[Theory] C Language vs Assembly Language: A Complete Mapping Guide! 🧩 (Building Foundational Strength for Reversing)

Hello, aspiring security professionals! 🌱

When studying malware analysis or reverse engineering, you inevitably encounter a huge barrier: Assembly Language.

Seeing a black screen filled with unknown English acronyms like MOV, LEA, CMP, JE… naturally makes you wonder, “Who am I? Where am I?” 😵‍💫

But don’t be intimidated! Assembly language is not alien. It’s simply C language (a high-level language) in different attire. Compilers translate C language into machine code according to predefined rules (Patterns), so if you know these ‘conversion rules (Mapping)’, you can read assembly language fluently.

Today, we will thoroughly explore the core of reverse engineering: the 1:1 mapping structure between C language and assembly language. Understanding this principle will allow you to see the flow of code even without a decompiler! 🚀

---

1. Variable Assignment 📥

Assigning a value to a variable in C language is expressed as data movement (Move) in assembly.

📌 C Language

int a = 10;
int b = a;

⚙️ Assembly

MOV [RBP-4], 0xA    ; 1. 메모리(변수 a의 위치)에 10(0xA)을 넣는다.
MOV EAX, [RBP-4]    ; 2. 변수 a의 값을 레지스터(EAX)로 가져온다.
MOV [RBP-8], EAX    ; 3. 레지스터 값을 메모리(변수 b의 위치)에 넣는다.

• Explanation:
• The CPU cannot directly move data from memory to memory. Therefore, it moves data via a register (temporary storage) like EAX.
• Forms like [RBP-4] refer to a stack memory address (local variable).
• Key point: You can think of MOV A, B as A = B.

---

2. Arithmetic Operations 🧮

Operations like addition and subtraction are very intuitive.

📌 C Language

a = a + 5;
a++;

⚙️ Assembly

ADD [RBP-4], 5      ; a = a + 5 (ADD: 더하기)
INC [RBP-4]         ; a++ (INC: 1 증가)

• Explanation:
• ADD: Addition
• SUB: Subtraction
• INC: Increment by 1
• DEC: Decrement by 1
• IMUL / IDIV: Multiplication / Division

---

3. Conditional Statements (If-Else) ⚖️

These are branching statements that change the flow of a program. In assembly, they consist of two steps: comparison (CMP) and jump (JUMP).

📌 C Language

if (a == 10) {
    // True Block
    b = 1;
} else {
    // False Block
    b = 0;
}

⚙️ Assembly

CMP [RBP-4], 0xA    ; 1. a와 10을 비교한다. (실제로는 a - 10을 해봄)
JNE 0x401050        ; 2. 결과가 같지 않다면(Not Equal), Else 블록(0x401050)으로 점프!

; --- True Block ---
MOV [RBP-8], 1      ; b = 1
JMP 0x401060        ; Else 블록을 건너뛰고 탈출!

; --- False Block (0x401050) ---
MOV [RBP-8], 0      ; b = 0

• Explanation:
• CMP A, B: Compares A and B. (Internally performs A – B and considers them equal if the result is 0)
• JE (Jump Equal): Jumps if equal
• JNE (Jump Not Equal): Jumps if not equal
• JG / JL: Jumps if greater / Jumps if less
• Remember that the { } block structure of high-level languages changes into a GOTO (jump) form in assembly!

---

4. Loops (For / While) 🔄

Loops are a combination of conditional statements and jumps. They have a cyclic structure where the code goes down and then jumps back up.

📌 C Language

for (int i = 0; i < 10; i++) {
    sum += i;
}

⚙️ Assembly

MOV [RBP-4], 0      ; i = 0 (초기화)
JMP Check_Condition ; 조건 확인하러 가기

Loop_Start:         ; 루프 시작 지점
MOV EAX, [RBP-4]    ; i 값을 가져옴
ADD [RBP-8], EAX    ; sum += i
INC [RBP-4]         ; i++ (증감)

Check_Condition:    ; 조건 확인 지점
CMP [RBP-4], 0xA    ; i와 10 비교
JL Loop_Start       ; i < 10 (작으면) Loop_Start로 다시 점프!

• Explanation:
• A C language for loop is broken down into the sequence: initialization -> condition check -> body -> increment/decrement -> condition check.
• If you see JMP or Jcc instructions with an upward arrow in assembly code, you can think, “Ah, this is a loop!”

---

5. Function Call 📞

This is the most important Calling Convention in reversing. Before calling a function, you prepare parameters (arguments), and after the function finishes, you receive the return value.

📌 C Language

int result = Add(10, 20);

⚙️ Assembly (x64 Standard)

MOV EDX, 20         ; 2번째 인자(20)를 EDX(또는 RSI) 레지스터에 넣음
MOV ECX, 10         ; 1번째 인자(10)를 ECX(또는 RDI) 레지스터에 넣음
CALL 0x401200       ; Add 함수 호출 (스택에 복귀 주소 저장하고 이동)
MOV [RBP-4], EAX    ; 결과값(EAX)을 result 변수에 저장

• Explanation:
• Parameter Passing: In an x64 environment, arguments are primarily passed in registers (RDI, RSI, RDX, RCX…). (x86 uses stack PUSH)
• CALL: Jumps to the address where the function is located. At this time, the return address after the function finishes is secretly saved on the stack.
• Return Value (RAX/EAX): The result of a function’s execution is always stored in the EAX (or RAX) register. Therefore, checking EAX immediately after a CALL will reveal the return value.

---

💡 Tip: Study with AI

It’s okay if the patterns you learned today aren’t familiar yet. We have AI!

If you encounter unfamiliar assembly code during practice, ask it this:

“Decompile this assembly code into C language and explain its structure (if, for, etc.)!”

AI will interpret the code based on the mapping rules we just learned. But remember, knowing the theory and seeing the results is vastly different from seeing them without understanding the theory! 😉

Conclusion 🎁

C language and assembly language are like ‘two sides of the same coin’.

If you gain the ability to imagine the other side (C language) just by looking at one side (assembly), you’ve already grasped the ticket to becoming an intermediate analyst.

Next time, based on this theory, we will conduct a magical practical session where we ask AI to “reimplement this assembly code in Python.”

Have a great time reversing today! Fighting! 💪

---