1. assembly basics
- 1. assembly basics
- 1.1. memory
- 1.1.1. ram
- 1.1.2. binary
- 1.1.3. function frames
- 1.2. registers
- 1.2.1. sizes
- 1.2.2. common x86 registers
- 1.3. stack
- 1.3.1. push
- 1.3.2. pop
- 1.4. syntax
- 1.4.1. intel
- 1.4.2. AT&T
- 1.5. Instruction
- 1.5.1. mov
- 1.5.2. sub / add
- 1.5.3. ret
- 1.5.4. leave
- 1.5.5. call
- 1.5.6. jmp
- 1.6. Functions
- 1.6.1. prolog
- 1.6.2. epilog
- 1.7. Buffer
- 1.8. Jump tables
1.1. memory
1.1.1. ram
Memory can be addressed using some number:
0x00000000000000000000
...
*memory*
...
0xffffffffffffffffffff
1.1.2. binary
Somewhere in memory lies the binary:
0x??? .text
initialized data
.bss
heap
|
v
...
>
...
^
|
stack
cmd line args
0x???
1.1.3. function frames
On the stack:
...
locals |
base pointer | line function
ret addr |
parameters |
locals |
base pointer | rectangle function
ret addr |
parameters |
1.2. registers
1.2.1. sizes
64 | 32 | 16 | 8 | 0 |
v v v v v
rax: ................................................................
eax: ................................
ax: ................
ah ........
al ........
r?x: 64 bit e?x: 32 bit ?x: 16 bit ?h: "high" 8 bit ?l: "low" 8 bit
1.2.2. common x86 registers
- stack
- rsp (stack pointer)
- rbp (base pointer)
- function arguments
- rdi
- rsi
- rdx
- rcx
- return value
- rax
- intruction pointer
- rip
1.3. stack
1.3.1. push
Stack: ___ ___ ___
>
push "a"
>
Stack: _a_ ___ ___
>
push "b"
>
Stack: _a_ _b_ ___
>
push "c"
>
Stack: _a_ _b_ _c_
1.3.2. pop
Stack: _a_ _b_ _c_
rax: ___
rbx: ___
rcx: ___
>
pop "rax"
>
Stack: _a_ _b_ ___
rax: _c_
rbx: ___
rcx: ___
>
pop "rbx"
>
Stack: _a_ ___ ___
rax: _c_
rbx: _b_
rcx: ___
>
pop "rcx"
>
Stack: ___ ___ ___
rax: _c_
rbx: _b_
rcx: _a_
1.4. syntax
1.4.1. intel
mov rax, rbx
1.4.2. AT&T
mov %rax, %rbx
1.5. Instruction
1.5.1. mov
mov dst, src
values in square brackets dereference pointers, so the following:
mov rbx, [rax]
sould move the value the pointer that is stored in rax points to into rbx.
1.5.2. sub / add
subtrace or add to the provided value
sub rax, 0x100
add rdx, [rax]
1.5.3. ret
1.5.4. leave
1.5.5. call
1.5.6. jmp
jne: jump if not equal jnz: jump if not zero
1.6. Functions
- group of instructions
- execute function by preparing registers, jumping to code, execution code and returning to original code
- function arguments passed depending on arch:
- 32: stack
- 64: registers (rdi, rsi, rdx, rcx, r8, r9)
1.6.1. prolog
push rip
push rbp
mov rbp, rsp
1.6.2. epilog
mov rsp, rbp
pop rbp
pop rip
1.7. Buffer
char str[16];
_ _ _ _
_ _ _ _
_ _ _ _
_ _ _ _
^
| stack grows up
| buffer get's written in the other dir
v
gets(str);
*input 16 "A"*
A A A A
A A A A
A A A A
A A A A
_ _ _ _ <- old rbp
_ _ _ _ <- old rip
*input 4 "B"*
A A A A
A A A A
A A A A
A A A A
B B B B <- old rbp
_ _ _ _ <- old rip