CPU Modes
User vs kernel mode frames what RE can observe — literacy on $RE_LAB toy binaries, not ring-0 exploits on unauthorized targets.
Visual · re_cpu_modes
CPU modes literacy. $RE_LAB only. Original Cyberlium.
Most crackmes run in user mode — knowing rings explains what debuggers can and cannot touch.
CPUs execute code at privilege levels: user mode (ring 3) for normal programs and kernel mode (ring 0) for the OS. Syscalls transition between them. RE on $RE_LAB crackmes mostly inspects user-mode code — registers, stack, and library calls — while kernel RE requires explicit authorization. Cyberlium teaches mode literacy for reading disassembly and debugger behavior. You will NOT develop unauthorized kernel rootkits or bypass OS protections on production systems. Next: Registers.
1. User mode vs kernel mode (named)
User-mode code cannot directly access hardware or arbitrary physical memory — it requests services via syscalls (read, write, mmap). Kernel mode handles those requests and enforces isolation between processes.
On $RE_LAB, your toy binary's main and check functions run in user mode. Breakpoints and single-step in gdb attach to user threads unless you deliberately analyze kernel modules with authorization.
Command guide
Try these commands — User mode vs kernel mode (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
objdump(1) — https://man7.org/linux/man-pages/man1/objdump.1.html (disassembly literacy) ELF program headers — https://man7.org/linux/man-pages/man5/elf.5.html (segments vs sections) LiveOverflow — https://www.youtube.com/c/LiveOverflow (CPU mode concepts)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install binutils
macOS: Built-in (Xcode CLI) or brew install binutils
Command — copy this
brew install binutils
Windows: Use WSL binutils
═══ LINUX / macOS ═══
Optional command
sudo apt install binutils # objdump readelf nm
Command — copy this
export LAB_RE=${LAB_RE:-$HOME/cyberlium-lab/t23-re}
readelf -h "$LAB_RE/bin/hello" | grep -E 'Class|Machine|Entry'
objdump -f "$LAB_RE/bin/hello"Primary tools to practice this lesson: objdump, readelf. Reference sites: objdump(1) (https://man7.org/linux/man-pages/man1/objdump.1.html); ELF program headers (https://man7.org/linux/man-pages/man5/elf.5.html); LiveOverflow (https://www.youtube.com/c/LiveOverflow). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Syscalls as RE landmarks
Disassembly shows calls into PLT stubs that trap to the kernel — read, write, open, exit. Mapping syscalls helps distinguish I/O from pure computation in crackmes.
Dynamic traces on $RE_LAB log syscall sequences — compare against source of YOUR toy binary to verify understanding.
3. Literacy supports analysis — not unauthorized escalation
Forbidden: kernel exploit development on unauthorized hosts, ring-0 patching of neighbor laptops, or 'privilege escalation homework' outside isolated $RE_LAB with YOUR binaries.
Ship: table — user mode, kernel mode, one syscall example each, one RE observation each. Next: Registers.
4. What you ship: CPU modes literacy table
Two rows: user/kernel definition + RE observation each. $RE_LAB context. NEVER unauthorized ring-0 work. chmod 600.
5. What you record before the next lesson
Date. CPU modes table. $RE_LAB named. File t23-m02-l01-cpu-modes.txt chmod 600.
6. Wrong vs right: commercial piracy vs crackmes/CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Build a rootkit 'for lab.' Ignore syscall boundaries when tracing.
- Right: Write CPU modes literacy table. Next: Registers.
Mission: name CPU modes for RE
1) Define user and kernel mode in one line each. 2) Name one syscall and what it does. 3) Write NEVER unauthorized kernel exploit line. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
User-mode literacy covers most crackmes and CTF RE.
APPLY: CPU modes literacy on Cyberlium means:
APPLY: True or False: Most crackmes on $RE_LAB run primarily in user mode.
APPLY: Syscalls appear in disassembly as: