Introduc)on to x86 Architecture

Transcription

1 Introduc)on to x86 Architecture

2 Objec)ves Introduce students to fundamental aspects of the x86 architecture Develop understanding of common x86 assembly instruc)ons 8/28/2015 2

3 Credit Many of these slides have been taken/ adapted from the Open Security Training Courses. hjp://opensecuritytraining.info/training.html They are licensed under a Crea)ve Commons License: hjp://crea)vecommons.org/licenses/by- sa/3.0 Students interested in this area are encouraged to u)lize this resource 8/28/2015 3

4 What you're going to learn #include <stdio.h> int main(){ prinx( Hello World!\n ); return 0x1234; } 8/28/2015 4

5 Is the same as.text: main.text: push ebp.text: mov ebp, esp.text: push offset ahelloworld ; "Hello world!\n".text: call ds:printf.text: e add esp, 4.text: mov eax, 1234h.text: pop ebp.text: retn Windows Visual C , Optimizations Disabled 8/28/2015 Disassembled with IDA Pro 5.0 Free Version 5

6 With op)miza)ons.text: main.text: push offset ahelloworld ; "Hello World!\n".text: call ds:printf.text: b pop ecx.text: c mov eax, 1234h.text: retn Windows Visual C , Optimizations Enabled Disassembled with IDA Pro 5.0 Free Version 8/28/2015 6

7 Refresher - Data Types double/long long?-> long double? int/long In C: char short 8/28/2015 7

8 Refresher - Alt. Radices Decimal, Binary, Hexidecimal Learn This! Decimal (base 10) Binary (base 2) Hex (base 16) b 0x b 0x b 0x b 0x b 0x b 0x b 0x b 0x b 0x b 0x b 0x0A b 0x0B b 0x0C b 0x0D b 0x0E 15 8/28/ b 0x0F 8

9 Architecture - CISC vs. RISC Intel is CISC - Complex Instruc)on Set Computer Many very special purpose instruc)ons that you will never see, and a given compiler may never use - just need to know how to use the manual Variable- length instruc)ons, between 1 and 16(?) bytes long. 16 is max len in theory, I don't know if it can happen in prac)ce Other major architectures are typically RISC - Reduced Instruc)on Set Computer Typically more registers, less and fixed- size instruc)ons Examples: PowerPC, ARM, SPARC, MIPS 8/28/2015 9

10 Architecture - Endian Endianness comes from Jonathan Swil's Gulliver's Travels. It doesn't majer which way you eat your eggs :) LiJle Endian - 0x stored in RAM lijle end first. The least significant byte of a word or larger is stored in the lowest address. E.g. 0x Intel is LiJle Endian Big Endian - 0x stored as is. Network traffic is Big Endian Most everyone else you've heard of (PowerPC, ARM, SPARC, MIPS) is either Big Endian by default or can be configured as either (Bi- Endian) 8/28/

11 Architecture - Registers Registers are small memory storage areas built into the processor (s)ll vola)le memory) 8 general purpose registers + the instruc)on pointer which points at the next instruc)on to execute But two of the 8 are not that general On x86-32, registers are 32 bits long On x86-64, they're 64 bits 8/28/ Book p. 25

12 Architecture - Register Conven)ons 1 These are Intel's suggestions to compiler developers (and assembly handcoders). Registers don't have to be used these ways, but if you see them being used like this, you'll know why. But I simplified some descriptions. I also color coded as GREEN for the ones which we will actually see in this class (as opposed to future ones), and RED for not. EAX - Stores function return values EBX - Base pointer to the data section ECX - Counter for string and loop operations EDX - I/O pointer Intel 8/28/2015 Arch v1 Section General-Purpose Registers 12

13 Architecture - Registers Conven)ons 2 ESI - Source pointer for string operations EDI - Destination pointer for string operations ESP - Stack pointer EBP - Stack frame base pointer EIP - Pointer to next instruction to execute ( instruction pointer ) 8/28/

14 Architecture - Registers Conven)ons 3 Caller- save registers - eax, edx, ecx If the caller has anything in the registers that it cares about, the caller is in charge of saving the value before a call to a subrou)ne, and restoring the value aler the call returns Put another way - the callee can (and is highly likely to) modify values in caller- save registers Callee- save registers - ebp, ebx, esi, edi If the callee needs to use more registers than are saved by the caller, the callee is responsible for making sure the values are stored/ restored Put another way - the callee must be a good ci)zen and not modify registers which the caller didn't save, unless the callee itself saves and restores the exis)ng values 8/28/

15 Architecture - Registers - 8/16/32 bit addressing 1 8/28/

16 Architecture - Registers - 8/16/32 bit addressing 2 8/28/

17 Architecture - EFLAGS EFLAGS register holds many single bit flags. Will only ask you to remember the following for now. Zero Flag (ZF) - Set if the result of some instruction is zero; cleared otherwise. Sign Flag (SF) - Set equal to the most-significant bit of the result, which is the sign bit of a signed integer. (0 indicates a positive value and 1 indicates a negative value.) Intel Vol 1 Sec page /28/

18 The Stack The stack is a conceptual area of main memory (RAM) which is designated by the OS when a program is started. Different OS start it at different addresses by conven)on A stack is a Last- In- First- Out (LIFO/FILO) data structure where data is "pushed" on to the top of the stack and "popped" off the top. By conven)on the stack grows toward lower memory addresses. Adding something to the stack means the top of the stack is now at a lower memory address. 8/28/

19 The Stack 2 As already men)oned, esp points to the top of the stack, the lowest address which is being used While data will exist at addresses beyond the top of the stack, it is considered ined The stack keeps track of which func)ons were called before the current one, it holds local variables and is frequently used to pass arguments to the next func)on to be called. A firm understanding of what is happening on the stack is *essen$al* to understanding a program's opera)on. 8/28/

20 2 PUSH - Push Word, Doubleword or Quadword onto the Stack For our purposes, it will always be a DWORD (4 bytes). Can either be an immediate (a numeric constant), or the value in a register The push instruction automatically decrements the stack pointer, esp, by 4. 8/28/

21 Registers Before eax 0x esp 0x0012FF8C push eax Registers After eax 0x esp 0x0012FF88 Stack Before Stack After 0x0012FF90 0x x esp 0x0012FF8C 0x x x0012FF88 esp 0x x0012FF84 0x0012FF80 8/28/

22 3 POP- Pop a Value from the Stack Take a DWORD off the stack, put it in a register, and increment esp by 4 8/28/

23 Registers Before eax 0xFFFFFFFF esp 0x0012FF88 pop eax Stack Before Registers After eax 0x esp 0x0012FF8C Stack After 0x0012FF90 0x x x0012FF8C 0x esp 0x esp 0x0012FF88 0x (0x ) 0x0012FF84 0x0012FF80 8/28/

24 Exercise 1 8/28/

25 Calling Conven)ons How code calls a subrou)ne is compiler- dependent and configurable. But there are a few conven)ons. We will only deal with the cdecl and stdcall conven)ons. More info at hjp://en.wikipedia.org/wiki/x86_calling_conven)ons hjp:// conven)ons 8/28/

26 Calling Conven)ons - cdecl C declara)on - most common calling conven)on Func)on parameters pushed onto stack right to lel Saves the old stack frame pointer and sets up a new stack frame eax or edx:eax returns the result for primi)ve data types Caller is responsible for cleaning up the stack 8/28/

27 Calling Conven)ons - stdcall I typically only see this conven)on used by Microsol C++ code - e.g. Win32 API Func)on parameters pushed onto stack right to lel Saves the old stack frame pointer and sets up a new stack frame eax or edx:eax returns the result for primi)ve data types Callee responsible for cleaning up any stack parameters it takes 8/28/

28 4 CALL - Call Procedure CALL's job is to transfer control to a different func)on, in a way that control can later be resumed where it lel off First it pushes the address of the next instruc)on onto the stack For use by RET for when the procedure is done Then it changes eip to the address given in the instruc)on Des)na)on address can be specified in mul)ple ways Absolute address Rela)ve address (rela)ve to the end of the instruc)on) 8/28/ Book p. 132

29 5 RET - Return from Procedure Two forms Pop the top of the stack into eip (remember pop increments stack pointer) In this form, the instruc)on is just wrijen as ret Typically used by cdecl func)ons Pop the top of the stack into eip and add a constant number of bytes to esp In this form, the instruc)on is wrijen as ret 0x8, or ret 0x20, etc Typically used by stdcall func)ons 8/28/

30 6 MOV - Move Can move: register to register memory to register, register to memory immediate to register, immediate to memory Never memory to memory! Memory addresses are given in r/m32 form talked about later 8/28/

31 7 8 ADD and SUB Adds or Subtracts, just as expected Des)na)on operand can be r/m32 or register Source operand can be r/m32 or register or immediate No source and des)na)on as r/m32s, because that could allow for memory to memory transfer, which isn't allowed on x86 Evaluates the opera)on as if it were on signed AND unsigned data, and sets flags as appropriate. Instruc)ons modify OF, SF, ZF, AF, PF, and CF flags add esp, 8 sub eax, [ebx*2] 8/28/ Add p. 202, Sub p. 210

32 General Stack Frame Opera)on We are going to pretend that main() is the very first function being executed in a program. This is what its stack looks like to start with (assuming it has any local variables). Local Variables stack bottom main() frame stack top 8/28/

33 General Stack Frame Opera)on 2 When main() decides to call a subroutine, main() becomes the caller. We will assume main() has some registers it would like to remain the same, so it will save them. We will also assume that the callee function takes some input arguments. Local Variables Caller-Save Registers Arguments to Pass to Callee stack bottom main() frame stack top 8/28/

34 General Stack Frame Opera)on 3 When main() actually issues the CALL instruction, the return address gets saved onto the stack, and because the next instruction after the call will be the beginning of the called function, we consider the frame to have changed to the callee. Local Variables Caller-Save Registers Arguments to Pass to Callee Caller's saved return address stack bottom main() frame stack top 8/28/

35 General Stack Frame Opera)on 4 When foo() starts, the frame pointer (ebp) still points to main()'s frame. So the first thing it does is to save the old frame pointer on the stack and set the new value to point to its own frame. Local Variables Caller-Save Registers Arguments to Pass to Callee Caller's saved return address Saved Frame Pointer stack bottom main() frame foo()'s frame stack top 8/28/

36 General Stack Frame Opera)on 5 Next, we'll assume the the callee foo() would like to use all the registers, and must therefore save the callee-save registers. Then it will allocate space for its local variables. Local Variables Caller-Save Registers Arguments to Pass to Callee Caller's saved return address Saved Frame Pointer Callee-Save Registers stack bottom main() frame foo()'s frame stack top Local Variables 8/28/

37 General Stack Frame Opera)on 6 At this point, foo() decides it wants to call bar(). It is still the callee-ofmain(), but it will now be the caller-of-bar. So it saves any caller-save registers that it needs to. It then puts the function arguments on the stack as well. Saved Frame Pointer Callee-Save Registers Local Variables Caller-Save Registers Arguments to Pass to Callee stack bottom main() frame foo()'s frame stack top 8/28/

38 General Stack Frame Layout Every part of the stack frame is technically optional (that is, you can hand code asm without following the conventions.) But compilers generate code which uses portions if they are needed. Which pieces are used can sometimes be manipulated with compiler options. (E.g. omit frame pointers, changing calling convention to pass arguments in registers, etc.) Saved Frame Pointer Callee-Save Registers Local Variables Caller-Save Registers Arguments to Pass to Callee stack bottom main() frame foo()'s frame stack top 8/28/

39 Stack Frames are a Linked List! The ebp in the current frame points at the saved ebp of the previous frame. stack bottom main() frame foo()'s frame bar()'s frame stack top 8/28/

40 Example1.c The stack frames in this example will be very simple. Only saved frame pointer (ebp) and saved return addresses (eip). //Example1 - using the stack //to call subrou)nes //New instruc)ons: //push, pop, call, ret, mov int sub(){ return 0xbeef; } int main(){ sub(); return 0xf00d; } sub: push ebp mov ebp,esp mov eax,0beefh pop ebp ret main: push ebp mov ebp,esp call sub (401000h) mov eax,0f00dh D pop E ret ebp 8/28/

41 eax ebp esp Example1.c 1: EIP = , but no instruc)on yet executed 0x003435C0 z 0x0012FFB8 z 0x0012FF6C z Key: x executed instruction, c modified value z start value sub: push ebp mov ebp,esp mov eax,0beefh pop ebp ret main: push ebp mov ebp,esp call sub (401000h) mov eax,0f00dh Belongs to the frame *before* main() is called 0x0012FF6C 0x0012FF68 0x0012FF64 0x0012FF60 0x0012FF5C 0x0012FF58 0x004012E8 z D pop ebp E ret 8/28/

42 Example1.c 2 eax ebp esp 0x003435C0 z 0x0012FFB8 z 0x0012FF68 c Key: x executed instruction, c modified value z start value sub: push ebp mov ebp,esp mov eax,0beefh pop ebp ret main: push ebp x mov ebp,esp call sub (401000h) mov eax,0f00dh 0x0012FF6C 0x0012FF68 0x0012FF64 0x0012FF60 0x0012FF5C 0x0012FF58 0x004012E8 z 0x0012FFB8 c D pop ebp E ret 8/28/

43 Example1.c 3 eax ebp esp 0x003435C0 z 0x0012FF68 c 0x0012FF68 Key: x executed instruction, c modified value z start value sub: push ebp mov ebp,esp mov eax,0beefh pop ebp ret main: push ebp mov ebp,esp x call sub (401000h) mov eax,0f00dh 0x0012FF6C 0x0012FF68 0x0012FF64 0x0012FF60 0x0012FF5C 0x0012FF58 0x004012E8 z 0x0012FFB D pop ebp E ret 8/28/

44 Example1.c 4 eax ebp esp 0x003435C0 z 0x0012FF68 0x0012FF64 c Key: x executed instruction, c modified value z start value sub: push ebp mov ebp,esp mov eax,0beefh pop ebp ret main: push ebp mov ebp,esp call sub (401000h) x mov eax,0f00dh 0x0012FF6C 0x0012FF68 0x0012FF64 0x0012FF60 0x0012FF5C 0x0012FF58 0x004012E8 z 0x0012FFB8 0x c D pop ebp E ret 8/28/

45 Example1.c 5 eax ebp esp 0x003435C0 z 0x0012FF68 0x0012FF60 c Key: x executed instruction, c modified value z start value sub: push ebp x mov ebp,esp mov eax,0beefh pop ebp ret main: push ebp mov ebp,esp call sub (401000h) mov eax,0f00dh D pop E ret ebp 0x0012FF6C 0x0012FF68 0x0012FF64 0x0012FF60 0x0012FF5C 0x0012FF58 0x004012E8 z 0x0012FFB8 0x x0012FF68 c 8/28/

46 Example1.c 6 eax ebp esp 0x003435C0 z 0x0012FF60 c 0x0012FF60 Key: x executed instruction, c modified value z start value sub: push ebp mov ebp,esp x mov eax,0beefh pop ebp ret main: push ebp mov ebp,esp call sub (401000h) mov eax,0f00dh D pop E ret ebp 0x0012FF6C 0x0012FF68 0x0012FF64 0x0012FF60 0x0012FF5C 0x0012FF58 0x004012E8 z 0x0012FFB8 0x x0012FF68 8/28/

47 Example1.c 6 STACK FRAME TIME OUT sub push mov mov pop retn main push mov call mov pop retn ebp ebp, esp eax, 0BEEFh ebp ebp ebp, esp _sub eax, 0F00Dh ebp Function-beforemain 's frame main's frame (saved frame pointer and saved return address) sub's frame (only saved frame pointer, because it doesn't call anything else, and doesn't have local variables) 0x0012FF6C 0x0012FF68 0x0012FF64 0x0012FF60 0x0012FF5C 0x0012FF58 0x004012E8 z 0x0012FFB8 0x x0012FF68 8/28/

48 Example1.c 7 eax ebp esp 0x0000BEEF 0x0012FF60 0x0012FF60 Key: x executed instruction, c modified value z start value sub: push ebp mov ebp,esp mov eax,0beefh x pop ebp ret main: push ebp mov ebp,esp call sub (401000h) mov eax,0f00dh D pop ebp E ret 0x0012FF6C 0x0012FF68 0x0012FF64 0x0012FF60 0x0012FF5C 0x0012FF58 0x004012E8 z 0x0012FFB8 0x x0012FF68 8/28/

49 Example1.c 8 eax ebp esp 0x0000BEEF 0x0012FF68 c 0x0012FF64 c Key: x executed instruction, c modified value z start value sub: push ebp mov ebp,esp mov eax,0beefh pop ebp x ret main: push ebp mov ebp,esp call sub (401000h) mov eax,0f00dh D pop ebp E ret 0x0012FF6C 0x0012FF68 0x0012FF64 0x0012FF60 0x0012FF5C 0x0012FF58 0x004012E8 z 0x0012FFB8 0x c 8/28/

50 Example1.c 9 eax ebp esp 0x0000BEEF 0x0012FF68 0x0012FF68 c Key: x executed instruction, c modified value z start value sub: push ebp mov ebp,esp mov eax,0beefh pop ebp ret x main: push ebp mov ebp,esp call sub (401000h) mov eax,0f00dh D pop ebp E ret 0x0012FF6C 0x0012FF68 0x0012FF64 0x0012FF60 0x0012FF5C 0x0012FF58 0x004012E8 z 0x0012FFB8 c 8/28/

51 Example1.c 9 eax ebp esp 0x0000F00D c 0x0012FF68 0x0012FF68 Key: x executed instruction, c modified value z start value sub: push ebp mov ebp,esp mov eax,0beefh pop ebp ret main: push ebp mov ebp,esp call sub (401000h) mov eax,0f00dh x D pop ebp E ret 0x0012FF6C 0x0012FF68 0x0012FF64 0x0012FF60 0x0012FF5C 0x0012FF58 0x004012E8 z 0x0012FFB8 8/28/

52 Example1.c 10 eax ebp esp 0x0000F00D 0x0012FFB8 c 0x0012FF6C c Key: x executed instruction, c modified value z start value sub: push ebp mov ebp,esp mov eax,0beefh pop ebp ret main: push ebp mov ebp,esp call sub (401000h) mov eax,0f00dh D pop ebp x E ret 0x0012FF6C 0x0012FF68 0x0012FF64 0x0012FF60 0x0012FF5C 0x0012FF58 0x004012E8 z c 8/28/

53 Example1.c 11 eax ebp esp 0x0000F00D 0x0012FFB8 0x0012FF70 c Key: x executed instruction, c modified value z start value sub: push ebp mov ebp,esp mov eax,0beefh pop ebp ret main: push ebp mov ebp,esp call sub (401000h) mov eax,0f00dh D pop ebp E ret x 0x0012FF6C 0x0012FF68 0x0012FF64 0x0012FF60 0x0012FF5C 0x0012FF58 c Execution would continue at the value ret 8/28/2015 removed from the stack: 0x004012E8 53

54 Example1 Notes sub() is deadcode - its return value is not used for anything, and main always returns 0xF00D. If op)miza)ons are turned on in the compiler, it would remove sub() Because there are no input parameters to sub(), there is no difference whether we compile as cdecl vs stdcall calling conven)ons 8/28/

55 Example2.c with Input parameters and Local Variables #include <stdlib.h> int sub(int x, int y){ return 2*x+y; } int main(int argc, char ** argv){ int a; a = atoi(argv[1]); return sub(argc,a); }.text: _sub: push ebp.text: mov ebp, esp.text: mov eax, [ebp+8].text: mov ecx, [ebp+0ch].text: lea eax, [ecx+eax*2].text: c pop ebp.text: d retn.text: _main: push ebp.text: mov ebp, esp.text: push ecx.text: mov eax, [ebp+0ch].text: mov ecx, [eax+4].text: a push ecx.text: b call dword ptr ds: imp atoi.text: add esp, 4.text: mov [ebp-4], eax.text: mov edx, [ebp-4].text: a push edx.text: b mov eax, [ebp+8].text: e push eax.text: f call _sub.text: add esp, 8.text: mov esp, ebp.text: pop ebp.text: a retn 8/28/

56 "r/m32" Addressing Forms Anywhere you see an r/m32 it means it could be taking a value either from a register, or a memory address. I'm just calling these r/m32 forms because anywhere you see r/ m32 in the manual, the instruc)on can be a varia)on of the below forms. In Intel syntax, most of the )me square brackets [] means to treat the value within as a memory address, and fetch the value at that address (like dereferencing a pointer) mov eax, ebx mov eax, [ebx] mov eax, [ebx+ecx*x] (X=1, 2, 4, 8) mov eax, [ebx+ecx*x+y] (Y= one byte, or 4 bytes, 0-2^32-1) Most complicated form is: [base + index*scale + disp] 8/28/2015 More info: Intel v2a, Section page in particular Tables 2-2 and 2-3

57 9 LEA - Load Effec)ve Address Frequently used with pointer arithme)c, some)mes for just arithme)c in general Uses the r/m32 form but is the excep$on to the rule that the square brackets [ ] syntax means dereference ( value at ) Example: ebx = 0x2, edx = 0x1000 lea eax, [edx+ebx*2] eax = 0x1004, not the value at 0x1004 8/28/

58 Example2.c - 1.text: _sub: push ebp.text: mov ebp, esp.text: mov eax, [ebp+8].text: mov ecx, [ebp+0ch].text: lea eax, [ecx+eax*2].text: c pop ebp.text: d retn.text: _main: push ebp x.text: mov ebp, esp.text: push ecx.text: mov eax, [ebp+0ch].text: mov ecx, [eax+4].text: a push ecx.text: b call dword ptr ds: imp atoi.text: add esp, 4.text: mov [ebp-4], eax.text: mov edx, [ebp-4].text: a push edx.text: b mov eax, [ebp+8].text: e push eax.text: f call _sub.text: add esp, 8.text: mov esp, ebp.text: pop ebp.text: a retn eax ecx edx ebp esp 0x0012FF30 0x0012FF2C 0x0012FF28 0x0012FF24 0x0012FF20 0x0012FF1C 0x0012FF18 0x0012FF14 0x0012FF10 0x0012FF0C 0xcafe z 0xbabe z 0xfeed z 0x0012FF50 z 0x0012FF24 c 0x12FFB0 (char ** argv)z 0x2 (int argc) z Addr after call _main z 0x0012FF50(saved ebp)c 8/28/ Key: executed instruction x, modified value c, arbitrary example start value z

59 Example2.c - 2.text: _sub: push ebp.text: mov ebp, esp.text: mov eax, [ebp+8].text: mov ecx, [ebp+0ch].text: lea eax, [ecx+eax*2].text: c pop ebp.text: d retn.text: _main: push ebp.text: mov ebp, esp x.text: push ecx.text: mov eax, [ebp+0ch].text: mov ecx, [eax+4].text: a push ecx.text: b call dword ptr ds: imp atoi.text: add esp, 4.text: mov [ebp-4], eax.text: mov edx, [ebp-4].text: a push edx.text: b mov eax, [ebp+8].text: e push eax.text: f call _sub.text: add esp, 8.text: mov esp, ebp.text: pop ebp.text: a retn eax ecx edx ebp esp 0x0012FF30 0x0012FF2C 0x0012FF28 0x0012FF24 0x0012FF20 0x0012FF1C 0x0012FF18 0x0012FF14 0x0012FF10 0x0012FF0C 0xcafe 0xbabe 0xfeed 0x0012FF24 c 0x0012FF24 0x12FFB0 (char ** argv) 0x2 (int argc) Addr after call _main 0x0012FF50 (saved ebp) 8/28/

60 Example2.c - 3.text: _sub: push ebp.text: mov ebp, esp.text: mov eax, [ebp+8].text: mov ecx, [ebp+0ch].text: lea eax, [ecx+eax*2].text: c pop ebp.text: d retn.text: _main: push ebp.text: mov ebp, esp.text: push ecx x.text: mov eax, [ebp+0ch].text: Caller-save, or mov ecx, [eax+4].text: a push ecx space for local.text: b call dword ptr ds: imp atoi var? This time it.text: add esp, 4.text: turns out to be mov [ebp-4], eax.text: space for local var mov edx, [ebp-4].text: a since there is no push edx.text: b corresponding pop, mov eax, [ebp+8].text: e and the address is push eax.text: f call _sub used later to refer.text: add esp, 8 to the value we.text: mov esp, ebp.text: know is stored in a. pop ebp.text: a retn eax ecx edx ebp esp 0x0012FF30 0x0012FF2C 0x0012FF28 0x0012FF24 0x0012FF20 0x0012FF1C 0x0012FF18 0x0012FF14 0x0012FF10 0x0012FF0C 0xcafe 0xbabe 0xfeed 0x0012FF24 0x0012FF20 c 0x12FFB0 (char ** argv) 0x2 (int argc) Addr after call _main 0x0012FF50 (saved ebp) 0xbabe (int a) c 8/28/

61 Example2.c - 4.text: _sub: push ebp.text: mov ebp, esp.text: mov eax, [ebp+8].text: mov ecx, [ebp+0ch].text: lea eax, [ecx+eax*2].text: c pop ebp.text: d retn.text: _main: push ebp.text: mov ebp, esp.text: push ecx.text: mov eax, [ebp+0ch] x.text: mov ecx, [eax+4].text: a Getting the push ecx.text: b call dword ptr ds: imp atoi.text: base of the add esp, 4.text: argv char * mov [ebp-4], eax.text: mov edx, [ebp-4].text: a array (aka push edx.text: b mov eax, [ebp+8] argv[0]).text: e push eax.text: f call _sub.text: add esp, 8.text: mov esp, ebp.text: pop ebp.text: a retn eax ecx edx ebp esp 0x0012FF30 0x0012FF2C 0x0012FF28 0x0012FF24 0x0012FF20 0x0012FF1C 0x0012FF18 0x0012FF14 0x0012FF10 0x0012FF0C 0x12FFB0 c 0xbabe 0xfeed 0x0012FF24 0x0012FF20 0x12FFB0 (char ** argv) 0x2 (int argc) Addr after call _main 0x0012FF50 (saved ebp) 0xbabe (int a) 8/28/

62 Example2-5.text: _sub: push ebp.text: mov ebp, esp.text: mov eax, [ebp+8].text: mov ecx, [ebp+0ch].text: lea eax, [ecx+eax*2].text: c pop ebp.text: d retn.text: _main: push ebp.text: mov ebp, esp.text: push ecx.text: mov eax, [ebp+0ch].text: mov ecx, [eax+4] x.text: a push ecx.text: b Getting the call dword ptr ds: imp atoi.text: add esp, 4 char * at.text: mov [ebp-4], eax.text: argv[1] mov edx, [ebp-4].text: a push edx (I chose.text: b mov eax, [ebp+8].text: e 0x12FFD4 push eax.text: f arbitrarily since call _sub.text: add esp, 8 it's out of the.text: mov esp, ebp.text: stack scope pop ebp.text: a eax ecx edx ebp esp 0x0012FF30 0x0012FF2C 0x0012FF28 0x0012FF24 0x0012FF20 0x0012FF1C 0x0012FF18 0x0012FF14 0x0012FF10 0x0012FF0C 0x12FFB0 0x12FFD4c (arbitraryz ) 0xfeed 0x0012FF24 0x0012FF20 0x12FFB0 (char ** argv) 0x2 (int argc) Addr after call _main 0x0012FF50 (saved ebp) 0xbabe (int a) we're currently retn looking 8/28/2015 at) 62

63 Example2-6.text: _sub: push ebp.text: mov ebp, esp.text: mov eax, [ebp+8].text: mov ecx, [ebp+0ch].text: lea eax, [ecx+eax*2].text: c Saving some pop ebp.text: d slides retn.text: This will push _main: the push ebp.text: address of the mov ebp, esp.text: string at argv[1] push ecx.text: (0x12FFD4). atoi() mov eax, [ebp+0ch].text: will read the string mov ecx, [eax+4].text: a and turn in into an push ecx x.text: b int, put that int in call dword ptr ds: imp atoi x.text: eax, and return. add esp, 4 x.text: Then the adding 4 mov [ebp-4], eax.text: to esp will negate mov edx, [ebp-4].text: a the having pushed push edx.text: b the input parameter mov eax, [ebp+8].text: e and make push eax.text: f 0x12FF1C call _sub.text: ined again add esp, 8.text: (this is indicative of mov esp, ebp.text: cdecl) pop ebp.text: a retn eax ecx edx ebp esp 0x0012FF30 0x0012FF2C 0x0012FF28 0x0012FF24 0x0012FF20 0x0012FF1C 0x0012FF18 0x0012FF14 0x0012FF10 0x0012FF0C 0x100c (arbitraryz ) 0x12FFD4 0xfeed 0x0012FF24 0x0012FF20 0x12FFB0 (char ** argv) 0x2 (int argc) Addr after call _main 0x0012FF50 (saved ebp) 0xbabe (int a) c c 8/28/

64 Example2-7.text: _sub: push ebp.text: mov ebp, esp.text: mov eax, [ebp+8].text: mov ecx, [ebp+0ch].text: lea eax, [ecx+eax*2].text: c pop ebp.text: d retn.text: _main: push ebp.text: mov ebp, esp.text: push ecx.text: mov eax, [ebp+0ch].text: First setting a mov ecx, [eax+4].text: a equal to the return push ecx.text: b value. Then call dword ptr ds: imp atoi.text: pushing a as the add esp, 4.text: second parameter mov [ebp-4], eax x.text: in sub(). We can mov edx, [ebp-4] x.text: a see an obvious push edx x.text: b optimization would mov eax, [ebp+8].text: e have been to push eax.text: f replace the last two call _sub.text: instructions with add esp, 8.text: push eax. mov esp, ebp.text: pop ebp.text: a retn eax ecx edx ebp esp 0x0012FF30 0x0012FF2C 0x0012FF28 0x0012FF24 0x0012FF20 0x0012FF1C 0x0012FF18 0x0012FF14 0x0012FF10 0x0012FF0C 0x100 0x12FFD4 0x100 c 0x0012FF24 0x0012FF1C c 0x12FFB0 (char ** argv) 0x2 (int argc) Addr after call _main 0x0012FF50 (saved ebp) 0x100 (int a) c 0x100 (int y) c 8/28/

65 Example2-8.text: _sub: push ebp.text: mov ebp, esp.text: mov eax, [ebp+8].text: mov ecx, [ebp+0ch].text: lea eax, [ecx+eax*2].text: c pop ebp.text: d retn.text: _main: push ebp.text: mov ebp, esp.text: push ecx.text: mov eax, [ebp+0ch].text: mov ecx, [eax+4].text: a push ecx.text: b call dword ptr ds: imp atoi.text: add esp, 4.text: mov [ebp-4], eax.text: mov edx, [ebp-4].text: a push edx.text: b mov eax, [ebp+8] x.text: e Pushing argc push eax x.text: f as the first call _sub.text: add esp, 8 parameter (int.text: mov esp, ebp.text: x) to sub() pop ebp.text: a retn eax ecx edx ebp esp 0x0012FF30 0x0012FF2C 0x0012FF28 0x0012FF24 0x0012FF20 0x0012FF1C 0x0012FF18 0x0012FF14 0x0012FF10 0x0012FF0C 0x2 c 0x12FFD4 0x100 0x0012FF24 0x0012FF18 c 0x12FFB0 (char ** argv) 0x2 (int argc) Addr after call _main 0x0012FF50 (saved ebp) 0x100 (int a) 0x100 (int y) 0x2 (int x) c 8/28/

66 Example2-9.text: _sub: push ebp.text: mov ebp, esp.text: mov eax, [ebp+8].text: mov ecx, [ebp+0ch].text: lea eax, [ecx+eax*2].text: c pop ebp.text: d retn.text: _main: push ebp.text: mov ebp, esp.text: push ecx.text: mov eax, [ebp+0ch].text: mov ecx, [eax+4].text: a push ecx.text: b call dword ptr ds: imp atoi.text: add esp, 4.text: mov [ebp-4], eax.text: mov edx, [ebp-4].text: a push edx.text: b mov eax, [ebp+8].text: e push eax.text: f call _sub x.text: add esp, 8.text: mov esp, ebp.text: pop ebp.text: a retn eax ecx edx ebp esp 0x0012FF30 0x0012FF2C 0x0012FF28 0x0012FF24 0x0012FF20 0x0012FF1C 0x0012FF18 0x0012FF14 0x0012FF10 0x0012FF0C 0x2 0x12FFD4 0x100 0x0012FF24 0x0012FF14 c 0x12FFB0 (char ** argv) 0x2 (int argc) Addr after call _main 0x0012FF50 (saved ebp) 0x100 (int a) 0x100 (int y) 0x2 (int x) 0x c 8/28/

67 Example2-10.text: _sub: push ebp x.text: mov ebp, esp x.text: mov eax, [ebp+8].text: mov ecx, [ebp+0ch].text: lea eax, [ecx+eax*2].text: c pop ebp.text: d retn.text: _main: push ebp.text: mov ebp, esp.text: push ecx.text: mov eax, [ebp+0ch].text: mov ecx, [eax+4].text: a push ecx.text: b call dword ptr ds: imp atoi.text: add esp, 4.text: mov [ebp-4], eax.text: mov edx, [ebp-4].text: a push edx.text: b mov eax, [ebp+8].text: e push eax.text: f call _sub.text: add esp, 8.text: mov esp, ebp.text: pop ebp.text: a retn eax ecx edx ebp esp 0x0012FF30 0x0012FF2C 0x0012FF28 0x0012FF24 0x0012FF20 0x0012FF1C 0x0012FF18 0x0012FF14 0x0012FF10 0x0012FF0C 0x2 0x12FFD4 0x100 0x0012FF10 c 0x0012FF10 c 0x12FFB0 (char ** argv) 0x2 (int argc) Addr after call _main 0x0012FF50 (saved ebp) 0x100 (int a) 0x100 (int y) 0x2 (int x) 0x x0012FF24(saved ebp)c 8/28/

68 Example2-11.text: _sub: push ebp.text: mov ebp, esp.text: mov eax, [ebp+8] x.text: mov ecx, [ebp+0ch] x.text: Move x into eax, lea eax, [ecx+eax*2] and y into ecx..text: c pop ebp.text: d retn.text: _main: push ebp.text: mov ebp, esp.text: push ecx.text: mov eax, [ebp+0ch].text: mov ecx, [eax+4].text: a push ecx.text: b call dword ptr ds: imp atoi.text: add esp, 4.text: mov [ebp-4], eax.text: mov edx, [ebp-4].text: a push edx.text: b mov eax, [ebp+8].text: e push eax.text: f call _sub.text: add esp, 8.text: mov esp, ebp.text: pop ebp.text: a retn eax ecx edx ebp esp 0x0012FF30 0x0012FF2C 0x0012FF28 0x0012FF24 0x0012FF20 0x0012FF1C 0x0012FF18 0x0012FF14 0x0012FF10 0x0012FF0C 0x2 c (no value change) 0x100 c 0x100 0x0012FF10 0x0012FF10 0x12FFB0 (char ** argv) 0x2 (int argc) Addr after call _main 0x0012FF50 (saved ebp) 0x100 (int a) 0x100 (int y) 0x2 (int x) 0x x0012FF24 (saved ebp) 8/28/

69 Example2-12.text: _sub: push ebp.text: mov ebp, esp.text: mov eax, [ebp+8].text: mov ecx, [ebp+0ch].text: Set the return value lea eax, [ecx+eax*2] x.text: c (eax) to 2*x + y. pop ebp.text: d Note: neither retn.text: pointer arith, nor _main: an push ebp.text: address which mov ebp, esp.text: was loaded. Just an push ecx.text: afficient way to do a mov eax, [ebp+0ch].text: calculation. mov ecx, [eax+4].text: a push ecx.text: b call dword ptr ds: imp atoi.text: add esp, 4.text: mov [ebp-4], eax.text: mov edx, [ebp-4].text: a push edx.text: b mov eax, [ebp+8].text: e push eax.text: f call _sub.text: add esp, 8.text: mov esp, ebp.text: pop ebp.text: a retn eax ecx edx ebp esp 0x0012FF30 0x0012FF2C 0x0012FF28 0x0012FF24 0x0012FF20 0x0012FF1C 0x0012FF18 0x0012FF14 0x0012FF10 0x0012FF0C 0x104 c 0x100 0x100 0x0012FF10 0x0012FF10 0x12FFB0 (char ** argv) 0x2 (int argc) Addr after call _main 0x0012FF50 (saved ebp) 0x100 (int a) 0x100 (int y) 0x2 (int x) 0x x0012FF24 (saved ebp) 8/28/

70 Example2-13.text: _sub: push ebp.text: mov ebp, esp.text: mov eax, [ebp+8].text: mov ecx, [ebp+0ch].text: lea eax, [ecx+eax*2].text: c pop ebp x.text: d retn.text: _main: push ebp.text: mov ebp, esp.text: push ecx.text: mov eax, [ebp+0ch].text: mov ecx, [eax+4].text: a push ecx.text: b call dword ptr ds: imp atoi.text: add esp, 4.text: mov [ebp-4], eax.text: mov edx, [ebp-4].text: a push edx.text: b mov eax, [ebp+8].text: e push eax.text: f call _sub.text: add esp, 8.text: mov esp, ebp.text: pop ebp.text: a retn eax ecx edx ebp esp 0x0012FF30 0x0012FF2C 0x0012FF28 0x0012FF24 0x0012FF20 0x0012FF1C 0x0012FF18 0x0012FF14 0x0012FF10 0x0012FF0C 0x104 0x100 0x100 0x0012FF24 c 0x0012FF14 c 0x12FFB0 (char ** argv) 0x2 (int argc) Addr after call _main 0x0012FF50 (saved ebp) 0x100 (int a) 0x100 (int y) 0x2 (int x) 0x c 8/28/

71 Example2-14.text: _sub: push ebp.text: mov ebp, esp.text: mov eax, [ebp+8].text: mov ecx, [ebp+0ch].text: lea eax, [ecx+eax*2].text: c pop ebp.text: d retn x.text: _main: push ebp.text: mov ebp, esp.text: push ecx.text: mov eax, [ebp+0ch].text: mov ecx, [eax+4].text: a push ecx.text: b call dword ptr ds: imp atoi.text: add esp, 4.text: mov [ebp-4], eax.text: mov edx, [ebp-4].text: a push edx.text: b mov eax, [ebp+8].text: e push eax.text: f call _sub.text: add esp, 8.text: mov esp, ebp.text: pop ebp.text: a retn eax ecx edx ebp esp 0x0012FF30 0x0012FF2C 0x0012FF28 0x0012FF24 0x0012FF20 0x0012FF1C 0x0012FF18 0x0012FF14 0x0012FF10 0x0012FF0C 0x104 0x100 0x100 0x0012FF24 0x0012FF18 c 0x12FFB0 (char ** argv) 0x2 (int argc) Addr after call _main 0x0012FF50 (saved ebp) 0x100 (int a) 0x100 (int y) 0x2 (int x) c 8/28/

72 Example2-15.text: _sub: push ebp.text: mov ebp, esp.text: mov eax, [ebp+8].text: mov ecx, [ebp+0ch].text: lea eax, [ecx+eax*2].text: c pop ebp.text: d retn.text: _main: push ebp.text: mov ebp, esp.text: push ecx.text: mov eax, [ebp+0ch].text: mov ecx, [eax+4].text: a push ecx.text: b call dword ptr ds: imp atoi.text: add esp, 4.text: mov [ebp-4], eax.text: mov edx, [ebp-4].text: a push edx.text: b mov eax, [ebp+8].text: e push eax.text: f call _sub.text: add esp, 8 x.text: mov esp, ebp.text: pop ebp.text: a retn eax ecx edx ebp esp 0x0012FF30 0x0012FF2C 0x0012FF28 0x0012FF24 0x0012FF20 0x0012FF1C 0x0012FF18 0x0012FF14 0x0012FF10 0x0012FF0C 0x104 0x100 0x100 0x0012FF24 0x0012FF20 c 0x12FFB0 (char ** argv) 0x2 (int argc) Addr after call _main 0x0012FF50 (saved ebp) 0x100 (int a) c c 8/28/

73 Example2-16.text: _sub: push ebp.text: mov ebp, esp.text: mov eax, [ebp+8].text: mov ecx, [ebp+0ch].text: lea eax, [ecx+eax*2].text: c pop ebp.text: d retn.text: _main: push ebp.text: mov ebp, esp.text: push ecx.text: mov eax, [ebp+0ch].text: mov ecx, [eax+4].text: a push ecx.text: b call dword ptr ds: imp atoi.text: add esp, 4.text: mov [ebp-4], eax.text: mov edx, [ebp-4].text: a push edx.text: b mov eax, [ebp+8].text: e push eax.text: f call _sub.text: add esp, 8.text: mov esp, ebp x.text: pop ebp.text: a retn eax ecx edx ebp esp 0x0012FF30 0x0012FF2C 0x0012FF28 0x0012FF24 0x0012FF20 0x0012FF1C 0x0012FF18 0x0012FF14 0x0012FF10 0x0012FF0C 0x104 0x100 0x100 0x0012FF24 0x0012FF24 c 0x12FFB0 (char ** argv) 0x2 (int argc) Addr after call _main 0x0012FF50 (saved ebp) c 8/28/

74 Example2-17.text: _sub: push ebp.text: mov ebp, esp.text: mov eax, [ebp+8].text: mov ecx, [ebp+0ch].text: lea eax, [ecx+eax*2].text: c pop ebp.text: d retn.text: _main: push ebp.text: mov ebp, esp.text: push ecx.text: mov eax, [ebp+0ch].text: mov ecx, [eax+4].text: a push ecx.text: b call dword ptr ds: imp atoi.text: add esp, 4.text: mov [ebp-4], eax.text: mov edx, [ebp-4].text: a push edx.text: b mov eax, [ebp+8].text: e push eax.text: f call _sub.text: add esp, 8.text: mov esp, ebp.text: pop ebp x.text: a retn eax ecx edx ebp esp 0x0012FF30 0x0012FF2C 0x0012FF28 0x0012FF24 0x0012FF20 0x0012FF1C 0x0012FF18 0x0012FF14 0x0012FF10 0x0012FF0C 0x104 0x100 0x100 0x0012FF50 c 0x0012FF28 c 0x12FFB0 (char ** argv) 0x2 (int argc) Addr after call _main c 8/28/

75 This may be A good )me for a break Or Ques)ons! 8/28/

76 Control Flow Two forms of control flow Condi)onal - go somewhere if a condi)on is met. Think if s, switches, loops Uncondi)onal - go somewhere no majer what. Procedure calls, goto, excep)ons, interrupts. We ve already seen procedure calls manifest themselves as push/call/ret, let s see how goto manifests itself in asm. 8/28/

77 Example2.999repea)ng.c: //Goto example #include <stdio.h> int main(){ goto mylabel; printf("skipped\n"); mylabel: printf("goto ftw!\n"); return 0xf00d; } push ebp mov ebp,esp jmp push h A call dword ptr ds:[ h] add esp,4 mylabel: push 40500Ch call dword ptr ds:[ h] E add esp, mov eax,0f00dh pop ebp ret 8/28/

78 10 JMP - Jump Change eip to the given address Main forms of the address Short rela)ve (1 byte displacement from end of the instruc)on) jmp doesn t have the number anywhere in it, it s really jmp 0x0E bytes forward Some disassemblers will indicate this with a mnemonic by wri)ng it as jmp short Near rela)ve (4 byte displacement from current eip) Absolute (hardcoded address in instruc)on) Absolute Indirect (address calculated with r/m32) jmp - 2 == infinite loop for short rela)ve jmp :) 8/28/2015 Book p

79 Example3.c (Remain calm) int main(){ int a=1, b=2; if(a == b){ return 1; } if(a > b){ return 2; } if(a < b){ return 3; } return 0xdefea7; } 8/28/2015 Jcc main: push ebp mov ebp,esp sub esp, mov dword ptr [ebp-4], D mov dword ptr [ebp-8], mov eax,dword ptr [ebp-4] cmp eax,dword ptr [ebp-8] A jne C mov eax, jmp mov ecx,dword ptr [ebp-4] cmp ecx,dword ptr [ebp-8] jle B mov eax, jmp mov edx,dword ptr [ebp-4] cmp edx,dword ptr [ebp-8] jge A mov eax, F jmp mov eax,0defea7h mov esp,ebp pop ebp ret 79

80 Ghost of Xmas Future: Tools you won t get to use today generate a Control Flow Graph (CFG) which looks much nicer. Not that that helps you. Just sayin :) 8/28/

81 11 Jcc - Jump If Condition Is Met There are more than 4 pages of condi)onal jump types! Luckily a bunch of them are synonyms for each other. JNE == JNZ (Jump if not equal, Jump if not zero, both check if the Zero Flag (ZF) == 0) 8/28/2015 Book p

82 Some Notable Jcc Instruc)ons JZ/JE: if ZF == 1 JNZ/JNE: if ZF == 0 JLE/JNG : if ZF == 1 or SF!= OF JGE/JNL : if SF == OF JBE: if CF == 1 OR ZF == 1 JB: if CF == 1 Note: Don t get hung up on memorizing which flags are set for what. More olen than not, you will be running code in a debugger, not just reading it. In the debugger you can just look at eflags and/or watch whether it takes a jump. 8/28/

83 Flag se ng Before you can do a condi)onal jump, you need something to set the condi)on flags for you. Typically done with CMP, TEST, or whatever instruc)ons are already inline and happen to have flag- se ng side- effects 8/28/

84 12 CMP - Compare Two Operands The comparison is performed by subtracting the second operand from the first operand and then setting the status flags in the same manner as the SUB instruction. What s the difference from just doing SUB? Difference is that with SUB the result has to be stored somewhere. With CMP the result is computed, the flags are set, but the result is discarded. Thus this only sets flags and doesn t mess up any of your registers. Modifies CF, OF, SF, ZF, AF, and PF (implies that SUB modifies all those too) 8/28/2015 Book p

85 13 TEST - Logical Compare Computes the bit-wise logical AND of first operand (source 1 operand) and the second operand (source 2 operand) and sets the SF, ZF, and PF status flags according to the result. Like CMP - sets flags, and throws away the result 8/28/2015 Book p

86 Example4.c #define MASK 0x100 int main(){ int a=0x1301; if(a & MASK){ return 1; jcc } else{ return 2; } } Eventually found out 8/28/2015 why there are 2 jmps! (no optimization, so simple compiler rules) main: push ebp mov ebp,esp push ecx mov dword ptr [ebp-4],1301h B mov eax,dword ptr [ebp-4] E and eax,100h je E mov eax, A jmp C jmp E mov eax, mov esp,ebp pop ebp ret I actually expected a TEST, because the result isn't stored 86

87 Refresher - Boolean ( bitwise ) logic AND & OR XOR ^ Operands Result NOT ~ 0 1 8/28/

88 14 AND - Logical AND Des)na)on operand can be r/m32 or register Source operand can be r/m32 or register or immediate (No source and des)na)on as r/m32s) and al, bl b (al - 0x33) AND b (bl - 0x55) result b (al - 0x11) and al, 0x b (al - 0x33) AND b (imm - 0x42) result b (al - 0x02) 8/28/2015 Book p

89 15 OR - Logical Inclusive OR Des)na)on operand can be r/m32 or register Source operand can be r/m32 or register or immediate (No source and des)na)on as r/m32s) or al, bl b (al - 0x33) OR b (bl - 0x55) result b (al - 0x77) or al, 0x b (al - 0x33) OR b (imm - 0x42) result b (al - 0x73) 8/28/2015 Book p

90 16 XOR - Logical Exclusive OR Des)na)on operand can be r/m32 or register Source operand can be r/m32 or register or immediate (No source and des)na)on as r/m32s) xor al, al b (al - 0x33) XOR b (al - 0x33) result b (al - 0x00) xor al, 0x b (al - 0x33) OR b (imm - 0x42) result b (al - 0x71) XOR is commonly used to zero a register, by XORing it with itself, because 8/28/2015 it s faster than a MOV Book p

91 17 NOT - One's Complement Negation Single source/des)na)on operand can be r/ m32 not al NOT b (al - 0x33) al not [al+bl] 0x result b (al - 0xCC) bl 0x al+bl 0x Xeno trying to be clever on a boring example, and failing 8/28/2015 Book p. 231 [al+bl] 0 (assumed memory at 0x ) NOT b result b 91

92 Example5.c - simple for loop #include <stdio.h> int main(){ int i; for(i = 0; i < 10; i++){ printf("i = %d\n, i); } } What does this add say about the calling convention of printf()? Interesting note: Defaults 8/28/2015 to returning 0 main: push ebp mov ebp,esp push ecx mov dword ptr [ebp-4], B jmp D mov eax,dword ptr [ebp-4] add eax, mov dword ptr [ebp-4],eax cmp dword ptr [ebp-4],0ah A jge C mov ecx,dword ptr [ebp-4] F push ecx push h call dword ptr ds:[ h] B add esp, E jmp D xor eax,eax mov esp,ebp pop ebp ret 92

93 Instruc)ons we now know(17) NOP PUSH/POP CALL/RET MOV/LEA ADD/SUB JMP/Jcc CMP/TEST AND/OR/XOR/NOT 8/28/

94 Example6.c //Multiply and divide transformations //New instructions: //shl - Shift Left, shr - Shift Right int main(){ unsigned int a, b, c; a = 0x40; b = a * 8; c = b / 16; return c; } 8/28/2015 main: push mov sub mov mov shl mov mov shr mov mov mov pop ret ebp ebp,esp esp,0ch dword ptr [ebp-4],40h eax,dword ptr [ebp-4] eax,3 dword ptr [ebp-8],eax ecx,dword ptr [ebp-8] ecx,4 dword ptr [ebp-0ch],ecx eax,dword ptr [ebp-0ch] esp,ebp ebp 94

95 18 SHL - Shift Logical Left Book p. 224 Can be explicitly used with the C << operator First operand (source and des)na)on) operand is an r/m32 Second operand is either cl (lowest byte of ecx), or a 1 byte immediate. The 2nd operand is the number of places to shil. It mul$plies the register by 2 for each place the value is shiled. More efficient than a mul)ply instruc)on. Bits shiled off the lel hand side are shiled into (set) the carry flag (CF) For purposes of determining if the CF is set at the end, think of it as n independent 1 bit shils. shl cl, b (cl - 0x33) result 8/28/ b (cl - 0xCC) CF = 0 shl cl, b (cl - 0x33) result b (cl - 0x98) CF = 1 95

96 19 SHR - Shift Logical Right Book p. 225 Can be explicitly used with the C >> operator First operand (source and des)na)on) operand is an r/m32 Second operand is either cl (lowest byte of ecx), or a 1 byte immediate. The 2nd operand is the number of places to shil. It divides the register by 2 for each place the value is shiled. More efficient than a mul)ply instruc)on. Bits shiled off the right hand side are shiled into (set) the carry flag (CF) For purposes of determining if the CF is set at the end, think of it as n independent 1 bit shils. shr cl, b (cl - 0x33) result 8/28/ b (cl - 0x0C) CF = 1 shr cl, b (cl - 0x33) result b (cl - 0x06) CF = 0 96

97 Example7.c //Multiply and divide operations //when the operand is not a //power of two //New instructions: imul, div int main(){ unsigned int a = 1; a = a * 6; a = a / 3; return 0x2bad; } 8/28/2015 main: push mov push mov mov imul mov mov xor mov div mov mov mov pop ret ebp ebp,esp ecx dword ptr [ebp-4],1 eax,dword ptr [ebp-4] eax,eax,6 dword ptr [ebp-4],eax eax,dword ptr [ebp-4] edx,edx ecx,3 eax,ecx dword ptr [ebp-4],eax eax,2badh esp,ebp ebp 97

98 20 IMUL - Signed Multiply Book p. 218 Wait what? Weren t the operands unsigned? Visual Studio seems to have a predilec)on for imul over mul (unsigned mul)ply). I haven t been able to get it to generate the lajer for simple examples. Three forms. One, two, or three operands imul r/m32 edx:eax = eax * r/m32 imul reg, r/m32 reg = reg * r/m32 imul reg, r/m32, immediate reg = r/m32 * immediate Three operands? Only one of it s kind?(see link in notes) initial edx eax r/m32(ecx) 0x0 0x x4 eax 0x20 r/m32(ecx) 0x4 eax 0x20 r/m32(ecx) 0x4 operation imul ecx imul eax, ecx imul eax, ecx, 0x6 result edx eax r/m32(ecx) eax r/m32(ecx) eax r/m32(ecx) 8/28/2015 0x1 0x x4 0x80 0x4 0x18 0x4 98

99 21 DIV - Unsigned Divide Book p. 221 Two forms Unsigned divide ax by r/m8, al = quo)ent, ah = remainder Unsigned divide edx:eax by r/m32, eax = quo)ent, edx = remainder If dividend is 32bits, edx will just be set to 0 before the instruc)on (as occurred in the Example7.c code) If the divisor is 0, a divide by zero excep)on is raised. initial ax 0x8 r/m8(cx) 0x3 edx eax r/m32(ecx) 0x0 0x8 0x3 operation div ax, cx div eax, ecx result 8/28/2015 ah 0x2 al 0x2 edx eax r/m32(ecx) 0x1 0x2 0x3 99

100 Example8.c //VisualStudio runtime check //buffer initialization //auto-generated code //New instruction: rep stos int main(){ char buf[40]; buf[39] = 42; return 0xb100d; } 8/28/

101 8/28/2015 Example8.c main: push ebp mov ebp,esp sub esp,30h push edi lea edi,[ebp-30h] A mov ecx,0ch F mov eax,0cccccccch rep stos dword ptr es:[edi] mov byte ptr [ebp-5],2ah A mov eax,0b100dh F push edx mov ecx,ebp push eax lea edx,[ (401048h)] call _RTC_CheckStackVars (4010B0h) E pop eax F pop edx pop edi mov esp,ebp pop ebp ret 101

102 22 REP STOS - Repeat Store String One of a family of rep opera)ons, which repeat a single instruc)on mul)ple )mes. (i.e. stos is also a standalone instruc)on) Rep isn t technically it s own instruc)on, it s an instruc)on prefix All rep opera)ons use ecx register as a counter to determine how many )mes to loop through the instruc)on. Each )me it executes, it decrements ecx. Once ecx == 0, it con)nues to the next instruc)on. Either moves one byte at a )me or one dword at a )me. Either fill byte at [edi] with al or fill dword at [edi] with eax. Moves the edi register forward one byte or one dword at a )me, so that the repeated store opera)on is storing into consecu)ve loca)ons. So there are 3 pieces which must happen before the actual rep stos occurs: set edi to the start des)na)on, eax/al to the value to store, and ecx to the number of )mes to store 8/28/2015 Book p

103 rep stos setup AC lea edi,[ebp- 0F0h] Set edi - the des$na$on B2 mov Set ecx - the count B7 mov Set eax - the value ecx,3ch eax,0cccccccch BC rep stos dword ptr es:[edi] Start the repeated store So what's this going to do? Store 0x3C copies of the dword 0xCCCCCCCC star)ng at ebp- 0xF0 And that just happens to be 0xF0 bytes of 0xCC! 8/28/

104 Q: Where does the rep stos come from in this example? A: Compiler-auto-generated code. From the stack frames runtime check option. This is enabled by default in the debug build. Disabling this option removes the compiler-generated code. 8/28/