Reverse Engineering II: The Basics

Size: px
Start display at page:

Download "Reverse Engineering II: The Basics"

Transcription

1 Reverse Engineering II: The Basics This document is only to be distributed to teachers and students of the Malware Analysis and Antivirus Technologies course and should only be used in accordance with the course guidelines. Protecting the irreplaceable f-secure.com

2 Agenda Very basics Intel x86 crash course Basics of C reversing 2

3 Binary Numbers Nibble B B D - Byte B D Word 3

4 Byte Order a.k.a. Endianness = 0x3412 (Little Endian) = 0x1234 (Big Endian) = 0x1234 (Little Endian) = 0x3412 (Big Endian) 4

5 Little Endian Dword x x

6 Endianness Matters Data exchange between computers Networking protocols File formats for disk storage 6

7 System Endianness Little Endian Intel x86 Intel 8051 Most ucontrollers Big Endian PowerPC (exc. G5) Sparc (exc. v9) System/370 Switchable Endianness ARM Alpha Intel IA64 7

8 ASCII Code 0x00-0x1F 0x20-0x3F 0x40-0x5F 0x60-0x7E Control Characters Digits and Punctuation Upper-case Letters and Special Lower-case Letters and Special Backspace, Line feed 0-9 <> =.,: *-()! abcd... `{} ~ 8

9 ASCII Example H e l l o C 6C 6F

10 Unicode Strings BOM H e l l o ff fe c 00 6c 00 6f 00 UTF-16 / UCS

11 String Storage ASCIIZ: Zero-terminated ASCII Pascal: Size byte + ASCII string Delphi: Size Dword + ASCII or Unicode string H e l l o ASCIIZ: C 6C 6F 00 Pascal: C 6C 6F 11

12 Intel x86 Architecture Image Copyright 2004 GNU 12

13 Introduction to Intel x86 Started with 8086 in 1978 Continued with 8088, 80186, 80286, 386, 486, Pentium, CISC architecture 32-bit is called x86-32 or IA bit is called x86-64, AMD64, EMT64T introduced in 1986 Has a 32-bit word length Has eight general-purpose registers Supports paging and virtual memory Addresses up to 4GiB of memory 13

14 Data Register Layout Image Copyright Intel Corporation 14

15 Data Registers AL / AH / AX EAX Accumulator Arithmetic operations BL / BH / BX EBX Data index General data storage, index CL / CH / CX ECX Loop counter Loop constructs DL / DH / DX EDX Data register Arithmetics 15

16 Address Registers IP / EIP Instruction Pointer Program execution SP / ESP Stack Pointer Stack operation BP / EBP Base Pointer Stack frame SI / ESI Source Index String operation DI / EDI Destination Index String operation 16

17 Segment Registers CS Code Segment Program code DS Data Segment Program data ES / FS / GS Other Segments Other uses 17

18 EFLAGS Register Image Copyright Intel Corporation 18

19 Mnemonic Examples MOV EAX, 1 ADD EDX, 5 SUB EBX, 2 AND ECX, 0 XOR EDX, 4 SHL ECX, 6 Move 1 to EAX Add 5 to EDX Subtract 2 from EBX Bit-wise AND 0 to ECX Bit-wise exclusive OR 4 to EDX Shift ECX left by six ROR EBX, 3 Bit-wise rotate EBX right by 3 INC ECX Increment ECX 19

20 More Mnemonics JNZ label JMP label CALL func RET LOOP label PUSH EAX POP EDI LODSB Jump if not zero (equal) Unconditional jump to label Call function Return from function ECX--, Jump to label if not zero Push EAX to stack Pop EDI from stack Load byte from DS:ESI to AL 20

21 Reversing C code

22 Basic Data Types char - 1 byte short - 2 bytes int - 4 bytes (platform word) long - 4 bytes float - 4 bytes floating point double - 8 bytes floating point

23 Pointers and Arrays Pointers can point to any memory location One-dimensional arrays are flat memory Multi-dimensional arrays use pointers A[0] A[1] A[2] A[3] char a[4]; char *b, c; c = a[2]; b = a; c = *(b+2);

24 Composite Types: Structure Memory is allocated for all members Members are accessible separately struct { unsigned int id; unsigned short age; char name[16]; } record;

25 Alignment Data structures are aligned to word size #pragma pack(n) directive can change it #pragma pack(1) removes alignment Important when reconstructing structures

26 Structure Storage Aligned long id; short age; 2-byte padding Packed long id; short age; char name[16]; char name[16]; sizeof(record) = 24 sizeof(record) = 22

27 Composite Types: Union Memory is allocated for the largest member Holds only one member at a time union foo { int one; }; char two;

28 Control Structures Conditional Branch Iteration Switch-Case Goto label

29 Conditional Branch: if var_c = dword ptr -0Ch int example_if() { int foo = 0; if (foo) { do_one_thing(); } else { do_another(); } } push ebp mov ebp, esp sub esp, 18h mov [ebp+var_c], 0 cmp [ebp+var_c], 0 jz short loc_1f27 call _do_one_thing jmp short locret_1f2c loc_1f27: call _do_another locret_1f2c: leave retn

30 Iteration: for int example_for() { int i; } for (i=0; i<10; i++) { if (check_something(i)) break; } push ebp mov ebp, esp sub esp, 28h mov [ebp+var_c], 0 jmp short loc_1f51 loc_1f3d: mov eax, [ebp+var_c] mov [esp], eax call _check_something test eax, eax jnz short locret_1f57 lea eax, [ebp+var_c] inc dword ptr [eax] loc_1f51: cmp [ebp+var_c], 9 jle short loc_1f3d locret_1f57: leave retn

31 Iteration: while int example_while() { int i = 0; } while (i < 100) { if (check_something(i)) break; } push ebp mov ebp, esp sub esp, 28h mov [ebp+var_c], 0 jmp short loc_1f77 loc_1f68: mov eax, [ebp+var_c] mov [esp], eax call _check_something test eax, eax jnz short locret_1f7d loc_1f77: cmp [ebp+var_c], 64h jl short loc_1f68 locret_1f7d: leave retn

32 Branching: Switch-Case int example_switch() { int i = 1; } switch (i) { case 0: do_one_thing(); break; case 1: do_another(); break; default: check_something(i); } push ebp mov ebp, esp sub esp, 38h mov [ebp+var_c], 1 mov eax, [ebp+var_c] mov [ebp+var_1c], eax cmp [ebp+var_1c], 0 jz short loc_1fab cmp [ebp+var_1c], 1 jz short loc_1fb2 mov eax, [ebp+var_c] mov [esp], eax call _check_something jmp short locret_1fb9 loc_1fab: call _do_one_thing jmp short locret_1fb9 loc_1fb2: call _do_another jmp short $+2 locret_1fb9: leave retn

33 Branching: Goto int example_goto(void) { open_files(); if do_one_thing() goto error; if do_another() goto error; close_files(); return 1; error: close_files(); return 0; } push ebp mov ebp, esp sub esp, 18h call _open_files call _do_one_thing test eax, eax jnz short loc_1fe6 call _do_another test eax, eax jnz short loc_1fe6 call _close_files mov [ebp+var_c], 1 jmp short loc_1ff2 loc_1fe6: call _close_files mov [ebp+var_c], 0 loc_1ff2: mov eax, [ebp+var_c] leave retn

34 Function Calling Conventions Common calling conventions: stdcall - Standard calls on Windows cdecl - Most common C calling convention fastcall - Uses registers for arguments thiscall - Pass this pointer in ECX in C++ Most important: Who is going to clean the stack? Mixing them will crash the program

35 Simple C Program int foobar(int x, int y) { int z; return x; } int main(void) { int z = foobar(1, 2); }

36 cdecl Calls PUSH arg2 PUSH arg1 CALL function ADD ESP,8 PUSH EBP MOV EBP, ESP SUB ESP, 4 MOV EAX, [EBP+8] MOV ESP, EBP POP EBP RET Stack ARG2 ARG1 RET Addr. Saved EBP LOC1 arg1: EBP+8 arg2: EBP+12 loc1: EBP-4

37 stdcall Calls PUSH arg2 PUSH arg1 CALL function PUSH EBP MOV EBP, ESP SUB ESP, 4 MOV EAX, [EBP+8] MOV ESP, EBP POP EBP RETN 8 ARG2 ARG1 RET Addr. Saved EBP LOC1 arg1: EBP+8 arg2: EBP+12 loc1: EBP-4

38 Reading Intel x86 Function-call Conventions: callconv-asm.html C Programming Information:

Reverse Engineering II: The Basics

Reverse Engineering II: The Basics Reverse Engineering II: The Basics Gergely Erdélyi Senior Manager, Anti-malware Research Protecting the irreplaceable f-secure.com Binary Numbers 1 0 1 1 - Nibble B 1 0 1 1 1 1 0 1 - Byte B D 1 0 1 1 1

More information

Reverse Engineering II: Basics. Gergely Erdélyi Senior Antivirus Researcher

Reverse Engineering II: Basics. Gergely Erdélyi Senior Antivirus Researcher Reverse Engineering II: Basics Gergely Erdélyi Senior Antivirus Researcher Agenda Very basics Intel x86 crash course Basics of C Binary Numbers Binary Numbers 1 Binary Numbers 1 0 1 1 Binary Numbers 1

More information

T Reverse Engineering Malware: Static Analysis I

T Reverse Engineering Malware: Static Analysis I T-110.6220 Reverse Engineering Malware: Static Analysis I Antti Tikkanen, F-Secure Corporation Protecting the irreplaceable f-secure.com Representing Data 2 Binary Numbers 1 0 1 1 Nibble B 1 0 1 1 1 1

More information

Static Analysis I PAOLO PALUMBO, F-SECURE CORPORATION

Static Analysis I PAOLO PALUMBO, F-SECURE CORPORATION Static Analysis I PAOLO PALUMBO, F-SECURE CORPORATION Representing Data Binary numbers 1 0 1 1 NIBBLE 0xB 1 0 1 1 1 1 0 1 0xBD 1 0 1 1 1 1 0 1 0 0 1 1 1 0 0 1 BYTE WORD 0xBD 0x39 Endianness c9 33 41 03

More information

X86 Addressing Modes Chapter 3" Review: Instructions to Recognize"

X86 Addressing Modes Chapter 3 Review: Instructions to Recognize X86 Addressing Modes Chapter 3" Review: Instructions to Recognize" 1 Arithmetic Instructions (1)! Two Operand Instructions" ADD Dest, Src Dest = Dest + Src SUB Dest, Src Dest = Dest - Src MUL Dest, Src

More information

Lecture 15 Intel Manual, Vol. 1, Chapter 3. Fri, Mar 6, Hampden-Sydney College. The x86 Architecture. Robb T. Koether. Overview of the x86

Lecture 15 Intel Manual, Vol. 1, Chapter 3. Fri, Mar 6, Hampden-Sydney College. The x86 Architecture. Robb T. Koether. Overview of the x86 Lecture 15 Intel Manual, Vol. 1, Chapter 3 Hampden-Sydney College Fri, Mar 6, 2009 Outline 1 2 Overview See the reference IA-32 Intel Software Developer s Manual Volume 1: Basic, Chapter 3. Instructions

More information

Practical Malware Analysis

Practical Malware Analysis Practical Malware Analysis Ch 4: A Crash Course in x86 Disassembly Revised 1-16-7 Basic Techniques Basic static analysis Looks at malware from the outside Basic dynamic analysis Only shows you how the

More information

The x86 Architecture

The x86 Architecture The x86 Architecture Lecture 24 Intel Manual, Vol. 1, Chapter 3 Robb T. Koether Hampden-Sydney College Fri, Mar 20, 2015 Robb T. Koether (Hampden-Sydney College) The x86 Architecture Fri, Mar 20, 2015

More information

Introduction to IA-32. Jo, Heeseung

Introduction to IA-32. Jo, Heeseung Introduction to IA-32 Jo, Heeseung IA-32 Processors Evolutionary design Starting in 1978 with 8086 Added more features as time goes on Still support old features, although obsolete Totally dominate computer

More information

INTRODUCTION TO IA-32. Jo, Heeseung

INTRODUCTION TO IA-32. Jo, Heeseung INTRODUCTION TO IA-32 Jo, Heeseung IA-32 PROCESSORS Evolutionary design Starting in 1978 with 8086 Added more features as time goes on Still support old features, although obsolete Totally dominate computer

More information

CSC 2400: Computer Systems. Towards the Hardware: Machine-Level Representation of Programs

CSC 2400: Computer Systems. Towards the Hardware: Machine-Level Representation of Programs CSC 2400: Computer Systems Towards the Hardware: Machine-Level Representation of Programs Towards the Hardware High-level language (Java) High-level language (C) assembly language machine language (IA-32)

More information

Complex Instruction Set Computer (CISC)

Complex Instruction Set Computer (CISC) Introduction ti to IA-32 IA-32 Processors Evolutionary design Starting in 1978 with 886 Added more features as time goes on Still support old features, although obsolete Totally dominate computer market

More information

CSC 8400: Computer Systems. Machine-Level Representation of Programs

CSC 8400: Computer Systems. Machine-Level Representation of Programs CSC 8400: Computer Systems Machine-Level Representation of Programs Towards the Hardware High-level language (Java) High-level language (C) assembly language machine language (IA-32) 1 Compilation Stages

More information

CS241 Computer Organization Spring 2015 IA

CS241 Computer Organization Spring 2015 IA CS241 Computer Organization Spring 2015 IA-32 2-10 2015 Outline! Review HW#3 and Quiz#1! More on Assembly (IA32) move instruction (mov) memory address computation arithmetic & logic instructions (add,

More information

CNIT 127: Exploit Development. Ch 1: Before you begin. Updated

CNIT 127: Exploit Development. Ch 1: Before you begin. Updated CNIT 127: Exploit Development Ch 1: Before you begin Updated 1-14-16 Basic Concepts Vulnerability A flaw in a system that allows an attacker to do something the designer did not intend, such as Denial

More information

Module 3 Instruction Set Architecture (ISA)

Module 3 Instruction Set Architecture (ISA) Module 3 Instruction Set Architecture (ISA) I S A L E V E L E L E M E N T S O F I N S T R U C T I O N S I N S T R U C T I O N S T Y P E S N U M B E R O F A D D R E S S E S R E G I S T E R S T Y P E S O

More information

CS412/CS413. Introduction to Compilers Tim Teitelbaum. Lecture 21: Generating Pentium Code 10 March 08

CS412/CS413. Introduction to Compilers Tim Teitelbaum. Lecture 21: Generating Pentium Code 10 March 08 CS412/CS413 Introduction to Compilers Tim Teitelbaum Lecture 21: Generating Pentium Code 10 March 08 CS 412/413 Spring 2008 Introduction to Compilers 1 Simple Code Generation Three-address code makes it

More information

Addressing Modes on the x86

Addressing Modes on the x86 Addressing Modes on the x86 register addressing mode mov ax, ax, mov ax, bx mov ax, cx mov ax, dx constant addressing mode mov ax, 25 mov bx, 195 mov cx, 2056 mov dx, 1000 accessing data in memory There

More information

Scott M. Lewandowski CS295-2: Advanced Topics in Debugging September 21, 1998

Scott M. Lewandowski CS295-2: Advanced Topics in Debugging September 21, 1998 Scott M. Lewandowski CS295-2: Advanced Topics in Debugging September 21, 1998 Assembler Syntax Everything looks like this: label: instruction dest,src instruction label Comments: comment $ This is a comment

More information

Assembly Language: IA-32 Instructions

Assembly Language: IA-32 Instructions Assembly Language: IA-32 Instructions 1 Goals of this Lecture Help you learn how to: Manipulate data of various sizes Leverage more sophisticated addressing modes Use condition codes and jumps to change

More information

Computer Processors. Part 2. Components of a Processor. Execution Unit The ALU. Execution Unit. The Brains of the Box. Processors. Execution Unit (EU)

Computer Processors. Part 2. Components of a Processor. Execution Unit The ALU. Execution Unit. The Brains of the Box. Processors. Execution Unit (EU) Part 2 Computer Processors Processors The Brains of the Box Computer Processors Components of a Processor The Central Processing Unit (CPU) is the most complex part of a computer In fact, it is the computer

More information

EXPERIMENT WRITE UP. LEARNING OBJECTIVES: 1. Get hands on experience with Assembly Language Programming 2. Write and debug programs in TASM/MASM

EXPERIMENT WRITE UP. LEARNING OBJECTIVES: 1. Get hands on experience with Assembly Language Programming 2. Write and debug programs in TASM/MASM EXPERIMENT WRITE UP AIM: Assembly language program for 16 bit BCD addition LEARNING OBJECTIVES: 1. Get hands on experience with Assembly Language Programming 2. Write and debug programs in TASM/MASM TOOLS/SOFTWARE

More information

MODE (mod) FIELD CODES. mod MEMORY MODE: 8-BIT DISPLACEMENT MEMORY MODE: 16- OR 32- BIT DISPLACEMENT REGISTER MODE

MODE (mod) FIELD CODES. mod MEMORY MODE: 8-BIT DISPLACEMENT MEMORY MODE: 16- OR 32- BIT DISPLACEMENT REGISTER MODE EXERCISE 9. Determine the mod bits from Figure 7-24 and write them in Table 7-7. MODE (mod) FIELD CODES mod 00 01 10 DESCRIPTION MEMORY MODE: NO DISPLACEMENT FOLLOWS MEMORY MODE: 8-BIT DISPLACEMENT MEMORY

More information

CS 31: Intro to Systems ISAs and Assembly. Martin Gagné Swarthmore College February 7, 2017

CS 31: Intro to Systems ISAs and Assembly. Martin Gagné Swarthmore College February 7, 2017 CS 31: Intro to Systems ISAs and Assembly Martin Gagné Swarthmore College February 7, 2017 ANNOUNCEMENT All labs will meet in SCI 252 (the robot lab) tomorrow. Overview How to directly interact with hardware

More information

Lab 3. The Art of Assembly Language (II)

Lab 3. The Art of Assembly Language (II) Lab. The Art of Assembly Language (II) Dan Bruce, David Clark and Héctor D. Menéndez Department of Computer Science University College London October 2, 2017 License Creative Commons Share Alike Modified

More information

CS165 Computer Security. Understanding low-level program execution Oct 1 st, 2015

CS165 Computer Security. Understanding low-level program execution Oct 1 st, 2015 CS165 Computer Security Understanding low-level program execution Oct 1 st, 2015 A computer lets you make more mistakes faster than any invention in human history - with the possible exceptions of handguns

More information

6/20/2011. Introduction. Chapter Objectives Upon completion of this chapter, you will be able to:

6/20/2011. Introduction. Chapter Objectives Upon completion of this chapter, you will be able to: Introduction Efficient software development for the microprocessor requires a complete familiarity with the addressing modes employed by each instruction. This chapter explains the operation of the stack

More information

CS 31: Intro to Systems ISAs and Assembly. Kevin Webb Swarthmore College September 25, 2018

CS 31: Intro to Systems ISAs and Assembly. Kevin Webb Swarthmore College September 25, 2018 CS 31: Intro to Systems ISAs and Assembly Kevin Webb Swarthmore College September 25, 2018 Overview How to directly interact with hardware Instruction set architecture (ISA) Interface between programmer

More information

Assembly Language Each statement in an assembly language program consists of four parts or fields.

Assembly Language Each statement in an assembly language program consists of four parts or fields. Chapter 3: Addressing Modes Assembly Language Each statement in an assembly language program consists of four parts or fields. The leftmost field is called the label. - used to identify the name of a memory

More information

CS 31: Intro to Systems ISAs and Assembly. Kevin Webb Swarthmore College February 9, 2016

CS 31: Intro to Systems ISAs and Assembly. Kevin Webb Swarthmore College February 9, 2016 CS 31: Intro to Systems ISAs and Assembly Kevin Webb Swarthmore College February 9, 2016 Reading Quiz Overview How to directly interact with hardware Instruction set architecture (ISA) Interface between

More information

UMBC. A register, an immediate or a memory address holding the values on. Stores a symbolic name for the memory location that it represents.

UMBC. A register, an immediate or a memory address holding the values on. Stores a symbolic name for the memory location that it represents. Intel Assembly Format of an assembly instruction: LABEL OPCODE OPERANDS COMMENT DATA1 db 00001000b ;Define DATA1 as decimal 8 START: mov eax, ebx ;Copy ebx to eax LABEL: Stores a symbolic name for the

More information

Program Exploitation Intro

Program Exploitation Intro Program Exploitation Intro x86 Assembly 04//2018 Security 1 Univeristà Ca Foscari, Venezia What is Program Exploitation "Making a program do something unexpected and not planned" The right bugs can be

More information

The Microprocessor and its Architecture

The Microprocessor and its Architecture The Microprocessor and its Architecture Contents Internal architecture of the Microprocessor: The programmer s model, i.e. The registers model The processor model (organization) Real mode memory addressing

More information

16.317: Microprocessor Systems Design I Fall 2015

16.317: Microprocessor Systems Design I Fall 2015 16.317: Microprocessor Systems Design I Fall 2015 Exam 2 Solution 1. (16 points, 4 points per part) Multiple choice For each of the multiple choice questions below, clearly indicate your response by circling

More information

x86 Assembly Tutorial COS 318: Fall 2017

x86 Assembly Tutorial COS 318: Fall 2017 x86 Assembly Tutorial COS 318: Fall 2017 Project 1 Schedule Design Review: Monday 9/25 Sign up for 10-min slot from 3:00pm to 7:00pm Complete set up and answer posted questions (Official) Precept: Monday

More information

An Introduction to x86 ASM

An Introduction to x86 ASM An Introduction to x86 ASM Malware Analysis Seminar Meeting 1 Cody Cutler, Anton Burtsev Registers General purpose EAX, EBX, ECX, EDX ESI, EDI (index registers, but used as general in 32-bit protected

More information

Chapter 3: Addressing Modes

Chapter 3: Addressing Modes Chapter 3: Addressing Modes Chapter 3 Addressing Modes Note: Adapted from (Author Slides) Instructor: Prof. Dr. Khalid A. Darabkh 2 Introduction Efficient software development for the microprocessor requires

More information

Instruction Set Architectures

Instruction Set Architectures Instruction Set Architectures ISAs Brief history of processors and architectures C, assembly, machine code Assembly basics: registers, operands, move instructions 1 What should the HW/SW interface contain?

More information

16.317: Microprocessor Systems Design I Fall 2014

16.317: Microprocessor Systems Design I Fall 2014 16.317: Microprocessor Systems Design I Fall 2014 Exam 2 Solution 1. (16 points, 4 points per part) Multiple choice For each of the multiple choice questions below, clearly indicate your response by circling

More information

Basic Execution Environment

Basic Execution Environment Basic Execution Environment 3 CHAPTER 3 BASIC EXECUTION ENVIRONMENT This chapter describes the basic execution environment of an Intel Architecture processor as seen by assembly-language programmers.

More information

CMSC Lecture 03. UMBC, CMSC313, Richard Chang

CMSC Lecture 03. UMBC, CMSC313, Richard Chang CMSC Lecture 03 Moore s Law Evolution of the Pentium Chip IA-32 Basic Execution Environment IA-32 General Purpose Registers Hello World in Linux Assembly Language Addressing Modes UMBC, CMSC313, Richard

More information

SPRING TERM BM 310E MICROPROCESSORS LABORATORY PRELIMINARY STUDY

SPRING TERM BM 310E MICROPROCESSORS LABORATORY PRELIMINARY STUDY BACKGROUND 8086 CPU has 8 general purpose registers listed below: AX - the accumulator register (divided into AH / AL): 1. Generates shortest machine code 2. Arithmetic, logic and data transfer 3. One

More information

We can study computer architectures by starting with the basic building blocks. Adders, decoders, multiplexors, flip-flops, registers,...

We can study computer architectures by starting with the basic building blocks. Adders, decoders, multiplexors, flip-flops, registers,... COMPUTER ARCHITECTURE II: MICROPROCESSOR PROGRAMMING We can study computer architectures by starting with the basic building blocks Transistors and logic gates To build more complex circuits Adders, decoders,

More information

Instruction Set Architectures

Instruction Set Architectures Instruction Set Architectures! ISAs! Brief history of processors and architectures! C, assembly, machine code! Assembly basics: registers, operands, move instructions 1 What should the HW/SW interface

More information

System calls and assembler

System calls and assembler System calls and assembler Michal Sojka sojkam1@fel.cvut.cz ČVUT, FEL License: CC-BY-SA 4.0 System calls (repetition from lectures) A way for normal applications to invoke operating system (OS) kernel's

More information

EEM336 Microprocessors I. Addressing Modes

EEM336 Microprocessors I. Addressing Modes EEM336 Microprocessors I Addressing Modes Introduction Efficient software development for the microprocessor requires a complete familiarity with the addressing modes employed by each instruction. This

More information

Hardware and Software Architecture. Chapter 2

Hardware and Software Architecture. Chapter 2 Hardware and Software Architecture Chapter 2 1 Basic Components The x86 processor communicates with main memory and I/O devices via buses Data bus for transferring data Address bus for the address of a

More information

Advanced Microprocessors

Advanced Microprocessors Advanced Microprocessors Notes #2 Software Architecture & Instruction Set Architecture Part 1 EE 467/567 Winter 2012 by Avinash Kodi SWA.1 Background Materials Textbook: 2.1, 2.2, 3.1 Other: IA-32 Intel

More information

complement) Multiply Unsigned: MUL (all operands are nonnegative) AX = BH * AL IMUL BH IMUL CX (DX,AX) = CX * AX Arithmetic MUL DWORD PTR [0x10]

complement) Multiply Unsigned: MUL (all operands are nonnegative) AX = BH * AL IMUL BH IMUL CX (DX,AX) = CX * AX Arithmetic MUL DWORD PTR [0x10] The following pages contain references for use during the exam: tables containing the x86 instruction set (covered so far) and condition codes. You do not need to submit these pages when you finish your

More information

Reverse Engineering Low Level Software. CS5375 Software Reverse Engineering Dr. Jaime C. Acosta

Reverse Engineering Low Level Software. CS5375 Software Reverse Engineering Dr. Jaime C. Acosta 1 Reverse Engineering Low Level Software CS5375 Software Reverse Engineering Dr. Jaime C. Acosta Machine code 2 3 Machine code Assembly compile Machine Code disassemble 4 Machine code Assembly compile

More information

x86 assembly CS449 Fall 2017

x86 assembly CS449 Fall 2017 x86 assembly CS449 Fall 2017 x86 is a CISC CISC (Complex Instruction Set Computer) e.g. x86 Hundreds of (complex) instructions Only a handful of registers RISC (Reduced Instruction Set Computer) e.g. MIPS

More information

Marking Scheme. Examination Paper Department of CE. Module: Microprocessors (630313)

Marking Scheme. Examination Paper Department of CE. Module: Microprocessors (630313) Philadelphia University Faculty of Engineering Marking Scheme Examination Paper Department of CE Module: Microprocessors (630313) Final Exam Second Semester Date: 02/06/2018 Section 1 Weighting 40% of

More information

Inline Assembler. Willi-Hans Steeb and Yorick Hardy. International School for Scientific Computing

Inline Assembler. Willi-Hans Steeb and Yorick Hardy. International School for Scientific Computing Inline Assembler Willi-Hans Steeb and Yorick Hardy International School for Scientific Computing e-mail: steebwilli@gmail.com Abstract We provide a collection of inline assembler programs. 1 Using the

More information

Registers. Ray Seyfarth. September 8, Bit Intel Assembly Language c 2011 Ray Seyfarth

Registers. Ray Seyfarth. September 8, Bit Intel Assembly Language c 2011 Ray Seyfarth Registers Ray Seyfarth September 8, 2011 Outline 1 Register basics 2 Moving a constant into a register 3 Moving a value from memory into a register 4 Moving values from a register into memory 5 Moving

More information

Machine-level Representation of Programs. Jin-Soo Kim Computer Systems Laboratory Sungkyunkwan University

Machine-level Representation of Programs. Jin-Soo Kim Computer Systems Laboratory Sungkyunkwan University Machine-level Representation of Programs Jin-Soo Kim (jinsookim@skku.edu) Computer Systems Laboratory Sungkyunkwan University http://csl.skku.edu Program? 짬뽕라면 준비시간 :10 분, 조리시간 :10 분 재료라면 1개, 스프 1봉지, 오징어

More information

Stack -- Memory which holds register contents. Will keep the EIP of the next address after the call

Stack -- Memory which holds register contents. Will keep the EIP of the next address after the call Call without Parameter Value Transfer What are involved? ESP Stack Pointer Register Grows by 4 for EIP (return address) storage Stack -- Memory which holds register contents Will keep the EIP of the next

More information

Chapter 11. Addressing Modes

Chapter 11. Addressing Modes Chapter 11 Addressing Modes 1 2 Chapter 11 11 1 Register addressing mode is the most efficient addressing mode because the operands are in the processor itself (there is no need to access memory). Chapter

More information

Assembly I: Basic Operations. Jin-Soo Kim Computer Systems Laboratory Sungkyunkwan University

Assembly I: Basic Operations. Jin-Soo Kim Computer Systems Laboratory Sungkyunkwan University Assembly I: Basic Operations Jin-Soo Kim (jinsookim@skku.edu) Computer Systems Laboratory Sungkyunkwan University http://csl.skku.edu Basic Execution Environment RAX RBX RCX RDX RSI RDI RBP RSP R8 R9 R10

More information

Instruction Set Architecture (ISA) Data Types

Instruction Set Architecture (ISA) Data Types Instruction Set Architecture (ISA) Data Types Computer Systems: Section 4.1 Suppose you built a computer What Building Blocks would you use? Arithmetic Logic Unit (ALU) OP1 OP2 OPERATION ALU RES Full Adder

More information

Computer Architecture and Assembly Language. Practical Session 3

Computer Architecture and Assembly Language. Practical Session 3 Computer Architecture and Assembly Language Practical Session 3 Advanced Instructions division DIV r/m - unsigned integer division IDIV r/m - signed integer division Dividend Divisor Quotient Remainder

More information

administrivia today start assembly probably won t finish all these slides Assignment 4 due tomorrow any questions?

administrivia today start assembly probably won t finish all these slides Assignment 4 due tomorrow any questions? administrivia today start assembly probably won t finish all these slides Assignment 4 due tomorrow any questions? exam on Wednesday today s material not on the exam 1 Assembly Assembly is programming

More information

Binghamton University. CS-220 Spring x86 Assembler. Computer Systems: Sections

Binghamton University. CS-220 Spring x86 Assembler. Computer Systems: Sections x86 Assembler Computer Systems: Sections 3.1-3.5 Disclaimer I am not an x86 assembler expert. I have never written an x86 assembler program. (I am proficient in IBM S/360 Assembler and LC3 Assembler.)

More information

COMPUTER ENGINEERING DEPARTMENT

COMPUTER ENGINEERING DEPARTMENT Page 1 of 11 COMPUTER ENGINEERING DEPARTMENT December 31, 2007 COE 205 COMPUTER ORGANIZATION & ASSEMBLY PROGRAMMING Major Exam II First Semester (071) Time: 7:00 PM-9:30 PM Student Name : KEY Student ID.

More information

CSE2421 FINAL EXAM SPRING Name KEY. Instructions: Signature

CSE2421 FINAL EXAM SPRING Name KEY. Instructions: Signature CSE2421 FINAL EXAM SPRING 2013 Name KEY Instructions: This is a closed-book, closed-notes, closed-neighbor exam. Only a writing utensil is needed for this exam. No calculators allowed. If you need to go

More information

Lab 2: Introduction to Assembly Language Programming

Lab 2: Introduction to Assembly Language Programming COE 205 Lab Manual Lab 2: Introduction to Assembly Language Programming - page 16 Lab 2: Introduction to Assembly Language Programming Contents 2.1. Intel IA-32 Processor Architecture 2.2. Basic Program

More information

Instruction Set Architectures

Instruction Set Architectures Instruction Set Architectures Computer Systems: Section 4.1 Suppose you built a computer What Building Blocks would you use? Arithmetic Logic Unit (ALU) OP1 OP2 OPERATION ALU RES ALU + Registers R0: 0x0000

More information

Week /8086 Microprocessor Programming I

Week /8086 Microprocessor Programming I Week 4 8088/8086 Microprocessor Programming I Example. The PC Typewriter Write an 80x86 program to input keystrokes from the PC s keyboard and display the characters on the system monitor. Pressing any

More information

Winter Compiler Construction T11 Activation records + Introduction to x86 assembly. Today. Tips for PA4. Today:

Winter Compiler Construction T11 Activation records + Introduction to x86 assembly. Today. Tips for PA4. Today: Winter 2006-2007 Compiler Construction T11 Activation records + Introduction to x86 assembly Mooly Sagiv and Roman Manevich School of Computer Science Tel-Aviv University Today ic IC Language Lexical Analysis

More information

Introduction to Reverse Engineering. Alan Padilla, Ricardo Alanis, Stephen Ballenger, Luke Castro, Jake Rawlins

Introduction to Reverse Engineering. Alan Padilla, Ricardo Alanis, Stephen Ballenger, Luke Castro, Jake Rawlins Introduction to Reverse Engineering Alan Padilla, Ricardo Alanis, Stephen Ballenger, Luke Castro, Jake Rawlins Reverse Engineering (of Software) What is it? What is it for? Binary exploitation (the cool

More information

CS24: INTRODUCTION TO COMPUTING SYSTEMS. Spring 2018 Lecture 4

CS24: INTRODUCTION TO COMPUTING SYSTEMS. Spring 2018 Lecture 4 CS24: INTRODUCTION TO COMPUTING SYSTEMS Spring 2018 Lecture 4 LAST TIME Enhanced our processor design in several ways Added branching support Allows programs where work is proportional to the input values

More information

Using MMX Instructions to Perform Simple Vector Operations

Using MMX Instructions to Perform Simple Vector Operations Using MMX Instructions to Perform Simple Vector Operations Information for Developers and ISVs From Intel Developer Services www.intel.com/ids Information in this document is provided in connection with

More information

EECE.3170: Microprocessor Systems Design I Summer 2017 Homework 4 Solution

EECE.3170: Microprocessor Systems Design I Summer 2017 Homework 4 Solution 1. (40 points) Write the following subroutine in x86 assembly: Recall that: int f(int v1, int v2, int v3) { int x = v1 + v2; urn (x + v3) * (x v3); Subroutine arguments are passed on the stack, and can

More information

W4118: PC Hardware and x86. Junfeng Yang

W4118: PC Hardware and x86. Junfeng Yang W4118: PC Hardware and x86 Junfeng Yang A PC How to make it do something useful? 2 Outline PC organization x86 instruction set gcc calling conventions PC emulation 3 PC board 4 PC organization One or more

More information

CS241 Computer Organization Spring Introduction to Assembly

CS241 Computer Organization Spring Introduction to Assembly CS241 Computer Organization Spring 2015 Introduction to Assembly 2-05 2015 Outline! Rounding floats: round-to-even! Introduction to Assembly (IA32) move instruction (mov) memory address computation arithmetic

More information

CSE P 501 Compilers. x86 Lite for Compiler Writers Hal Perkins Autumn /25/ Hal Perkins & UW CSE J-1

CSE P 501 Compilers. x86 Lite for Compiler Writers Hal Perkins Autumn /25/ Hal Perkins & UW CSE J-1 CSE P 501 Compilers x86 Lite for Compiler Writers Hal Perkins Autumn 2011 10/25/2011 2002-11 Hal Perkins & UW CSE J-1 Agenda Learn/review x86 architecture Core 32-bit part only for now Ignore crufty, backward-compatible

More information

CSE351 Spring 2018, Midterm Exam April 27, 2018

CSE351 Spring 2018, Midterm Exam April 27, 2018 CSE351 Spring 2018, Midterm Exam April 27, 2018 Please do not turn the page until 11:30. Last Name: First Name: Student ID Number: Name of person to your left: Name of person to your right: Signature indicating:

More information

IA-32 Architecture. CS 4440/7440 Malware Analysis and Defense

IA-32 Architecture. CS 4440/7440 Malware Analysis and Defense IA-32 Architecture CS 4440/7440 Malware Analysis and Defense Intel x86 Architecture } Security professionals constantly analyze assembly language code } Many exploits are written in assembly } Source code

More information

Islamic University Gaza Engineering Faculty Department of Computer Engineering ECOM 2125: Assembly Language LAB. Lab # 7. Procedures and the Stack

Islamic University Gaza Engineering Faculty Department of Computer Engineering ECOM 2125: Assembly Language LAB. Lab # 7. Procedures and the Stack Islamic University Gaza Engineering Faculty Department of Computer Engineering ECOM 2125: Assembly Language LAB Lab # 7 Procedures and the Stack April, 2014 1 Assembly Language LAB Runtime Stack and Stack

More information

Lecture (02) The Microprocessor and Its Architecture By: Dr. Ahmed ElShafee

Lecture (02) The Microprocessor and Its Architecture By: Dr. Ahmed ElShafee Lecture (02) The Microprocessor and Its Architecture By: Dr. Ahmed ElShafee ١ INTERNAL MICROPROCESSOR ARCHITECTURE Before a program is written or instruction investigated, internal configuration of the

More information

Assembly Language Lab # 9

Assembly Language Lab # 9 Faculty of Engineering Computer Engineering Department Islamic University of Gaza 2011 Assembly Language Lab # 9 Stacks and Subroutines Eng. Doaa Abu Jabal Assembly Language Lab # 9 Stacks and Subroutines

More information

Assembly level Programming. 198:211 Computer Architecture. (recall) Von Neumann Architecture. Simplified hardware view. Lecture 10 Fall 2012

Assembly level Programming. 198:211 Computer Architecture. (recall) Von Neumann Architecture. Simplified hardware view. Lecture 10 Fall 2012 19:211 Computer Architecture Lecture 10 Fall 20 Topics:Chapter 3 Assembly Language 3.2 Register Transfer 3. ALU 3.5 Assembly level Programming We are now familiar with high level programming languages

More information

Assembler Programming. Lecture 2

Assembler Programming. Lecture 2 Assembler Programming Lecture 2 Lecture 2 8086 family architecture. From 8086 to Pentium4. Registers, flags, memory organization. Logical, physical, effective address. Addressing modes. Processor Processor

More information

16.317: Microprocessor Systems Design I Spring 2015

16.317: Microprocessor Systems Design I Spring 2015 16.317: Microprocessor Systems Design I Spring 2015 Exam 2 Solution 1. (16 points, 4 points per part) Multiple choice For each of the multiple choice questions below, clearly indicate your response by

More information

The x86 Architecture. ICS312 - Spring 2018 Machine-Level and Systems Programming. Henri Casanova

The x86 Architecture. ICS312 - Spring 2018 Machine-Level and Systems Programming. Henri Casanova The x86 Architecture ICS312 - Spring 2018 Machine-Level and Systems Programming Henri Casanova (henric@hawaii.edu) The 80x86 Architecture! To learn assembly programming we need to pick a processor family

More information

Assembly Language for Intel-Based Computers, 4 th Edition. Chapter 2: IA-32 Processor Architecture Included elements of the IA-64 bit

Assembly Language for Intel-Based Computers, 4 th Edition. Chapter 2: IA-32 Processor Architecture Included elements of the IA-64 bit Assembly Language for Intel-Based Computers, 4 th Edition Kip R. Irvine Chapter 2: IA-32 Processor Architecture Included elements of the IA-64 bit Slides prepared by Kip R. Irvine Revision date: 09/25/2002

More information

Turning C into Object Code Code in files p1.c p2.c Compile with command: gcc -O p1.c p2.c -o p Use optimizations (-O) Put resulting binary in file p

Turning C into Object Code Code in files p1.c p2.c Compile with command: gcc -O p1.c p2.c -o p Use optimizations (-O) Put resulting binary in file p Turning C into Object Code Code in files p1.c p2.c Compile with command: gcc -O p1.c p2.c -o p Use optimizations (-O) Put resulting binary in file p text C program (p1.c p2.c) Compiler (gcc -S) text Asm

More information

22 Assembly Language for Intel-Based Computers, 4th Edition. 3. Each edge is a transition from one state to another, caused by some input.

22 Assembly Language for Intel-Based Computers, 4th Edition. 3. Each edge is a transition from one state to another, caused by some input. 22 Assembly Language for Intel-Based Computers, 4th Edition 6.6 Application: Finite-State Machines 1. A directed graph (also known as a diagraph). 2. Each node is a state. 3. Each edge is a transition

More information

The IA-32 Stack and Function Calls. CS4379/5375 Software Reverse Engineering Dr. Jaime C. Acosta

The IA-32 Stack and Function Calls. CS4379/5375 Software Reverse Engineering Dr. Jaime C. Acosta 1 The IA-32 Stack and Function Calls CS4379/5375 Software Reverse Engineering Dr. Jaime C. Acosta 2 Important Registers used with the Stack EIP: ESP: EBP: 3 Important Registers used with the Stack EIP:

More information

Interfacing Compiler and Hardware. Computer Systems Architecture. Processor Types And Instruction Sets. What Instructions Should A Processor Offer?

Interfacing Compiler and Hardware. Computer Systems Architecture. Processor Types And Instruction Sets. What Instructions Should A Processor Offer? Interfacing Compiler and Hardware Computer Systems Architecture FORTRAN 90 program C++ program Processor Types And Sets FORTRAN 90 Compiler C++ Compiler set level Hardware 1 2 What s Should A Processor

More information

1. Introduction to Assembly Language

1. Introduction to Assembly Language www.vchowk.com 1. Introduction to Assembly Language Solved EXERCISE 1 Note: Dear fellows I tried my best to solve this exercise questions if there s any mistake or doubt in any question correct it and

More information

Credits and Disclaimers

Credits and Disclaimers Credits and Disclaimers 1 The examples and discussion in the following slides have been adapted from a variety of sources, including: Chapter 3 of Computer Systems 2 nd Edition by Bryant and O'Hallaron

More information

CMSC 313 COMPUTER ORGANIZATION & ASSEMBLY LANGUAGE PROGRAMMING LECTURE 03, SPRING 2013

CMSC 313 COMPUTER ORGANIZATION & ASSEMBLY LANGUAGE PROGRAMMING LECTURE 03, SPRING 2013 CMSC 313 COMPUTER ORGANIZATION & ASSEMBLY LANGUAGE PROGRAMMING LECTURE 03, SPRING 2013 TOPICS TODAY Moore s Law Evolution of Intel CPUs IA-32 Basic Execution Environment IA-32 General Purpose Registers

More information

SYSC3601 Microprocessor Systems. Unit 2: The Intel 8086 Architecture and Programming Model

SYSC3601 Microprocessor Systems. Unit 2: The Intel 8086 Architecture and Programming Model SYSC3601 Microprocessor Systems Unit 2: The Intel 8086 Architecture and Programming Model Topics/Reading SYSC3601 2 Microprocessor Systems 1. Registers and internal architecture (Ch 2) 2. Address generation

More information

CSCE 212H, Spring 2008 Lab Assignment 3: Assembly Language Assigned: Feb. 7, Due: Feb. 14, 11:59PM

CSCE 212H, Spring 2008 Lab Assignment 3: Assembly Language Assigned: Feb. 7, Due: Feb. 14, 11:59PM CSCE 212H, Spring 2008 Lab Assignment 3: Assembly Language Assigned: Feb. 7, Due: Feb. 14, 11:59PM February 7, 2008 1 Overview The purpose of this assignment is to introduce you to the assembly language

More information

Ethical Hacking. Assembly Language Tutorial

Ethical Hacking. Assembly Language Tutorial Ethical Hacking Assembly Language Tutorial Number Systems Memory in a computer consists of numbers Computer memory does not store these numbers in decimal (base 10) Because it greatly simplifies the hardware,

More information

Machine and Assembly Language Principles

Machine and Assembly Language Principles Machine and Assembly Language Principles Assembly language instruction is synonymous with a machine instruction. Therefore, need to understand machine instructions and on what they operate - the architecture.

More information

Proposed Common Configuration Method

Proposed Common Configuration Method Proposed Common Configuration Method July 9, 1991 The Common Configuration Method (CCM) simplifies configuration of disks and other storage devices. This definition includes a Standard AT Compatible Register

More information

CS499. Intel Architecture

CS499. Intel Architecture CS499 Intel Architecture Intel Architecture References IA-32 Intel Architecture Software Developer s Manual, Volume 1: Basic Architecture Volume 2: Instruction Set Reference www.intel.com/design/pentiumii/manuals/

More information

x86 Programming I CSE 351 Winter

x86 Programming I CSE 351 Winter x86 Programming I CSE 351 Winter 2017 http://xkcd.com/409/ Administrivia Lab 2 released! Da bomb! Go to section! No Luis OH Later this week 2 Roadmap C: car *c = malloc(sizeof(car)); c->miles = 100; c->gals

More information

Q1: Multiple choice / 20 Q2: Memory addressing / 40 Q3: Assembly language / 40 TOTAL SCORE / 100

Q1: Multiple choice / 20 Q2: Memory addressing / 40 Q3: Assembly language / 40 TOTAL SCORE / 100 16.317: Microprocessor-Based Systems I Summer 2012 Exam 1 July 20, 2012 Name: ID #: For this exam, you may use a calculator and one 8.5 x 11 double-sided page of notes. All other electronic devices (e.g.,

More information