assembly basics
memory
ram
binary
function frames
registers
sizes
common x86 registers
stack
push
pop
syntax
intel
AT&T
Instruction
mov
sub / add
ret
leave
call
jmp
Functions
prolog
epilog
Buffer
Jump tables
0x00000000000000000000
...
*memory*
...
0xffffffffffffffffffff
Somewhere in memory lies the binary:
0x??? .text
initialized data
.bss
heap
|
v
...
...
^
|
stack
cmd line args
0x???
On the stack:
...
locals |
base pointer | line function
ret addr |
parameters |
locals |
base pointer | rectangle function
ret addr |
parameters |
64 | 32 | 16 | 8 | 0 |
v v v v v
rax: ................................................................
eax: ................................
ax: ................
ah ........
al ........
r?x: 64 bit
e?x: 32 bit
?x: 16 bit
?h: "high" 8 bit
?l: "low" 8 bit
- stack
- rsp (stack pointer)
- rbp (base pointer)
- function arguments
- rdi
- rsi
- rdx
- rcx
- return value
- rax
- intruction pointer
- rip
Stack: ___ ___ ___
push "a"
Stack: _a_ ___ ___
push "b"
Stack: _a_ _b_ ___
push "c"
Stack: _a_ _b_ _c_
Stack: _a_ _b_ _c_
rax: ___
rbx: ___
rcx: ___
pop "rax"
Stack: _a_ _b_ ___
rax: _c_
rbx: ___
rcx: ___
pop "rbx"
Stack: _a_ ___ ___
rax: _c_
rbx: _b_
rcx: ___
pop "rcx"
Stack: ___ ___ ___
rax: _c_
rbx: _b_
rcx: _a_
mov rax, rbx
mov %rax, %rbx
mov dst, src
values in square brackets dereference pointers, so the following:
mov rbx, [rax]
sould move the value the pointer that is stored in rax points to into rbx.
subtrace or add to the provided value
sub rax, 0x100
add rdx, [rax]
jne: jump if not equal
jnz: jump if not zero
- group of instructions
- execute function by preparing registers, jumping to code, execution code and returning to original code
- function arguments passed depending on arch:
- 32: stack
- 64: registers (rdi, rsi, rdx, rcx, r8, r9)
push rip
push rbp
mov rbp, rsp
mov rsp, rbp
pop rbp
pop rip
char str[16];
_ _ _ _
_ _ _ _
_ _ _ _
_ _ _ _
^
| stack grows up
| buffer get's written in the other dir
v
gets(str);
*input 16 "A"*
A A A A
A A A A
A A A A
A A A A
_ _ _ _ <- old rbp
_ _ _ _ <- old rip
*input 4 "B"*
A A A A
A A A A
A A A A
A A A A
B B B B <- old rbp
_ _ _ _ <- old rip