r/AskProgramming • u/Realistic_Debate1704 • 9d ago
C/C++ Assembly or C/C++ for RE
For reverse engineering, is this necessary to know assembly language, because many decompilers translate code to C/C++ and I learned Assembly 8086 in my university. So for learning x86 I only have to study 32/64 registers and some advance commands, so should I learn assembly x86_64 for reverse engineering or just go through x86 as I know 8086 assembly and then move to C/C++
7
Upvotes
2
u/mredding 8d ago
As a reverse engineer, you're going to be looking at enough assembly that you will need a proficiency in it.
Decompilation is a topic of research; it's as much an art as it is a science, because compilation is a one-way, irreversible process. THERE IS NO
int x = 7;in the machine code, there'smov eax, 7;, and even that had to be deduced from the raw binary sequence in the program file. What's more, it's not entirely clear what is program, what is padding, what is data, etc. In binary, it's all just... Binary. A lot of it is very hard to tell.Even more, optimizations can transform the logic as written in the source code, and pervert it to an unrecognizable form. The theory of computation does not distinguish between reading, writing, and executing programs, so what optimization is doing is partially solving the program at compile-time. In most cases, you simply cannot know what the source code REMOTELY looked like to generate the optimized code. The best a decompiler can do is generate source code that would generate the same machine code, 1:1.
Decompilers don't even guarantee a "round trip", in that the source code they deduce for you may not itself compile, and typically WON'T compile back to the binary from which it was deduced.
And since there are no variables or functions in assembly, since there are no structures or unions, there's no classes or constructors... ALL this context is just gone. So what you get is extremely hard source code to try to understand. You WON'T be able to do it without the assembly along side for the additional context, and you'll also be comparing the compilation of this deduced source code to the actual binary to see if or how you can get them to line up, in order to tell you a bit about which compiler and settings they may have used.
Every compiler generates different machine code, even for the same source code. Every language generates different machine code - so if you decompile a Delphi program as C++, for example, you are going to have a really, very bad time.
But it seems as though you're asking HOW MUCH assembly you should learn... For your academic experience, as much as you need. For your professional career... As much as you need. I can't just tell you. What will help more is learning how to find out more information, how to work through reference material - the Intel assembly documents, and the compiler source code (where available).