mith College Computer Science CSC231 Assembly Week #11 Fall 2017 Dominique Thiébaut
|
|
|
- Paulina Skinner
- 6 years ago
- Views:
Transcription
1 mith College Computer Science CSC231 Assembly Week #11 Fall 2017 Dominique Thiébaut
2 Back to Conditional Jumps
3 Review sub eax, 10 jz there xxx xxx there:yyy yyy
4 Review cmp eax, 10 jz there xxx xxx there:yyy yyy
5 Examples ; if eax == ebx: ; count += 1 ; ; if dish[j] == 1: ; dishstring[j] = '#' ; else ; dishstring[j] = ' '
6 Examples ; if dish[j-1]!= dish[j+1]: ; newdish[j] = '#' ; else ; newdish[j] = ' '
7 Examples ; # c is a char ; if c >= 'a' and c <= 'z': ; c = chr( ord(c)-32 ) ;
8 ; for (int i=0; i<20; i++ ) { ; print( fib[i] ); ; } Examples
9 Examples ; if x > 0xF : ; z = x+2 ; else: ; z = x-1
10 Meet ALL the Conditional Jumps! je, jz je, jz jne, jnz jne, jnz jl jb jle jbe jg ja jge jae
11 And also jc jnc jp jnp
12 Functions
13 eax ebx eip esp ecx edx esi edi CF PF ZF SF OF DF ALU
14 The Stack Segment Stack Process Data Code
15 Simplest use of the Stack: Push & Pop
16 Push & Pop ecx eip > 003 mov ecx, for: push ecx 007 mov ecx, message 00A mov edx, dword[numchar] 00C call _printstring 00F pop ecx 011 loop for
17 Push & Pop ecx 10 eip > 003 mov ecx, for: push ecx 007 mov ecx, message 00A mov edx, dword[numchar] 00C call _printstring 00F pop ecx 011 loop for
18 Push & Pop ecx eip > 003 mov ecx, for: push ecx 007 mov ecx, message 00A mov edx, dword[numchar] 00C call _printstring 00F pop ecx 011 loop for
19 Push & Pop ecx 11a9f7c3 10 eip > 003 mov ecx, for: push ecx 007 mov ecx, message 00A mov edx, dword[numchar] 00C call _printstring 00F pop ecx 011 loop for
20 Push & Pop ecx 11a9f7c3 10 eip > 003 mov ecx, for: push ecx 007 mov ecx, message 00A mov edx, dword[numchar] 00C call _printstring 00F pop ecx 011 loop for
21 Push & Pop ecx 11a9f7c mov ecx, for: push ecx 007 mov ecx, message 00A mov edx, dword[numchar] 00C call _printstring 00F pop ecx 011 loop for eip >
22 Push & Pop ecx 11a9f7c3 10 eip > 003 mov ecx, for: push ecx 007 mov ecx, message 00A mov edx, dword[numchar] 00C call _printstring 00F pop ecx 011 loop for
23 Push & Pop ecx eip > 003 mov ecx, for: push ecx 007 mov ecx, message 00A mov edx, dword[numchar] 00C call _printstring 00F pop ecx 011 loop for
24 Push & Pop ecx eip > 003 mov ecx, for: push ecx 007 mov ecx, message 00A mov edx, dword[numchar] 00C call _printstring 00F pop ecx 011 loop for
25 Push & Pop ecx eip > 003 mov ecx, for: push ecx 007 mov ecx, message 00A mov edx, dword[numchar] 00C call _printstring 00F pop ecx 011 loop for
26 Push & Pop ecx 11a9f7c3 9 eip > 003 mov ecx, for: push ecx 007 mov ecx, message 00A mov edx, dword[numchar] 00C call _printstring 00F pop ecx 011 loop for
27 Push & Pop ecx Etc 003 mov ecx, for: push ecx 007 mov ecx, message 00A mov edx, dword[numchar] 00C call _printstring 00F pop ecx 011 loop for
28 Always pop in reverse order for: push ecx 007 push edx 00A push eax xxx xxx xxx 01F pop eax 021 pop edx 023 pop ecx
29 We stopped here last time
30 Back to Functions
31 001 ; add1(): adds 1 to eax 001 add1: inc eax 003 ret Our first function! 004 ; main() 004 _Start: 004 mov eax, call add1 00A sub eax, 5 00C call add1 00F add eax, 3
32 eax 001 ; add1(): adds 1 to eax 001 add1: inc eax 003 ret eip > 004 ; main() 004 _Start: 004 mov eax, call add1 00A sub eax, 5 00C call add1 00F add eax, 3
33 eax ; add1(): adds 1 to eax 001 add1: inc eax 003 ret eip > 004 ; main() 004 _Start: 004 mov eax, call add1 00A sub eax, 5 00C call add1 00F add eax, 3
34 eax eip > ; add1(): adds 1 to eax 001 add1: inc eax 003 ret 004 ; main() 004 _Start: 004 mov eax, call add1 00A sub eax, 5 00C call add1 00F add eax, 3 00A
35 eax eip > ; add1(): adds 1 to eax 001 add1: inc eax 003 ret 004 ; main() 004 _Start: 004 mov eax, call add1 00A sub eax, 5 00C call add1 00F add eax, 3 00A
36 eax A 001 ; add1(): adds 1 to eax 001 add1: inc eax 003 ret eip > 004 ; main() 004 _Start: 004 mov eax, call add1 00A sub eax, 5 00C call add1 00F add eax, 3
37 eax A 001 ; add1(): adds 1 to eax 001 add1: inc eax 003 ret eip > 004 ; main() 004 _Start: 004 mov eax, call add1 00A sub eax, 5 00C call add1 00F add eax, 3
38 eax eip > ; add1(): adds 1 to eax 001 add1: inc eax 003 ret 004 ; main() 004 _Start: 004 mov eax, call add1 00A sub eax, 5 00C call add1 00F add eax, 3 00F
39 eax F eip > 001 ; add1(): adds 1 to eax 001 add1: inc eax 003 ret 004 ; main() 004 _Start: 004 mov eax, call add1 00A sub eax, 5 00C call add1 00F add eax, 3
40 eax eip > ; add1(): adds 1 to eax 001 add1: inc eax 003 ret 004 ; main() 004 _Start: 004 mov eax, call add1 00A sub eax, 5 00C call add1 00F add eax, 3 00F
41 eax ; add1(): adds 1 to eax 001 add1: inc eax 003 ret 00F eip > 004 ; main() 004 _Start: 004 mov eax, call add1 00A sub eax, 5 00C call add1 00F add eax, 3 012??
42 func: inst1 inst2 ret pop into eip call func inst3 { push addr of inst3 jmp func
43 What about Nested Function Calls?
44 eax eip > 001 ; add1(): adds 1 to eax 001 add1: inc eax 002 call sub2 003 ret 004 sub2: sub eax, ret 00A _Start: 00A mov eax, 10 00F call add1 011 sub eax, 5
45 eax eip > ; add1(): adds 1 to eax 001 add1: inc eax 002 call sub2 003 ret 004 sub2: sub eax, ret 00A _Start: 00A mov eax, 10 00F call add1 011 sub eax, 5
46 eax eip > 001 ; add1(): adds 1 to eax 001 add1: inc eax 002 call sub2 003 ret 004 sub2: sub eax, ret 00A _Start: 00A mov eax, 10 00F call add1 011 sub eax, 5
47 eax eip > 001 ; add1(): adds 1 to eax 001 add1: inc eax 002 call sub2 003 ret 004 sub2: sub eax, ret 00A _Start: 00A mov eax, 10 00F call add1 011 sub eax, 5
48 eax eip > ; add1(): adds 1 to eax 001 add1: inc eax 002 call sub2 003 ret 004 sub2: sub eax, ret 00A _Start: 00A mov eax, 10 00F call add1 011 sub eax,
49 eax ; add1(): adds 1 to eax 001 add1: inc eax 002 call sub2 003 ret 003 eip > 004 sub2: sub eax, ret 00A _Start: 00A mov eax, 10 00F call add1 011 sub eax, 5
50 eax eip > 001 ; add1(): adds 1 to eax 001 add1: inc eax 002 call sub2 003 ret 004 sub2: sub eax, ret 00A _Start: 00A mov eax, 10 00F call add1 011 sub eax, 5 003
51 eax eip > ; add1(): adds 1 to eax 001 add1: inc eax 002 call sub2 003 ret 004 sub2: sub eax, ret 00A _Start: 00A mov eax, 10 00F call add1 011 sub eax,
52 eax ; add1(): adds 1 to eax 001 add1: inc eax 002 call sub2 003 ret 004 sub2: sub eax, ret eip > 00A _Start: 00A mov eax, 10 00F call add1 011 sub eax, 5???,?
53 Exercise Write a program that uses a function tolower() to return the lowercase version of a string. ecx contains the address, and edx the number of characters in the string.
54 Exercise Write a program that uses a function printdashes that prints a line of stars, the length of which is passed in eax. Write your function so that it doesn't modify any of the other registers.
55 Passing Parameters to Functions
56 Passing through registers Passing through the stack Passing by Value Passing by Reference
57 Passing Parameters Via Registers 001 ; add1(): adds 1 to eax 001 add1: inc eax 003 call sub2 003 ret 004 ; sub2: subtracts 2 from ex 004 sub2: sub eax, ret 00A _Start: 00A mov eax, 10 00F call add1 011 sub eax, 5
58 eax ebx ecx eip esp ebp edx esi edi CF PF ZF SF OF DF ALU
59 Passing Parameters Through the Stack void printsumxy( int x, int y ) { print( x+y ); } int a, b; a = 3; b = 5; printsumxy( a, b ); // prints 8
60 section.data a dd 0 b dd 0 section.text 001 ; printsumxy(x,y): prints x+y 001 printsumxy: 001 push ebp 003 mov ebp, esp 005 mov eax, dword[ebp+8] 007 add eax, dword[ebp+12] 009 call _printint 00B pop ebp 00C ret 8 01A _Start: 01A mov dword[a], 3 01F mov dword[b], push dword[a] 023 push dword[b] 025 call printsumxy
61 section.data a dd 0 b dd 0 eax section.text 001 ; printsumxy(x,y): prints x+y 001 printsumxy: 001 push ebp 003 mov ebp, esp 005 mov eax, dword[ebp+8] 007 add eax, dword[ebp+12] 009 call _printint 00B pop ebp 00C ret 8 01A _Start: 01A mov dword[a], 3 01F mov dword[b], push dword[a] 023 push dword[b] 025 call printsumxy < eip
62 section.data a dd 0 3 b dd 0 eax section.text 001 ; printsumxy(x,y): prints x+y 001 printsumxy: 001 push ebp 003 mov ebp, esp 005 mov eax, dword[ebp+8] 007 add eax, dword[ebp+12] 009 call _printint 00B pop ebp 00C ret 8 01A _Start: 01A mov dword[a], 3 01F mov dword[b], push dword[a] 023 push dword[b] 025 call printsumxy < eip
63 section.data a dd 0 3 b dd 0 5 eax section.text 001 ; printsumxy(x,y): prints x+y 001 printsumxy: 001 push ebp 003 mov ebp, esp 005 mov eax, dword[ebp+8] 007 add eax, dword[ebp+12] 009 call _printint 00B pop ebp 00C ret 8 01A _Start: 01A mov dword[a], 3 01F mov dword[b], push dword[a] 023 push dword[b] 025 call printsumxy < eip
64 section.data a dd 0 3 b dd 0 5 eax section.text 001 ; printsumxy(x,y): prints x+y 001 printsumxy: 001 push ebp 003 mov ebp, esp 005 mov eax, dword[ebp+8] 007 add eax, dword[ebp+12] 009 call _printint 00B pop ebp 00C ret 8 01A _Start: 01A mov dword[a], 3 01F mov dword[b], push dword[a] 023 push dword[b] 025 call printsumxy < eip 3
65 section.data a dd 0 3 b dd 0 5 eax section.text 001 ; printsumxy(x,y): prints x+y 001 printsumxy: 001 push ebp 003 mov ebp, esp 005 mov eax, dword[ebp+8] 007 add eax, dword[ebp+12] 009 call _printint 00B pop ebp 00C ret 8 01A _Start: 01A mov dword[a], 3 01F mov dword[b], push dword[a] 023 push dword[b] 025 call printsumxy 027 < eip 3 5
66 section.data a dd 0 3 b dd 0 5 eax section.text 001 ; printsumxy(x,y): prints x+y 001 printsumxy: 001 push ebp 003 mov ebp, esp 005 mov eax, dword[ebp+8] 007 add eax, dword[ebp+12] 009 call _printint 00B pop ebp 00C ret 8 < eip A _Start: 01A mov dword[a], 3 01F mov dword[b], push dword[a] 023 push dword[b] 025 call printsumxy 027
67 section.data a dd 0 3 b dd 0 5 eax section.text 001 ; printsumxy(x,y): prints x+y 001 printsumxy: 001 push ebp 003 mov ebp, esp 005 mov eax, dword[ebp+8] 007 add eax, dword[ebp+12] 009 call _printint 00B pop ebp 00C ret 8 01A _Start: 01A mov dword[a], 3 01F mov dword[b], push dword[a] 023 push dword[b] 025 call printsumxy 027 < eip old ebp
68 section.data a dd 0 3 b dd 0 5 eax section.text 001 ; printsumxy(x,y): prints x+y 001 printsumxy: 001 push ebp 003 mov ebp, esp 005 mov eax, dword[ebp+8] 007 add eax, dword[ebp+12] 009 call _printint 00B pop ebp 00C ret 8 01A _Start: 01A mov dword[a], 3 01F mov dword[b], push dword[a] 023 push dword[b] 025 call printsumxy 027 < eip old ebp ebp
69 section.data a dd 0 3 b dd 0 5 eax 5 section.text 001 ; printsumxy(x,y): prints x+y 001 printsumxy: 001 push ebp 003 mov ebp, esp 005 mov eax, dword[ebp+8] 007 add eax, dword[ebp+12] 009 call _printint 00B pop ebp 00C ret 8 01A _Start: 01A mov dword[a], 3 01F mov dword[b], push dword[a] 023 push dword[b] 025 call printsumxy 027 < eip old ebp ebp
70 section.data a dd 0 3 b dd 0 5 eax 5 8 section.text 001 ; printsumxy(x,y): prints x+y 001 printsumxy: 001 push ebp 003 mov ebp, esp 005 mov eax, dword[ebp+8] 007 add eax, dword[ebp+12] 009 call _printint 00B pop ebp 00C ret 8 01A _Start: 01A mov dword[a], 3 01F mov dword[b], push dword[a] 023 push dword[b] 025 call printsumxy 027 < eip old ebp ebp
71 somewhere where _printint lives < eip section.data a dd 0 3 b dd 0 5 eax 5 8 section.text 001 ; printsumxy(x,y): prints x+y 001 printsumxy: 001 push ebp 003 mov ebp, esp 005 mov eax, dword[ebp+8] 007 add eax, dword[ebp+12] 009 call _printint 00B pop ebp 00C ret 8 01A _Start: 01A mov dword[a], 3 01F mov dword[b], push dword[a] 023 push dword[b] 025 call printsumxy old ebp 00B < ebp
72 section.data a dd 0 3 b dd 0 5 eax 5 8 section.text 001 ; printsumxy(x,y): prints x+y 001 printsumxy: 001 push ebp 003 mov ebp, esp 005 mov eax, dword[ebp+8] 007 add eax, dword[ebp+12] 009 call _printint 00B pop ebp 00C ret 8 01A _Start: 01A mov dword[a], 3 01F mov dword[b], push dword[a] 023 push dword[b] 025 call printsumxy 027 < eip old ebp 00B < ebp esp
73 section.data a dd 0 3 b dd 0 5 section.text 001 ; printsumxy(x,y): prints x+y 001 printsumxy: 001 push ebp 003 mov ebp, esp 005 mov eax, dword[ebp+8] 007 add eax, dword[ebp+12] 009 call _printint 00B pop ebp 00C ret 8 01A _Start: 01A mov dword[a], 3 01F mov dword[b], push dword[a] 023 push dword[b] 025 call printsumxy 027 < eip eax < ebp old ebp 00B 5 8
74 section.data a dd 0 3 b dd 0 5 section.text 001 ; printsumxy(x,y): prints x+y 001 printsumxy: 001 push ebp 003 mov ebp, esp 005 mov eax, dword[ebp+8] 007 add eax, dword[ebp+12] 009 call _printint 00B pop ebp 00C ret 8 01A _Start: 01A mov dword[a], 3 01F mov dword[b], push dword[a] 023 push dword[b] 025 call printsumxy 027 < eip eax < ebp old ebp 00B 5 8
75 Exercise void func( int x ) { return x*3 + 2; } int a, b, c, d; a = 3; b = 5; c = func( a ); d = func( 30 ); translate this into assembly
76 ;;; FUNCTION SIDE function: push ebp ;save old ebp mov ebp, esp ;make ebp point ;to stack frame Summary xxx xxx dword[ebp+8] ;access paramn dword[ebp+12];access paramn-1 pop ebp ;restore ebp ret 4N ;return and pop ;4N bytes from stack ;;; CALLER SIDE push push push call param1 param2 paramn function
77 Summary ;;; FUNCTION SIDE function: push ebp ;save old ebp mov ebp, esp ;make ebp point ;to stack frame push-registers-you-will-use (clean function) xxx xxx dword[ebp+8] ;access param1 dword[ebp+12];access param2 ;;; CALLER SIDE pop-register-you-used pop ebp ;restore ebp ret 4N ;return and pop ;4N bytes from stack push push push call param1 param2 paramn function
78 Useful Instructions for Functions pushad popad ;push EAX, ECX, EDX, ;EBX, original ESP, ; EBP, ESI, and EDI. ;pop them back in ;reverse order
79 ;;; ; ;;; ; _printstring: prints a string whose address is in ;;; ; ecx, and whose total number of chars ;;; ; is in edx. ;;; ; Examples: ;;; ; Assume a string labeled msg, containing "Hello World!", ;;; ; and a constant MSGLEN equal to 12. To print this string: ;;; ; ;;; ; mov ecx, msg ;;; ; mov edx, MSGLEN ;;; ; call _printstring ;;; ; ;;; ; REGISTERS MODIFIED: NONE ;;; ; ;;; ;save eax and ebx so that they are not modified by the function Example 1 _printstring: push push mov mov int pop pop ret eax ebx eax,sys_write ebx,stdout 0x80 ebx eax
80 Example 2 ;;; ; ;;; ; ;;; ; getinput: gets a numerical input from the keyboard. ;;; ; returns the resulting number in eax (32 bits). ;;; ; recognizes - as the first character of ;;; ; negative numbers. Does not skip whitespace ;;; ; at the beginning. Stops on first not decimal ;;; ; character encountered. ;;; ; ;;; ; NO REGISTERS MODIFIED, except eax ;;; ; ;;; ; Example of call: ;;; ; ;;; ; call getinput ;;; ; mov dword[x], eax ; put integer in x ;;; ; ;;; ; ;;; ; _getinput: section.bss buffer resb 120 intg resd 1 isneg resb 1 section.text pushad ; save all registers.loop1: mov esi, buffer ; eci --> buffer mov edi, 0 ; edi = counter of chars mov eax, 03 ; input
81 Dot-Labels ;;; ; ;;; ; printline: mov esi, buffer ; esi --> buffer mov edi, 0 ; edi = counter of chars.loop1: mov eax, 03 ; input mov ebx, 0 ; stdin mov ecx, esi ; where to put the next char loop.loop1.for1: mov.for2: mov... ret ;;; ; ;;; ; printreg: mov esi, buffer mov edi, 0.for1: mov.for2: mov ret
82 Dot-Labels ;;; ; ;;; ; printline: mov esi, buffer ; esi --> buffer mov edi, 0 ; edi = counter of chars.loop1: mov eax, 03 ; input mov ebx, 0 ; stdin mov ecx, esi ; where to put the next char loop.loop1.for1: mov.for2: mov... ret ;;; ; ;;; ; printreg: mov esi, buffer mov edi, 0.for1: mov printline.for2:.for2: mov ret printreg.for2:
83 Passing through registers Passing through the stack Passing by Value Passing by Reference
mith College Computer Science CSC231 Assembly Week #12 Thanksgiving 2017 Dominique Thiébaut
mith College Computer Science CSC231 Assembly Week #12 Thanksgiving 2017 Dominique Thiébaut dthiebaut@smith.edu ;;; FUNCTION SIDE function: ebp ;save old ebp ebp, esp ;make ebp point ;to stack frame Summary
mith College Computer Science CSC231 Assembly Week #10 Fall 2017 Dominique Thiébaut
mith College Computer Science CSC231 Assembly Week #10 Fall 2017 Dominique Thiébaut dthiebaut@smith.edu 2 Videos to Start With https://www.youtube.com/watch?v=fdmzngwchdk https://www.youtube.com/watch?v=k2iz1qsx4cm
mith College Computer Science CSC231 Assembly Week #9 Spring 2017 Dominique Thiébaut
mith College Computer Science CSC231 Assembly Week #9 Spring 2017 Dominique Thiébaut dthiebaut@smith.edu 2 Videos to Watch at a Later Time https://www.youtube.com/watch?v=fdmzngwchdk https://www.youtube.com/watch?v=k2iz1qsx4cm
Introduction to 8086 Assembly
Introduction to 8086 Assembly Lecture 5 Jump, Conditional Jump, Looping, Compare instructions Labels and jumping (the jmp instruction) mov eax, 1 add eax, eax jmp label1 xor eax, eax label1: sub eax, 303
mith College Computer Science CSC231 Assembly Week #9 Fall 2017 Dominique Thiébaut
mith College Computer Science CSC231 Assembly Week #9 Fall 2017 Dominique Thiébaut dthiebaut@smith.edu Looping Through Arrays LOOP INSTRUCTION Looping Through Arrays INDIRECT ADDRESSING MODE Indirect Addressing
mith College Computer Science CSC231 - Assembly Week #9 Dominique Thiébaut
mith College Computer Science CSC231 - Assembly Week #9 Dominique Thiébaut dthiebaut@smith.edu https://docs.google.com/forms/d/e/1faipqlscgsgjakylraq3zt6rvr-xmksy1zxrpe0myhpanyigp8byjba/viewform 1,000,000
Program Exploitation Intro
Program Exploitation Intro x86 Assembly 04//2018 Security 1 Univeristà Ca Foscari, Venezia What is Program Exploitation "Making a program do something unexpected and not planned" The right bugs can be
X86 Addressing Modes Chapter 3" Review: Instructions to Recognize"
X86 Addressing Modes Chapter 3" Review: Instructions to Recognize" 1 Arithmetic Instructions (1)! Two Operand Instructions" ADD Dest, Src Dest = Dest + Src SUB Dest, Src Dest = Dest - Src MUL Dest, Src
CS61 Section Solutions 3
CS61 Section Solutions 3 (Week of 10/1-10/5) 1. Assembly Operand Specifiers 2. Condition Codes 3. Jumps 4. Control Flow Loops 5. Procedure Calls 1. Assembly Operand Specifiers Q1 Operand Value %eax 0x104
mith College Computer Science CSC231 Assembly Week #5 Fall 2017 Dominique Thiébaut
mith College Computer Science CSC231 Assembly Week #5 Fall 2017 Dominique Thiébaut dthiebaut@smith.edu 0000 0 0 0001 1 1 0010 2 2 0011 3 3 0100 4 4 0101 5 5 0110 6 6 0111 7 7 1000 8 8 1001 9 9 1010 A 10
mith College Computer Science CSC231 Assembly Week #13 Fall 2017 Dominique Thiébaut
mith College Computer Science CSC21 Assembly Week #1 Fall 2017 Dominique Thiébaut dthiebaut@smith.edu for n in 0 1 2 5 ; do echo "n =$n"./hw7b $n echo "" done Pascal Triangle n =0 n =1 1 n =2 1 0 1 1 n
mith College Computer Science CSC231 - Assembly Week #3 Dominique Thiébaut
mith College Computer Science CSC231 - Assembly Week #3 Dominique Thiébaut dthiebaut@smith.edu memory mov add registers hexdump listings number systems Let's Review Last Week's Material section.data
CSC 2400: Computer Systems. Towards the Hardware: Machine-Level Representation of Programs
CSC 2400: Computer Systems Towards the Hardware: Machine-Level Representation of Programs Towards the Hardware High-level language (Java) High-level language (C) assembly language machine language (IA-32)
Lab 3. The Art of Assembly Language (II)
Lab. The Art of Assembly Language (II) Dan Bruce, David Clark and Héctor D. Menéndez Department of Computer Science University College London October 2, 2017 License Creative Commons Share Alike Modified
CSC 8400: Computer Systems. Machine-Level Representation of Programs
CSC 8400: Computer Systems Machine-Level Representation of Programs Towards the Hardware High-level language (Java) High-level language (C) assembly language machine language (IA-32) 1 Compilation Stages
Assembly Language: Function Calls
Assembly Language: Function Calls 1 Goals of this Lecture Help you learn: Function call problems: Calling and returning Passing parameters Storing local variables Handling registers without interference
administrivia today start assembly probably won t finish all these slides Assignment 4 due tomorrow any questions?
administrivia today start assembly probably won t finish all these slides Assignment 4 due tomorrow any questions? exam on Wednesday today s material not on the exam 1 Assembly Assembly is programming
Assembly Language: Function Calls" Goals of this Lecture"
Assembly Language: Function Calls" 1 Goals of this Lecture" Help you learn:" Function call problems:" Calling and returning" Passing parameters" Storing local variables" Handling registers without interference"
Conditional Processing
١ Conditional Processing Computer Organization & Assembly Language Programming Dr Adnan Gutub aagutub at uqu.edu.sa Presentation Outline [Adapted from slides of Dr. Kip Irvine: Assembly Language for Intel-Based
Assembly Language: Function Calls" Goals of this Lecture"
Assembly Language: Function Calls" 1 Goals of this Lecture" Help you learn:" Function call problems:" Calling and urning" Passing parameters" Storing local variables" Handling registers without interference"
Assembly Language: Function Calls. Goals of this Lecture. Function Call Problems
Assembly Language: Function Calls 1 Goals of this Lecture Help you learn: Function call problems: Calling and urning Passing parameters Storing local variables Handling registers without interference Returning
CPS104 Recitation: Assembly Programming
CPS104 Recitation: Assembly Programming Alexandru Duțu 1 Facts OS kernel and embedded software engineers use assembly for some parts of their code some OSes had their entire GUIs written in assembly in
Islamic University Gaza Engineering Faculty Department of Computer Engineering ECOM 2125: Assembly Language LAB. Lab # 10. Advanced Procedures
Islamic University Gaza Engineering Faculty Department of Computer Engineering ECOM 2125: Assembly Language LAB Lab # 10 Advanced Procedures May, 2014 1 Assembly Language LAB Stack Parameters There are
SOEN228, Winter Revision 1.2 Date: October 25,
SOEN228, Winter 2003 Revision 1.2 Date: October 25, 2003 1 Contents Flags Mnemonics Basic I/O Exercises Overview of sample programs 2 Flag Register The flag register stores the condition flags that retain
mith College Computer Science CSC231 - Assembly Week #4 Dominique Thiébaut
mith College Computer Science CSC231 - Assembly Week #4 Dominique Thiébaut dthiebaut@smith.edu Homework Solutions Outline Review Hexdump Pentium Data Registers 32-bit, 16-bit and 8-bit quantities (registers
LABORATORY WORK NO. 7 FLOW CONTROL INSTRUCTIONS
LABORATORY WORK NO. 7 FLOW CONTROL INSTRUCTIONS 1. Object of laboratory The x86 microprocessor family has a large variety of instructions that allow instruction flow control. We have 4 categories: jump,
16.317: Microprocessor Systems Design I Fall 2014
16.317: Microprocessor Systems Design I Fall 2014 Exam 2 Solution 1. (16 points, 4 points per part) Multiple choice For each of the multiple choice questions below, clearly indicate your response by circling
EECE.3170: Microprocessor Systems Design I Summer 2017 Homework 4 Solution
1. (40 points) Write the following subroutine in x86 assembly: Recall that: int f(int v1, int v2, int v3) { int x = v1 + v2; urn (x + v3) * (x v3); Subroutine arguments are passed on the stack, and can
CS 33: Week 3 Discussion. x86 Assembly (v1.0) Section 1G
CS 33: Week 3 Discussion x86 Assembly (v1.0) Section 1G Announcements - HW2 due Sunday - MT1 this Thursday! - Lab2 out Info Name: Eric Kim (Section 1G, 2-4 PM, BH 5419) Office Hours (Boelter 2432) - Wed
CS 31: Intro to Systems ISAs and Assembly. Kevin Webb Swarthmore College February 9, 2016
CS 31: Intro to Systems ISAs and Assembly Kevin Webb Swarthmore College February 9, 2016 Reading Quiz Overview How to directly interact with hardware Instruction set architecture (ISA) Interface between
CS 31: Intro to Systems ISAs and Assembly. Kevin Webb Swarthmore College September 25, 2018
CS 31: Intro to Systems ISAs and Assembly Kevin Webb Swarthmore College September 25, 2018 Overview How to directly interact with hardware Instruction set architecture (ISA) Interface between programmer
16.317: Microprocessor Systems Design I Fall 2015
16.317: Microprocessor Systems Design I Fall 2015 Exam 2 Solution 1. (16 points, 4 points per part) Multiple choice For each of the multiple choice questions below, clearly indicate your response by circling
Lab 6: Conditional Processing
COE 205 Lab Manual Lab 6: Conditional Processing Page 56 Lab 6: Conditional Processing Contents 6.1. Unconditional Jump 6.2. The Compare Instruction 6.3. Conditional Jump Instructions 6.4. Finding the
Jump instructions. Unconditional jumps Direct jump. do not change flags. jmp label
do not change flags Unconditional jumps Direct jump jmp label Jump instructions jmp Continue xor eax,eax Continue: xor ecx,ecx Machine code: 0040340A EB 02 0040340C 33 C0 0040340E 33 C9 displacement =
Computer Architecture and Assembly Language. Practical Session 5
Computer Architecture and Assembly Language Practical Session 5 Addressing Mode - "memory address calculation mode" An addressing mode specifies how to calculate the effective memory address of an operand.
Ex: Write a piece of code that transfers a block of 256 bytes stored at locations starting at 34000H to locations starting at 36000H. Ans.
INSTRUCTOR: ABDULMUTTALIB A H ALDOURI Conditional Jump Cond Unsigned Signed = JE : Jump Equal JE : Jump Equal ZF = 1 JZ : Jump Zero JZ : Jump Zero ZF = 1 JNZ : Jump Not Zero JNZ : Jump Not Zero ZF = 0
16.317: Microprocessor Systems Design I Spring 2015
16.317: Microprocessor Systems Design I Spring 2015 Exam 2 Solution 1. (16 points, 4 points per part) Multiple choice For each of the multiple choice questions below, clearly indicate your response by
Practical Malware Analysis
Practical Malware Analysis Ch 4: A Crash Course in x86 Disassembly Revised 1-16-7 Basic Techniques Basic static analysis Looks at malware from the outside Basic dynamic analysis Only shows you how the
An Introduction to x86 ASM
An Introduction to x86 ASM Malware Analysis Seminar Meeting 1 Cody Cutler, Anton Burtsev Registers General purpose EAX, EBX, ECX, EDX ESI, EDI (index registers, but used as general in 32-bit protected
Second Part of the Course
CSC 2400: Computer Systems Towards the Hardware 1 Second Part of the Course Toward the hardware High-level language (C) assembly language machine language (IA-32) 2 High-Level Language g Make programming
Reverse Engineering Low Level Software. CS5375 Software Reverse Engineering Dr. Jaime C. Acosta
1 Reverse Engineering Low Level Software CS5375 Software Reverse Engineering Dr. Jaime C. Acosta Machine code 2 3 Machine code Assembly compile Machine Code disassemble 4 Machine code Assembly compile
Process Layout and Function Calls
Process Layout and Function Calls CS 6 Spring 07 / 8 Process Layout in Memory Stack grows towards decreasing addresses. is initialized at run-time. Heap grow towards increasing addresses. is initialized
BAHAR DÖNEMİ MİKROİŞLEMCİLER LAB4 FÖYÜ
LAB4 RELATED INSTRUCTIONS: Compare, division and jump instructions CMP REG, memory memory, REG REG, REG memory, immediate REG, immediate operand1 - operand2 Result is not stored anywhere, flags are set
Computer Architecture..Second Year (Sem.2).Lecture(4) مدرس المادة : م. سندس العزاوي... قسم / الحاسبات
مدرس المادة : م. سندس العزاوي... قسم / الحاسبات... - 26 27 Assembly Level Machine Organization Usage of AND, OR, XOR, NOT AND : X Y X AND Y USE : to chick any bit by change ( to ) or ( to ) EX : AX = FF5
IFE: Course in Low Level Programing. Lecture 6
IFE: Course in Low Level Programing Lecture 6 Instruction Set of Intel x86 Microprocessors Conditional jumps Jcc jump on condition cc, JMP jump always, CALL call a procedure, RET return from procedure,
mith College Computer Science CSC231 - Assembly Week #8 Dominique Thiébaut
mith College Computer Science CSC231 - Assembly Week #8 Dominique Thiébaut dthiebaut@smith.edu Can't Sleep https://xkcd.com/571/ Logic Design Logic Design Image from http://www.willegal.net/appleii/images/motherboard.jpg
Procedure-Calling Conventions October 30
Procedure-Calling Conventions October 30 CSC201 Section 002 Fall, 2000 Saving registers Registers are inevitably used by subroutines; changes their! Registers have global scope; calling procedures also
Subprograms: Arguments
Subprograms: Arguments ICS312 Machine-Level and Systems Programming Henri Casanova (henric@hawaii.edu) Activation Records The stack is useful to store and rieve urn addresses, transparently managed via
COMPUTER ENGINEERING DEPARTMENT
Page 1 of 11 COMPUTER ENGINEERING DEPARTMENT December 31, 2007 COE 205 COMPUTER ORGANIZATION & ASSEMBLY PROGRAMMING Major Exam II First Semester (071) Time: 7:00 PM-9:30 PM Student Name : KEY Student ID.
Assembly Language Lab # 9
Faculty of Engineering Computer Engineering Department Islamic University of Gaza 2011 Assembly Language Lab # 9 Stacks and Subroutines Eng. Doaa Abu Jabal Assembly Language Lab # 9 Stacks and Subroutines
Computer Architecture and Assembly Language. Practical Session 3
Computer Architecture and Assembly Language Practical Session 3 Advanced Instructions division DIV r/m - unsigned integer division IDIV r/m - signed integer division Dividend Divisor Quotient Remainder
Subprograms: Local Variables
Subprograms: Local Variables ICS312 Machine-Level and Systems Programming Henri Casanova (henric@hawaii.edu) Local Variables in Subprograms In all the examples we have seen so far, the subprograms were
Function Calls COS 217. Reading: Chapter 4 of Programming From the Ground Up (available online from the course Web site)
Function Calls COS 217 Reading: Chapter 4 of Programming From the Ground Up (available online from the course Web site) 1 Goals of Today s Lecture Finishing introduction to assembly language o EFLAGS register
Assembler lecture 4 S.Šimoňák, DCI FEEI TU of Košice
Assembler lecture 4 S.Šimoňák, DCI FEEI TU of Košice Addressing data access specification arrays - specification and manipulation impacts of addressing to performance Processor architecture CISC (more
CNIT 127: Exploit Development. Ch 1: Before you begin. Updated
CNIT 127: Exploit Development Ch 1: Before you begin Updated 1-14-16 Basic Concepts Vulnerability A flaw in a system that allows an attacker to do something the designer did not intend, such as Denial
Stack -- Memory which holds register contents. Will keep the EIP of the next address after the call
Call without Parameter Value Transfer What are involved? ESP Stack Pointer Register Grows by 4 for EIP (return address) storage Stack -- Memory which holds register contents Will keep the EIP of the next
CSCI 2021: x86-64 Control Flow
CSCI 2021: x86-64 Control Flow Chris Kauffman Last Updated: Mon Mar 11 11:54:06 CDT 2019 1 Logistics Reading Bryant/O Hallaron Ch 3.6: Control Flow Ch 3.7: Procedure calls Goals Jumps and Control flow
Language of x86 processor family
Assembler lecture 2 S.Šimoňák, DCI FEEI TU of Košice Language of x86 processor family Assembler commands: instructions (processor, instructions of machine language) directives (compiler translation control,
Basic Assembly Instructions
Basic Assembly Instructions Ned Nedialkov McMaster University Canada SE 3F03 January 2013 Outline Multiplication Division FLAGS register Branch Instructions If statements Loop instructions 2/21 Multiplication
Lecture 15 Intel Manual, Vol. 1, Chapter 3. Fri, Mar 6, Hampden-Sydney College. The x86 Architecture. Robb T. Koether. Overview of the x86
Lecture 15 Intel Manual, Vol. 1, Chapter 3 Hampden-Sydney College Fri, Mar 6, 2009 Outline 1 2 Overview See the reference IA-32 Intel Software Developer s Manual Volume 1: Basic, Chapter 3. Instructions
ASSEMBLY II: CONTROL FLOW. Jo, Heeseung
ASSEMBLY II: CONTROL FLOW Jo, Heeseung IA-32 PROCESSOR STATE Temporary data Location of runtime stack %eax %edx %ecx %ebx %esi %edi %esp %ebp General purpose registers Current stack top Current stack frame
System Programming and Computer Architecture (Fall 2009)
System Programming and Computer Architecture (Fall 2009) Recitation 2 October 8 th, 2009 Zaheer Chothia Email: zchothia@student.ethz.ch Web: http://n.ethz.ch/~zchothia/ Topics for Today Classroom Exercise
EXPERIMENT WRITE UP. LEARNING OBJECTIVES: 1. Get hands on experience with Assembly Language Programming 2. Write and debug programs in TASM/MASM
EXPERIMENT WRITE UP AIM: Assembly language program to search a number in given array. LEARNING OBJECTIVES: 1. Get hands on experience with Assembly Language Programming 2. Write and debug programs in TASM/MASM
Towards the Hardware"
CSC 2400: Computer Systems Towards the Hardware Chapter 2 Towards the Hardware High-level language (Java) High-level language (C) assembly language machine language (IA-32) 1 High-Level Language Make programming
Intel Instruction Set (gas)
Intel Instruction Set (gas) These slides provide the gas format for a subset of the Intel processor instruction set, including: Operation Mnemonic Name of Operation Syntax Operation Examples Effect on
We will first study the basic instructions for doing multiplications and divisions
MULTIPLICATION, DIVISION AND NUMERICAL CONVERSIONS We will first study the basic instructions for doing multiplications and divisions We then use these instructions to 1. Convert a string of ASCII digits
CSE351 Spring 2018, Midterm Exam April 27, 2018
CSE351 Spring 2018, Midterm Exam April 27, 2018 Please do not turn the page until 11:30. Last Name: First Name: Student ID Number: Name of person to your left: Name of person to your right: Signature indicating:
Assembly Language: IA-32 Instructions
Assembly Language: IA-32 Instructions 1 Goals of this Lecture Help you learn how to: Manipulate data of various sizes Leverage more sophisticated addressing modes Use condition codes and jumps to change
COMPUTER ENGINEERING DEPARTMENT
Page 1 of 14 COMPUTER ENGINEERING DEPARTMENT Jan. 7, 2010 COE 205 COMPUTER ORGANIZATION & ASSEMBLY PROGRAMMING Major Exam II First Semester (091) Time: 3:30 PM-6:00 PM Student Name : KEY Student ID. :
The IA-32 Stack and Function Calls. CS4379/5375 Software Reverse Engineering Dr. Jaime C. Acosta
1 The IA-32 Stack and Function Calls CS4379/5375 Software Reverse Engineering Dr. Jaime C. Acosta 2 Important Registers used with the Stack EIP: ESP: EBP: 3 Important Registers used with the Stack EIP:
Assembly II: Control Flow. Jin-Soo Kim Computer Systems Laboratory Sungkyunkwan University
Assembly II: Control Flow Jin-Soo Kim (jinsookim@skku.edu) Computer Systems Laboratory Sungkyunkwan University http://csl.skku.edu Processor State (x86-64) RAX 63 31 EAX 0 RBX EBX RCX RDX ECX EDX General-purpose
Summary: Direct Code Generation
Summary: Direct Code Generation 1 Direct Code Generation Code generation involves the generation of the target representation (object code) from the annotated parse tree (or Abstract Syntactic Tree, AST)
Credits and Disclaimers
Credits and Disclaimers 1 The examples and discussion in the following slides have been adapted from a variety of sources, including: Chapter 3 of Computer Systems 2 nd Edition by Bryant and O'Hallaron
Instruction Set Architecture
CS:APP Chapter 4 Computer Architecture Instruction Set Architecture Randal E. Bryant adapted by Jason Fritts http://csapp.cs.cmu.edu CS:APP2e Hardware Architecture - using Y86 ISA For learning aspects
Chapter 4 Processor Architecture: Y86 (Sections 4.1 & 4.3) with material from Dr. Bin Ren, College of William & Mary
Chapter 4 Processor Architecture: Y86 (Sections 4.1 & 4.3) with material from Dr. Bin Ren, College of William & Mary 1 Outline Introduction to assembly programing Introduction to Y86 Y86 instructions,
Low-Level Essentials for Understanding Security Problems Aurélien Francillon
Low-Level Essentials for Understanding Security Problems Aurélien Francillon francill@eurecom.fr Computer Architecture The modern computer architecture is based on Von Neumann Two main parts: CPU (Central
Lecture 4 CIS 341: COMPILERS
Lecture 4 CIS 341: COMPILERS CIS 341 Announcements HW2: X86lite Available on the course web pages. Due: Weds. Feb. 7 th at midnight Pair-programming project Zdancewic CIS 341: Compilers 2 X86 Schematic
Assembly II: Control Flow
Assembly II: Control Flow Jinkyu Jeong (jinkyu@skku.edu) Computer Systems Laboratory Sungkyunkwan University http://csl.skku.edu SSE2030: Introduction to Computer Systems, Spring 2018, Jinkyu Jeong (jinkyu@skku.edu)
The x86 Architecture
The x86 Architecture Lecture 24 Intel Manual, Vol. 1, Chapter 3 Robb T. Koether Hampden-Sydney College Fri, Mar 20, 2015 Robb T. Koether (Hampden-Sydney College) The x86 Architecture Fri, Mar 20, 2015
Assembly Language for Intel-Based Computers, 4 th Edition. Chapter 6: Conditional Processing
Assembly Language for Intel-Based Computers, 4 th Edition Kip R. Irvine Chapter 6: Conditional Processing (c) Pearson Education, 2002. All rights reserved. Chapter Overview Boolean and Comparison Instructions
Where We Are. Optimizations. Assembly code. generation. Lexical, Syntax, and Semantic Analysis IR Generation. Low-level IR code.
Where We Are Source code if (b == 0) a = b; Low-level IR code Optimized Low-level IR code Assembly code cmp $0,%rcx cmovz %rax,%rdx Lexical, Syntax, and Semantic Analysis IR Generation Optimizations Assembly
Lecture (08) x86 programming 7
Lecture (08) x86 programming 7 By: Dr. Ahmed ElShafee 1 Conditional jump: Conditional jumps are executed only if the specified conditions are true. Usually the condition specified by a conditional jump
Computer Architecture and Assembly Language. Practical Session 7
Computer Architecture and Assembly Language Practical Session 7 Co-Routines co-routines are assembly implementation of threads each co-routine decides to which co-routine to pass a control (unlike usual
Process Layout, Function Calls, and the Heap
Process Layout, Function Calls, and the Heap CS 6 Spring 20 Prof. Vern Paxson TAs: Devdatta Akhawe, Mobin Javed, Matthias Vallentin January 9, 20 / 5 2 / 5 Outline Process Layout Function Calls The Heap
Intel x86 Jump Instructions. Part 5. JMP address. Operations: Program Flow Control. Operations: Program Flow Control.
Part 5 Intel x86 Jump Instructions Control Logic Fly over code Operations: Program Flow Control Operations: Program Flow Control Unlike high-level languages, processors don't have fancy expressions or
Assembly II: Control Flow. Jin-Soo Kim Computer Systems Laboratory Sungkyunkwan University
Assembly II: Control Flow Jin-Soo Kim (jinsookim@skku.edu) Computer Systems Laboratory Sungkyunkwan University http://csl.skku.edu IA-32 Processor State %eax %edx Temporary data Location of runtime stack
1 if (a == b) 2 { 3 /* true stuff here */ 4 } 5 else 6 { 7 /* false stuff here */ 8 } 10 /* done either way (i.e., whether true.
1 movl a, %eax 2 movl b, %ebx 3 cmpl %eax, %ebx 4 je truestuff 5 6 /* false stuff here */ 7 jmp DoneEitherWay 8 9 truestuff: 10 /* if true code here */ 1 int absdiff(int x, int y) 3 if (x
mith College Computer Science CSC231-Assembly Fall 2017 Week #2 Dominique Thiébaut
mith College Computer Science CSC231-Assembly Fall 2017 Week #2 Dominique Thiébaut dthiebaut@smith.edu Outline Labs: emacs, assembly Assembly + Linking Process Object files DB directive: Everything is
CS412/CS413. Introduction to Compilers Tim Teitelbaum. Lecture 21: Generating Pentium Code 10 March 08
CS412/CS413 Introduction to Compilers Tim Teitelbaum Lecture 21: Generating Pentium Code 10 March 08 CS 412/413 Spring 2008 Introduction to Compilers 1 Simple Code Generation Three-address code makes it
CS 31: Intro to Systems ISAs and Assembly. Martin Gagné Swarthmore College February 7, 2017
CS 31: Intro to Systems ISAs and Assembly Martin Gagné Swarthmore College February 7, 2017 ANNOUNCEMENT All labs will meet in SCI 252 (the robot lab) tomorrow. Overview How to directly interact with hardware
Machine-Level Programming II: Control and Arithmetic
Machine-Level Programming II: Control and Arithmetic CSCI 2400: Computer Architecture Instructor: David Ferry Slides adapted from Bryant & O Hallaron s slides 1 Today Complete addressing mode, address
Assembly Language II: Addressing Modes & Control Flow
Assembly Language II: Addressing Modes & Control Flow Learning Objectives Interpret different modes of addressing in x86 assembly Move data seamlessly between registers and memory Map data structures in
Intel x86 Jump Instructions. Part 5. JMP address. Operations: Program Flow Control. Operations: Program Flow Control.
Part 5 Intel x86 Jump Instructions Control Logic Fly over code Operations: Program Flow Control Operations: Program Flow Control Unlike high-level languages, processors don't have fancy expressions or
16.317: Microprocessor Systems Design I Fall 2013
16.317: Microprocessor Systems Design I Fall 2013 Exam 2 Solution 1. (20 points, 5 points per part) Multiple choice For each of the multiple choice questions below, clearly indicate your response by circling
It is possible to define a number using a character or multiple numbers (see instruction DB) by using a string.
1 od 5 17. 12. 2017 23:53 (https://github.com/schweigi/assembler-simulator) Introduction This simulator provides a simplified assembler syntax (based on NASM (http://www.nasm.us)) and is simulating a x86
Selection and Iteration. Chapter 7 S. Dandamudi
Selection and Iteration Chapter 7 S. Dandamudi Outline Unconditional jump Compare instruction Conditional jumps Single flags Unsigned comparisons Signed comparisons Loop instructions Implementing high-level
Winter Compiler Construction T11 Activation records + Introduction to x86 assembly. Today. Tips for PA4. Today:
Winter 2006-2007 Compiler Construction T11 Activation records + Introduction to x86 assembly Mooly Sagiv and Roman Manevich School of Computer Science Tel-Aviv University Today ic IC Language Lexical Analysis
Sistemi Operativi. Lez. 16 Elementi del linguaggio Assembler AT&T
Sistemi Operativi Lez. 16 Elementi del linguaggio Assembler AT&T Data Sizes Three main data sizes Byte (b): 1 byte Word (w): 2 bytes Long (l): 4 bytes Separate assembly-language instructions E.g., addb,
Complex Instruction Set Computer (CISC)
Introduction ti to IA-32 IA-32 Processors Evolutionary design Starting in 1978 with 886 Added more features as time goes on Still support old features, although obsolete Totally dominate computer market
Branching and Looping
Branching and Looping EECE416 uc Fall 2011 Unconditional Jumps jmp Like a goto in a high-level language Format: jmp StatementLabel The next statement executed will be the one at StatementLabel: jmp Encoding