mith College Computer Science CSC231 Assembly Week #12 Thanksgiving 2017 Dominique Thiébaut

Size: px
Start display at page:

Download "mith College Computer Science CSC231 Assembly Week #12 Thanksgiving 2017 Dominique Thiébaut"

Transcription

1 mith College Computer Science CSC231 Assembly Week #12 Thanksgiving 2017 Dominique Thiébaut

2 ;;; FUNCTION SIDE function: ebp ;save old ebp ebp, esp ;make ebp point ;to stack frame Summary dword[ebp+8] ;access paramn dword[ebp+12];access paramn-1 ;restore ebp N ;return and pop ;4N bytes from stack ;;; CALLER SIDE param1 param2 paramn function

3 Summary ;;; FUNCTION SIDE function: ebp ;save old ebp ebp, esp ;make ebp point ;to stack frame -registers-you-will-use (clean function) dword[ebp+8] ;access param1 dword[ebp+12];access param2 ;;; CALLER SIDE pop-register-you-used ;restore ebp N ;return and pop ;4N bytes from stack param1 param2 paramn function

4 Useful Instructions for Functions ad popad ; EAX, ECX, EDX, ;EBX, original ESP, ; EBP, ESI, and EDI. ;pop them back in ;reverse order

5 ;;; ; ;;; ; _printstring: prints a string whose address is in ;;; ; ecx, and whose total number of chars ;;; ; is in edx. ;;; ; Examples: ;;; ; Assume a string labeled msg, containing "Hello World!", ;;; ; and a constant MSGLEN equal to 12. To print this string: ;;; ; ;;; ; ecx, msg ;;; ; edx, MSGLEN ;;; ; _printstring ;;; ; ;;; ; REGISTERS MODIFIED: NONE ;;; ; ;;; ;save and ebx so that they are not modified by the function Example 1 _printstring: int pop pop ret ebx,sys_write ebx,stdout 0x80 ebx

6 ;;; ; ;;; ; ;;; ; getinput: gets a numerical input from the keyboard. ;;; ; returns the resulting number in (32 bits). ;;; ; recognizes - as the first character of ;;; ; negative numbers. Does not skip whitespace ;;; ; at the beginning. Stops on first not decimal ;;; ; character encountered. ;;; ; ;;; ; NO REGISTERS MODIFIED, except ;;; ; ;;; ; Example of : ;;; ; ;;; ; getinput ;;; ; dword[x], ; put integer in x ;;; ; ;;; ; ;;; ; _getinput: section.bss buffer resb 120 intg resd 1 isneg resb 1 Example 2 ad ; save all registers.loop1: esi, buffer ; eci --> buffer edi, 0 ; edi = counter of chars, 03 ; input ebx, 0 ; stdin ecx, esi ; where to put the next char ; cut for the sake of simplicity. Look in 231Lib.asm for more info!

7 Dot-Labels ;;; ; ;;; ; printline: esi, buffer ; esi --> buffer edi, 0 ; edi = counter of chars.loop1:, 03 ; input ebx, 0 ; stdin ecx, esi ; where to put the next char loop.loop1.for1:.for2:... ret ;;; ; ;;; ; printreg: esi, buffer edi, 0.for1:.for2: ret

8 Dot-Labels ;;; ; ;;; ; printline: esi, buffer ; esi --> buffer edi, 0 ; edi = counter of chars.loop1:, 03 ; input ebx, 0 ; stdin ecx, esi ; where to put the next char loop.loop1.for1:.for2:... ret ;;; ; ;;; ; printreg: esi, buffer edi, 0.for1: printline.for2:.for2: ret printreg.for2:

9 Exercise Write a function that copies an array of N bytes into another array of N bytes. The function receives three parameters: the address of the first array, the address of the second array, and the number of bytes. void copyarrays( table1, table2, N );

10 Passing through registers Passing through the stack Passing by Value Passing by Reference

11 Rule for Writing Functions: Pushing and popping operations into/from the stack must always cancel each other out! ( a + 3 ( b^2 + ( c+1) ^(d-1) ) ) Same as with parentheses

12 # example.py from future import print_function def ( array ): for i in range( len( array ) ): array[ i ] += 1 Table = [1, 2, 3, 4] print( str( Table ) ) ( Table ) print( str( Table ) ) An Example : ebp ebp, esp ebx ecx ecx, 4 ebx, dword[ebp+8], Table

13 # example.py from future import print_function def ( array ): for i in range( len( array ) ): array[ i ] += 1 Table = [1, 2, 3, 4] print( str( Table ) ) ( Table ) print( str( Table ) ) An Example : ebp ebp, esp ebx ecx ecx, 4 ebx, dword[ebp+8], Table

14 # example.py from future import print_function def ( array ): for i in range( len( array ) ): array[ i ] += 1 Table = [1, 2, 3, 4] print( str( Table ) ) ( Table ) print( str( Table ) ) An Example : ebp ebp, esp ebx ecx ecx, 4 ebx, dword[ebp+8], Table

15 # example.py from future import print_function def ( array ): for i in range( len( array ) ): array[ i ] += 1 Table = [1, 2, 3, 4] print( str( Table ) ) ( Table ) print( str( Table ) ) An Example : ebp ebp, esp ebx ecx ecx, 4 ebx, dword[ebp+8], Table

16 Single-Step Execution

17 Passing Parameters by Reference: an Example

18 ?? ebx?? ecx?? : ebp ebp, esp ebx ecx ecx, 4 ebx, dword[ebp+8] esp > Memory?? 4, Table < eip 3 2 1

19 ebx?? ecx?? : ebp ebp, esp ebx ecx ecx, 4 ebx, dword[ebp+8] esp > Memory?? 4, Table < eip 3 2 1

20 ebx?? ecx?? : ebp ebp, esp ebx ecx ecx, 4 ebx, dword[ebp+8] esp > Memory?? 4, Table < eip 3 2 1

21 ebx?? ecx?? : ebp ebp, esp ebx ecx ecx, 4 ebx, dword[ebp+8] < eip esp > Memory?? ret addr 4, Table 3 2 1

22 ebx?? ecx?? : ebp ebp, esp ebx ecx ecx, 4 ebx, dword[ebp+8] < eip esp > Memory?? ret addr old epb 4, Table 3 2 1

23 ebx?? ecx?? : ebp ebp, esp ebx ecx ecx, 4 ebx, dword[ebp+8] < eip esp ebp > Memory?? ret addr old epb 4, Table 3 2 1

24 ebx?? ecx?? : ebp ebp, esp ebx ecx ecx, 4 ebx, dword[ebp+8] < eip ebp > esp > Memory?? ret addr old epb old ebx 4, Table 3 2 1

25 ebx?? ecx?? : ebp ebp, esp ebx ecx ecx, 4 ebx, dword[ebp+8] < eip ebp > esp > Memory?? ret addr old epb old ebx old ecx 4, Table 3 2 1

26 ebx?? ecx 4 : ebp ebp, esp ebx ecx ecx, 4 ebx, dword[ebp+8] < eip ebp > esp > Memory?? ret addr old epb old ebx old ecx 4, Table 3 2 1

27 ebx ecx 4 : ebp ebp, esp ebx ecx ecx, 4 ebx, dword[ebp+8] < eip ebp > esp > Memory?? ret addr old epb old ebx old ecx 4, Table 3 2 1

28 ebx ecx 4 : ebp ebp, esp ebx ecx ecx, 4 ebx, dword[ebp+8] < eip ebp > esp > Memory?? ret addr old epb old ebx old ecx 4, Table

29 ebx 89A4 ecx 4 : ebp ebp, esp ebx ecx ecx, 4 ebx, dword[ebp+8] < eip ebp > esp > Memory?? ret addr old epb old ebx old ecx 4, Table

30 ebx 89A4 ecx 4 3 : ebp ebp, esp ebx ecx ecx, 4 ebx, dword[ebp+8] < eip ebp > esp > Memory?? ret addr old epb old ebx old ecx 4, Table

31 ebx 89A4 ecx 4 3 : ebp ebp, esp ebx ecx ecx, 4 ebx, dword[ebp+8] < eip ebp > esp > Memory?? ret addr old epb old ebx old ecx 4, Table

32 ebx 89A8 ecx 4 3 : ebp ebp, esp ebx ecx ecx, 4 ebx, dword[ebp+8] < eip ebp > esp > Memory?? ret addr old epb old ebx old ecx 4, Table

33 ebx 89B2 ecx : ebp ebp, esp ebx ecx ecx, 4 ebx, dword[ebp+8] < eip ebp > esp > Memory?? ret addr old epb old ebx old ecx 4 5, Table

34 ebx 89B2 ecx?? : ebp ebp, esp ebx ecx ecx, 4 ebx, dword[ebp+8] < eip ebp > esp > Memory?? ret addr old epb old ebx old ecx 4 5, Table

35 ebx?? ecx?? : ebp ebp, esp ebx ecx ecx, 4 ebx, dword[ebp+8] < eip esp ebp > Memory?? ret addr old epb old ebx old ecx 4 5, Table

36 ebx?? ecx?? : ebp ebp, esp ebx ecx ecx, 4 ebx, dword[ebp+8] < eip esp > Memory?? ret addr old epb old ebx old ecx 4 5, Table

37 ebx?? ecx?? : ebp ebp, esp ebx ecx ecx, 4 ebx, dword[ebp+8] esp > Memory?? ret addr old epb old ebx old ecx 4 5, Table < eip

38 Passing through registers Passing through the stack Passing by Value Passing by Reference

39 esp > Memory?? ret addr old epb old ebx old ecx Question 1: What happens to the data "below" esp? Can it be used?

40 Memory?? ret addr old epb Question 2: What about local variables? old ebx esp > old ecx

41 RECURSION

42 Python 3.5.0b1 (v3.5.0b1:071fefbb5e3d, May , 18:22:54) [GCC (Apple Inc. build 5666) (dot 3)] on darwin Type "copyright", "credits" or "license()" for more information. >>> def fact( n ): if n <= 1: return 1 return n * fact( n - 1 ) >>> fact( 3 ) 6 >>> fact( 5 ) 120 >>> fact( 20 ) >>> fact( 100 ) >>> { 1 if n<=1 n! = n * (n-1)! otherwise

43 Write the function fact(n) and it from main(), in Assembly

44 Compare to Non-Recursive Version

45 Question 1 Compare the execution time of the recursive version of factorial() to its non-recursive version.

46 Question 2 If the maximum stack size given to a program is 8 GBytes, how many terms could fact() compute, at most, if we didn't care about multiplication overflow? Note: We can get the default stack size linux uses with ulimit -s

mith College Computer Science CSC231 Assembly Week #11 Fall 2017 Dominique Thiébaut

mith College Computer Science CSC231 Assembly Week #11 Fall 2017 Dominique Thiébaut mith College Computer Science CSC231 Assembly Week #11 Fall 2017 Dominique Thiébaut dthiebaut@smith.edu Back to Conditional Jumps Review sub eax, 10 jz there xxx xxx there:yyy yyy Review cmp eax, 10 jz

More information

mith College Computer Science CSC231 Assembly Week #13 Fall 2017 Dominique Thiébaut

mith College Computer Science CSC231 Assembly Week #13 Fall 2017 Dominique Thiébaut mith College Computer Science CSC21 Assembly Week #1 Fall 2017 Dominique Thiébaut dthiebaut@smith.edu for n in 0 1 2 5 ; do echo "n =$n"./hw7b $n echo "" done Pascal Triangle n =0 n =1 1 n =2 1 0 1 1 n

More information

Assembly Language: Function Calls

Assembly Language: Function Calls Assembly Language: Function Calls 1 Goals of this Lecture Help you learn: Function call problems: Calling and returning Passing parameters Storing local variables Handling registers without interference

More information

Assembly Language: Function Calls" Goals of this Lecture"

Assembly Language: Function Calls Goals of this Lecture Assembly Language: Function Calls" 1 Goals of this Lecture" Help you learn:" Function call problems:" Calling and returning" Passing parameters" Storing local variables" Handling registers without interference"

More information

Assembly Language: Function Calls" Goals of this Lecture"

Assembly Language: Function Calls Goals of this Lecture Assembly Language: Function Calls" 1 Goals of this Lecture" Help you learn:" Function call problems:" Calling and urning" Passing parameters" Storing local variables" Handling registers without interference"

More information

Assembly Language: Function Calls. Goals of this Lecture. Function Call Problems

Assembly Language: Function Calls. Goals of this Lecture. Function Call Problems Assembly Language: Function Calls 1 Goals of this Lecture Help you learn: Function call problems: Calling and urning Passing parameters Storing local variables Handling registers without interference Returning

More information

Islamic University Gaza Engineering Faculty Department of Computer Engineering ECOM 2125: Assembly Language LAB. Lab # 10. Advanced Procedures

Islamic University Gaza Engineering Faculty Department of Computer Engineering ECOM 2125: Assembly Language LAB. Lab # 10. Advanced Procedures Islamic University Gaza Engineering Faculty Department of Computer Engineering ECOM 2125: Assembly Language LAB Lab # 10 Advanced Procedures May, 2014 1 Assembly Language LAB Stack Parameters There are

More information

mith College Computer Science CSC231 - Assembly Week #9 Dominique Thiébaut

mith College Computer Science CSC231 - Assembly Week #9 Dominique Thiébaut mith College Computer Science CSC231 - Assembly Week #9 Dominique Thiébaut dthiebaut@smith.edu https://docs.google.com/forms/d/e/1faipqlscgsgjakylraq3zt6rvr-xmksy1zxrpe0myhpanyigp8byjba/viewform 1,000,000

More information

mith College Computer Science CSC231 Assembly Week #9 Fall 2017 Dominique Thiébaut

mith College Computer Science CSC231 Assembly Week #9 Fall 2017 Dominique Thiébaut mith College Computer Science CSC231 Assembly Week #9 Fall 2017 Dominique Thiébaut dthiebaut@smith.edu Looping Through Arrays LOOP INSTRUCTION Looping Through Arrays INDIRECT ADDRESSING MODE Indirect Addressing

More information

Stack -- Memory which holds register contents. Will keep the EIP of the next address after the call

Stack -- Memory which holds register contents. Will keep the EIP of the next address after the call Call without Parameter Value Transfer What are involved? ESP Stack Pointer Register Grows by 4 for EIP (return address) storage Stack -- Memory which holds register contents Will keep the EIP of the next

More information

ASSEMBLY III: PROCEDURES. Jo, Heeseung

ASSEMBLY III: PROCEDURES. Jo, Heeseung ASSEMBLY III: PROCEDURES Jo, Heeseung IA-32 STACK (1) Characteristics Region of memory managed with stack discipline Grows toward lower addresses Register indicates lowest stack address - address of top

More information

Assembly III: Procedures. Jo, Heeseung

Assembly III: Procedures. Jo, Heeseung Assembly III: Procedures Jo, Heeseung IA-32 Stack (1) Characteristics Region of memory managed with stack discipline Grows toward lower addresses Register indicates lowest stack address - address of top

More information

Computer Architecture and Assembly Language. Practical Session 5

Computer Architecture and Assembly Language. Practical Session 5 Computer Architecture and Assembly Language Practical Session 5 Addressing Mode - "memory address calculation mode" An addressing mode specifies how to calculate the effective memory address of an operand.

More information

Function Calls COS 217. Reading: Chapter 4 of Programming From the Ground Up (available online from the course Web site)

Function Calls COS 217. Reading: Chapter 4 of Programming From the Ground Up (available online from the course Web site) Function Calls COS 217 Reading: Chapter 4 of Programming From the Ground Up (available online from the course Web site) 1 Goals of Today s Lecture Finishing introduction to assembly language o EFLAGS register

More information

Question 4.2 2: (Solution, p 5) Suppose that the HYMN CPU begins with the following in memory. addr data (translation) LOAD 11110

Question 4.2 2: (Solution, p 5) Suppose that the HYMN CPU begins with the following in memory. addr data (translation) LOAD 11110 Questions 1 Question 4.1 1: (Solution, p 5) Define the fetch-execute cycle as it relates to a computer processing a program. Your definition should describe the primary purpose of each phase. Question

More information

X86 Stack Calling Function POV

X86 Stack Calling Function POV X86 Stack Calling Function POV Computer Systems Section 3.7 Stack Frame Reg Value ebp xffff FFF0 esp xffff FFE0 eax x0000 000E Memory Address Value xffff FFF8 xffff FFF4 x0000 0004 xffff FFF4 x0000 0003

More information

Computer Architecture and Assembly Language. Practical Session 3

Computer Architecture and Assembly Language. Practical Session 3 Computer Architecture and Assembly Language Practical Session 3 Advanced Instructions division DIV r/m - unsigned integer division IDIV r/m - signed integer division Dividend Divisor Quotient Remainder

More information

Assembly Language Lab # 9

Assembly Language Lab # 9 Faculty of Engineering Computer Engineering Department Islamic University of Gaza 2011 Assembly Language Lab # 9 Stacks and Subroutines Eng. Doaa Abu Jabal Assembly Language Lab # 9 Stacks and Subroutines

More information

Machine-level Programming (3)

Machine-level Programming (3) Machine-level Programming (3) Procedures A: call A call A return Two issues How to return to the correct position? How to pass arguments and return values between callee to caller? 2 Procedure Control

More information

Subprograms: Local Variables

Subprograms: Local Variables Subprograms: Local Variables ICS312 Machine-Level and Systems Programming Henri Casanova (henric@hawaii.edu) Local Variables in Subprograms In all the examples we have seen so far, the subprograms were

More information

Lecture 4 CIS 341: COMPILERS

Lecture 4 CIS 341: COMPILERS Lecture 4 CIS 341: COMPILERS CIS 341 Announcements HW2: X86lite Available on the course web pages. Due: Weds. Feb. 7 th at midnight Pair-programming project Zdancewic CIS 341: Compilers 2 X86 Schematic

More information

EECE.3170: Microprocessor Systems Design I Summer 2017 Homework 4 Solution

EECE.3170: Microprocessor Systems Design I Summer 2017 Homework 4 Solution 1. (40 points) Write the following subroutine in x86 assembly: Recall that: int f(int v1, int v2, int v3) { int x = v1 + v2; urn (x + v3) * (x v3); Subroutine arguments are passed on the stack, and can

More information

Assembly III: Procedures. Jin-Soo Kim Computer Systems Laboratory Sungkyunkwan University

Assembly III: Procedures. Jin-Soo Kim Computer Systems Laboratory Sungkyunkwan University Assembly III: Procedures Jin-Soo Kim (jinsookim@skku.edu) Computer Systems Laboratory Sungkyunkwan University http://csl.skku.edu IA-32 (1) Characteristics Region of memory managed with stack discipline

More information

Program Exploitation Intro

Program Exploitation Intro Program Exploitation Intro x86 Assembly 04//2018 Security 1 Univeristà Ca Foscari, Venezia What is Program Exploitation "Making a program do something unexpected and not planned" The right bugs can be

More information

Lecture 15 Intel Manual, Vol. 1, Chapter 3. Fri, Mar 6, Hampden-Sydney College. The x86 Architecture. Robb T. Koether. Overview of the x86

Lecture 15 Intel Manual, Vol. 1, Chapter 3. Fri, Mar 6, Hampden-Sydney College. The x86 Architecture. Robb T. Koether. Overview of the x86 Lecture 15 Intel Manual, Vol. 1, Chapter 3 Hampden-Sydney College Fri, Mar 6, 2009 Outline 1 2 Overview See the reference IA-32 Intel Software Developer s Manual Volume 1: Basic, Chapter 3. Instructions

More information

Procedure Calls. Young W. Lim Sat. Young W. Lim Procedure Calls Sat 1 / 27

Procedure Calls. Young W. Lim Sat. Young W. Lim Procedure Calls Sat 1 / 27 Procedure Calls Young W. Lim 2016-11-05 Sat Young W. Lim Procedure Calls 2016-11-05 Sat 1 / 27 Outline 1 Introduction References Stack Background Transferring Control Register Usage Conventions Procedure

More information

mith College Computer Science CSC231 - Assembly Week #4 Dominique Thiébaut

mith College Computer Science CSC231 - Assembly Week #4 Dominique Thiébaut mith College Computer Science CSC231 - Assembly Week #4 Dominique Thiébaut dthiebaut@smith.edu Homework Solutions Outline Review Hexdump Pentium Data Registers 32-bit, 16-bit and 8-bit quantities (registers

More information

CMSC 313 Lecture 12 [draft] How C functions pass parameters

CMSC 313 Lecture 12 [draft] How C functions pass parameters CMSC 313 Lecture 12 [draft] How C functions pass parameters UMBC, CMSC313, Richard Chang Last Time Stack Instructions: PUSH, POP PUSH adds an item to the top of the stack POP removes an

More information

x86 assembly CS449 Fall 2017

x86 assembly CS449 Fall 2017 x86 assembly CS449 Fall 2017 x86 is a CISC CISC (Complex Instruction Set Computer) e.g. x86 Hundreds of (complex) instructions Only a handful of registers RISC (Reduced Instruction Set Computer) e.g. MIPS

More information

mith College Computer Science CSC231 - Assembly Week #3 Dominique Thiébaut

mith College Computer Science CSC231 - Assembly Week #3 Dominique Thiébaut mith College Computer Science CSC231 - Assembly Week #3 Dominique Thiébaut dthiebaut@smith.edu memory mov add registers hexdump listings number systems Let's Review Last Week's Material section.data

More information

mith College Computer Science CSC231-Assembly Fall 2017 Week #2 Dominique Thiébaut

mith College Computer Science CSC231-Assembly Fall 2017 Week #2 Dominique Thiébaut mith College Computer Science CSC231-Assembly Fall 2017 Week #2 Dominique Thiébaut dthiebaut@smith.edu Outline Labs: emacs, assembly Assembly + Linking Process Object files DB directive: Everything is

More information

CSE 351: Week 4. Tom Bergan, TA

CSE 351: Week 4. Tom Bergan, TA CSE 35 Week 4 Tom Bergan, TA Does this code look okay? int binarysearch(int a[], int length, int key) { int low = 0; int high = length - ; while (low

More information

4) C = 96 * B 5) 1 and 3 only 6) 2 and 4 only

4) C = 96 * B 5) 1 and 3 only 6) 2 and 4 only Instructions: The following questions use the AT&T (GNU) syntax for x86-32 assembly code, as in the course notes. Submit your answers to these questions to the Curator as OQ05 by the posted due date and

More information

Machine-Level Programming III: Procedures

Machine-Level Programming III: Procedures Machine-Level Programming III: Procedures IA32 Region of memory managed with stack discipline Grows toward lower addresses Register indicates lowest stack address address of top element Bottom Increasing

More information

Processes (Intro) Yannis Smaragdakis, U. Athens

Processes (Intro) Yannis Smaragdakis, U. Athens Processes (Intro) Yannis Smaragdakis, U. Athens Process: CPU Virtualization Process = Program, instantiated has memory, code, current state What kind of memory do we have? registers + address space Let's

More information

CMSC 313 COMPUTER ORGANIZATION & ASSEMBLY LANGUAGE PROGRAMMING

CMSC 313 COMPUTER ORGANIZATION & ASSEMBLY LANGUAGE PROGRAMMING CMSC 313 COMPUTER ORGANIZATION & ASSEMBLY LANGUAGE PROGRAMMING LECTURE 16, SPRING 2013 TOPICS TODAY Project 6 Perils & Pitfalls of Memory Allocation C Function Call Conventions in Assembly Language PERILS

More information

The x86 Architecture

The x86 Architecture The x86 Architecture Lecture 24 Intel Manual, Vol. 1, Chapter 3 Robb T. Koether Hampden-Sydney College Fri, Mar 20, 2015 Robb T. Koether (Hampden-Sydney College) The x86 Architecture Fri, Mar 20, 2015

More information

The IA-32 Stack and Function Calls. CS4379/5375 Software Reverse Engineering Dr. Jaime C. Acosta

The IA-32 Stack and Function Calls. CS4379/5375 Software Reverse Engineering Dr. Jaime C. Acosta 1 The IA-32 Stack and Function Calls CS4379/5375 Software Reverse Engineering Dr. Jaime C. Acosta 2 Important Registers used with the Stack EIP: ESP: EBP: 3 Important Registers used with the Stack EIP:

More information

CPS104 Recitation: Assembly Programming

CPS104 Recitation: Assembly Programming CPS104 Recitation: Assembly Programming Alexandru Duțu 1 Facts OS kernel and embedded software engineers use assembly for some parts of their code some OSes had their entire GUIs written in assembly in

More information

Procedure Calls. Young W. Lim Mon. Young W. Lim Procedure Calls Mon 1 / 29

Procedure Calls. Young W. Lim Mon. Young W. Lim Procedure Calls Mon 1 / 29 Procedure Calls Young W. Lim 2017-08-21 Mon Young W. Lim Procedure Calls 2017-08-21 Mon 1 / 29 Outline 1 Introduction Based on Stack Background Transferring Control Register Usage Conventions Procedure

More information

U23 - Binary Exploitation

U23 - Binary Exploitation U23 - Binary Exploitation Stratum Auhuur robbje@aachen.ccc.de November 21, 2016 Context OS: Linux Context OS: Linux CPU: x86 (32 bit) Context OS: Linux CPU: x86 (32 bit) Address Space Layout Randomization:

More information

CMSC 313 Lecture 12. Project 3 Questions. How C functions pass parameters. UMBC, CMSC313, Richard Chang

CMSC 313 Lecture 12. Project 3 Questions. How C functions pass parameters. UMBC, CMSC313, Richard Chang Project 3 Questions CMSC 313 Lecture 12 How C functions pass parameters UMBC, CMSC313, Richard Chang Last Time Stack Instructions: PUSH, POP PUSH adds an item to the top of the stack POP

More information

CS213. Machine-Level Programming III: Procedures

CS213. Machine-Level Programming III: Procedures CS213 Machine-Level Programming III: Procedures Topics IA32 stack discipline Register saving conventions Creating pointers to local variables IA32 Region of memory managed with stack discipline Grows toward

More information

CS 31: Intro to Systems Functions and the Stack. Martin Gagne Swarthmore College February 23, 2016

CS 31: Intro to Systems Functions and the Stack. Martin Gagne Swarthmore College February 23, 2016 CS 31: Intro to Systems Functions and the Stack Martin Gagne Swarthmore College February 23, 2016 Reminders Late policy: you do not have to send me an email to inform me of a late submission before the

More information

mith College Computer Science CSC231 Assembly Week #5 Fall 2017 Dominique Thiébaut

mith College Computer Science CSC231 Assembly Week #5 Fall 2017 Dominique Thiébaut mith College Computer Science CSC231 Assembly Week #5 Fall 2017 Dominique Thiébaut dthiebaut@smith.edu 0000 0 0 0001 1 1 0010 2 2 0011 3 3 0100 4 4 0101 5 5 0110 6 6 0111 7 7 1000 8 8 1001 9 9 1010 A 10

More information

SOEN228, Winter Revision 1.2 Date: October 25,

SOEN228, Winter Revision 1.2 Date: October 25, SOEN228, Winter 2003 Revision 1.2 Date: October 25, 2003 1 Contents Flags Mnemonics Basic I/O Exercises Overview of sample programs 2 Flag Register The flag register stores the condition flags that retain

More information

Winter Compiler Construction T11 Activation records + Introduction to x86 assembly. Today. Tips for PA4. Today:

Winter Compiler Construction T11 Activation records + Introduction to x86 assembly. Today. Tips for PA4. Today: Winter 2006-2007 Compiler Construction T11 Activation records + Introduction to x86 assembly Mooly Sagiv and Roman Manevich School of Computer Science Tel-Aviv University Today ic IC Language Lexical Analysis

More information

ROP It Like It s Hot!

ROP It Like It s Hot! Wednesday, December 3, 14 2014 Red Canari, Inc. All rights reserved. 1 I N F O R M AT I O N S E C U R I T Y ROP It Like It s Hot! A 101 on Buffer Overflows, Return Oriented Programming, & Shell- code Development

More information

administrivia today start assembly probably won t finish all these slides Assignment 4 due tomorrow any questions?

administrivia today start assembly probably won t finish all these slides Assignment 4 due tomorrow any questions? administrivia today start assembly probably won t finish all these slides Assignment 4 due tomorrow any questions? exam on Wednesday today s material not on the exam 1 Assembly Assembly is programming

More information

Function Call Convention

Function Call Convention Function Call Convention Compass Security Schweiz AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Tel +41 55 214 41 60 Fax +41 55 214 41 61 team@csnc.ch www.csnc.ch Content Intel Architecture Memory Layout

More information

mith College Computer Science CSC231 Assembly Week #9 Spring 2017 Dominique Thiébaut

mith College Computer Science CSC231 Assembly Week #9 Spring 2017 Dominique Thiébaut mith College Computer Science CSC231 Assembly Week #9 Spring 2017 Dominique Thiébaut dthiebaut@smith.edu 2 Videos to Watch at a Later Time https://www.youtube.com/watch?v=fdmzngwchdk https://www.youtube.com/watch?v=k2iz1qsx4cm

More information

16.317: Microprocessor Systems Design I Fall 2014

16.317: Microprocessor Systems Design I Fall 2014 16.317: Microprocessor Systems Design I Fall 2014 Exam 2 Solution 1. (16 points, 4 points per part) Multiple choice For each of the multiple choice questions below, clearly indicate your response by circling

More information

CS 33: Week 3 Discussion. x86 Assembly (v1.0) Section 1G

CS 33: Week 3 Discussion. x86 Assembly (v1.0) Section 1G CS 33: Week 3 Discussion x86 Assembly (v1.0) Section 1G Announcements - HW2 due Sunday - MT1 this Thursday! - Lab2 out Info Name: Eric Kim (Section 1G, 2-4 PM, BH 5419) Office Hours (Boelter 2432) - Wed

More information

1 /* file cpuid2.s */ 4.asciz "The processor Vendor ID is %s \n" 5.section.bss. 6.lcomm buffer, section.text. 8.globl _start.

1 /* file cpuid2.s */ 4.asciz The processor Vendor ID is %s \n 5.section.bss. 6.lcomm buffer, section.text. 8.globl _start. 1 /* file cpuid2.s */ 2.section.data 3 output: 4.asciz "The processor Vendor ID is %s \n" 5.section.bss 6.lcomm buffer, 12 7.section.text 8.globl _start 9 _start: 10 movl $0, %eax 11 cpuid 12 movl $buffer,

More information

3. Process Management in xv6

3. Process Management in xv6 Lecture Notes for CS347: Operating Systems Mythili Vutukuru, Department of Computer Science and Engineering, IIT Bombay 3. Process Management in xv6 We begin understanding xv6 process management by looking

More information

CSC 2400: Computer Systems. Using the Stack for Function Calls

CSC 2400: Computer Systems. Using the Stack for Function Calls CSC 24: Computer Systems Using the Stack for Function Calls Lecture Goals Challenges of supporting functions! Providing information for the called function Function arguments and local variables! Allowing

More information

CS 161 Computer Security. Week of January 22, 2018: GDB and x86 assembly

CS 161 Computer Security. Week of January 22, 2018: GDB and x86 assembly Raluca Popa Spring 2018 CS 161 Computer Security Discussion 1 Week of January 22, 2018: GDB and x86 assembly Objective: Studying memory vulnerabilities requires being able to read assembly and step through

More information

Subprograms: Arguments

Subprograms: Arguments Subprograms: Arguments ICS312 Machine-Level and Systems Programming Henri Casanova (henric@hawaii.edu) Activation Records The stack is useful to store and rieve urn addresses, transparently managed via

More information

CNIT 127: Exploit Development. Ch 2: Stack Overflows in Linux

CNIT 127: Exploit Development. Ch 2: Stack Overflows in Linux CNIT 127: Exploit Development Ch 2: Stack Overflows in Linux Stack-based Buffer Overflows Most popular and best understood exploitation method Aleph One's "Smashing the Stack for Fun and Profit" (1996)

More information

AS08-C++ and Assembly Calling and Returning. CS220 Logic Design AS08-C++ and Assembly. AS08-C++ and Assembly Calling Conventions

AS08-C++ and Assembly Calling and Returning. CS220 Logic Design AS08-C++ and Assembly. AS08-C++ and Assembly Calling Conventions CS220 Logic Design Outline Calling Conventions Multi-module Programs 1 Calling and Returning We have already seen how the call instruction is used to execute a subprogram. call pushes the address of the

More information

CSC 8400: Computer Systems. Using the Stack for Function Calls

CSC 8400: Computer Systems. Using the Stack for Function Calls CSC 84: Computer Systems Using the Stack for Function Calls Lecture Goals Challenges of supporting functions! Providing information for the called function Function arguments and local variables! Allowing

More information

Islamic University Gaza Engineering Faculty Department of Computer Engineering ECOM 2125: Assembly Language LAB. Lab # 7. Procedures and the Stack

Islamic University Gaza Engineering Faculty Department of Computer Engineering ECOM 2125: Assembly Language LAB. Lab # 7. Procedures and the Stack Islamic University Gaza Engineering Faculty Department of Computer Engineering ECOM 2125: Assembly Language LAB Lab # 7 Procedures and the Stack April, 2014 1 Assembly Language LAB Runtime Stack and Stack

More information

mith College Computer Science CSC231 Assembly Week #10 Fall 2017 Dominique Thiébaut

mith College Computer Science CSC231 Assembly Week #10 Fall 2017 Dominique Thiébaut mith College Computer Science CSC231 Assembly Week #10 Fall 2017 Dominique Thiébaut dthiebaut@smith.edu 2 Videos to Start With https://www.youtube.com/watch?v=fdmzngwchdk https://www.youtube.com/watch?v=k2iz1qsx4cm

More information

Machine Program: Procedure. Zhaoguo Wang

Machine Program: Procedure. Zhaoguo Wang Machine Program: Procedure Zhaoguo Wang Requirements of procedure calls? P() { y = Q(x); y++; 1. Passing control int Q(int i) { int t, z; return z; Requirements of procedure calls? P() { y = Q(x); y++;

More information

UMBC. contain new IP while 4th and 5th bytes contain CS. CALL BX and CALL [BX] versions also exist. contain displacement added to IP.

UMBC. contain new IP while 4th and 5th bytes contain CS. CALL BX and CALL [BX] versions also exist. contain displacement added to IP. Procedures: CALL: Pushes the address of the instruction following the CALL instruction onto the stack. RET: Pops the address. SUM PROC NEAR USES BX CX DX ADD AX, BX ADD AX, CX MOV AX, DX RET SUM ENDP NEAR

More information

Computer Architecture and Assembly Language. Practical Session 7

Computer Architecture and Assembly Language. Practical Session 7 Computer Architecture and Assembly Language Practical Session 7 Co-Routines co-routines are assembly implementation of threads each co-routine decides to which co-routine to pass a control (unlike usual

More information

Stack, subprograms. procedures and modular programming role of stack while using procedures stack implementation (Pentium)

Stack, subprograms. procedures and modular programming role of stack while using procedures stack implementation (Pentium) Assembler lecture 3 S.Šimoňák, DCI FEEI TU of Košice Stack, subprograms procedures and modular programming role of stack while using procedures stack implementation (Pentium) Stack LIFO data structure,

More information

Homework. In-line Assembly Code Machine Language Program Efficiency Tricks Reading PAL, pp 3-6, Practice Exam 1

Homework. In-line Assembly Code Machine Language Program Efficiency Tricks Reading PAL, pp 3-6, Practice Exam 1 Homework In-line Assembly Code Machine Language Program Efficiency Tricks Reading PAL, pp 3-6, 361-367 Practice Exam 1 1 In-line Assembly Code The gcc compiler allows you to put assembly instructions in-line

More information

Procedure-Calling Conventions October 30

Procedure-Calling Conventions October 30 Procedure-Calling Conventions October 30 CSC201 Section 002 Fall, 2000 Saving registers Registers are inevitably used by subroutines; changes their! Registers have global scope; calling procedures also

More information

The course that gives CMU its Zip! Machine-Level Programming III: Procedures Sept. 17, 2002

The course that gives CMU its Zip! Machine-Level Programming III: Procedures Sept. 17, 2002 15-213 The course that gives CMU its Zip! Machine-Level Programming III: Procedures Sept. 17, 2002 Topics IA32 stack discipline Register saving conventions Creating pointers to local variables class07.ppt

More information

W4118: PC Hardware and x86. Junfeng Yang

W4118: PC Hardware and x86. Junfeng Yang W4118: PC Hardware and x86 Junfeng Yang A PC How to make it do something useful? 2 Outline PC organization x86 instruction set gcc calling conventions PC emulation 3 PC board 4 PC organization One or more

More information

CS61 Section Solutions 3

CS61 Section Solutions 3 CS61 Section Solutions 3 (Week of 10/1-10/5) 1. Assembly Operand Specifiers 2. Condition Codes 3. Jumps 4. Control Flow Loops 5. Procedure Calls 1. Assembly Operand Specifiers Q1 Operand Value %eax 0x104

More information

Complex Instruction Set Computer (CISC)

Complex Instruction Set Computer (CISC) Introduction ti to IA-32 IA-32 Processors Evolutionary design Starting in 1978 with 886 Added more features as time goes on Still support old features, although obsolete Totally dominate computer market

More information

Microprocessors ( ) Fall 2010/2011 Lecture Notes # 15. Stack Operations. 10 top

Microprocessors ( ) Fall 2010/2011 Lecture Notes # 15. Stack Operations. 10 top Microprocessors (0630371) Fall 2010/2011 Lecture Notes # 15 Stack Operations Objectives of the Lecture Runtime Stack PUSH Operation POP Operation Initializing the Stack PUSH and POP Instructions Stack

More information

CS642: Computer Security

CS642: Computer Security X86 Review Process Layout, ISA, etc. CS642: Computer Security Drew Davidson davidson@cs.wisc.edu From Last Week ACL- based permissions (UNIX style) Read, Write, execute can be restricted on users and groups

More information

Systems I. Machine-Level Programming V: Procedures

Systems I. Machine-Level Programming V: Procedures Systems I Machine-Level Programming V: Procedures Topics abstraction and implementation IA32 stack discipline Procedural Memory Usage void swap(int *xp, int *yp) int t0 = *xp; int t1 = *yp; *xp = t1; *yp

More information

System calls and assembler

System calls and assembler System calls and assembler Michal Sojka sojkam1@fel.cvut.cz ČVUT, FEL License: CC-BY-SA 4.0 System calls (repetition from lectures) A way for normal applications to invoke operating system (OS) kernel's

More information

Digital Forensics Lecture 3 - Reverse Engineering

Digital Forensics Lecture 3 - Reverse Engineering Digital Forensics Lecture 3 - Reverse Engineering Low-Level Software Akbar S. Namin Texas Tech University Spring 2017 Reverse Engineering High-Level Software Low-level aspects of software are often the

More information

CS 31: Intro to Systems ISAs and Assembly. Martin Gagné Swarthmore College February 7, 2017

CS 31: Intro to Systems ISAs and Assembly. Martin Gagné Swarthmore College February 7, 2017 CS 31: Intro to Systems ISAs and Assembly Martin Gagné Swarthmore College February 7, 2017 ANNOUNCEMENT All labs will meet in SCI 252 (the robot lab) tomorrow. Overview How to directly interact with hardware

More information

x86 assembly CS449 Spring 2016

x86 assembly CS449 Spring 2016 x86 assembly CS449 Spring 2016 CISC vs. RISC CISC [Complex instruction set Computing] - larger, more feature-rich instruction set (more operations, addressing modes, etc.). slower clock speeds. fewer general

More information

Practical Malware Analysis

Practical Malware Analysis Practical Malware Analysis Ch 4: A Crash Course in x86 Disassembly Revised 1-16-7 Basic Techniques Basic static analysis Looks at malware from the outside Basic dynamic analysis Only shows you how the

More information

Register Allocation, iii. Bringing in functions & using spilling & coalescing

Register Allocation, iii. Bringing in functions & using spilling & coalescing Register Allocation, iii Bringing in functions & using spilling & coalescing 1 Function Calls ;; f(x) = let y = g(x) ;; in h(y+x) + y*5 (:f (x

More information

printf("this program adds the value 10 to a given integer number.\n\n");

printf(this program adds the value 10 to a given integer number.\n\n); PA1 Sample Solution Program 1 void add10(int *n); //Prototype int n; printf("this program adds the value 10 to a given integer number.\n\n"); printf("please enter an integer number: "); scanf("%d", &n);

More information

mith College Computer Science CSC231 - Assembly Week #8 Dominique Thiébaut

mith College Computer Science CSC231 - Assembly Week #8 Dominique Thiébaut mith College Computer Science CSC231 - Assembly Week #8 Dominique Thiébaut dthiebaut@smith.edu Can't Sleep https://xkcd.com/571/ Logic Design Logic Design Image from http://www.willegal.net/appleii/images/motherboard.jpg

More information

CMSC 313 COMPUTER ORGANIZATION & ASSEMBLY LANGUAGE PROGRAMMING PREVIEW SLIDES 16, SPRING 2013

CMSC 313 COMPUTER ORGANIZATION & ASSEMBLY LANGUAGE PROGRAMMING PREVIEW SLIDES 16, SPRING 2013 CMSC 313 COMPUTER ORGANIZATION & ASSEMBLY LANGUAGE PROGRAMMING PREVIEW SLIDES 16, SPRING 2013 CONST POINTERS CONST POINTERS 4 ways to declare pointers in combination with const:!! int *ptr! const int *ptr!

More information

Computer Systems Lecture 9

Computer Systems Lecture 9 Computer Systems Lecture 9 CPU Registers in x86 CPU status flags EFLAG: The Flag register holds the CPU status flags The status flags are separate bits in EFLAG where information on important conditions

More information

16.317: Microprocessor Systems Design I Spring 2015

16.317: Microprocessor Systems Design I Spring 2015 16.317: Microprocessor Systems Design I Spring 2015 Exam 2 Solution 1. (16 points, 4 points per part) Multiple choice For each of the multiple choice questions below, clearly indicate your response by

More information

CS412/CS413. Introduction to Compilers Tim Teitelbaum. Lecture 21: Generating Pentium Code 10 March 08

CS412/CS413. Introduction to Compilers Tim Teitelbaum. Lecture 21: Generating Pentium Code 10 March 08 CS412/CS413 Introduction to Compilers Tim Teitelbaum Lecture 21: Generating Pentium Code 10 March 08 CS 412/413 Spring 2008 Introduction to Compilers 1 Simple Code Generation Three-address code makes it

More information

CSC 2400: Computer Systems. Towards the Hardware: Machine-Level Representation of Programs

CSC 2400: Computer Systems. Towards the Hardware: Machine-Level Representation of Programs CSC 2400: Computer Systems Towards the Hardware: Machine-Level Representation of Programs Towards the Hardware High-level language (Java) High-level language (C) assembly language machine language (IA-32)

More information

CS241 Computer Organization Spring 2015 IA

CS241 Computer Organization Spring 2015 IA CS241 Computer Organization Spring 2015 IA-32 2-10 2015 Outline! Review HW#3 and Quiz#1! More on Assembly (IA32) move instruction (mov) memory address computation arithmetic & logic instructions (add,

More information

CIT Week13 Lecture

CIT Week13 Lecture CIT 3136 - Week13 Lecture Runtime Environments During execution, allocation must be maintained by the generated code that is compatible with the scope and lifetime rules of the language. Typically there

More information

CS 31: Intro to Systems ISAs and Assembly. Kevin Webb Swarthmore College February 9, 2016

CS 31: Intro to Systems ISAs and Assembly. Kevin Webb Swarthmore College February 9, 2016 CS 31: Intro to Systems ISAs and Assembly Kevin Webb Swarthmore College February 9, 2016 Reading Quiz Overview How to directly interact with hardware Instruction set architecture (ISA) Interface between

More information

CS 31: Intro to Systems ISAs and Assembly. Kevin Webb Swarthmore College September 25, 2018

CS 31: Intro to Systems ISAs and Assembly. Kevin Webb Swarthmore College September 25, 2018 CS 31: Intro to Systems ISAs and Assembly Kevin Webb Swarthmore College September 25, 2018 Overview How to directly interact with hardware Instruction set architecture (ISA) Interface between programmer

More information

X86 Addressing Modes Chapter 3" Review: Instructions to Recognize"

X86 Addressing Modes Chapter 3 Review: Instructions to Recognize X86 Addressing Modes Chapter 3" Review: Instructions to Recognize" 1 Arithmetic Instructions (1)! Two Operand Instructions" ADD Dest, Src Dest = Dest + Src SUB Dest, Src Dest = Dest - Src MUL Dest, Src

More information

Low Level Programming Lecture 2. International Faculty of Engineerig, Technical University of Łódź

Low Level Programming Lecture 2. International Faculty of Engineerig, Technical University of Łódź Low Level Programming Lecture 2 Intel processors' architecture reminder Fig. 1. IA32 Registers IA general purpose registers EAX- accumulator, usually used to store results of integer arithmetical or binary

More information

How Software Executes

How Software Executes How Software Executes CS-576 Systems Security Instructor: Georgios Portokalidis Overview Introduction Anatomy of a program Basic assembly Anatomy of function calls (and returns) Memory Safety Intel x86

More information

X86 Review Process Layout, ISA, etc. CS642: Computer Security. Drew Davidson

X86 Review Process Layout, ISA, etc. CS642: Computer Security. Drew Davidson X86 Review Process Layout, ISA, etc. CS642: Computer Security Drew Davidson davidson@cs.wisc.edu From Last Time ACL-based permissions (UNIX style) Read, Write, execute can be restricted on users and groups

More information

Machine Code and Assemblers November 6

Machine Code and Assemblers November 6 Machine Code and Assemblers November 6 CSC201 Section 002 Fall, 2000 Definitions Assembly time vs. link time vs. load time vs. run time.c file.asm file.obj file.exe file compiler assembler linker Running

More information

Lab 3. The Art of Assembly Language (II)

Lab 3. The Art of Assembly Language (II) Lab. The Art of Assembly Language (II) Dan Bruce, David Clark and Héctor D. Menéndez Department of Computer Science University College London October 2, 2017 License Creative Commons Share Alike Modified

More information

Assignment 11: functions, calling conventions, and the stack

Assignment 11: functions, calling conventions, and the stack Assignment 11: functions, calling conventions, and the stack ECEN 4553 & 5013, CSCI 4555 & 5525 Prof. Jeremy G. Siek December 5, 2008 The goal of this week s assignment is to remove function definitions

More information