emile.space

            
            

1. assembly basics

1. assembly basics
    1.1. memory
       1.1.1. ram
       1.1.2. binary
       1.1.3. function frames
    1.2. registers
       1.2.1. sizes
       1.2.2. common x86 registers
    1.3. stack
       1.3.1. push
       1.3.2. pop
    1.4. syntax
       1.4.1. intel
       1.4.2. AT&T
    1.5. Instruction
       1.5.1. mov
       1.5.2. sub / add
       1.5.3. ret
       1.5.4. leave
       1.5.5. call
       1.5.6. jmp
    1.6. Functions
       1.6.1. prolog
       1.6.2. epilog
    1.7. Buffer
    1.8. Jump tables

1.1. memory


            
            

1.1.1. ram

  





0xffff ffff ffff ffff

Memory can be addressed using some number:

0x00000000000000000000
...
*memory*
...
0xffffffffffffffffffff

1.1.2. binary

Somewhere in memory lies the binary:

0x??? .text
      initialized data
      .bss
      heap
       |
       v
      ...
      ...
       ^
       |
      stack
      cmd line args
0x???

1.1.3. function frames

On the stack:

...

locals          |
base pointer    | line function
ret addr        |
parameters      |

locals          |
base pointer    | rectangle function
ret addr        |
parameters      |

1.2. registers


            
            

1.2.1. sizes

  64 |                            32 |            16 |     8 |    0 |
     v                               v               v       v      v
rax: ................................................................
                               eax:  ................................
                                                 ax: ................
                                                  ah ........        
                                                          al ........

r?x: 64 bit
e?x: 32 bit
 ?x: 16 bit
 ?h: "high" 8 bit
 ?l: "low" 8 bit

1.2.2. common x86 registers

- stack
  - rsp (stack pointer)
  - rbp (base pointer)

- function arguments
  - rdi
  - rsi
  - rdx
  - rcx

- return value
  - rax

- intruction pointer
  - rip

1.3. stack


            
            

1.3.1. push

Stack: ___ ___ ___
push "a"
Stack: _a_ ___ ___
push "b"
Stack: _a_ _b_ ___
push "c"
Stack: _a_ _b_ _c_

1.3.2. pop

Stack: _a_ _b_ _c_
rax: ___
rbx: ___
rcx: ___
pop "rax"
Stack: _a_ _b_ ___
rax: _c_
rbx: ___
rcx: ___
pop "rbx"
Stack: _a_ ___ ___
rax: _c_
rbx: _b_
rcx: ___
pop "rcx"
Stack: ___ ___ ___
rax: _c_
rbx: _b_
rcx: _a_

1.4. syntax


            
            

1.4.1. intel

mov rax, rbx

1.4.2. AT&T

mov %rax, %rbx

1.5. Instruction


            
            

1.5.1. mov

mov dst, src

values in square brackets dereference pointers, so the following:

mov rbx, [rax]

sould move the value the pointer that is stored in rax points to into rbx.

1.5.2. sub / add

subtrace or add to the provided value

sub rax, 0x100

add rdx, [rax]

1.5.3. ret


            
            

1.5.4. leave


            
            

1.5.5. call


            
            

1.5.6. jmp

jne: jump if not equal
jnz: jump if not zero

1.6. Functions

- group of instructions
- execute function by preparing registers, jumping to code, execution code and returning to original code
- function arguments passed depending on arch:
  - 32: stack
  - 64: registers (rdi, rsi, rdx, rcx, r8, r9)

1.6.1. prolog

push rip
push rbp
mov rbp, rsp

1.6.2. epilog

mov rsp, rbp
pop rbp
pop rip

1.7. Buffer

char str[16];

_ _ _ _
_ _ _ _
_ _ _ _
_ _ _ _ 

^
| stack grows up
 
| buffer get's written in the other dir
v

gets(str);

*input 16 "A"*

A A A A
A A A A
A A A A
A A A A
_ _ _ _ <- old rbp
_ _ _ _ <- old rip

*input 4 "B"*

A A A A
A A A A
A A A A
A A A A
B B B B <- old rbp
_ _ _ _ <- old rip

1.8. Jump tables




backlinks: - /workshops/2022/ctf-foo/03-05-ctf-foo-assembly-basics/
rss feed of @hanemile@chaos.social mastodon lieu webring search engine XXIIVV webring mastodon
emile - 1708604777.245476s - generated using vokobe "0.1.3"