<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>The Binary Auditor™</title>
	<atom:link href="http://www.binary-auditing.com/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.binary-auditing.com</link>
	<description>free training modules for people with an attitude!</description>
	<lastBuildDate>Tue, 24 Aug 2010 06:27:33 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0.1</generator>
		<item>
		<title>First 2 exercises (Splish 1 and Splish 2) solved</title>
		<link>http://www.binary-auditing.com/2010/08/first-2-exercises-splish-1-and-splish-2-solved/</link>
		<comments>http://www.binary-auditing.com/2010/08/first-2-exercises-splish-1-and-splish-2-solved/#comments</comments>
		<pubDate>Tue, 24 Aug 2010 06:27:33 +0000</pubDate>
		<dc:creator>Dr. Thorsten Schneider</dc:creator>
				<category><![CDATA[News]]></category>
		<category><![CDATA[Solutions]]></category>
		<category><![CDATA[The Binary Auditor™]]></category>
		<category><![CDATA[File Format Exercise]]></category>
		<category><![CDATA[Splish 1]]></category>
		<category><![CDATA[Splish 2]]></category>

		<guid isPermaLink="false">http://www.binary-auditing.com/?p=2159</guid>
		<description><![CDATA[This is what I have expected. The first 2 copy protection exercises Splish 1 and Splish 2 have been solved. There is still the File Format Exercise missing but this should take not long to get solved as well. I will prepare the next exercises during this day and what I can promise is that it gets more and more harder. Remember, that all exercises have been selected in such way that beginners have a good start. ]]></description>
		<wfw:commentRss>http://www.binary-auditing.com/2010/08/first-2-exercises-splish-1-and-splish-2-solved/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Welcome to the new website</title>
		<link>http://www.binary-auditing.com/2010/08/welcome-to-the-new-website/</link>
		<comments>http://www.binary-auditing.com/2010/08/welcome-to-the-new-website/#comments</comments>
		<pubDate>Sat, 21 Aug 2010 08:56:13 +0000</pubDate>
		<dc:creator>Dr. Thorsten Schneider</dc:creator>
				<category><![CDATA[News]]></category>
		<category><![CDATA[The Binary Auditor™]]></category>

		<guid isPermaLink="false">http://www.binary-auditing.com/?p=2139</guid>
		<description><![CDATA[So here we are with our new design. Some more changes will come during the next days and weeks. So let us explain what we would like to offer in the near future.]]></description>
		<wfw:commentRss>http://www.binary-auditing.com/2010/08/welcome-to-the-new-website/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>[EXERCISE 0012] Something floating around&#8230;</title>
		<link>http://www.binary-auditing.com/2009/12/exercise-0012-something-floating-around/</link>
		<comments>http://www.binary-auditing.com/2009/12/exercise-0012-something-floating-around/#comments</comments>
		<pubDate>Thu, 17 Dec 2009 07:59:46 +0000</pubDate>
		<dc:creator>Dr. Thorsten Schneider</dc:creator>
				<category><![CDATA[The Binary Auditor™ Short Exercises]]></category>
		<category><![CDATA[casting]]></category>
		<category><![CDATA[exercise]]></category>
		<category><![CDATA[float]]></category>
		<category><![CDATA[floating point numbers]]></category>
		<category><![CDATA[type cast]]></category>

		<guid isPermaLink="false">http://www.binary-auditing.com/?p=2069</guid>
		<description><![CDATA[This time you are in need to download a small file to do your analysis. Fire it up in IDA Pro and tell me what is happening here? Remember: Something floating around...]]></description>
		<wfw:commentRss>http://www.binary-auditing.com/2009/12/exercise-0012-something-floating-around/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>[EXERCISE 0011] Time Shift</title>
		<link>http://www.binary-auditing.com/2009/12/exercise-0011-time-shift/</link>
		<comments>http://www.binary-auditing.com/2009/12/exercise-0011-time-shift/#comments</comments>
		<pubDate>Tue, 15 Dec 2009 07:44:21 +0000</pubDate>
		<dc:creator>Dr. Thorsten Schneider</dc:creator>
				<category><![CDATA[The Binary Auditor™ Short Exercises]]></category>
		<category><![CDATA[exercise]]></category>
		<category><![CDATA[shift]]></category>
		<category><![CDATA[time shift]]></category>

		<guid isPermaLink="false">http://www.binary-auditing.com/?p=2065</guid>
		<description><![CDATA[One step to the left, one step to the right. Hmmm... This small code snippet seems to do something within loops. Try to figure out WHAT it is doing and please: provide a C++ or pseudo code of your analysis! Manual decompilation rocks!]]></description>
		<wfw:commentRss>http://www.binary-auditing.com/2009/12/exercise-0011-time-shift/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>RE-Google &#8211; IDA Pro Plugin that queries Google Code</title>
		<link>http://www.binary-auditing.com/2009/11/re-google-ida-pro-plugin-that-queries-google-code/</link>
		<comments>http://www.binary-auditing.com/2009/11/re-google-ida-pro-plugin-that-queries-google-code/#comments</comments>
		<pubDate>Tue, 24 Nov 2009 09:01:29 +0000</pubDate>
		<dc:creator>Dr. Thorsten Schneider</dc:creator>
				<category><![CDATA[Featured]]></category>
		<category><![CDATA[The Binary Auditor™ Labs]]></category>
		<category><![CDATA[analysis]]></category>
		<category><![CDATA[Google]]></category>
		<category><![CDATA[IDA Pro]]></category>
		<category><![CDATA[plugin]]></category>
		<category><![CDATA[RE-Google]]></category>

		<guid isPermaLink="false">http://www.binary-auditing.com/?p=2049</guid>
		<description><![CDATA[RE-Google is a plugin for the Interactive DisAssembler (IDA) Pro that queries Google Code for information about the functions contained in a disassembled binary. The top results are then displayed as comments to the function and can be opened by just clicking on it. The top results will often tell you what to the function is actually doing or what you will find in the inside. ]]></description>
		<wfw:commentRss>http://www.binary-auditing.com/2009/11/re-google-ida-pro-plugin-that-queries-google-code/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>[EXERCISE 0010] All are equal?</title>
		<link>http://www.binary-auditing.com/2009/11/exercise-0010-all-are-equal/</link>
		<comments>http://www.binary-auditing.com/2009/11/exercise-0010-all-are-equal/#comments</comments>
		<pubDate>Mon, 23 Nov 2009 13:55:41 +0000</pubDate>
		<dc:creator>Dr. Thorsten Schneider</dc:creator>
				<category><![CDATA[The Binary Auditor™ Short Exercises]]></category>
		<category><![CDATA[equality]]></category>
		<category><![CDATA[exercise]]></category>
		<category><![CDATA[operator]]></category>
		<category><![CDATA[relational]]></category>

		<guid isPermaLink="false">http://www.binary-auditing.com/?p=2035</guid>
		<description><![CDATA[Ok, next one. This time we focus on operators. In this case we need a screenshot instead of code only. Help me: what is this code doing?]]></description>
		<wfw:commentRss>http://www.binary-auditing.com/2009/11/exercise-0010-all-are-equal/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>[EXERCISE 0009] Compound assignments</title>
		<link>http://www.binary-auditing.com/2009/11/exercise-0009-compound-assignments/</link>
		<comments>http://www.binary-auditing.com/2009/11/exercise-0009-compound-assignments/#comments</comments>
		<pubDate>Sun, 22 Nov 2009 13:44:20 +0000</pubDate>
		<dc:creator>Dr. Thorsten Schneider</dc:creator>
				<category><![CDATA[The Binary Auditor™ Short Exercises]]></category>
		<category><![CDATA[assignment]]></category>
		<category><![CDATA[compound]]></category>
		<category><![CDATA[exercise]]></category>
		<category><![CDATA[operator]]></category>

		<guid isPermaLink="false">http://www.binary-auditing.com/?p=2033</guid>
		<description><![CDATA[The compound assignment operators consist of a binary operator and the simple assignment operator. They perform the operation of the binary operator on both operands and store the result of that operation into the left operand, which must be a modifiable lvalue. So lets go: transform this snippet back to C++ code!]]></description>
		<wfw:commentRss>http://www.binary-auditing.com/2009/11/exercise-0009-compound-assignments/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>[EXERCISE 0008] WTF? Where is my modulo?</title>
		<link>http://www.binary-auditing.com/2009/11/exercise-0008-wtf-where-is-my-modulo/</link>
		<comments>http://www.binary-auditing.com/2009/11/exercise-0008-wtf-where-is-my-modulo/#comments</comments>
		<pubDate>Fri, 20 Nov 2009 13:36:20 +0000</pubDate>
		<dc:creator>Dr. Thorsten Schneider</dc:creator>
				<category><![CDATA[The Binary Auditor™ Short Exercises]]></category>
		<category><![CDATA[exercise]]></category>
		<category><![CDATA[modulo]]></category>

		<guid isPermaLink="false">http://www.binary-auditing.com/?p=2030</guid>
		<description><![CDATA[Damn it. Just installed Visual Studio and did a simple compile. Have a look at my source! What the hell is doing Visual Studio with my code? Maybe you can guess why I got this difference between source and binary?]]></description>
		<wfw:commentRss>http://www.binary-auditing.com/2009/11/exercise-0008-wtf-where-is-my-modulo/feed/</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
		<item>
		<title>[EXERCISE 0007] Simple math operations</title>
		<link>http://www.binary-auditing.com/2009/11/exercise-0007-simple-math-operations/</link>
		<comments>http://www.binary-auditing.com/2009/11/exercise-0007-simple-math-operations/#comments</comments>
		<pubDate>Thu, 19 Nov 2009 13:30:23 +0000</pubDate>
		<dc:creator>Dr. Thorsten Schneider</dc:creator>
				<category><![CDATA[The Binary Auditor™ Short Exercises]]></category>
		<category><![CDATA[arithmetic]]></category>
		<category><![CDATA[exercise]]></category>
		<category><![CDATA[math]]></category>
		<category><![CDATA[mathematic]]></category>
		<category><![CDATA[variable]]></category>

		<guid isPermaLink="false">http://www.binary-auditing.com/?p=2028</guid>
		<description><![CDATA[Ah, math. What a beautiful discipline. Lots of math is used within application development. Understandable in C++ might be problematic in assembly code. This exercise is not a problem at all, just some few math lines which are not complicated. Anyway, it is very important that you start playing such little math game if we later dig into cryptographic schemes. So tell me: what is this code doing?]]></description>
		<wfw:commentRss>http://www.binary-auditing.com/2009/11/exercise-0007-simple-math-operations/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>[EXERCISE 0006] Very simple one</title>
		<link>http://www.binary-auditing.com/2009/11/exercise-0006-very-simple-one/</link>
		<comments>http://www.binary-auditing.com/2009/11/exercise-0006-very-simple-one/#comments</comments>
		<pubDate>Wed, 18 Nov 2009 13:23:17 +0000</pubDate>
		<dc:creator>Dr. Thorsten Schneider</dc:creator>
				<category><![CDATA[The Binary Auditor™ Short Exercises]]></category>
		<category><![CDATA[exercise]]></category>
		<category><![CDATA[variable]]></category>

		<guid isPermaLink="false">http://www.binary-auditing.com/?p=2021</guid>
		<description><![CDATA[This one is a very simple one and for the beginners. Translate the following code to C++ or pseudocode. Do this line by line adding explanation what is going on here!]]></description>
		<wfw:commentRss>http://www.binary-auditing.com/2009/11/exercise-0006-very-simple-one/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>[EXERCISE 0005] Mad #define constant</title>
		<link>http://www.binary-auditing.com/2009/11/exercise-0005-mad-define-constant/</link>
		<comments>http://www.binary-auditing.com/2009/11/exercise-0005-mad-define-constant/#comments</comments>
		<pubDate>Tue, 17 Nov 2009 13:18:26 +0000</pubDate>
		<dc:creator>Dr. Thorsten Schneider</dc:creator>
				<category><![CDATA[The Binary Auditor™ Short Exercises]]></category>
		<category><![CDATA[constant]]></category>
		<category><![CDATA[define]]></category>
		<category><![CDATA[exercise]]></category>
		<category><![CDATA[variable]]></category>

		<guid isPermaLink="false">http://www.binary-auditing.com/?p=2016</guid>
		<description><![CDATA[I really hate this. All I did was a simple #define in the C++ code and some very few lines of code (actually 4). Whatever... looking at the IDA output I am lost. What the hell is the code doing here? Can you help us to understand the code?]]></description>
		<wfw:commentRss>http://www.binary-auditing.com/2009/11/exercise-0005-mad-define-constant/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>[EXERCISE 0004] Identify Variables</title>
		<link>http://www.binary-auditing.com/2009/11/exercise-0004-identify-variables/</link>
		<comments>http://www.binary-auditing.com/2009/11/exercise-0004-identify-variables/#comments</comments>
		<pubDate>Mon, 16 Nov 2009 12:54:58 +0000</pubDate>
		<dc:creator>Dr. Thorsten Schneider</dc:creator>
				<category><![CDATA[The Binary Auditor™ Short Exercises]]></category>
		<category><![CDATA[bool]]></category>
		<category><![CDATA[double]]></category>
		<category><![CDATA[exercise]]></category>
		<category><![CDATA[float]]></category>
		<category><![CDATA[long double]]></category>
		<category><![CDATA[signed char]]></category>
		<category><![CDATA[signed int]]></category>
		<category><![CDATA[signed long int]]></category>
		<category><![CDATA[signed short int]]></category>
		<category><![CDATA[unsigned char]]></category>
		<category><![CDATA[unsigned int]]></category>
		<category><![CDATA[unsigned long int]]></category>
		<category><![CDATA[unsigned short int]]></category>
		<category><![CDATA[variable]]></category>
		<category><![CDATA[wchar_t]]></category>

		<guid isPermaLink="false">http://www.binary-auditing.com/?p=1994</guid>
		<description><![CDATA[One of the most important capabilities during binary auditing is to identify variables within assembly code. Sometimes such variables are not that clear to identify for beginners as it is by reading C++ code. This time we have a look at many different variables at once. What I can do is to give you some hints. The original source code contained: double, long double, unsigned char, signed char, unsigned long int, signed long int, unsigned short int, signed short int, unsigned int, signed int, bool, float, and wchar_t. Can you get which variable type is corresponding to which lines of the assembly code?]]></description>
		<wfw:commentRss>http://www.binary-auditing.com/2009/11/exercise-0004-identify-variables/feed/</wfw:commentRss>
		<slash:comments>8</slash:comments>
		</item>
		<item>
		<title>[EXERCISE 0003] Understanding RVAs and Import Tables</title>
		<link>http://www.binary-auditing.com/2009/11/exercise-0003-understanding-rvas-and-import-tables/</link>
		<comments>http://www.binary-auditing.com/2009/11/exercise-0003-understanding-rvas-and-import-tables/#comments</comments>
		<pubDate>Thu, 05 Nov 2009 06:43:34 +0000</pubDate>
		<dc:creator>Dr. Thorsten Schneider</dc:creator>
				<category><![CDATA[The Binary Auditor™ Short Exercises]]></category>
		<category><![CDATA[exercise]]></category>
		<category><![CDATA[import]]></category>
		<category><![CDATA[loader]]></category>
		<category><![CDATA[RVA]]></category>
		<category><![CDATA[table]]></category>
		<category><![CDATA[thunk]]></category>

		<guid isPermaLink="false">http://www.binary-auditing.com/?p=1262</guid>
		<description><![CDATA[Import Libraries are dlls that an executable image are bound to. Much of windows core functionailty is found in Dlls that MS provides and is how applications interact with the base windows services. ]]></description>
		<wfw:commentRss>http://www.binary-auditing.com/2009/11/exercise-0003-understanding-rvas-and-import-tables/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>[EXERCISE 0002] Simple manual decompilation exercise for beginners &#8211; Part 2</title>
		<link>http://www.binary-auditing.com/2009/11/exercise-0002-simple-manual-decompilation-exercise-for-beginners-part-2/</link>
		<comments>http://www.binary-auditing.com/2009/11/exercise-0002-simple-manual-decompilation-exercise-for-beginners-part-2/#comments</comments>
		<pubDate>Wed, 04 Nov 2009 12:31:10 +0000</pubDate>
		<dc:creator>Dr. Thorsten Schneider</dc:creator>
				<category><![CDATA[The Binary Auditor™ Short Exercises]]></category>
		<category><![CDATA[decompilation]]></category>
		<category><![CDATA[exercise]]></category>
		<category><![CDATA[manual]]></category>
		<category><![CDATA[pseudo code]]></category>

		<guid isPermaLink="false">http://www.binary-auditing.com/?p=1232</guid>
		<description><![CDATA[Your goal is to analyse the following compiler-generated assembly language code and understand how it works. It contains a very simple loop. You must retrieve the proper C/C++ code or pseudo code of this commented procedure. Your solution has to contain either a full commented C/C++ code or a detailed pseudo code describing the function of the above snippet.]]></description>
		<wfw:commentRss>http://www.binary-auditing.com/2009/11/exercise-0002-simple-manual-decompilation-exercise-for-beginners-part-2/feed/</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
		<item>
		<title>The Binary Auditor™ now optimized for iPhone</title>
		<link>http://www.binary-auditing.com/2009/11/the-binary-auditor%e2%84%a2-now-optimized-for-iphone/</link>
		<comments>http://www.binary-auditing.com/2009/11/the-binary-auditor%e2%84%a2-now-optimized-for-iphone/#comments</comments>
		<pubDate>Tue, 03 Nov 2009 09:41:24 +0000</pubDate>
		<dc:creator>Dr. Thorsten Schneider</dc:creator>
				<category><![CDATA[The Binary Auditor™ Labs]]></category>
		<category><![CDATA[news]]></category>

		<guid isPermaLink="false">http://www.binary-auditing.com/?p=1984</guid>
		<description><![CDATA[The Binary Auditor™ automatically transforms now its content into a web-application experience when viewed from an iPhone, iPod touch or Android touch mobile device. It comes complete with all the standard features: search, categories, tags, archives, photos &#038; more. ]]></description>
		<wfw:commentRss>http://www.binary-auditing.com/2009/11/the-binary-auditor%e2%84%a2-now-optimized-for-iphone/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Preventing the Exploitation of Structured Exception Handler (SEH) Overwrites with SEHOP</title>
		<link>http://www.binary-auditing.com/2009/10/preventing-the-exploitation-of-structured-exception-handler-seh-overwrites-with-sehop/</link>
		<comments>http://www.binary-auditing.com/2009/10/preventing-the-exploitation-of-structured-exception-handler-seh-overwrites-with-sehop/#comments</comments>
		<pubDate>Thu, 29 Oct 2009 12:04:30 +0000</pubDate>
		<dc:creator>Dr. Thorsten Schneider</dc:creator>
				<category><![CDATA[Featured]]></category>
		<category><![CDATA[The Binary Auditor™ Labs]]></category>
		<category><![CDATA[ASLR]]></category>
		<category><![CDATA[exception]]></category>
		<category><![CDATA[exploitation]]></category>
		<category><![CDATA[SAFESEH]]></category>
		<category><![CDATA[seh]]></category>
		<category><![CDATA[SEHOP]]></category>
		<category><![CDATA[structured exception handler]]></category>

		<guid isPermaLink="false">http://www.binary-auditing.com/?p=1974</guid>
		<description><![CDATA[The purpose of the SEHOP mitigation is to prevent an attacker from being able to make use of the Structured Exception Handler (SEH) overwrite exploitation technique.]]></description>
		<wfw:commentRss>http://www.binary-auditing.com/2009/10/preventing-the-exploitation-of-structured-exception-handler-seh-overwrites-with-sehop/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Enhanced Mitigation Evaluation Toolkit &#8211; A toolkit to apply security mitigation technologies to arbitrary applications</title>
		<link>http://www.binary-auditing.com/2009/10/enhanced-mitigation-evaluation-toolkit-a-toolkit-to-apply-security-mitigation-technologies-to-arbitrary-applications/</link>
		<comments>http://www.binary-auditing.com/2009/10/enhanced-mitigation-evaluation-toolkit-a-toolkit-to-apply-security-mitigation-technologies-to-arbitrary-applications/#comments</comments>
		<pubDate>Wed, 28 Oct 2009 11:58:15 +0000</pubDate>
		<dc:creator>Dr. Thorsten Schneider</dc:creator>
				<category><![CDATA[Featured]]></category>
		<category><![CDATA[The Binary Auditor™ Labs]]></category>
		<category><![CDATA[arbitrary]]></category>
		<category><![CDATA[EMET]]></category>
		<category><![CDATA[microsoft]]></category>
		<category><![CDATA[mitigation]]></category>
		<category><![CDATA[toolkit]]></category>

		<guid isPermaLink="false">http://www.binary-auditing.com/?p=1967</guid>
		<description><![CDATA[Microsoft has released a new toolkit for hardening binary applications without the need of recompilation. It is called Mitigation Evaluation Toolkit - A toolkit to apply security mitigation technologies to arbitrary applications.]]></description>
		<wfw:commentRss>http://www.binary-auditing.com/2009/10/enhanced-mitigation-evaluation-toolkit-a-toolkit-to-apply-security-mitigation-technologies-to-arbitrary-applications/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Simple pointer analysis</title>
		<link>http://www.binary-auditing.com/2009/09/simple-pointer-analysis/</link>
		<comments>http://www.binary-auditing.com/2009/09/simple-pointer-analysis/#comments</comments>
		<pubDate>Wed, 23 Sep 2009 10:50:55 +0000</pubDate>
		<dc:creator>Dr. Thorsten Schneider</dc:creator>
				<category><![CDATA[The Binary Auditor™ Labs]]></category>
		<category><![CDATA[pattern]]></category>
		<category><![CDATA[pointer]]></category>

		<guid isPermaLink="false">http://www.binary-auditing.com/?p=1940</guid>
		<description><![CDATA[Pointers are a part of C++ programming that can cause grief though not as much as in C, where to do anything non trivial you have to use pointers. Pointers aren't that bad, but if you're new to them they will cause you troubles. It is all to easy to write bad code with pointers. ]]></description>
		<wfw:commentRss>http://www.binary-auditing.com/2009/09/simple-pointer-analysis/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Simple function call versus __fastcall</title>
		<link>http://www.binary-auditing.com/2009/09/simple-function-call-versus-__fastcall/</link>
		<comments>http://www.binary-auditing.com/2009/09/simple-function-call-versus-__fastcall/#comments</comments>
		<pubDate>Wed, 23 Sep 2009 09:55:30 +0000</pubDate>
		<dc:creator>Dr. Thorsten Schneider</dc:creator>
				<category><![CDATA[Featured]]></category>
		<category><![CDATA[The Binary Auditor™ Labs]]></category>
		<category><![CDATA[arguments]]></category>
		<category><![CDATA[callee clean-up]]></category>
		<category><![CDATA[caller clean-up]]></category>
		<category><![CDATA[calling convention]]></category>
		<category><![CDATA[fastcall]]></category>
		<category><![CDATA[pattern]]></category>
		<category><![CDATA[registers]]></category>
		<category><![CDATA[stack]]></category>

		<guid isPermaLink="false">http://www.binary-auditing.com/?p=1920</guid>
		<description><![CDATA[The __fastcall calling convention specifies that arguments to functions are to be passed in registers, when possible. The following list shows the implementation of this calling convention.]]></description>
		<wfw:commentRss>http://www.binary-auditing.com/2009/09/simple-function-call-versus-__fastcall/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>PeLib &#8211; An open-source C++ library to modify PE files</title>
		<link>http://www.binary-auditing.com/2009/09/pelib-an-open-source-c-library-to-modify-pe-files/</link>
		<comments>http://www.binary-auditing.com/2009/09/pelib-an-open-source-c-library-to-modify-pe-files/#comments</comments>
		<pubDate>Wed, 23 Sep 2009 06:17:37 +0000</pubDate>
		<dc:creator>Dr. Thorsten Schneider</dc:creator>
				<category><![CDATA[The Binary Auditor™ Labs]]></category>
		<category><![CDATA[file format]]></category>
		<category><![CDATA[library]]></category>
		<category><![CDATA[PE]]></category>
		<category><![CDATA[PeLib]]></category>

		<guid isPermaLink="false">http://www.binary-auditing.com/?p=1897</guid>
		<description><![CDATA[PeLib is an open source C++ library with the purpose to ease the access and modification of PE (Portable executable) files. This is done through a multitude of classes which represent all important PE header and directory structures and which provide the necessary functions to read, modify and write these structures. ]]></description>
		<wfw:commentRss>http://www.binary-auditing.com/2009/09/pelib-an-open-source-c-library-to-modify-pe-files/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>[EXERCISE 0001] Simple manual decompilation exercise for beginners</title>
		<link>http://www.binary-auditing.com/2009/09/exercise-0001-simple-manual-decompilation-exercise-for-beginners/</link>
		<comments>http://www.binary-auditing.com/2009/09/exercise-0001-simple-manual-decompilation-exercise-for-beginners/#comments</comments>
		<pubDate>Tue, 22 Sep 2009 07:10:39 +0000</pubDate>
		<dc:creator>Dr. Thorsten Schneider</dc:creator>
				<category><![CDATA[The Binary Auditor™ Short Exercises]]></category>
		<category><![CDATA[decompilation]]></category>
		<category><![CDATA[exercise]]></category>
		<category><![CDATA[manual]]></category>
		<category><![CDATA[pseudo code]]></category>

		<guid isPermaLink="false">http://www.binary-auditing.com/?p=1227</guid>
		<description><![CDATA[Your goal is to analyse the following compiler-generated assembly language code and to understand how it works. You must retrieve the proper C/C++ code or pseudo code of this commented code. Your solution has to contain either a full commented C/C++ code or a detailed pseudo code describing the function of the above snippet.]]></description>
		<wfw:commentRss>http://www.binary-auditing.com/2009/09/exercise-0001-simple-manual-decompilation-exercise-for-beginners/feed/</wfw:commentRss>
		<slash:comments>9</slash:comments>
		</item>
		<item>
		<title>Common Object File Format (COFF)</title>
		<link>http://www.binary-auditing.com/2009/09/common-object-file-format-coff/</link>
		<comments>http://www.binary-auditing.com/2009/09/common-object-file-format-coff/#comments</comments>
		<pubDate>Thu, 10 Sep 2009 07:26:48 +0000</pubDate>
		<dc:creator>Dr. Thorsten Schneider</dc:creator>
				<category><![CDATA[The Binary Auditor™ Labs]]></category>
		<category><![CDATA[COFF]]></category>
		<category><![CDATA[file format]]></category>

		<guid isPermaLink="false">http://www.binary-auditing.com/?p=1839</guid>
		<description><![CDATA[Windows NT uses a special format for the executable (image) files and object files. The format used in these files are referred to as Portable Executable (PE) or Common Object File Format (COFF) files. ]]></description>
		<wfw:commentRss>http://www.binary-auditing.com/2009/09/common-object-file-format-coff/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>The XM File Format</title>
		<link>http://www.binary-auditing.com/2009/09/the-xm-file-format/</link>
		<comments>http://www.binary-auditing.com/2009/09/the-xm-file-format/#comments</comments>
		<pubDate>Tue, 08 Sep 2009 13:37:59 +0000</pubDate>
		<dc:creator>Dr. Thorsten Schneider</dc:creator>
				<category><![CDATA[The Binary Auditor™ Labs]]></category>
		<category><![CDATA[file format]]></category>
		<category><![CDATA[keygen]]></category>
		<category><![CDATA[music]]></category>
		<category><![CDATA[xm]]></category>

		<guid isPermaLink="false">http://www.binary-auditing.com/?p=1818</guid>
		<description><![CDATA[The .XM files (Extended Module) are multichannel MOD files created by Triton's FastTracker ][. They feature up to 32 channels and different effects. FT 2 is
a shareware program. After the initial .XM header follows the pattern data, after the patterns follow the instruments.]]></description>
		<wfw:commentRss>http://www.binary-auditing.com/2009/09/the-xm-file-format/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Why does the dec/jne combo operate faster than the equivalent loopnz?</title>
		<link>http://www.binary-auditing.com/2009/09/why-does-the-decjne-combo-operate-faster-than-the-equivalent-loopnz/</link>
		<comments>http://www.binary-auditing.com/2009/09/why-does-the-decjne-combo-operate-faster-than-the-equivalent-loopnz/#comments</comments>
		<pubDate>Tue, 08 Sep 2009 11:31:21 +0000</pubDate>
		<dc:creator>Dr. Thorsten Schneider</dc:creator>
				<category><![CDATA[The Binary Auditor™ Labs]]></category>
		<category><![CDATA[dec/jnz]]></category>
		<category><![CDATA[loop]]></category>
		<category><![CDATA[optimization]]></category>

		<guid isPermaLink="false">http://www.binary-auditing.com/?p=1134</guid>
		<description><![CDATA[The dec/jnz pair operates faster then a loopsz for several reasons. First, dec and jnz pair up in the different modules of the netburst pipeline, so they can be executed simultaneously. Top that off with the fact that dec and jnz both require few cycles to execute, while the loopnz (and all the loop instructions, for that matter) instruction takes more cycles to complete. loop instructions are rarely seen output by good compilers.]]></description>
		<wfw:commentRss>http://www.binary-auditing.com/2009/09/why-does-the-decjne-combo-operate-faster-than-the-equivalent-loopnz/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Microsoft x64 calling convention</title>
		<link>http://www.binary-auditing.com/2009/09/microsoft-x64-calling-convention/</link>
		<comments>http://www.binary-auditing.com/2009/09/microsoft-x64-calling-convention/#comments</comments>
		<pubDate>Mon, 07 Sep 2009 08:16:45 +0000</pubDate>
		<dc:creator>Dr. Thorsten Schneider</dc:creator>
				<category><![CDATA[The Binary Auditor™ Labs]]></category>
		<category><![CDATA[amd64]]></category>
		<category><![CDATA[architecture]]></category>
		<category><![CDATA[assembly language routines]]></category>
		<category><![CDATA[calling convention]]></category>
		<category><![CDATA[floating point numbers]]></category>
		<category><![CDATA[intel 64]]></category>
		<category><![CDATA[member function]]></category>
		<category><![CDATA[microsoft]]></category>
		<category><![CDATA[microsoft x64]]></category>
		<category><![CDATA[parameters]]></category>
		<category><![CDATA[registers]]></category>
		<category><![CDATA[shadow space]]></category>
		<category><![CDATA[stack]]></category>
		<category><![CDATA[thunk]]></category>
		<category><![CDATA[visual studio]]></category>
		<category><![CDATA[x64]]></category>

		<guid isPermaLink="false">http://www.binary-auditing.com/?p=263</guid>
		<description><![CDATA[The x64 calling convention (for long mode on x86-64) takes advantage of additional register space in the AMD64/Intel 64 platform. The registers RCX, RDX, R8, R9 are used for integer and pointer arguments, and XMM0, XMM1, XMM2, XMM3 are used for floating point arguments. ]]></description>
		<wfw:commentRss>http://www.binary-auditing.com/2009/09/microsoft-x64-calling-convention/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
	</channel>
</rss>
