Cheatsheets

x86-64 Registers & Calling Conventions

Windows x64: first four integer/pointer args in RCX, RDX, R8, R9; the rest on the stack. The caller always reserves 32 bytes of shadow space above the return address, even if the callee has fewer than 4 args. Float/double args use XMM0–XMM3 in parallel with the integer slots (an arg is in either the GPR or the XMM register for its position, never both).

System V AMD64 (Linux/macOS): first six integer/pointer args in RDI, RSI, RDX, RCX, R8, R9; floats in XMM0–XMM7. No shadow space, but there's a 128-byte red zone below RSP that leaf functions can use without adjusting the stack pointer.

Common x86-64 Instructions

Conditional jumps read the flags cmp/test just set:

x86-64 Stack Frame Layout

The stack grows downward (toward lower addresses). A standard prologue —

push rbp
mov  rbp, rsp
sub  rsp, 0x20   ; reserve space for locals

— produces this layout, read relative to RBP:

A classic stack-smash overflows a local buffer far enough to overwrite the saved RBP and then the return address — the exact byte count from the start of the buffer to [rbp+8] is what lab-19 asks you to compute. The matching epilogue, leave; ret (or mov rsp, rbp; pop rbp; ret), reverses the prologue and jumps to whatever address now sits at the top of the stack.

ARM64 (AArch64) Quick Reference

Unlike x86, ARM is a load-store architecture — arithmetic instructions only operate on registers, never directly on memory. There's also no dedicated call instruction with an implicit stack push: BL puts the return address straight into X30, and a leaf function that never calls anything else doesn't need to touch the stack at all.

PE Format Quick Reference

Data Directory index → contents:

Section characteristics (bitflags): 0x20000000 EXECUTE · 0x40000000 READ · 0x80000000 WRITE. A section with all three set (0xE0000000-family, "RWX") is the classic packing/injection red flag — see lab-11 and lab-16.

ELF Format Quick Reference

Program header p_type values:

p_flags: 1=PF_X (execute) · 2=PF_W (write) · 4=PF_R (read) — combined by OR, e.g. 5 = R+X.

Common File Signatures

The first bytes of a file ("magic bytes") identify its format regardless of extension — the first thing to check on an unknown sample.

Debugger Command Reference

WinAPI Capability Clusters

Individual imports are weak signals — legitimate software uses most of these too. A cluster of related imports is what turns "possible" into "likely." These are the exact clusters this course's labs are built around:

Anti-Debugging Techniques

How a sample checks whether it's being watched — and the static/dynamic tell for each check, per lab-10.

Packer Signatures

Static tells that identify which packer compressed/obfuscated a binary — the first move on any sample flagged by high section entropy, per lab-16.

Persistence Locations

Where malware re-establishes itself after a reboot or logout — the standard checklist for triage and cleanup, per lab-14.

ASCII Quick Reference

Ranges worth recognizing on sight in a hex viewer's ASCII column, without memorizing all 128 codepoints.

A run of alternating printable-byte / 0x00 bytes (e.g. 48 00 69 00 = "H.i.") is UTF-16LE — the wide-string encoding Windows APIs favor. Plain strings without -el misses these entirely.