Lab 3. The Art of Assembly Language (II)
|
|
|
- Milton Lynch
- 5 years ago
- Views:
Transcription
1 Lab. The Art of Assembly Language (II) Dan Bruce, David Clark and Héctor D. Menéndez Department of Computer Science University College London October 2, 2017 License Creative Commons Share Alike Modified from Xeno Kovah slides of Open Security Training Dan, David and Héctor (UCL) Assembly October 2,
2 Introduction There are two forms to modify control flow: Conditional: go somewhere if a condition is met. For example: if s, switches, loops. Unconditional: go somewhere directly. For example: Procedure calls, goto, exceptions, interrupts. Dan, David and Héctor (UCL) Assembly October 2,
3 JMP - Jump Change EIP to the given address (like goto). The main forms of the address: Relative: 1 byte displacement from end of the instruction (jmp 0x0E). Absolute: hardcoded address in instruction (jmp 0x ). Absolute Indirect: address calculated with r/m2 (jmp eax - 0x0E). Dan, David and Héctor (UCL) Assembly October 2,
4 Flags Dan, David and Héctor (UCL) Assembly October 2,
5 Jcc - Jump If Condition Is Met There are several options for conditional jumps. We will focused on those that corresponds with: ZF, CF, OF and SF. Dan, David and Héctor (UCL) Assembly October 2,
6 Some Jcc Instructions JZ/JE (Zero/Equal): if ZF == 1. JNZ/JNE (No Zero/Equal): if ZF == 0. JLE/JNG (Less or Equal - Signed): if ZF == 1 or SF!= OF. JGE/JNL (Greater or Equal -Signed): if SF == OF. JBE (Below or Equal - Unsigned): if CF == 1 OR ZF == 1. JAE (Above or Equal - Unsigned): if CF == 0 OR ZF == 1. In the debugger you can just look at eflags and/or watch whether it takes a jump. Dan, David and Héctor (UCL) Assembly October 2,
7 We update the frame register with the stack register something : mov cx, sub ax, cx j z main jmp end main : mov ax, mov bx, sub ax, bx add ax, ax D jnz something end : E r e t OF SF ZF PF CF EIP AX BX CX 0x Dan, David and Héctor (UCL) Assembly October 2,
8 We update the frame register with the stack register something : mov cx, sub ax, cx j z main jmp end main : mov ax, mov bx, sub ax, bx add ax, ax D jnz something end : E r e t OF SF ZF PF CF EIP AX BX CX 0x Dan, David and Héctor (UCL) Assembly October 2,
9 We update the frame register with the stack register something : mov cx, sub ax, cx j z main jmp end main : mov ax, mov bx, sub ax, bx add ax, ax D jnz something end : E r e t OF SF ZF PF CF EIP AX BX CX 0x Dan, David and Héctor (UCL) Assembly October 2,
10 We update the frame register with the stack register something : mov cx, sub ax, cx j z main jmp end main : mov ax, mov bx, sub ax,bx add ax, ax D jnz something end : E r e t OF SF ZF PF CF EIP AX BX CX 0x Dan, David and Héctor (UCL) Assembly October 2,
11 We update the frame register with the stack register something : mov cx, sub ax, cx j z main jmp end main : mov ax, mov bx, sub ax, bx add ax,ax D jnz something end : E r e t OF SF ZF PF CF EIP AX BX CX 0x D -2 Dan, David and Héctor (UCL) Assembly October 2,
12 We update the frame register with the stack register something : mov cx, sub ax, cx j z main jmp end main : mov ax, mov bx, sub ax, bx add ax, ax D jnz something end : E r e t OF SF ZF PF CF EIP AX BX CX 0x Dan, David and Héctor (UCL) Assembly October 2,
13 We update the frame register with the stack register something : mov cx, sub ax, cx j z main jmp end main : mov ax, mov bx, sub ax, bx add ax, ax D jnz something end : E r e t OF SF ZF PF CF EIP AX BX CX 0x Dan, David and Héctor (UCL) Assembly October 2,
14 We update the frame register with the stack register something : mov cx, sub ax,cx j z main jmp end main : mov ax, mov bx, sub ax, bx add ax, ax D jnz something end : E r e t OF SF ZF PF CF EIP AX BX CX 0x Dan, David and Héctor (UCL) Assembly October 2,
15 We update the frame register with the stack register something : mov cx, sub ax, cx jz main jmp end main : mov ax, mov bx, sub ax, bx add ax, ax D jnz something end : E r e t OF SF ZF PF CF EIP AX BX CX 0x Dan, David and Héctor (UCL) Assembly October 2,
16 We update the frame register with the stack register something : mov cx, sub ax, cx j z main jmp end main : mov ax, mov bx, sub ax, bx add ax, ax D jnz something end : E r e t OF SF ZF PF CF EIP AX BX CX 0x E -5 Dan, David and Héctor (UCL) Assembly October 2,
17 We update the frame register with the stack register something : mov cx, sub ax, cx j z main jmp end main : mov ax, mov bx, sub ax, bx add ax, ax D jnz something end : E ret OF SF ZF PF CF EIP AX BX CX unknown -5 Dan, David and Héctor (UCL) Assembly October 2,
18 Flag setting Before you can do a conditional jump, you need to set the flags. Common instructions are CMP, TEST, or any arithmetic or logic instructions having flag-setting side-effects Dan, David and Héctor (UCL) Assembly October 2,
19 CMP - Compare Two Operands The comparison is performed by subtracting the second operand from the first operand and then setting the status flags in the same manner as the SUB instruction. With CMP the result is computed, the flags are set, but the result is discarded. Modifies CF, OF, SF, ZF, AF, and PF. Dan, David and Héctor (UCL) Assembly October 2,
20 TEST - Logical Compare Computes the bit-wise logical AND of first operand and the second operand and sets the SF, ZF, and PF status flags according to the result. Like CMP - sets flags, and throws away the result Dan, David and Héctor (UCL) Assembly October 2,
21 AND - Logical AND Destination operand can be r/m2 or register. Source operand can be r/m2 or register or immediate. No source and destination as r/m2. and al, bl and al, 0x b (al - 0x) AND b (bl - 0x55) result b (al - 0x11) b (al - 0x) AND b (imm - 0x42) result b (al - 0x02) Dan, David and Héctor (UCL) Assembly October 2,
22 OR - Logical Inclusive OR Destination operand can be r/m2 or register. Source operand can be r/m2 or register or immediate. or al,bl or al, 0x b (al - 0x) OR b (bl - 0x55) result b (al - 0x77) b (al - 0x) OR b (imm - 0x42) result b (al - 0x7) Dan, David and Héctor (UCL) Assembly October 2,
23 XOR - Logical Exclusive OR Commonly used to zero a register. xor al,al xor al, 0x b (al - 0x) XOR b (al - 0x) result b (al - 0x00) b (al - 0x) OR b (imm - 0x42) result b (al - 0x71) Dan, David and Héctor (UCL) Assembly October 2,
24 NOT - One s Complement Negation Single source/destination operand can be r/m2. not al not [al+bl] NOT b (al - 0x) result b (al - 0xCC) al 0x bl 0x al+bl 0x [al+bl] 0 (assumed memory at 0x ) NOT b result b Dan, David and Héctor (UCL) Assembly October 2,
25 SHL - Shift Logical Left Can be explicitly used with the C << operator. First operand (source and destination) is r/m2. Second operand is either cl (lowest byte of ecx), or a 1 byte immediate. The 2nd operand is the number of places to shift. Multiplies by 2 more efficiently. Bits shifted off the left hand side set the carry flag (CF). sh cl,2 shl cl, b (cl - 0x) result b (cl - 0xCC) CF = b (cl - 0x) result b (cl - 0x98) CF = 1 Dan, David and Héctor (UCL) Assembly October 2,
26 SHR - Shift Logical Right Can be explicitly used with the C >> operator. First operand (source and destination) is r/m2. Second operand is either cl (lowest byte of ecx), or a 1 byte immediate. The 2nd operand is the number of places to shift. It divides the register by 2 for each place the value is shifted. Bits shifted off the right hand side set the carry flag (CF). shr cl,2 shr cl, b (cl - 0x) result b (cl - 0x0C) CF = b (cl - 0x) result b (cl - 0x06) CF = 0 Dan, David and Héctor (UCL) Assembly October 2,
27 REP - Repeat Prefix It is an instruction prefix. Repeat a single instruction multiple times. All rep operations use ecx register as a counter to determine how many times to loop. Each time it decrements ecx. Once ecx == 0, it continues. Dan, David and Héctor (UCL) Assembly October 2,
28 REP STOS - Repeat Store String Either moves one byte at a time or one dword at a time. Either fill byte at [edi] with al or fill dword at [edi] with eax. Moves the edi register forward one byte or one dword at a time, so that the repeated store operation is storing into consecutive locations. So there are things which must happen before the actual rep stos occurs: set edi to the start destination, eax/al to the value to store, and ecx to the number of times to store Dan, David and Héctor (UCL) Assembly October 2,
29 REP STOS - Set edi - the destination: 00411AC lea edi,[ebp-0f0h] Set ecx - the count 00411B2 mov ecx,ch Set eax - the value 00411B7 mov eax,0cccccccch Start the repeated store 00411BC rep stos dword ptr [edi] Stores 0xC copies of the dword 0xCCCCCCCC starting at ebp-0xf0 Dan, David and Héctor (UCL) Assembly October 2,
30 REP MOVS - Repeat Move Data String to String Either moves one byte at a time or one dword at a time. Either move byte at [esi] to byte at [edi] or move dword at [esi] to dword at [edi]. Moves the esi and edi registers forward one byte or one dword at a time, so that the repeated store operation is storing into consecutive locations. So there are things which must happen before the actual rep movs occurs: set esi to the start source, set edi to the start destination, and set ecx to the number of times to move Dan, David and Héctor (UCL) Assembly October 2,
31 ENTER - High Level Procedure Init Pushes EBP and then sets EBP to ESP. Reserves memory for local variables in the stack. 1 enter 20,0 Dan, David and Héctor (UCL) Assembly October 2,
32 LEAVE - High Level Procedure Exit Set ESP to EBP, then pop EBP. It finishes the execution. Depends on compiler and options. 1 mov eax, dword ptr [ ebp+8] 2 pop esi pop edi 4 leave 5 r e t Dan, David and Héctor (UCL) Assembly October 2,
33 C to Assembly Dan, David and Héctor (UCL) Assembly October 2,
34 IF / ELSE 1 i f ( a > 5) 2 p r i n t f ( A i s g r e a t e r than 5 ) ; else 4 p r i n t f ( A i s smaller or equal to 5 ) ; 5 return ; Dan, David and Héctor (UCL) Assembly October 2,
35 IF / ELSE Imagine that a value is in ax 1 cmp ax,5 2 jg g r e a t e r jmp smaller 4 g r e a t e r : 5 mov r d i, msggreater 6 mov rax,0 7 c a l l p r i n t f 8 jmp end 9 smaller : 10 mov r d i, msgsmaller 11 mov rax,0 12 c a l l p r i n t f 1 end : 14 leave Dan, David and Héctor (UCL) Assembly October 2,
36 FOR 1 for ( i =0; i <10; i ++) 2 p r i n t f ( Hello ) ; Dan, David and Héctor (UCL) Assembly October 2,
37 FOR 1 mov cx,0 2 loop1 : cmp cx,10 4 jge end 5 mov r d i, msg 6 mov rax,0 7 c a l l p r i n t f 8 add cx,1 9 jmp loop1 10 end : 11 mov rax,0 12 c a l l e x i t Dan, David and Héctor (UCL) Assembly October 2,
38 Compile to Assembly The compiler is able to generate assembly code as an intermediate representation: $ gcc S masm= i n t e l m2 test. c This will generate a file named test.s containing the assembly code (in intel format) of the source code test.c Dan, David and Héctor (UCL) Assembly October 2,
39 Disassembling: Objdump We can recover the original assembly code using Objdump: $ objdump M i n t e l d test This will show the assembly expressions after a disassemble process. Dan, David and Héctor (UCL) Assembly October 2,
40 Disassembling: GDB We can also recover them with GDB: $ gdb test $> break main $> run $> set disassembly f l a v o r i n t e l $> disassemble In this case, we are running the program. Dan, David and Héctor (UCL) Assembly October 2,
41 MAIN 1 i n t main ( i n t argc, char argv [ ] ) { 2 i n t a=; i n t b=5; 4 i n t c=a+b ; 5 return 1; 6 } Dan, David and Héctor (UCL) Assembly October 2,
42 MAIN 1 main : 2 push ebp mov ebp, esp 4 sub esp, 16 5 mov DWORD PTR [ ebp 4], 6 mov DWORD PTR [ ebp 8], 5 7 mov eax, DWORD PTR [ ebp 8] 8 mov edx, DWORD PTR [ ebp 4] 9 add eax, edx 10 mov DWORD PTR [ ebp 12], eax 11 mov eax, 1 12 leave 1 r e t Dan, David and Héctor (UCL) Assembly October 2,
43 Function Call 1 i n t mysum( i n t a, i n t b ){ 2 i n t c =; i n t t o t a l ; 4 t o t a l =a+c+b ; 5 return t o t a l ; 6 } 7 8 i n t main ( i n t argc, char argv [ ] ) { 9 i n t a=; 10 i n t b=5; 11 mysum( a, b ) ; 12 return 1; 1 } Dan, David and Héctor (UCL) Assembly October 2,
44 Function Call (main) 1 main : 2 push ebp mov ebp, esp 4 sub esp, 24 5 mov DWORD PTR [ ebp 4], 6 mov DWORD PTR [ ebp 8], 5 7 mov eax, DWORD PTR [ ebp 8] 8 mov DWORD PTR [ esp +4], eax 9 mov eax, DWORD PTR [ ebp 4] 10 mov DWORD PTR [ esp ], eax 11 c a l l mysum 12 mov eax, 1 1 leave 14 r e t Dan, David and Héctor (UCL) Assembly October 2,
45 Function Call (mysum) 1 mysum: 2 push ebp mov ebp, esp 4 sub esp, 16 5 mov DWORD PTR [ ebp 4], 6 mov eax, DWORD PTR [ ebp 4] 7 mov edx, DWORD PTR [ ebp+8] 8 add edx, eax 9 mov eax, DWORD PTR [ ebp+12] 10 add eax, edx 11 mov DWORD PTR [ ebp 8], eax 12 mov eax, DWORD PTR [ ebp 8] 1 leave 14 r e t Dan, David and Héctor (UCL) Assembly October 2,
46 main : push ebp mov ebp, esp sub esp, 24 mov DWORD PTR [ ebp 4], mov DWORD PTR [ ebp 8], 5 mov eax, DWORD PTR [ ebp 8] mov DWORD PTR [ esp +4], eax mov eax, DWORD PTR [ ebp 4] mov DWORD PTR [ esp ], eax c a l l mysum mov eax, 1 leave r e t 0x070 0x06C 0x068 0x064 0x060 0x05C 0x058 0x054 old ebp Dan, David and Héctor (UCL) Assembly October 2,
47 main : push ebp mov ebp, esp sub esp, 24 mov DWORD PTR [ ebp 4], mov DWORD PTR [ ebp 8], 5 mov eax, DWORD PTR [ ebp 8] mov DWORD PTR [ esp +4], eax mov eax, DWORD PTR [ ebp 4] mov DWORD PTR [ esp ], eax c a l l mysum mov eax, 1 leave r e t 0x070 0x06C 0x068 0x064 0x060 0x05C 0x058 0x054 old ebp Dan, David and Héctor (UCL) Assembly October 2,
48 main : push ebp mov ebp, esp sub esp, 24 mov DWORD PTR [ ebp 4], mov DWORD PTR [ ebp 8], 5 mov eax, DWORD PTR [ ebp 8] mov DWORD PTR [ esp +4], eax mov eax, DWORD PTR [ ebp 4] mov DWORD PTR [ esp ], eax c a l l mysum mov eax, 1 leave r e t 0x070 0x06C 0x068 0x064 0x060 0x05C 0x058 0x054 old ebp Dan, David and Héctor (UCL) Assembly October 2,
49 main : push ebp mov ebp, esp sub esp, 24 mov DWORD PTR [ebp-4], mov DWORD PTR [ ebp 8], 5 mov eax, DWORD PTR [ ebp 8] mov DWORD PTR [ esp +4], eax mov eax, DWORD PTR [ ebp 4] mov DWORD PTR [ esp ], eax c a l l mysum mov eax, 1 leave r e t 0x070 0x06C 0x068 0x064 0x060 0x05C 0x058 0x054 old ebp Dan, David and Héctor (UCL) Assembly October 2,
50 main : push ebp mov ebp, esp sub esp, 24 mov DWORD PTR [ ebp 4], mov DWORD PTR [ebp-8], 5 mov eax, DWORD PTR [ ebp 8] mov DWORD PTR [ esp +4], eax mov eax, DWORD PTR [ ebp 4] mov DWORD PTR [ esp ], eax c a l l mysum mov eax, 1 leave r e t 0x070 0x06C 0x068 0x064 0x060 0x05C 0x058 0x054 old ebp 5 Dan, David and Héctor (UCL) Assembly October 2,
51 main : push ebp mov ebp, esp sub esp, 24 mov DWORD PTR [ ebp 4], mov DWORD PTR [ ebp 8], 5 mov eax, DWORD PTR [ebp-8] mov DWORD PTR [ esp +4], eax mov eax, DWORD PTR [ ebp 4] mov DWORD PTR [ esp ], eax c a l l mysum mov eax, 1 leave r e t 0x070 0x06C 0x068 0x064 0x060 0x05C 0x058 0x054 old ebp 5 Dan, David and Héctor (UCL) Assembly October 2,
52 main : push ebp mov ebp, esp sub esp, 24 mov DWORD PTR [ ebp 4], mov DWORD PTR [ ebp 8], 5 mov eax, DWORD PTR [ ebp 8] mov DWORD PTR [esp+4], eax mov eax, DWORD PTR [ ebp 4] mov DWORD PTR [ esp ], eax c a l l mysum mov eax, 1 leave r e t 0x070 0x06C 0x068 0x064 0x060 0x05C 0x058 0x054 old ebp 5 5 Dan, David and Héctor (UCL) Assembly October 2,
53 main : push ebp mov ebp, esp sub esp, 24 mov DWORD PTR [ ebp 4], mov DWORD PTR [ ebp 8], 5 mov eax, DWORD PTR [ ebp 8] mov DWORD PTR [ esp +4], eax mov eax, DWORD PTR [ebp-4] mov DWORD PTR [ esp ], eax c a l l mysum mov eax, 1 leave r e t 0x070 0x06C 0x068 0x064 0x060 0x05C 0x058 0x054 old ebp 5 5 Dan, David and Héctor (UCL) Assembly October 2,
54 main : push ebp mov ebp, esp sub esp, 24 mov DWORD PTR [ ebp 4], mov DWORD PTR [ ebp 8], 5 mov eax, DWORD PTR [ ebp 8] mov DWORD PTR [ esp +4], eax mov eax, DWORD PTR [ ebp 4] mov DWORD PTR [esp], eax c a l l mysum mov eax, 1 leave r e t 0x070 0x06C 0x068 0x064 0x060 0x05C 0x058 0x054 old ebp 5 5 Dan, David and Héctor (UCL) Assembly October 2,
55 main : push ebp mov ebp, esp sub esp, 24 mov DWORD PTR [ ebp 4], mov DWORD PTR [ ebp 8], 5 mov eax, DWORD PTR [ ebp 8] mov DWORD PTR [ esp +4], eax mov eax, DWORD PTR [ ebp 4] mov DWORD PTR [ esp ], eax call mysum mov eax, 1 leave r e t 0x070 0x06C 0x068 0x064 0x060 0x05C 0x058 0x054 0x050 old ebp 5 5 EIP Dan, David and Héctor (UCL) Assembly October 2,
56 mysum: push ebp mov ebp, esp sub esp, 16 mov DWORD PTR [ ebp 4], mov eax, DWORD PTR [ ebp 4] mov edx, DWORD PTR [ ebp+8] add edx, eax mov eax, DWORD PTR [ ebp+12] add eax, edx mov DWORD PTR [ ebp 8], eax mov eax, DWORD PTR [ ebp 8] leave r e t 0x05C 0x058 0x054 0x050 0x04C 0x048 0x044 0x040 0x0C 5 EIP Dan, David and Héctor (UCL) Assembly October 2,
57 mysum: push ebp mov ebp, esp sub esp, 16 mov DWORD PTR [ ebp 4], mov eax, DWORD PTR [ ebp 4] mov edx, DWORD PTR [ ebp+8] add edx, eax mov eax, DWORD PTR [ ebp+12] add eax, edx mov DWORD PTR [ ebp 8], eax mov eax, DWORD PTR [ ebp 8] leave r e t 0x05C 0x058 0x054 0x050 0x04C 0x048 0x044 0x040 0x0C 5 EIP main ebp Dan, David and Héctor (UCL) Assembly October 2,
58 mysum: push ebp mov ebp, esp sub esp, 16 mov DWORD PTR [ ebp 4], mov eax, DWORD PTR [ ebp 4] mov edx, DWORD PTR [ ebp+8] add edx, eax mov eax, DWORD PTR [ ebp+12] add eax, edx mov DWORD PTR [ ebp 8], eax mov eax, DWORD PTR [ ebp 8] leave r e t 0x05C 0x058 0x054 0x050 0x04C 0x048 0x044 0x040 0x0C 5 EIP main ebp Dan, David and Héctor (UCL) Assembly October 2,
59 mysum: push ebp mov ebp, esp sub esp, 16 mov DWORD PTR [ ebp 4], mov eax, DWORD PTR [ ebp 4] mov edx, DWORD PTR [ ebp+8] add edx, eax mov eax, DWORD PTR [ ebp+12] add eax, edx mov DWORD PTR [ ebp 8], eax mov eax, DWORD PTR [ ebp 8] leave r e t 0x05C 0x058 0x054 0x050 0x04C 0x048 0x044 0x040 0x0C 5 EIP main ebp Dan, David and Héctor (UCL) Assembly October 2,
60 mysum: push ebp mov ebp, esp sub esp, 16 mov DWORD PTR [ebp-4], mov eax, DWORD PTR [ ebp 4] mov edx, DWORD PTR [ ebp+8] add edx, eax mov eax, DWORD PTR [ ebp+12] add eax, edx mov DWORD PTR [ ebp 8], eax mov eax, DWORD PTR [ ebp 8] leave r e t 0x05C 0x058 0x054 0x050 0x04C 0x048 0x044 0x040 0x0C 5 EIP main ebp Dan, David and Héctor (UCL) Assembly October 2,
61 mysum: push ebp mov ebp, esp sub esp, 16 mov DWORD PTR [ ebp 4], mov eax, DWORD PTR [ebp-4] mov edx, DWORD PTR [ ebp+8] add edx, eax mov eax, DWORD PTR [ ebp+12] add eax, edx mov DWORD PTR [ ebp 8], eax mov eax, DWORD PTR [ ebp 8] leave r e t 0x05C 0x058 0x054 0x050 0x04C 0x048 0x044 0x040 0x0C 5 EIP main ebp Dan, David and Héctor (UCL) Assembly October 2,
62 mysum: push ebp mov ebp, esp sub esp, 16 mov DWORD PTR [ ebp 4], mov eax, DWORD PTR [ ebp 4] mov edx, DWORD PTR [ebp+8] add edx, eax mov eax, DWORD PTR [ ebp+12] add eax, edx mov DWORD PTR [ ebp 8], eax mov eax, DWORD PTR [ ebp 8] leave r e t 0x05C 0x058 0x054 0x050 0x04C 0x048 0x044 0x040 0x0C 5 EIP main ebp Dan, David and Héctor (UCL) Assembly October 2,
63 mysum: push ebp mov ebp, esp sub esp, 16 mov DWORD PTR [ ebp 4], mov eax, DWORD PTR [ ebp 4] mov edx, DWORD PTR [ ebp+8] add edx, eax mov eax, DWORD PTR [ ebp+12] add eax, edx mov DWORD PTR [ ebp 8], eax mov eax, DWORD PTR [ ebp 8] leave r e t 0x05C 0x058 0x054 0x050 0x04C 0x048 0x044 0x040 0x0C 5 EIP main ebp Dan, David and Héctor (UCL) Assembly October 2,
64 mysum: push ebp mov ebp, esp sub esp, 16 mov DWORD PTR [ ebp 4], mov eax, DWORD PTR [ ebp 4] mov edx, DWORD PTR [ ebp+8] add edx, eax mov eax, DWORD PTR [ebp+12] add eax, edx mov DWORD PTR [ ebp 8], eax mov eax, DWORD PTR [ ebp 8] leave r e t 0x05C 0x058 0x054 0x050 0x04C 0x048 0x044 0x040 0x0C 5 EIP main ebp Dan, David and Héctor (UCL) Assembly October 2,
65 mysum: push ebp mov ebp, esp sub esp, 16 mov DWORD PTR [ ebp 4], mov eax, DWORD PTR [ ebp 4] mov edx, DWORD PTR [ ebp+8] add edx, eax mov eax, DWORD PTR [ ebp+12] add eax, edx mov DWORD PTR [ ebp 8], eax mov eax, DWORD PTR [ ebp 8] leave r e t 0x05C 0x058 0x054 0x050 0x04C 0x048 0x044 0x040 0x0C 5 EIP main ebp Dan, David and Héctor (UCL) Assembly October 2,
66 mysum: push ebp mov ebp, esp sub esp, 16 mov DWORD PTR [ ebp 4], mov eax, DWORD PTR [ ebp 4] mov edx, DWORD PTR [ ebp+8] add edx, eax mov eax, DWORD PTR [ ebp+12] add eax, edx mov DWORD PTR [ebp-8], eax mov eax, DWORD PTR [ ebp 8] leave r e t 0x05C 0x058 0x054 0x050 0x04C 0x048 0x044 0x040 0x0C 5 EIP main ebp 11 Dan, David and Héctor (UCL) Assembly October 2,
67 mysum: push ebp mov ebp, esp sub esp, 16 mov DWORD PTR [ ebp 4], mov eax, DWORD PTR [ ebp 4] mov edx, DWORD PTR [ ebp+8] add edx, eax mov eax, DWORD PTR [ ebp+12] add eax, edx mov DWORD PTR [ ebp 8], eax mov eax, DWORD PTR [ebp-8] leave r e t 0x05C 0x058 0x054 0x050 0x04C 0x048 0x044 0x040 0x0C 5 EIP main ebp 11 Dan, David and Héctor (UCL) Assembly October 2,
68 mysum: push ebp mov ebp, esp sub esp, 16 mov DWORD PTR [ ebp 4], mov eax, DWORD PTR [ ebp 4] mov edx, DWORD PTR [ ebp+8] add edx, eax mov eax, DWORD PTR [ ebp+12] add eax, edx mov DWORD PTR [ ebp 8], eax mov eax, DWORD PTR [ ebp 8] leave r e t 0x05C 0x058 0x054 0x050 0x04C 0x048 0x044 0x040 0x0C 5 EIP main ebp Dan, David and Héctor (UCL) Assembly October 2,
69 mysum: push ebp mov ebp, esp sub esp, 16 mov DWORD PTR [ ebp 4], mov eax, DWORD PTR [ ebp 4] mov edx, DWORD PTR [ ebp+8] add edx, eax mov eax, DWORD PTR [ ebp+12] add eax, edx mov DWORD PTR [ ebp 8], eax mov eax, DWORD PTR [ ebp 8] leave r e t 0x05C 0x058 0x054 0x050 0x04C 0x048 0x044 0x040 0x0C 5 EIP Dan, David and Héctor (UCL) Assembly October 2,
70 mysum: push ebp mov ebp, esp sub esp, 16 mov DWORD PTR [ ebp 4], mov eax, DWORD PTR [ ebp 4] mov edx, DWORD PTR [ ebp+8] add edx, eax mov eax, DWORD PTR [ ebp+12] add eax, edx mov DWORD PTR [ ebp 8], eax mov eax, DWORD PTR [ ebp 8] leave ret 0x05C 0x058 0x054 0x050 0x04C 0x048 0x044 0x040 0x0C 5 Dan, David and Héctor (UCL) Assembly October 2,
71 Exercises 5 Modify exercise 4 and include AND, OR and XOR operations. 6 Ask the user to introduce two numbers and print the value of the greater and smaller. 7 Ask the user how many numbers he wants to introduce. Latter, ask him every number (the maximum will be 100). Print the maximum and minimum of these numbers. 8 Modify exercise 4 to use the stack for controlling the variables. Dan, David and Héctor (UCL) Assembly October 2,
Program Exploitation Intro
Program Exploitation Intro x86 Assembly 04//2018 Security 1 Univeristà Ca Foscari, Venezia What is Program Exploitation "Making a program do something unexpected and not planned" The right bugs can be
X86 Addressing Modes Chapter 3" Review: Instructions to Recognize"
X86 Addressing Modes Chapter 3" Review: Instructions to Recognize" 1 Arithmetic Instructions (1)! Two Operand Instructions" ADD Dest, Src Dest = Dest + Src SUB Dest, Src Dest = Dest - Src MUL Dest, Src
CSC 2400: Computer Systems. Towards the Hardware: Machine-Level Representation of Programs
CSC 2400: Computer Systems Towards the Hardware: Machine-Level Representation of Programs Towards the Hardware High-level language (Java) High-level language (C) assembly language machine language (IA-32)
CSC 8400: Computer Systems. Machine-Level Representation of Programs
CSC 8400: Computer Systems Machine-Level Representation of Programs Towards the Hardware High-level language (Java) High-level language (C) assembly language machine language (IA-32) 1 Compilation Stages
complement) Multiply Unsigned: MUL (all operands are nonnegative) AX = BH * AL IMUL BH IMUL CX (DX,AX) = CX * AX Arithmetic MUL DWORD PTR [0x10]
![complement) Multiply Unsigned: MUL (all operands are nonnegative) AX = BH * AL IMUL BH IMUL CX (DX,AX) = CX * AX Arithmetic MUL DWORD PTR [0x10]](/thumbs/76/72989659.jpg "complement) Multiply Unsigned: MUL (all operands are nonnegative) AX = BH * AL IMUL BH IMUL CX (DX,AX) = CX * AX Arithmetic MUL DWORD PTR [0x10]")
The following pages contain references for use during the exam: tables containing the x86 instruction set (covered so far) and condition codes. You do not need to submit these pages when you finish your
Practical Malware Analysis
Practical Malware Analysis Ch 4: A Crash Course in x86 Disassembly Revised 1-16-7 Basic Techniques Basic static analysis Looks at malware from the outside Basic dynamic analysis Only shows you how the
Reverse Engineering Low Level Software. CS5375 Software Reverse Engineering Dr. Jaime C. Acosta
1 Reverse Engineering Low Level Software CS5375 Software Reverse Engineering Dr. Jaime C. Acosta Machine code 2 3 Machine code Assembly compile Machine Code disassemble 4 Machine code Assembly compile
Lecture 2 Assembly Language
Lecture 2 Assembly Language Computer and Network Security 9th of October 2017 Computer Science and Engineering Department CSE Dep, ACS, UPB Lecture 2, Assembly Language 1/37 Recap: Explorations Tools assembly
CS412/CS413. Introduction to Compilers Tim Teitelbaum. Lecture 21: Generating Pentium Code 10 March 08
CS412/CS413 Introduction to Compilers Tim Teitelbaum Lecture 21: Generating Pentium Code 10 March 08 CS 412/413 Spring 2008 Introduction to Compilers 1 Simple Code Generation Three-address code makes it
CS241 Computer Organization Spring 2015 IA
CS241 Computer Organization Spring 2015 IA-32 2-10 2015 Outline! Review HW#3 and Quiz#1! More on Assembly (IA32) move instruction (mov) memory address computation arithmetic & logic instructions (add,
CS165 Computer Security. Understanding low-level program execution Oct 1 st, 2015
CS165 Computer Security Understanding low-level program execution Oct 1 st, 2015 A computer lets you make more mistakes faster than any invention in human history - with the possible exceptions of handguns
16.317: Microprocessor Systems Design I Fall 2015
16.317: Microprocessor Systems Design I Fall 2015 Exam 2 Solution 1. (16 points, 4 points per part) Multiple choice For each of the multiple choice questions below, clearly indicate your response by circling
Basic Pentium Instructions. October 18
Basic Pentium Instructions October 18 CSC201 Section 002 Fall, 2000 The EFLAGS Register Bit 11 = Overflow Flag Bit 7 = Sign Flag Bit 6 = Zero Flag Bit 0 = Carry Flag "Sets the flags" means sets OF, ZF,
Module 3 Instruction Set Architecture (ISA)
Module 3 Instruction Set Architecture (ISA) I S A L E V E L E L E M E N T S O F I N S T R U C T I O N S I N S T R U C T I O N S T Y P E S N U M B E R O F A D D R E S S E S R E G I S T E R S T Y P E S O
An Introduction to x86 ASM
An Introduction to x86 ASM Malware Analysis Seminar Meeting 1 Cody Cutler, Anton Burtsev Registers General purpose EAX, EBX, ECX, EDX ESI, EDI (index registers, but used as general in 32-bit protected
16.317: Microprocessor Systems Design I Fall 2014
16.317: Microprocessor Systems Design I Fall 2014 Exam 2 Solution 1. (16 points, 4 points per part) Multiple choice For each of the multiple choice questions below, clearly indicate your response by circling
Lecture 15 Intel Manual, Vol. 1, Chapter 3. Fri, Mar 6, Hampden-Sydney College. The x86 Architecture. Robb T. Koether. Overview of the x86
Lecture 15 Intel Manual, Vol. 1, Chapter 3 Hampden-Sydney College Fri, Mar 6, 2009 Outline 1 2 Overview See the reference IA-32 Intel Software Developer s Manual Volume 1: Basic, Chapter 3. Instructions
The x86 Architecture
The x86 Architecture Lecture 24 Intel Manual, Vol. 1, Chapter 3 Robb T. Koether Hampden-Sydney College Fri, Mar 20, 2015 Robb T. Koether (Hampden-Sydney College) The x86 Architecture Fri, Mar 20, 2015
CPS104 Recitation: Assembly Programming
CPS104 Recitation: Assembly Programming Alexandru Duțu 1 Facts OS kernel and embedded software engineers use assembly for some parts of their code some OSes had their entire GUIs written in assembly in
mith College Computer Science CSC231 Assembly Week #11 Fall 2017 Dominique Thiébaut
mith College Computer Science CSC231 Assembly Week #11 Fall 2017 Dominique Thiébaut dthiebaut@smith.edu Back to Conditional Jumps Review sub eax, 10 jz there xxx xxx there:yyy yyy Review cmp eax, 10 jz
CNIT 127: Exploit Development. Ch 1: Before you begin. Updated
CNIT 127: Exploit Development Ch 1: Before you begin Updated 1-14-16 Basic Concepts Vulnerability A flaw in a system that allows an attacker to do something the designer did not intend, such as Denial
Introduction to Intel x86-64 Assembly, Architecture, Applications, & Alliteration. Xeno Kovah 2014 xkovah at gmail
Introduction to Intel x86-64 Assembly, Architecture, Applications, & Alliteration Xeno Kovah 2014 xkovah at gmail All materials is licensed under a Creative Commons Share Alike license. http://creativecommons.org/licenses/by-sa/3.0/
Conditional Processing
١ Conditional Processing Computer Organization & Assembly Language Programming Dr Adnan Gutub aagutub at uqu.edu.sa Presentation Outline [Adapted from slides of Dr. Kip Irvine: Assembly Language for Intel-Based
CS 31: Intro to Systems ISAs and Assembly. Kevin Webb Swarthmore College February 9, 2016
CS 31: Intro to Systems ISAs and Assembly Kevin Webb Swarthmore College February 9, 2016 Reading Quiz Overview How to directly interact with hardware Instruction set architecture (ISA) Interface between
Computer Architecture and Assembly Language. Practical Session 3
Computer Architecture and Assembly Language Practical Session 3 Advanced Instructions division DIV r/m - unsigned integer division IDIV r/m - signed integer division Dividend Divisor Quotient Remainder
Lab 6: Conditional Processing
COE 205 Lab Manual Lab 6: Conditional Processing Page 56 Lab 6: Conditional Processing Contents 6.1. Unconditional Jump 6.2. The Compare Instruction 6.3. Conditional Jump Instructions 6.4. Finding the
CS 31: Intro to Systems ISAs and Assembly. Kevin Webb Swarthmore College September 25, 2018
CS 31: Intro to Systems ISAs and Assembly Kevin Webb Swarthmore College September 25, 2018 Overview How to directly interact with hardware Instruction set architecture (ISA) Interface between programmer
Intel Instruction Set (gas)
Intel Instruction Set (gas) These slides provide the gas format for a subset of the Intel processor instruction set, including: Operation Mnemonic Name of Operation Syntax Operation Examples Effect on
Reverse Engineering II: Basics. Gergely Erdélyi Senior Antivirus Researcher
Reverse Engineering II: Basics Gergely Erdélyi Senior Antivirus Researcher Agenda Very basics Intel x86 crash course Basics of C Binary Numbers Binary Numbers 1 Binary Numbers 1 0 1 1 Binary Numbers 1
Reverse Engineering II: The Basics
Reverse Engineering II: The Basics This document is only to be distributed to teachers and students of the Malware Analysis and Antivirus Technologies course and should only be used in accordance with
Reverse Engineering II: The Basics
Reverse Engineering II: The Basics Gergely Erdélyi Senior Manager, Anti-malware Research Protecting the irreplaceable f-secure.com Binary Numbers 1 0 1 1 - Nibble B 1 0 1 1 1 1 0 1 - Byte B D 1 0 1 1 1
Q1: Multiple choice / 20 Q2: Protected mode memory accesses
16.317: Microprocessor-Based Systems I Summer 2012 Exam 2 August 1, 2012 Name: ID #: For this exam, you may use a calculator and one 8.5 x 11 double-sided page of notes. All other electronic devices (e.g.,
CMSC 313 Lecture 07. Short vs Near Jumps Logical (bit manipulation) Instructions AND, OR, NOT, SHL, SHR, SAL, SAR, ROL, ROR, RCL, RCR
CMSC 313 Lecture 07 Short vs Near Jumps Logical (bit manipulation) Instructions AND, OR, NOT, SHL, SHR, SAL, SAR, ROL, ROR, RCL, RCR More Arithmetic Instructions NEG, MUL, IMUL, DIV Indexed Addressing:
Second Part of the Course
CSC 2400: Computer Systems Towards the Hardware 1 Second Part of the Course Toward the hardware High-level language (C) assembly language machine language (IA-32) 2 High-Level Language g Make programming
Rev101. spritzers - CTF team. spritz.math.unipd.it/spritzers.html
Rev101 spritzers - CTF team spritz.math.unipd.it/spritzers.html Disclaimer All information presented here has the only purpose of teaching how reverse engineering works. Use your mad skillz only in CTFs
Introduction to IA-32. Jo, Heeseung
Introduction to IA-32 Jo, Heeseung IA-32 Processors Evolutionary design Starting in 1978 with 8086 Added more features as time goes on Still support old features, although obsolete Totally dominate computer
Ex: Write a piece of code that transfers a block of 256 bytes stored at locations starting at 34000H to locations starting at 36000H. Ans.
INSTRUCTOR: ABDULMUTTALIB A H ALDOURI Conditional Jump Cond Unsigned Signed = JE : Jump Equal JE : Jump Equal ZF = 1 JZ : Jump Zero JZ : Jump Zero ZF = 1 JNZ : Jump Not Zero JNZ : Jump Not Zero ZF = 0
INTRODUCTION TO IA-32. Jo, Heeseung
INTRODUCTION TO IA-32 Jo, Heeseung IA-32 PROCESSORS Evolutionary design Starting in 1978 with 8086 Added more features as time goes on Still support old features, although obsolete Totally dominate computer
Complex Instruction Set Computer (CISC)
Introduction ti to IA-32 IA-32 Processors Evolutionary design Starting in 1978 with 886 Added more features as time goes on Still support old features, although obsolete Totally dominate computer market
CS61 Section Solutions 3
CS61 Section Solutions 3 (Week of 10/1-10/5) 1. Assembly Operand Specifiers 2. Condition Codes 3. Jumps 4. Control Flow Loops 5. Procedure Calls 1. Assembly Operand Specifiers Q1 Operand Value %eax 0x104
CS 31: Intro to Systems ISAs and Assembly. Martin Gagné Swarthmore College February 7, 2017
CS 31: Intro to Systems ISAs and Assembly Martin Gagné Swarthmore College February 7, 2017 ANNOUNCEMENT All labs will meet in SCI 252 (the robot lab) tomorrow. Overview How to directly interact with hardware
Basic Execution Environment
Basic Execution Environment 3 CHAPTER 3 BASIC EXECUTION ENVIRONMENT This chapter describes the basic execution environment of an Intel Architecture processor as seen by assembly-language programmers.
Introduction to 8086 Assembly
Introduction to 8086 Assembly Lecture 5 Jump, Conditional Jump, Looping, Compare instructions Labels and jumping (the jmp instruction) mov eax, 1 add eax, eax jmp label1 xor eax, eax label1: sub eax, 303
IFE: Course in Low Level Programing. Lecture 6
IFE: Course in Low Level Programing Lecture 6 Instruction Set of Intel x86 Microprocessors Conditional jumps Jcc jump on condition cc, JMP jump always, CALL call a procedure, RET return from procedure,
Assembly Language: IA-32 Instructions
Assembly Language: IA-32 Instructions 1 Goals of this Lecture Help you learn how to: Manipulate data of various sizes Leverage more sophisticated addressing modes Use condition codes and jumps to change
Chapter 12. Selected Pentium Instructions
Chapter 12 Selected Pentium Instructions 1 2 Chapter 12 12 1 Carry flag indicates out-of-range error for unsigned operations. Chapter 12 3 12 2 Overflow flag indicates out-of-range error for signed operations.
mith College Computer Science CSC231 Assembly Week #9 Spring 2017 Dominique Thiébaut
mith College Computer Science CSC231 Assembly Week #9 Spring 2017 Dominique Thiébaut dthiebaut@smith.edu 2 Videos to Watch at a Later Time https://www.youtube.com/watch?v=fdmzngwchdk https://www.youtube.com/watch?v=k2iz1qsx4cm
LABORATORY WORK NO. 7 FLOW CONTROL INSTRUCTIONS
LABORATORY WORK NO. 7 FLOW CONTROL INSTRUCTIONS 1. Object of laboratory The x86 microprocessor family has a large variety of instructions that allow instruction flow control. We have 4 categories: jump,
SOEN228, Winter Revision 1.2 Date: October 25,
SOEN228, Winter 2003 Revision 1.2 Date: October 25, 2003 1 Contents Flags Mnemonics Basic I/O Exercises Overview of sample programs 2 Flag Register The flag register stores the condition flags that retain
EECE.3170: Microprocessor Systems Design I Summer 2017 Homework 4 Solution
1. (40 points) Write the following subroutine in x86 assembly: Recall that: int f(int v1, int v2, int v3) { int x = v1 + v2; urn (x + v3) * (x v3); Subroutine arguments are passed on the stack, and can
A CRASH COURSE IN X86 DISASSEMBLY
A CRASH COURSE IN X86 DISASSEMBLY As discussed in previous chapters, basic static and dynamic malware analysis methods are good for initial triage, but they do not provide enough information to analyze
Machine-level Representation of Programs. Jin-Soo Kim Computer Systems Laboratory Sungkyunkwan University
Machine-level Representation of Programs Jin-Soo Kim (jinsookim@skku.edu) Computer Systems Laboratory Sungkyunkwan University http://csl.skku.edu Program? 짬뽕라면 준비시간 :10 분, 조리시간 :10 분 재료라면 1개, 스프 1봉지, 오징어
Intel 8086: Instruction Set
IUST-EE (Chapter 6) Intel 8086: Instruction Set 1 Outline Instruction Set Data Transfer Instructions Arithmetic Instructions Bit Manipulation Instructions String Instructions Unconditional Transfer Instruction
3.1 DATA MOVEMENT INSTRUCTIONS 45
3.1.1 General-Purpose Data Movement s 45 3.1.2 Stack Manipulation... 46 3.1.3 Type Conversion... 48 3.2.1 Addition and Subtraction... 51 3.1 DATA MOVEMENT INSTRUCTIONS 45 MOV (Move) transfers a byte, word,
Marking Scheme. Examination Paper Department of CE. Module: Microprocessors (630313)
Philadelphia University Faculty of Engineering Marking Scheme Examination Paper Department of CE Module: Microprocessors (630313) Final Exam Second Semester Date: 02/06/2018 Section 1 Weighting 40% of
SPRING TERM BM 310E MICROPROCESSORS LABORATORY PRELIMINARY STUDY
BACKGROUND 8086 CPU has 8 general purpose registers listed below: AX - the accumulator register (divided into AH / AL): 1. Generates shortest machine code 2. Arithmetic, logic and data transfer 3. One
mith College Computer Science CSC231 Assembly Week #10 Fall 2017 Dominique Thiébaut
mith College Computer Science CSC231 Assembly Week #10 Fall 2017 Dominique Thiébaut dthiebaut@smith.edu 2 Videos to Start With https://www.youtube.com/watch?v=fdmzngwchdk https://www.youtube.com/watch?v=k2iz1qsx4cm
Assembly II: Control Flow. Jin-Soo Kim Computer Systems Laboratory Sungkyunkwan University
Assembly II: Control Flow Jin-Soo Kim (jinsookim@skku.edu) Computer Systems Laboratory Sungkyunkwan University http://csl.skku.edu Processor State (x86-64) RAX 63 31 EAX 0 RBX EBX RCX RDX ECX EDX General-purpose
PESIT Bangalore South Campus
INTERNAL ASSESSMENT TEST 2 Date : 02/04/2018 Max Marks: 40 Subject & Code : Microprocessor (15CS44) Section : IV A and B Name of faculty: Deepti.C Time : 8:30 am-10:00 am Note: Note: Answer any five complete
Assembly level Programming. 198:211 Computer Architecture. (recall) Von Neumann Architecture. Simplified hardware view. Lecture 10 Fall 2012
19:211 Computer Architecture Lecture 10 Fall 20 Topics:Chapter 3 Assembly Language 3.2 Register Transfer 3. ALU 3.5 Assembly level Programming We are now familiar with high level programming languages
The Instruction Set. Chapter 5
The Instruction Set Architecture Level(ISA) Chapter 5 1 ISA Level The ISA level l is the interface between the compilers and the hardware. (ISA level code is what a compiler outputs) 2 Memory Models An
Assembly Language for Intel-Based Computers, 4 th Edition. Chapter 6: Conditional Processing
Assembly Language for Intel-Based Computers, 4 th Edition Kip R. Irvine Chapter 6: Conditional Processing (c) Pearson Education, 2002. All rights reserved. Chapter Overview Boolean and Comparison Instructions
Islamic University Gaza Engineering Faculty Department of Computer Engineering ECOM 2125: Assembly Language LAB. Lab # 7. Procedures and the Stack
Islamic University Gaza Engineering Faculty Department of Computer Engineering ECOM 2125: Assembly Language LAB Lab # 7 Procedures and the Stack April, 2014 1 Assembly Language LAB Runtime Stack and Stack
16.317: Microprocessor Systems Design I Spring 2015
16.317: Microprocessor Systems Design I Spring 2015 Exam 2 Solution 1. (16 points, 4 points per part) Multiple choice For each of the multiple choice questions below, clearly indicate your response by
CSE P 501 Compilers. x86 Lite for Compiler Writers Hal Perkins Autumn /25/ Hal Perkins & UW CSE J-1
CSE P 501 Compilers x86 Lite for Compiler Writers Hal Perkins Autumn 2011 10/25/2011 2002-11 Hal Perkins & UW CSE J-1 Agenda Learn/review x86 architecture Core 32-bit part only for now Ignore crufty, backward-compatible
CMSC 313 Lecture 05 [draft]
![CMSC 313 Lecture 05 [draft]](/thumbs/75/71799209.jpg "CMSC 313 Lecture 05 [draft]")
CMSC 313 Lecture 05 [draft] More on Conditional Jump Instructions Short Jumps vs Near Jumps Using Jump Instructions Logical (bit manipulation) Instructions AND, OR, NOT, SHL, SHR, SAL, SAR, ROL, ROR, RCL,
Assembly II: Control Flow
Assembly II: Control Flow Jinkyu Jeong (jinkyu@skku.edu) Computer Systems Laboratory Sungkyunkwan University http://csl.skku.edu SSE2030: Introduction to Computer Systems, Spring 2018, Jinkyu Jeong (jinkyu@skku.edu)
x86 Assembly Tutorial COS 318: Fall 2017
x86 Assembly Tutorial COS 318: Fall 2017 Project 1 Schedule Design Review: Monday 9/25 Sign up for 10-min slot from 3:00pm to 7:00pm Complete set up and answer posted questions (Official) Precept: Monday
Instructions moving data
do not affect flags. Instructions moving data mov register/mem, register/mem/number (move data) The difference between the value and the address of a variable mov al,sum; value 56h al mov ebx,offset Sum;
Assembly Programmer s View Lecture 4A Machine-Level Programming I: Introduction
Assembly Programmer s View Lecture 4A Machine-Level Programming I: Introduction E I P CPU isters Condition Codes Addresses Data Instructions Memory Object Code Program Data OS Data Topics Assembly Programmer
Buffer Overflow Attack
Buffer Overflow Attack What every applicant for the hacker should know about the foundation of buffer overflow attacks By (Dalgona@wowhacker.org) Email: zinwon@gmail.com 2005 9 5 Abstract Buffer overflow.
6/20/2011. Introduction. Chapter Objectives Upon completion of this chapter, you will be able to:
Introduction Efficient software development for the microprocessor requires a complete familiarity with the addressing modes employed by each instruction. This chapter explains the operation of the stack
x64 Cheat Sheet Fall 2014
CS 33 Intro Computer Systems Doeppner x64 Cheat Sheet Fall 2014 1 x64 Registers x64 assembly code uses sixteen 64-bit registers. Additionally, the lower bytes of some of these registers may be accessed
Computer Architecture and System Programming Laboratory. TA Session 3
Computer Architecture and System Programming Laboratory TA Session 3 Stack - LIFO word-size data structure STACK is temporary storage memory area register points on top of stack (by default, it is highest
Inline Assembler. Willi-Hans Steeb and Yorick Hardy. International School for Scientific Computing
Inline Assembler Willi-Hans Steeb and Yorick Hardy International School for Scientific Computing e-mail: steebwilli@gmail.com Abstract We provide a collection of inline assembler programs. 1 Using the
COMPUTER ENGINEERING DEPARTMENT
Page 1 of 11 COMPUTER ENGINEERING DEPARTMENT December 31, 2007 COE 205 COMPUTER ORGANIZATION & ASSEMBLY PROGRAMMING Major Exam II First Semester (071) Time: 7:00 PM-9:30 PM Student Name : KEY Student ID.
Towards the Hardware"
CSC 2400: Computer Systems Towards the Hardware Chapter 2 Towards the Hardware High-level language (Java) High-level language (C) assembly language machine language (IA-32) 1 High-Level Language Make programming
Chapter 3: Addressing Modes
Chapter 3: Addressing Modes Chapter 3 Addressing Modes Note: Adapted from (Author Slides) Instructor: Prof. Dr. Khalid A. Darabkh 2 Introduction Efficient software development for the microprocessor requires
Introduction to Reverse Engineering. Alan Padilla, Ricardo Alanis, Stephen Ballenger, Luke Castro, Jake Rawlins
Introduction to Reverse Engineering Alan Padilla, Ricardo Alanis, Stephen Ballenger, Luke Castro, Jake Rawlins Reverse Engineering (of Software) What is it? What is it for? Binary exploitation (the cool
Low-Level Essentials for Understanding Security Problems Aurélien Francillon
Low-Level Essentials for Understanding Security Problems Aurélien Francillon francill@eurecom.fr Computer Architecture The modern computer architecture is based on Von Neumann Two main parts: CPU (Central
Dr. Ramesh K. Karne Department of Computer and Information Sciences, Towson University, Towson, MD /12/2014 Slide 1
Dr. Ramesh K. Karne Department of Computer and Information Sciences, Towson University, Towson, MD 21252 rkarne@towson.edu 11/12/2014 Slide 1 Intel x86 Aseembly Language Assembly Language Assembly Language
EXPERIMENT WRITE UP. LEARNING OBJECTIVES: 1. Get hands on experience with Assembly Language Programming 2. Write and debug programs in TASM/MASM
EXPERIMENT WRITE UP AIM: Assembly language program for 16 bit BCD addition LEARNING OBJECTIVES: 1. Get hands on experience with Assembly Language Programming 2. Write and debug programs in TASM/MASM TOOLS/SOFTWARE
Signed number Arithmetic. Negative number is represented as
Signed number Arithmetic Signed and Unsigned Numbers An 8 bit number system can be used to create 256 combinations (from 0 to 255), and the first 128 combinations (0 to 127) represent positive numbers
We will first study the basic instructions for doing multiplications and divisions
MULTIPLICATION, DIVISION AND NUMERICAL CONVERSIONS We will first study the basic instructions for doing multiplications and divisions We then use these instructions to 1. Convert a string of ASCII digits
Ex : Write an ALP to evaluate x(y + z) where x = 10H, y = 20H and z = 30H and store the result in a memory location 54000H.
Ex : Write an ALP to evaluate x(y + z) where x = 10H, y = 20H and z = 30H and store the result in a memory location 54000H. MOV AX, 5000H MOV DS, AX MOV AL, 20H MOV CL, 30H ADD AL, CL MOV CL, 10H MUL CL
x86 assembly CS449 Fall 2017
x86 assembly CS449 Fall 2017 x86 is a CISC CISC (Complex Instruction Set Computer) e.g. x86 Hundreds of (complex) instructions Only a handful of registers RISC (Reduced Instruction Set Computer) e.g. MIPS
System calls and assembler
System calls and assembler Michal Sojka sojkam1@fel.cvut.cz ČVUT, FEL License: CC-BY-SA 4.0 System calls (repetition from lectures) A way for normal applications to invoke operating system (OS) kernel's
CS 261 Fall Mike Lam, Professor. x86-64 Control Flow
CS 261 Fall 2018 Mike Lam, Professor x86-64 Control Flow Topics Condition codes Jumps Conditional moves Jump tables Motivation We cannot translate the following C function to assembly, using only data
CS24: INTRODUCTION TO COMPUTING SYSTEMS. Spring 2016 Lecture 12
CS24: INTRODUCTION TO COMPUTING SYSTEMS Spring 2016 Lecture 12 CS24 MIDTERM Midterm format: 6 hour overall time limit, multiple sittings (If you are focused on midterm, clock should be running.) Open book
Assembly Language LAB
Assembly Language LAB Islamic University Gaza Engineering Faculty Department of Computer Engineering 2013 ECOM 2125: Assembly Language LAB Created by: Eng. Ahmed M. Ayash Modified and Presented By: Eihab
administrivia today start assembly probably won t finish all these slides Assignment 4 due tomorrow any questions?
administrivia today start assembly probably won t finish all these slides Assignment 4 due tomorrow any questions? exam on Wednesday today s material not on the exam 1 Assembly Assembly is programming
CSE2421 FINAL EXAM SPRING Name KEY. Instructions: Signature
CSE2421 FINAL EXAM SPRING 2013 Name KEY Instructions: This is a closed-book, closed-notes, closed-neighbor exam. Only a writing utensil is needed for this exam. No calculators allowed. If you need to go
Overview of Compiler. A. Introduction
CMPSC 470 Lecture 01 Topics: Overview of compiler Compiling process Structure of compiler Programming language basics Overview of Compiler A. Introduction What is compiler? What is interpreter? A very
CSCE 212H, Spring 2008 Lab Assignment 3: Assembly Language Assigned: Feb. 7, Due: Feb. 14, 11:59PM
CSCE 212H, Spring 2008 Lab Assignment 3: Assembly Language Assigned: Feb. 7, Due: Feb. 14, 11:59PM February 7, 2008 1 Overview The purpose of this assignment is to introduce you to the assembly language
Assembly Language Each statement in an assembly language program consists of four parts or fields.
Chapter 3: Addressing Modes Assembly Language Each statement in an assembly language program consists of four parts or fields. The leftmost field is called the label. - used to identify the name of a memory
EXPERIMENT WRITE UP. LEARNING OBJECTIVES: 1. Get hands on experience with Assembly Language Programming 2. Write and debug programs in TASM/MASM
EXPERIMENT WRITE UP AIM: Assembly language program to search a number in given array. LEARNING OBJECTIVES: 1. Get hands on experience with Assembly Language Programming 2. Write and debug programs in TASM/MASM
BAHAR DÖNEMİ MİKROİŞLEMCİLER LAB4 FÖYÜ
LAB4 RELATED INSTRUCTIONS: Compare, division and jump instructions CMP REG, memory memory, REG REG, REG memory, immediate REG, immediate operand1 - operand2 Result is not stored anywhere, flags are set
Marking Scheme. Examination Paper. Module: Microprocessors (630313)
Philadelphia University Faculty of Engineering Marking Scheme Examination Paper Department of CE Module: Microprocessors (630313) Final Exam Second Semester Date: 12/06/2017 Section 1 Weighting 40% of
Assembly Language Lab # 9
Faculty of Engineering Computer Engineering Department Islamic University of Gaza 2011 Assembly Language Lab # 9 Stacks and Subroutines Eng. Doaa Abu Jabal Assembly Language Lab # 9 Stacks and Subroutines
Do not turn the page until 5:10.
University of Washington Computer Science & Engineering Autumn 2018 Instructor: Justin Hsia 2018-10-29 Last Name: First Name: Student ID Number: Name of person to your Left Right All work is my own. I