0x01: The Rise of High-Level Languages
Assembly language is close to the hardware, and each instruction corresponds to specific processor operations. While powerful, assembly is difficult to write, debug, and maintain—especially for large programs. It also lacks portability: code written for one processor architecture (like Arm) often cannot run on another (like x86) without significant rewriting.

To solve these challenges, high-level languages (HLLs) were developed. Examples include C, C++, Python, and Java. These languages abstract away hardware-specific details, allowing a single program to be compiled for multiple architectures. High-level languages provide readable syntax, data structures, and control flow constructs that make programming faster, easier, and less error-prone.

0x02: Compilation Process
High-level code cannot be executed directly by a processor. Instead, a compiler translates the human-readable source code into machine code, which the processor can execute. When using a cross-compiler, high-level code written on one architecture (like x64) can be compiled into a binary for another architecture (like Arm).

The compiler handles multiple transformations:

• Optimization for speed and memory usage
• Conversion of data types and structures into register/memory operations
• Elimination of unnecessary instructions

Because compilation is lossy, much of the high-level context (variable names, comments, and code structure) is stripped away. This is why reverse engineers often work from binaries instead of source code.

0x03: Reverse Engineering: Disassembly
When the source code is unavailable, reverse engineers rely on disassembly. Disassembly reconstructs the assembly instructions that the binary would execute, translating machine code back into a human-readable form.

Common uses of disassembly:

• Malware analysis: Understanding the behavior of suspicious programs
• Exploit development: Determining why certain vulnerabilities exist
• Compiler verification: Checking the correctness and efficiency of compiled output

Example: Using the Linux tool objdump to disassemble a simple program:

#include <unistd.h>
int main(void) {
    write(1, "Hello!\n", 7);
}

#include <unistd.h>
int main(void) {
    write(1, "Hello!\n", 7);
}

$ gcc -c hello.c
$ objdump -d hello.o
Disassembly of section .text:
00000000 <main>:
0: b580    push {r7, lr}
2: af00    add r7, sp, #0
4: 2207    movs r2, #7
6: 4b04    ldr r3, [pc, #16] ; (18 <main+0x18>)
...

$ gcc -c hello.c
$ objdump -d hello.o
Disassembly of section .text:
00000000 <main>:
0: b580    push {r7, lr}
2: af00    add r7, sp, #0
4: 2207    movs r2, #7
6: 4b04    ldr r3, [pc, #16] ; (18 <main+0x18>)
...

This output shows how high-level write() calls translate into Arm assembly instructions.

0x04: Decompilation
Decompilers attempt to go a step further than disassembly. Instead of showing raw assembly, they try to reconstruct high-level code (often pseudocode) from a binary.

Advantages:

• Simplifies reading large or complex programs
• Provides a high-level overview of program logic

Limitations:

• Cannot fully restore original source code
• Symbol names, variable names, and comments are usually lost
• Aggressive compiler optimizations can lead to misleading pseudocode

Example Tools:

• Ghidra (free, open-source)

• IDA Pro (commercial)

Decompilers are especially useful for analyzing simple functions or understanding program structure quickly, but serious vulnerability analysis or exploit development still requires reading the disassembled assembly code.

0x05: Portability and Cross-Compiling
High-level languages can be compiled for multiple architectures, but assembly is architecture-specific. For example, moving the decimal value 1 into a register differs across architectures:

Cross-compilers allow you to generate Arm binaries from an x64 machine. The binary is still Arm machine code, but you didn’t need an Arm processor to assemble it.

$ arm-linux-gnueabihf-as myasm.s -o myasm.o
$ arm-linux-gnueabihf-ld myasm.o -o myasm
$ file myasm
myasm: ELF 32-bit LSB executable, ARM

$ arm-linux-gnueabihf-as myasm.s -o myasm.o
$ arm-linux-gnueabihf-ld myasm.o -o myasm
$ file myasm
myasm: ELF 32-bit LSB executable, ARM

0x06: Summary

• Assembly language is low-level and architecture-specific.
• High-level languages abstract away hardware details, enabling portability.
• Compilers convert high-level code to machine code, which processors execute.
• Reverse engineers use disassembly to analyze binaries at the instruction level.
• Decompilers provide high-level pseudocode but cannot perfectly reconstruct original source code.
• Cross-compilers allow creating binaries for architectures different from the host machine.

Understanding the distinctions between high-level languages, assembly, and machine code is critical for effective reverse engineering.