1. assembly basics

1. assembly basics
    1.1. memory
       1.1.1. ram
       1.1.2. binary
       1.1.3. function frames
    1.2. registers
       1.2.1. sizes
       1.2.2. common x86 registers
    1.3. stack
       1.3.1. push
       1.3.2. pop
    1.4. syntax
       1.4.1. intel
       1.4.2. AT&T
    1.5. Instruction
       1.5.1. mov
       1.5.2. sub / add
       1.5.3. ret
       1.5.4. leave
       1.5.5. call
       1.5.6. jmp
    1.6. Functions
       1.6.1. prolog
       1.6.2. epilog
    1.7. Buffer
    1.8. Jump tables

1.1. memory

1.1.1. ram

Memory can be addressed using some number:

0x00000000000000000000

...

*memory*

...

0xffffffffffffffffffff

1.1.2. binary

Somewhere in memory lies the binary:

0x??? .text

      initialized data

      .bss

      heap

       |

       v

      ...

      ...

       ^

       |

      stack

      cmd line args

0x???

1.1.3. function frames

On the stack:

...

locals          |

base pointer    | line function

ret addr        |

parameters      |

locals          |

base pointer    | rectangle function

ret addr        |

parameters      |

1.2. registers

1.2.1. sizes

  64 |                            32 |            16 |     8 |    0 |

     v                               v               v       v      v

rax: ................................................................

                               eax:  ................................

                                                 ax: ................

                                                  ah ........        

                                                          al ........

r?x: 64 bit
e?x: 32 bit
 ?x: 16 bit
 ?h: "high" 8 bit
 ?l: "low" 8 bit

1.2.2. common x86 registers

- stack
  - rsp (stack pointer)
  - rbp (base pointer)

- function arguments
  - rdi
  - rsi
  - rdx
  - rcx

- return value
  - rax

- intruction pointer
  - rip

1.3. stack

1.3.1. push

Stack: ___ ___ ___

push "a"

Stack: _a_ ___ ___

push "b"

Stack: _a_ _b_ ___

push "c"

Stack: _a_ _b_ _c_

1.3.2. pop

Stack: _a_ _b_ _c_

rax: ___

rbx: ___

rcx: ___

pop "rax"

Stack: _a_ _b_ ___

rax: _c_

rbx: ___

rcx: ___

pop "rbx"

Stack: _a_ ___ ___

rax: _c_

rbx: _b_

rcx: ___

pop "rcx"

Stack: ___ ___ ___

rax: _c_

rbx: _b_

rcx: _a_

1.4. syntax

1.4.1. intel

mov rax, rbx

1.4.2. AT&T

mov %rax, %rbx

1.5. Instruction

1.5.1. mov

mov dst, src

values in square brackets dereference pointers, so the following:

mov rbx, [rax]

sould move the value the pointer that is stored in rax points to into rbx.

1.5.2. sub / add

subtrace or add to the provided value

sub rax, 0x100

add rdx, [rax]

1.5.3. ret

1.5.4. leave

1.5.5. call

1.5.6. jmp

jne: jump if not equal
jnz: jump if not zero

1.6. Functions

- group of instructions
- execute function by preparing registers, jumping to code, execution code and returning to original code
- function arguments passed depending on arch:
  - 32: stack
  - 64: registers (rdi, rsi, rdx, rcx, r8, r9)

1.6.1. prolog

push rip

push rbp

mov rbp, rsp

1.6.2. epilog

mov rsp, rbp

pop rbp

pop rip

1.7. Buffer

char str[16];

_ _ _ _

_ _ _ _

_ _ _ _

_ _ _ _ 

^

| stack grows up

| buffer get's written in the other dir

v

gets(str);

*input 16 "A"*

A A A A

A A A A

A A A A

A A A A

_ _ _ _ <- old rbp

_ _ _ _ <- old rip

*input 4 "B"*

A A A A

A A A A

A A A A

A A A A

B B B B <- old rbp

_ _ _ _ <- old rip

1.8. Jump tables

backlinks:
- /workshops/2022/ctf-foo/03-05-ctf-foo-assembly-basics/

    

emile - 1712771337.428385s - generated using vokobe "0.1.3"