Search icon CANCEL
Subscription
0
Cart icon
Your Cart (0 item)
Close icon
You have no products in your basket yet
Save more on your purchases! discount-offer-chevron-icon
Savings automatically calculated. No voucher code required.
Arrow left icon
All Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Newsletter Hub
Free Learning
Arrow right icon
timer SALE ENDS IN
0 Days
:
00 Hours
:
00 Minutes
:
00 Seconds
Arrow up icon
GO TO TOP
Mastering Malware Analysis

You're reading from   Mastering Malware Analysis The complete malware analyst's guide to combating malicious software, APT, cybercrime, and IoT attacks

Arrow left icon
Product type Paperback
Published in Jun 2019
Publisher Packt
ISBN-13 9781789610789
Length 562 pages
Edition 1st Edition
Languages
Arrow right icon
Authors (2):
Arrow left icon
Alexey Kleymenov Alexey Kleymenov
Author Profile Icon Alexey Kleymenov
Alexey Kleymenov
Amr Thabet Amr Thabet
Author Profile Icon Amr Thabet
Amr Thabet
Arrow right icon
View More author details
Toc

Table of Contents (18) Chapters Close

Title Page
Copyright and Credits
About Packt
Contributors Preface 1. A Crash Course in CISC/RISC and Programming Basics FREE CHAPTER 2. Basic Static and Dynamic Analysis for x86/x64 3. Unpacking, Decryption, and Deobfuscation 4. Inspecting Process Injection and API Hooking 5. Bypassing Anti-Reverse Engineering Techniques 6. Understanding Kernel-Mode Rootkits 7. Handling Exploits and Shellcode 8. Reversing Bytecode Languages: .NET, Java, and More 9. Scripts and Macros: Reversing, Deobfuscation, and Debugging 10. Dissecting Linux and IoT Malware 11. Introduction to macOS and iOS Threats 12. Analyzing Android Malware Samples 1. Other Books You May Enjoy

Working with SPARC

Scalable Processor Architecture (SPARC) is a RISC ISA that was originally developed by Sun Microsystems (now part of the Oracle corporation). The first implementation was used in Sun's own workstation and server systems. Later, it was licensed to multiple other manufacturers, one of them being Fujitsu. As Oracle terminated SPARC Design in 2017, all future development continued with Fujitsu as the main provider of SPARC servers.

Several fully open source implementations of SPARC architecture exist. Multiple operating systems are currently supporting it, including Oracle Solaris, Linux, and BSD systems, and multiple IoT malware families have dedicated modules for it as well.

Basics

According to the Oracle SPARC Architecture documentation, the particular implementation may contain between 72 and 640 general-purpose 64-bit R registers. However, only 31/32 GPRs are immediately visible at any one time; 8 are global registers, R[0] to R[7] (also known as g0-g7), with the first register, g0, hardwired to 0; and 24 are associated with the following register windows:

  • Eight in registers in[0]-in[7] (R[24]-R[31]): For passing arguments and returning results
  • Eight local registers local[0]-local[7] (R[16]-R[23]): For retaining local variables
  • Eight out registers out[0]-out[7] (R[8]-R[15]): For passing arguments and returning results

The CALL instruction writes its own address into the out[7] (R[15]) register.

In order to pass arguments to the function, they must be placed in the out registers and, when the function gets control, it will access them in its in registers. Additional arguments can be provided through the stack. The result is placed to the first in register, which then becomes the first out register when the function returns. The SAVE and RESTORE instructions are used in this switch to allocate a new register window and later restore the previous one, respectively.

SPARC also has 32 single-precision FPRs (32-bit), 32 double-precision FPRs (64-bit), and 16 quad-precision FPRs (128- bit), some of which overlap.

Apart from that, there are many other registers that serve specific purposes, including the following:

  • FPRS: Contains the FPU mode and status information
  • Ancillary state registers (ASR 0, ASR 2-6, ASR 19-22, and ASR 24-28 are not reserved): Serve multiple purposes, including the following:
    • ASR 2Condition Codes Register (CCR)
    • ASR 5: PC
    • ASR 6: FPRS
    • ASR 19: General Status Register (GSR)
  • Register-Window PR state registers (PR 9-14): Determine the state of the register windows including the following:
    • PR 9: Current Window Pointer (CWP)
    • PR 14: Window State (WSTATE)
  • Non-register-Window PR state registers (PR 0-3, PR 5-8 and PR 16): Visible only to software running in the privileged mode

32-bit SPARC uses big-endianness, while 64-bit SPARC uses big-endian instructions but can access data in any order. SPARC also uses a notion of traps that implement a transfer of control to privileged software using a dedicated table that may contain the first 8 instructions (32 for some frequently used traps) of each trap handler. The base address of the table is set by software in a Trap Base Address (TBA) register.

The instruction set

The instruction from the memory location, which is specified by the PC, is fetched and executed, and then new values are assigned to the PC and the Next Program Counter (NPC), which is a pseudo-register.

Detailed instruction formats can be found in the individual instruction descriptions.

Here are the basic categories of instructions supported with examples:

  • Memory access:
    • LDUB: Load unsigned byte
    • ST: Store
  • Arithmetic/logical/shift integers:
    • ADD: Add
    • SLL: Shift left logical
  • Control transfer:
    • BE: Branch on equal 
    • JMPL: Jump and link
    • CALL: Call and link
    • RETURN: Return from the function
  • State register access:
    • WRCCR: Write CCR
  • Floating-point operations:
    • FOR: Logical or for F registers
  • Conditional move:
    • MOVcc: Move if the condition is True for the selected condition code (cc)
  • Register window management:
    • SAVE: Save caller's window
    • FLUSHW: Flush register Windows
  • Single Instruction Multiple Data (SIMD) instructions:
    • FPSUB: Partitioned integer subtraction for F registers
You have been reading a chapter from
Mastering Malware Analysis
Published in: Jun 2019
Publisher: Packt
ISBN-13: 9781789610789
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at £13.99/month. Cancel anytime
Visually different images