.

Alex

The sources say EIP holds the memory address of the next instruction the CPU is going to execute.

Maya

Correct.

Alex

The CPU is essentially a loop.

Maya

It looks at EIP.

Alex

It says, okay, EIP contains the address 0x0804.

Maya

The CPU fetches the bytes at that address, decodes them, and executes them.

Alex

And then what?

Maya

And while it is doing that, it automatically increments the EIP register to point to the address of the subsequent instruction.

Alex

Then the loop repeats, fetch, decode, execute, increment, millions of times a second.

Maya

So logically, if I am an attacker and I want the computer to stop running Microsoft Word and start running my malicious shellcode, I don't need to rewrite the entire operating system.

Alex

I just need to change the value of the code.

Maya

I just need to change the value inside the EIT register.

Alex

If I can put the memory address of my malware into EIP, the CPU will just blindly fetch it and execute it.

Maya

That is the ultimate goal of a control flow hijack exploit.

Alex

You want control of EIP.

Maya

But there is a massive catch.

Alex

The architecture does not allow you to directly manipulate EIP.

Maya

If I am writing assembly code, I can write MOVEAX1 to put the number one into EAX.

Alex

But I cannot write MOVEAX0XBADC0DE.

Maya

The CPU will throw an exception.

Alex

It is illegal.

Maya

It is restricted by hardware design.

Alex

If you could directly manipulate the instruction pointer with a simple data move, the system would be impossibly fragile.

Maya

So how does it change?

Alex

EIP only changes its value in two ways.

Maya

First, sequentially, as we just discussed, moving to the next line of code.

Alex

Second, when the code executes specific permitted control flow instructions.

Maya

Things like JMP to jump to a new loop or call to execute a function or RET to return from a function.

Alex

So if EIP is the steering wheel and I am an attacker, how do I grab the wheel if the CPU has hard-coded physical rules saying my hands are not allowed to touch it?

Maya

You have to exploit the bureaucracy of the machine.

Alex

Let's go back to our factory analogy.

Maya

The registers are the pockets.

Alex

EIP is the supervisor's official clipboard.

Maya

OK, the clipboard.

Alex

The clipboard has the exact aisle and shelf number the worker must walk to next.

Maya

As an outside attacker, you cannot just walk onto the factory floor, snatch the clipboard out of the supervisor's hands, and erase the number.

Alex

The physical security, the CPU architecture will stop you.

Maya

Right.

Alex

The system throws an exception.

Maya

But you can trick the system into willingly handing you the clipboard.

Alex

You do this by exploiting the vulnerability inherent in a shift change.

Maya

A shift change?

Alex

In the execution flow of a program, a shift change occurs whenever the code executes a function call.

Maya

The main program has to pause its execution, hands control over to a completely different subroutine to do some work, and then critically, it must return control back to the exact spot it left off.

Alex

OK, that makes sense.

Maya

To manage that complex juggling act, to remember where to return to, the CPU relies entirely on a memory structure called the stack.

Alex

And that brings us to the core mechanism, the stack and the art of function calls.

Maya

If we want to hack the system, we have to understand how the system legally hands off control.

Alex

So what exactly is the stack?

Maya

The stack is a designated area of RAM set aside for short term memory.

Alex

It manages the execution of functions, local variables, and control flow.

Maya

It operates as a LIFO data structure.

Alex

Last in, first out.

Maya

The classic computer science analogy is a stack of plates at a massive buffet.

Alex

Let's say an Indian wedding buffet.

Maya

Perfect analogy.

Alex

The catering staff brings out a fresh plate and places it right on the top of the spring loaded pile.

Maya

When a guest walks up, they don't pull a plate from the bottom or the middle.

Alex

They take the exact plate that was just placed on top.

Maya

The last plate placed on the pile is the first plate taken off.

Alex

Exactly.

Maya

In physics assembly language, the act of putting a new plate on top of the pile is the PUSH instruction.

Alex

You push a value onto the stack.

Maya

The act of taking a plate off the top is the POP instruction.

Alex

You pop a value off the stack and put it into a register.

Maya

And our ESP register, the stack pointer, is crapping all this.

Alex

Yes, ESP is the mechanism tracking the top of the pile.

Maya

Wherever the top plate is, ESP points to its exact memory address.

Alex

Simple enough.

Maya

But here is where the architecture introduces a concept that is deeply counterintuitive.

Alex

And it is the entire geographic reason why buffer overflows work.

Maya

In BIA86, the stack grows downward in memory.

Alex

It is a concept you have to trace out slowly to internalize.

Maya

I really need to visualize this because when I think of a stack of plates growing, the physical pile gets taller, the height increases.

Alex

But in memory, you're saying when the stack grows, the memory address actually gets smaller.

Maya

Let's expand our visualization.

Alex

Imagine the entire RAM address space is a giant skyscraper.

Maya

Address 0x00000 is the ground floor lobby.

Alex

Address 0xFFFFFF is the penthouse suite at the very top.

Maya

OK, I have the skyscraper in my head.

Alex

When an operating system loads a program into memory, it divides that skyscraper into sections.

Maya

The long term data, things like the memory heap where dynamic variables are allocated, starts way down near the ground floor.

Alex

As the program requests more heap memory, it builds upwards floor by floor toward the sky.

Maya

Lower addresses to higher addresses.

Alex

That makes intuitive sense.

Maya

But the stack is anchored at the opposite end.

Alex

The base of the stack is anchored way up near the penthouse.

Maya

When you PSH a new piece of data onto the stack, the stack expands downward toward the ground floor.

Alex

OK, let me do the math to make sure I grasp this.

Maya

If my stack pointer ESP is currently pointing at memory address 0x1000, let's call that floor 1000, and I execute a command to PSH a four byte integer onto the stack, the stack has to grow.

Alex

But because it grows downward, the CPU actually subtracts four from the current address.

Maya

So ESP moves down to 0x0FFC floor 996.

Alex

Exactly.

Maya

The PSH instruction inherently decrements the stack pointer.

Alex

It subtracts from the address space.

Maya

Conversely, when you POP data off the stack, removing it, ESP increments, it adds to the address space, retreating back up the skyscraper toward the penthouse.

Alex

Why design it that way?

Maya

I mean, why have the heap grow up and the stack grow down?

Alex

It was an elegant solution to memory management in early systems.

Maya

It's a very limited RAM.

Alex

By putting the heap at the bottom growing up and the stack at the top growing down, they share the massive empty space in the middle of the skyscraper.

Maya

Ah, so they don't block each other.

Alex

Right.

Maya

You don't have to preallocate a fixed size for either one.

Alex

They can both grow dynamically as needed.

Maya

And as long as they don't crash into each other in the middle, you maximize your available memory.

Alex

Brilliant engineering.

Maya

But as we'll see, that downward growth direction creates a fatal geographic collision.

Alex

Before we look at the exploit, we have to trace exactly what happens when a program calls a function.

Maya

The sources provide the exact assembly instructions generated by a compiler for a function call.

Alex

It's a sequence of operations called the function prologue and the function epilogue.

Maya

Let's trace it.

Alex

Whenever a program executes a call instruction to jump to a new function, it has to set up a new clean workspace on the stack for that specific function to use.

Maya

We call this a stack frame.

Alex

The function prologue is the sequence of assembly instructions that builds this frame.

Maya

The standard prologue usually looks like this.

Alex

Step one.

Maya

P-U-S-H-E-B-P.

Alex

Step two, M-O-V-E-B-P-E-S-P.

Maya

Step three, S-U-B-E-S-P-0-X-2-0.

Alex

Let's break down what the CPU is actually doing here.

Maya

First, what is E-B-P?

Alex

E-B-P is the base pointer.

Maya

While ESP dynamically bounces up and down tracking the very top of the stack, E-B-P acts as a static anchor for the current function's frame.

Alex

It gives the function a reliable reference point to find its variables.

Maya

So step one, P-U-S-H-E-B-P.

Alex

The CPU takes the base pointer of the previous function, the one that called us, and pushes it onto the stack to save it.

Maya

We don't want to lose the anchor of the program that called us.

Alex

Correct.

Maya

Step two, M-O-V-E-B-P-E-S-P.

Alex

We take the current value of the stack pointer, ESP, which is pointing right at that saved value we just pushed.

Maya

We copy it into E-B-P.

Alex

We have just established a brand new anchor for our new function.

Maya

And then step three, S-U-B-E-S-P-0-X-2-0, subtracting from ESP, because attracting moves us further down the memory skyscraper.

Alex

This instruction is effectively carving out an empty chunk of space on the stack.

Maya

Yes.

Alex

0x2, 0 hex is 32 bytes.

Maya

So we just shifted the top of the stack down by 32 bytes, leaving a 32 byte empty void between our anchor, E-B-P, and the top of the stack, ESP.

Alex

Exactly.

Maya

That empty void is the local variable space.

Alex

If the function needs to store a temporary username or do some math, it uses that 32 byte frame.

Maya

The function now executes its core logic entirely within that safe workspace.

Alex

And when the function finishes its work, it has to clean up the mess and return control to the main program.

Maya

That brings us to the function epilogue.

Alex

The epilogue is the teardown phase.

Maya

It usually consists of two instructions, leave followed by ret.

Alex

What does leave do?

Maya

Leave effectively undoes the prologue.

Alex

It collapses the workspace.

Maya

It moves the ESP pointer back up to the E-B-P anchor, instantly discarding all the local variables.

Alex

Then it pox the old saved E-B-P value off the stack and restores it to the E-B-P register.

Maya

So the previous function's anchor is restored.

Alex

The stack frame is just gone.

Maya

The frame is gone.

Alex

And then we hit the final instruction, ret, the return instruction.

Maya

This is the moment of truth.

Alex

This is the exact moment the shift change happens.

Maya

When the CPU executes ret, it needs to know what memory address to jump back to in the main program.

Alex

But how does it know?

Maya

Because right before the main program executed the KELOLAND instruction to start all this, it did something crucial.

Alex

It took the memory address of its own next instruction, the return address, and it pushed it onto the stack.

Maya

It left a breadcrumb.

Alex

A breadcrumb, yes.

Maya

The return address was pushed onto the stack before the prologue even started.

Alex

So now, after the lead instruction has collapsed the frame, that exact breadcrumb is sitting right at the very top of the stack.

Maya

ESP is pointing directly at it.

Alex

So when the RDT instruction fires.

Maya

The CPU blindly looks at the top of the stack.

Alex

It POPs whatever 4-byte value is sitting there, and it shoves that value directly into the E-I-P register.

Maya

The instruction pointer.

Alex

The steering wheel.

Maya

Yes.

Alex

The CPU assumes, it entirely trusts, that the value sitting there is the legitimate return address it saved microseconds ago.

Maya

And if it is the legitimate address, the program seamlessly jumps back to the main code and resumes execution as if nothing happened.

Alex

But if an attacker has managed to tamper with that value on the stack, if they have overwritten that breadcrumb with a memory address of their own choosing, the CPU POPs the attacker's address into the steering wheel and the attacker takes absolute control of the execution flow.

Maya

And that brings us to the ultimate exploit.

Alex

We have assembled all the puzzle pieces.

Maya

We understand the von Neumann architecture where data and code are identical.

Alex

We understand E-I-P.

Maya

We understand the stack growing downwards and the function prologue setting up local variables directly adjacent to the saved return address.

Alex

We are finally ready to understand how a stack buffer overflow actually works.

Maya

Let's set the stage for the collision.

Alex

We establish that the stack grows downward from the penthouse down toward the ground to the floor.

Maya

When we carved out our 32 byte local variable space with S-E-B-E-S-P-0-X-2-0, we move the boundary lower.

Alex

OK, keep that geography in mind.

Maya

The local variable buffer sits at a low memory address.

Alex

But when a program reads data into that buffer, say, the program asks the user for a password and starts copying the keystrokes into that local variable space, it writes that data upward in memory.

Maya

Wait, upward.

Alex

Are you sure?

Maya

Yes.

Alex

Strings and buffers are written from lower addresses to higher addresses.

Maya

It starts at the bottom of the carved out space and writes consecutively upward, moving back toward the penthouse.

Alex

Oh, I see the fatal flaw.

Maya

I see the collision course.

Alex

Right.

Maya

The buffer sits down below and it fills upward.

Alex

What sits immediately above that buffer at a slightly higher memory address, just waiting there?

Maya

The saved EBP anchor and immediately above that, the return address.

Alex

Boom.

Maya

Exactly.

Alex

Imagine the program is written in C and it uses a fundamentally unsafe function like StripB.

Maya

StringCopy.

Alex

StripB is notoriously dangerous.

Maya

Because it does not check the length of the input.

Alex

It just blindly copies data until it hits a null byte.

Maya

So the programmer allocates a 32 byte buffer for the password.

Alex

But I, as the attacker, feed the program a password that is 100 bytes long.

Maya

Just a massive string of Ns.

Alex

The StripB function starts writing your A's at the bottom of the buffer, moving upward.

Maya

It hits 32 bytes.

Alex

The buffer is full.

Maya

But StripB doesn't care.

Alex

It keeps writing upward, spilling out of the defined buffer boundary, corrupting the adjacent memory space on the stack.

Maya

It overwrites the buffer.

Alex

It's the saved EBP anchor.

Maya

And then crudely, it overwrites the return address.

Alex

It replaces that vital breadcrumb with your data.

Maya

If you craft your input perfectly, you don't just overwrite it with random A's.

Alex

You overwrite the exact location of the return address with a specific calculated four byte memory address that points directly to a malicious payload.

Maya

You also snuck into memory, often hidden right inside that very same buffer of A's.

Alex

You set a trap and you just wait for the function to finish its work.

Maya

The function finishes.

Alex

It executes the Aleve instruction.

Maya

The frame collapses.

Alex

ESP now points directly to the corrupted return address you overwrote.

Maya

Then the RET instruction fires.

Alex

The CPU reaches down at the stack, expecting to pick up the legitimate breadcrumb.

Maya

Instead, it picks up my malicious, carefully calculated memory address.

Alex

It pops that address directly into the EIP register.

Maya

The CPU just willingly handed me the supervisor's clipboard.

Alex

And because of the von Neumann flaw, because the CPU cannot distinguish between your text input data and legitimate code, the CPU jumps to your payload, decodes your text data as assembly instructions, and executes them with the full privileges of the program.

Maya

The system is completely compromised.

Alex

Completely.

Maya

To bring this all together into one final visualization for the listener, let's combine our analogies.

Alex

How do I picture this entire sequence from the input to the exploit?

Maya

Picture the factory floor again.

Alex

You are a worker filling out a small paper form attached to a clipboard.

Maya

The form has a tiny, clearly defined box that says, enter your name, max, 10 letters.

Alex

Right below that physical box on the paper, the supervisor has written the official return instructions for the next shift.

Maya

Go back to aisle four.

Alex

OK, the name box is the 32 byte local variable buffer.

Maya

The supervisor's instructions below it represent the return address sitting on the stack.

Alex

Precisely.

Maya

You, the attacker, decide to ignore the boundaries.

Alex

You pick up a massive marker and you write a name that is way too long.

Maya

You write Aditya Subramanian, the conqueror.

Alex

That's a lot of ink.

Maya

Your ink literally bleeds out into the physical boundaries of the name box, spilling down the page.

Alex

The thick ink completely covers up the supervisor's original instruction of go back to aisle four.

Maya

I am overwriting the stack memory.

Alex

Yes.

Maya

And because you plan this meticulously, use the tail end of your spilling ink to write your own fake orders over the top of the obscured text, go to the vault and open the safe.

Alex

And what represents the CPU executing the RET instruction?

Maya

When the factory worker finishes processing your form, their eyes naturally drop down to the next line to read where they should go next.

Alex

They see your newly written fake orders.

Maya

And because they are a blind worker operating perfectly under the von Neumann model, they do not pause to question who wrote the orders or why the ink matches the name box.

Alex

They cannot distinguish the data from the instruction.

Maya

They simply follow the ink.

Alex

They walk to the vault, open the safe, and the bank is robbed.

Maya

You fed the machine data just a long string of text and you manipulated the physics of the memory layout to trick you into executing that data as code.

Alex

That is absolutely chilling when you break it down step by step.

Maya

It strips away all the mystery.

Alex

It's not movie hacker magic.

Maya

It is just logic, architecture and physics being pushed past their designed boundaries.

Alex

That is the beauty and the terror of reverse engineering.

Maya

Once you see the matrix, you realize how incredibly precise these attacks actually are.

Alex

Let's take a breath and recap the massive journey we just took because we covered a staggering amount of ground today.

Maya

It is a lot to digest, but it built the ultimate foundation.

Alex

We started high up in the noise of an SOC alert queue.

Maya

We looked at the taxonomy of malware and realized that trying to fit threats into rigid boxes like downloader or spyware during a live incident is a trap.

Alex

Instead, we use the three question triage.

Maya

How did it arrive?

Alex

What does it do?

Maya

How does it hide?

Alex

We applied that behavioral lens to worms, which operated machine speed over networks, Trojans, which rely on process deception and human interaction, and rude kits, which compromised the kernel APIs to lie to the operating system itself.

Maya

And then we went subsurface.

Alex

We examined the Von Neumann architecture, exposing the foundational vulnerability of shared memory for code and data.

Maya

We navigated the backwards reading logic of little endian byte ordering.

Alex

We explored the CPU's internal pockets, the registers focusing on EAX for decision making and the ultimate prize, the EIP instruction pointer.

Maya

We traced the complex choreography of the stack.

Alex

We visualized the memory, the skyscraper, watching the stack grow downward while the buffer filled upward.

Maya

We walked step by step through the function prologue and epilogue, watching the leave and return instructions execute the shift change.

Alex

And finally, we saw the collision, the buffer overflow, the spilling ink, rewriting the return address, tricking the CPU into popping a malicious pointer into EIP, handing over total control.

Maya

Listener, if you followed us through that, you now have a bare metal understanding of cybersecurity.

Alex

You don't just know the buzzwords, you understand the binary physics of why the attacks actually work and understanding that fundamental architecture leads to a very profound, almost philosophical question to leave you with this entire class of vulnerability, the buffer overflow, the ability to hijack execution flow.

Maya

It all stems from one single design choice made in the 1940s.

Alex

The von Neumann shared memory model, keeping the recipe instructions and the ingredients in the same containers on the belt, the root cause of the entire exploit industry.

Maya

So consider this thought experiment.

Alex

What if we completely rebuilt our computing infrastructure from scratch?

Maya

What if a future generation of processors abandoned von Neumann entirely and adopted a pure Harvard architecture where the silicon physically separates the memory chips for executable code and user data?

Alex

If the hardware physically prevented you from ever writing user input into an executable space, would malware as we know it cease to exist?

Maya

Or would the attackers just find a near even more terrifying layer of logic to exploit?

Alex

Exactly.

Maya

That is a phenomenal question to chew on, because as we've seen today, the human ingenuity to find the cracks in the system, to overflow the boxes and rewrite the rules that never stops.

Alex

Thank you for joining us on this deep dive into the bare metal of malware analysis.

Maya

Keep questioning the system, keep tracing the logic, and we will catch you next time.

Show Notes

Key topics covered: - The Three-Question Triage: A systematic approach to handling a live incident and classifying a new malware sample. - Malware Taxonomy Demystified: Core behavioral differences between Worms (self-propagating), Trojans (deceptive disguises), and Rootkits (deep system concealment). - x86 Architecture and CPU Registers: Why the Von Neumann architecture and CPU registers are the baseline for any reverse engineer. - The Mechanics of Control: The Instruction Pointer (EIP), the Stack Pointer (ESP), and how attackers manipulate the stack to hijack execution flow.

Next episode

EP 02 · The Art of Deception: Unmasking Anti-Analysis & Evasion Techniques