Memory Layout(global data, code, stack, heap, etc) with TLS
On AArch64 (ARM64), the memory layout for Thread Local Storage (TLS) follows TLS Variant 1. This is distinct from x86_64 (which uses Variant 2). The key difference is the location…
Author: Haco
AFL Coverage Instrumentation Callback
0000000000000bc0 <bbCallback>: bc0: 90000102 adrp x2, 20000 <_exit@GLIBC_2.17> bc4: f9404c43 ldr x3, [x2, #152] bc8: b4000263 cbz x3, c14 <bbCallback+0x54> bcc: d53bd042 mrs x2, tpidr_el0 bd0: a9bf7bfd stp x29, x30,…
Executable Startup And Initialization
CRT (C Runtime) "glue code" refers to a set of pre-compiled object files (typically crt1.o, crti.o, crtn.o, crtbegin.o, and crtend.o) that are automatically linked with your program. They "glue" the…
The difference between soundness and completeness
In logic and computer science, soundness and completeness are two fundamental properties of a formal system (a set of rules for proving things). They describe the relationship between Provability (can…
Global variable declaration inside function (Python
If you only want to read (access) the value of a global variable, you do not need the global keyword. Python automatically looks up the variable in the global scope…
Why the load of main by _start uses got entry, not adrp+add pair?
The _start function uses a Global Offset Table (GOT) entry to load the address of main primarily because _start is defined in a pre-compiled object file (typically Scrt1.o) that was…
AArch64 Pre/Post Indexing
In AArch64 (ARMv8-A 64-bit architecture), Pre-indexing and Post-indexing are memory addressing modes used with Load (LDR) and Store (STR) instructions. Their primary purpose is to perform Writeback: they automatically update…
Check whether an executable is pure C or CPP
Distinguishing between a pure C and a C++ executable can be achieved by examining the symbols and library dependencies of the binary file. C++ compilers employ a technique called "name…
Setup Docker on Ubuntu 25.10
To set up Docker on Ubuntu 25.10 (Questing Quokka), follow these steps. These instructions use the official Docker repository to ensure you get the latest version. Step 1: Uninstall Old Versions…
PIE Relocation: Tagging Addresses
In a Position-Independent Executable (PIE), absolute addresses aren't "tagged" directly within the machine code. Instead, the linker creates a separate list of instructions and data locations that need fixing, and this…