Introduction To Intel x86 Assembly, Architecture, Applications, & Alliteration

Introduction to Intel x86 Assembly, Architecture, Applications, & Alliteration
Xeno Kovah 2009/2010 xkovah at gmail
Approved for Public Release: 10-3348. Distribution Unlimited
All materials is licensed under a Creative Commons Share Alike license.

http://creativecommons.org/licenses/by-sa/3.0/
Additional Content/Ideas/Info Provided By:

Jon A. Erickson, Christian Arllen, Dave Keppler Who suggested what, is inline with the material
About Me
Security nerd - generalist, not specialist Realmz ~1996, Mac OS 8, BEQ->BNE FTW! x86 ~2002 Know or have known ~5 assembly languages(x86, SPARC, ARM, PPC, 68HC12). x86 is by far the most complex. Routinely read assembly when debugging my own code, reading exploit code, and reverse engineering things
4
About You?
Name & Department Why did you want to take the class? If you know you will be applying this knowledge, to which OS and/or development environment?
About the Class

The intent of this class is to expose you to the most commonly generated assembly instructions, and the most frequently dealt with architecture hardware.
32 bit instructions/hardware Implementation of a Stack Common tools
Many things will therefore be left out or deferred to later classes.

Floating point instructions/hardware 16/64 bit instructions/hardware Complicated or rare 32 bit instructions Instruction pipeline, caching hierarchy, alternate modes of operation, hw virtualization, etc
About the Class 2

The hope is that the material covered will be provide the required background to delve deeper into areas which may have seemed daunting previously. Because I can't anticipate the needs of all job classes, if there are specific areas which you think would be useful to certain job types, let me know. The focus areas are currently primarily influenced by my security background, but I would like to make the class as widely applicable as possible.
Agenda
Day 1 - Part 1 - Architecture Introduction, Windows tools Day 1 - Part 2 - Windows Tools & Analysis, Learning New Instructions Day 2 - Part 1 - Linux Tools & Analysis Day 2 - Part 2 - Inline Assembly, Read The Fun Manual, Choose Your Own Adventure
8
Miss Alaineous
Questions: Ask 'em if you got 'em
If you fall behind and get lost and try to tough it out until you understand, it's more likely that you will stay lost, so ask questions ASAP.
Browsing the web and/or checking email during class is a good way to get lost ;) Vote on class schedule. Benevolent dictator clause. It's called x86 because of the progression of Intel chips from 8086, 80186, 80286, etc. I just had to get that out of the way. :)
9
What you're going to learn

#include <stdio.h> int main(){ printf(Hello World!\n); return 0x1234; }
10
Is the same as
.text:00401730 main .text:00401730 .text:00401731 .text:00401733 .text:00401738 .text:0040173E .text:00401741 .text:00401746 .text:00401747
push ebp mov ebp, esp push offset aHelloWorld ; "Hello world\n" call ds:__imp__printf add esp, 4 mov eax, 1234h pop ebp retn
Windows Visual C++ 2005, /GS (buffer overflow protection) option turned off 11 Disassembled with IDA Pro 4.9 Free Version
Is the same as
08048374 <main>: 8048374: 8d 4c 24 04 8048378: 83 e4 f0 804837b: ff 71 fc 804837e: 55 804837f: 89 e5 8048381: 51 8048382: 83 ec 04 8048385: c7 04 24 60 84 04 08 804838c: e8 43 ff ff ff 8048391: b8 2a 00 00 00 8048396: 83 c4 04 8048399: 59 804839a: 5d 804839b: 8d 61 fc 804839e: c3 804839f: 90 nop lea 0x4(%esp),%ecx and $0xfffffff0,%esp pushl -0x4(%ecx) push %ebp mov %esp,%ebp push %ecx sub $0x4,%esp movl $0x8048460,(%esp) call 80482d4 <puts@plt> mov $0x1234,%eax add $0x4,%esp pop %ecx pop %ebp lea -0x4(%ecx),%esp ret
Ubuntu 8.04, GCC 4.2.4 Disassembled with objdump -d
12
Is the same as
_main: 00001fca 00001fcb 00001fcd 00001fce 00001fd1 00001fd6 00001fd7 00001fdd 00001fe0 00001fe5 00001fea 00001fed 00001fee 00001fef
pushl movl pushl subl calll popl leal movl calll movl addl popl leave ret %ebp %esp,%ebp %ebx $0x14,%esp 0x00001fd6 %ebx 0x0000001a(%ebx),%eax %eax,(%esp) 0x00003005 ; symbol stub for: _puts $0x00001234,%eax $0x14,%esp %ebx
Mac OS 10.5.6, GCC 4.0.1 Disassembled from command line with otool -tV
13
But it all boils down to

.text:00401000 main .text:00401000 push offset aHelloWorld ; "Hello world\n" .text:00401005 call ds:__imp__printf .text:0040100B pop ecx .text:0040100C mov eax, 1234h .text:00401011 retn
Windows Visual C++ 2005, /GS (buffer overflow protection) option turned off Optimize for minimum size (/O1) turned on 14 Disassembled with IDA Pro 4.9 Free Version
Take Heart!
By one measure, only 14 assembly instructions account for 90% of code!

http://www.blackhat.com/presentations/bh-usa-06/BH-US-06-Bilar.pdf
I think that knowing about 20-30 (not counting variations) is good enough that you will have the check the manual very infrequently You've already seen 11 instructions, just in the hello world variations!
15
Refresher - Data Types

In C: char short int/long double/long long ?-> long double?
16
Refresher - Alt. Radices Decimal, Binary, Hexidecimal

If you don't know this, you must memorize tonight
Decimal (base 10) 00 01 02 03 04 05 06 07 08 Binary (base 2) 0000b 0001b 0010b 0011b 0100b 0101b 0110b 0111b 1000b Hex (base 16) 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08
09
10 11 12 13 14 15
1001b
1010b 1011b 1100b 1101b 1110b 1111b
0x09
0x0A 0x0B 0x0C 0x0D 0x0E 0x0F
17
Refresher - Negative Numbers

one's complement = flip all bits. 0->1, 1->0 two's complement = one's complement + 1 Negative numbers are defined as the two's complement of the positive number Number 00000001b : 0x01 00000100b : 0x04 00011010b : 0x1A One's Comp. 11111110b : 0xFE 11111011b : 0xFB 11100101b : 0xE5 Two's Comp. (negative) 11111111b : 0xFF : -1 11111100b : 0xFC : -4 11100110b : 0xE6 : -26
10110000b : 0xB0 : -?
0x01 to 0x7F positive byte, 0x80 to 0xFF negative byte 0x00000001 to 0x7FFFFFFF positive dword 0x80000000 to 0xFFFFFFFF negative dword
18
Architecture - CISC vs. RISC

Intel is CISC - Complex Instruction Set Computer
Many very special purpose instructions that you will never see, and a given compiler may never use - just need to know how to use the manual Variable-length instructions, between 1 and 16(?) bytes long.
16 is max len in theory, I don't know if it can happen in practice
Other major architectures are typically RISC Reduced Instruction Set Computer
Typically more registers, less and fixed-size instructions Examples: PowerPC, ARM, SPARC, MIPS
19
Architecture - Endian
Endianness comes from Jonathan Swift's Gulliver's Travels. It doesn't matter which way you eat your eggs :) Little Endian - 0x12345678 stored in RAM little end first. The least significant byte of a word or larger is stored in the lowest address. E.g. 0x78563412
Intel is Little Endian
Big Endian - 0x12345678 stored as is.

Network traffic is Big Endian Most everyone else you've heard of (PowerPC, ARM, SPARC, MIPS) is either Big Endian by default or can be configured as either (Bi-Endian)
Book p. 163
Book for this class is Professional Assembly Language by Blum
20
Endianess pictures
Big Endian (Others)
Register FE ED FA CE High Memory Addresses
Little Endian (Intel)

Register
00 00 CE FA ED FE
0x5 0x4 0x3 0x2 0x1 0x0
00 00 FE ED FA CE
FE ED FA CE
Low Memory Addresses
21
Architecture - Registers
Registers are small memory storage areas built into the processor (still volatile memory) 8 general purpose registers + the instruction pointer which points at the next instruction to execute
But two of the 8 are not that general
On x86-32, registers are 32 bits long On x86-64, they're 64 bits

Book p. 25
22
Architecture - Register Conventions 1

These are Intel's suggestions to compiler developers (and assembly handcoders). Registers don't have to be used these ways, but if you see them being used like this, you'll know why. But I simplified some descriptions. I also color coded as GREEN for the ones which we will actually see in this class (as opposed to future ones), and RED for not. EAX - Stores function return values EBX - Base pointer to the data section ECX - Counter for string and loop operations EDX - I/O pointer
Intel Arch v1 Section 3.4.1 - General-Purpose Registers
23
Architecture - Registers Conventions 2

ESI - Source pointer for string operations EDI - Destination pointer for string operations ESP - Stack pointer EBP - Stack frame base pointer EIP - Pointer to next instruction to execute (instruction pointer)
24
Architecture - Registers Conventions 3

Caller-save registers - eax, edx, ecx If the caller has anything in the registers that it cares about, the caller is in charge of saving the value before a call to a subroutine, and restoring the value after the call returns Put another way - the callee can (and is highly likely to) modify values in caller-save registers Callee-save registers - ebp, ebx, esi, edi If the callee needs to use more registers than are saved by the caller, the callee is responsible for making sure the values are stored/restored Put another way - the callee must be a good citizen and not modify registers which the caller didn't save, unless the callee itself saves and restores the existing values
25
Architecture - Registers 8/16/32 bit addressing 1
http://www.sandpile.org/ia32/reg.htm
26
Architecture - Registers 8/16/32 bit addressing 2
http://www.sandpile.org/ia32/reg.htm
27
Architecture - EFLAGS
EFLAGS register holds many single bit flags. Will only ask you to remember the following for now.
Zero Flag (ZF) - Set if the result of some instruction is zero; cleared otherwise. Sign Flag (SF) - Set equal to the most-significant bit of the result, which is the sign bit of a signed integer. (0 indicates a positive value and 1 indicates a negative value.)
Intel Vol 1 Sec 3.4.3 - page 3-20
28
Your first x86 instruction: NOP

NOP - No Operation! No registers, no values, no nothin'! Just there to pad/align bytes, or to delay time Bad guys use it to make simple exploits more reliable. But that's another class ;)
29
Extra! Extra! Late-breaking NOP news!

Amaze those who know x86 by citing this interesting bit of trivia:
The one-byte NOP instruction is an alias mnemonic for the XCHG (E)AX, (E)AX instruction.
I had never looked in the manual for NOP apparently :)
Every other person I had told this to had never heard it either. Thanks to Jon Erickson for cluing me in to this. XCHG instruction is not officially in this class. But if I hadn't just told you what it does, I bet you would have guessed right anyway.
XCHG in book p. 112
30
The Stack
The stack is a conceptual area of main memory (RAM) which is designated by the OS when a program is started.
Different OS start it at different addresses by convention
A stack is a Last-In-First-Out (LIFO/FILO) data structure where data is "pushed" on to the top of the stack and "popped" off the top. By convention the stack grows toward lower memory addresses. Adding something to the stack means the top of the stack is now at a lower memory address.
31
The Stack 2
As already mentioned, esp points to the top of the stack, the lowest address which is being used
While data will exist at addresses beyond the top of the stack, it is considered undefined
The stack keeps track of which functions were called before the current one, it holds local variables and is frequently used to pass arguments to the next function to be called. A firm understanding of what is happening on the stack is *essential* to understanding a 32 program's operation.
PUSH - Push Word, Doubleword or Quadword onto the Stack

For our purposes, it will always be a DWORD (4 bytes).
Can either be an immediate (a numeric constant), or the value in a register
The push instruction automatically decrements the stack pointer, esp, by 4.
Book p. 120
33
Registers Before
Registers After
eax esp
0x00000003 0x0012FF8C
push eax
Stack Before
eax esp
0x00000003 0x0012FF88
Stack After
0x0012FF90
0x00000001 0x00000002 undef undef undef esp
0x00000001
esp
0x0012FF8C 0x0012FF88 0x0012FF84
0x00000002
0x00000003 undef
0x0012FF80
undef
34
POP- Pop a Value from the Stack

Take a DWORD off the stack, put it in a register, and increment esp by 4
Book p. 120
35
Registers Before
eax
esp
0xFFFFFFFF
0x0012FF88
pop eax
Stack Before
Registers After
eax esp
0x00000003 0x0012FF8C
Stack After
0x0012FF90 0x0012FF8C esp 0x0012FF88 0x0012FF84
0x00000001 0x00000002 0x00000003 undef undef
0x00000001
esp
0x00000002
undef(0x00000003) undef
0x0012FF80
undef
36
Calling Conventions
How code calls a subroutine is compiler-dependent and configurable. But there are a few conventions. We will only deal with the cdecl and stdcall conventions. More info at
http://en.wikipedia.org/wiki/X86_calling_conventions http://www.programmersheaven.com/2/Calling-conventions
37
Calling Conventions - cdecl

C declaration - most common calling convention Function parameters pushed onto stack right to left Saves the old stack frame pointer and sets up a new stack frame eax or edx:eax returns the result for primitive data types Caller is responsible for cleaning up the stack
38
Calling Conventions - stdcall

I typically only see this convention used by Microsoft C++ code - e.g. Win32 API Function parameters pushed onto stack right to left Saves the old stack frame pointer and sets up a new stack frame eax or edx:eax returns the result for primitive data types Callee responsible for cleaning up any stack parameters it takes
Aside: typical MS, If I call my new way of doing stuff 'standard' it must be true!
39
CALL - Call Procedure

CALL's job is to transfer control to a different function, in a way that control can later be resumed where it left off First it pushes the address of the next instruction onto the stack
For use by RET for when the procedure is done
Then it changes eip to the address given in the instruction Destination address can be specified in multiple ways
Absolute address Relative address (relative to the end of the instruction)
40
Book p. 132
RET - Return from Procedure

Two forms
Pop the top of the stack into eip (remember pop increments stack pointer)
In this form, the instruction is just written as ret Typically used by cdecl functions
Pop the top of the stack into eip and add a constant number of bytes to esp
In this form, the instruction is written as ret 0x8, or ret 0x20, etc Typically used by stdcall functions
Kinda book p. 133
41
MOV - Move
Can move:
register to register memory to register, register to memory immediate to register, immediate to memory
Never memory to memory! Memory addresses are given in r/m32 form talked about later
Book p. 97
42
General Stack Frame Operation

We are going to pretend that main() is the very first function being executed in a program. This is what its stack looks like to start with (assuming it has any local variables). stack bottom Local Variables
main() frame
undef
undef
stack top
Book p. 306
43
General Stack Frame Operation 2

When main() decides to call a subroutine, main() becomes the caller. We will assume main() has some registers it would like to remain the same, so it will save them. We will also assume that the callee function takes some input arguments.
stack bottom Local Variables Caller-Save Registers Arguments to Pass to Callee
main() frame
undef
undef
stack top
44

When main() actually issues the CALL instruction, the return address gets saved onto the stack, and because the next instruction after the call will be the beginning of the called function, we consider the frame to have changed to the callee.
stack bottom Local Variables Caller-Save Registers Arguments to Pass to Callee Caller's saved return address
main() frame
undef
undef
stack top
45

When foo() starts, the frame pointer (ebp) still points to main()'s frame. So the first thing it does is to save the old frame pointer on the stack and set the new value to point to its own frame.
stack bottom Local Variables Caller-Save Registers Arguments to Pass to Callee Caller's saved return address Saved Frame Pointer
main() frame
foo()'s frame
undef
stack top
46

Next, we'll assume the the callee foo() would like to use all the registers, and must therefore save the callee-save registers. Then it will allocate space for its local variables.
stack bottom Local Variables Caller-Save Registers Arguments to Pass to Callee Caller's saved return address Saved Frame Pointer
main() frame
foo()'s frame
undef
stack top
47
Callee-Save Registers
Local Variables

At this point, foo() decides it wants to call bar(). It is still the callee-ofmain(), but it will now be the caller-of-bar. So it saves any caller-save registers that it needs to. It then puts the function arguments on the stack as well.
stack bottom Saved Frame Pointer Callee-Save Registers Local Variables Caller-Save Registers Arguments to Pass to Callee
main() frame
foo()'s frame
undef
stack top
48
General Stack Frame Layout

Every part of the stack frame is technically optional (that is, you can hand code asm without following the conventions.) But compilers generate code which uses portions if they are needed. Which pieces are used can sometimes be manipulated with compiler options. (E.g. omit frame pointers, changing calling convention to pass arguments in registers, etc.)
stack bottom
Saved Frame Pointer

Callee-Save Registers Local Variables Caller-Save Registers Arguments to Pass to Callee
main() frame foo()'s frame
undef
stack top
49
Stack Frames are a Linked List!

The ebp in the current frame points at the saved ebp of the previous frame. stack bottom
main() frame
foo()'s frame
bar()'s frame
stack top
50
Example1.c
The stack frames in this example will be very simple. Only saved frame pointer (ebp) and saved return addresses (eip).
//Example1 - using the stack //to call subroutines //New instructions: //push, pop, call, ret, mov int sub(){ return 0xbeef; } int main(){ sub(); return 0xf00d; }
sub: 00401000 push 00401001 mov 00401003 mov 00401008 pop 00401009 ret main: 00401010 push 00401011 mov 00401013 call 00401018 mov 0040101D pop 0040101E ret
ebp ebp,esp eax,0BEEFh ebp
ebp ebp,esp sub (401000h) eax,0F00Dh ebp
51
Example1.c 1:
EIP = 00401010, but no instruction yet executed Key:
eax ebp esp
0x003435C0
0x0012FFB8
0x0012FF6C
executed instruction, modified value start value
0x0012FF6C 0x004012E8 0x0012FF68 undef 0x0012FF64

Belongs to the 0x0012FF60 frame *before* main() is called
undef undef
0x0012FF5C
0x0012FF58
undef
undef
52
Example1.c 2
eax ebp esp
0x003435C0 0x0012FFB8 0x0012FF68
Key: executed instruction, modified value start value
0x0012FF6C 0x004012E8 0x0012FF68 0x0012FFB8 0x0012FF64 0x0012FF60 undef undef
0x0012FF5C
0x0012FF58
undef
undef
53
Example1.c 3
eax ebp esp
0x003435C0
0x0012FF68
0x0012FF68
0x0012FF5C
0x0012FF58
undef
undef
54
Example1.c 4
eax ebp esp
0x003435C0
0x0012FF68
0x0012FF64
0x0012FF6C 0x004012E8 0x0012FF68 0x0012FFB8 0x0012FF64 0x0012FF60 0x00401018 undef
0x0012FF5C
0x0012FF58
undef
undef
55
Example1.c 5
eax ebp esp
0x003435C0
0x0012FF68
0x0012FF60
0x0012FF6C 0x004012E8 0x0012FF68 0x0012FFB8 0x0012FF64 0x0012FF60 0x00401018 0x0012FF68
0x0012FF5C
0x0012FF58
undef
undef
56
Example1.c 6
eax ebp esp
0x003435C0
0x0012FF60
0x0012FF60
0x0012FF5C
0x0012FF58
undef
undef
57
Example1.c 6 STACK FRAME TIME OUT

Function-beforemain's frame
main's frame
(saved frame pointer and saved return address)
sub push ebp mov ebp, esp mov eax, 0BEEFh pop ebp retn main push ebp mov ebp, esp call _sub mov eax, 0F00Dh pop ebp retn
0x0012FF6C 0x0012FF68 0x0012FF64 0x0012FF60 0x0012FF5C 0x0012FF58
0x004012E8 0x0012FFB8 0x00401018 0x0012FF68
sub's frame
(only saved frame pointer, because it doesn't call anything else, and doesn't have local variables)
undef
undef
58
Example1.c 7
eax ebp esp
0x0000BEEF 0x0012FF60 0x0012FF60
0x0012FF5C
0x0012FF58
undef
undef
59
Example1.c 8
eax ebp esp
0x0000BEEF
0x0012FF68
0x0012FF64
0x0012FF6C 0x004012E8 0x0012FF68 0x0012FFB8 0x0012FF64 0x0012FF60 0x00401018 undef
0x0012FF5C
0x0012FF58
undef
undef
60
Example1.c 9
eax ebp esp
0x0000BEEF
0x0012FF68
0x0012FF68
0x0012FF5C
0x0012FF58
undef
undef
61
Example1.c 9
eax ebp esp
0x0000F00D
0x0012FF68
0x0012FF68
0x0012FF5C
0x0012FF58
undef
undef
62
Example1.c 10
eax ebp esp
0x0000F00D
0x0012FFB8
0x0012FF6C
0x0012FF6C 0x004012E8 0x0012FF68 undef 0x0012FF64 0x0012FF60 undef undef
0x0012FF5C
0x0012FF58
undef
undef
63
Example1.c 11
eax ebp esp
0x0000F00D
0x0012FFB8
0x0012FF70
0x0012FF6C 0x0012FF68 0x0012FF64 0x0012FF60
undef undef undef undef
0x0012FF5C
0x0012FF58
undef
undef
64
Execution would continue at the value ret removed from the stack: 0x004012E8
Example1 Notes
sub() is deadcode - its return value is not used for anything, and main always returns 0xF00D. If optimizations are turned on in the compiler, it would remove sub() Because there are no input parameters to sub(), there is no difference whether we compile as cdecl vs stdcall calling conventions
65
Let's do that in a tool

Visual C++ 2008 Express Edition (which I will shorthand as VisualStudio or VS) Standard Windows development environment Available for free, but missing some features that pro developers might want Can't move applications to other systems without installing the redistributable libraries
66
Finding the VisualStudio solution file
67
Creating a new project - 1
Creating a new project 1
68
69
70
Adding files to the project
71
Setting project properties - 1
Setting project properties
72
Setting project properties 2
Unfortunately the debug information format alters the code which gets generated too much, making it not as simple as I would like for this class.
73
This would just add extra complexity to the asm which we don't want for now
74

It's all just a wrapper to set command line options
Different options can be set for release vs debug builds
Click this to change which config set is active
75

C++ has more complicated compilergenerated code, and while our stuff is simple enough that the compiler probably wouldn't do anything different, it's good to do this just to be safe
76
Another thing where I found out the hard way that it will increase the asm complexity
77
Building the project - 1
Building project
78
Building the project - 2
Building project 2
Information about whether the build succeeded will be here. If it fails, a separate error tab will open up
79
Setting breakpoints & start debugger

Click to the left of the line to break at.
80
Step into
Step over
Step out
Debugging the program 2

Continue Stop debugging Restart debugging Current stopped location
81
Showing assembly
Right click: Only available while debugging

82
Watching registers
Note that it knows the ebp register is going to be used in this instruction
83
Showing registers
Here you can enter register names or variable names

84
Watching the stack change - 1
Watching the stack change 1
85
Watching the stack change - 2
Watching the stack change 2
Right click on the body of the data in the window and make sure everything's set like this
Set address to esp (will always be the top of the stack)
Set to 1
Click Reevaluate Automatically so that it will change the display as
86
Going through Example1.c in Visual Studio

sub: push mov mov pop ret main: push mov call mov pop ret ebp ebp,esp eax,0BEEFh ebp
ebp ebp,esp sub eax,0F00Dh ebp
87
Example2.c with Input parameters and Local Variables

#include <stdlib.h> int sub(int x, int y){ return 2*x+y; } int main(int argc, char ** argv){ int a; a = atoi(argv[1]); return sub(argc,a); }
.text:00000000 _sub: .text:00000001 .text:00000003 .text:00000006 .text:00000009 .text:0000000C .text:0000000D .text:00000010 _main: .text:00000011 .text:00000013 .text:00000014 .text:00000017 .text:0000001A .text:0000001B .text:00000021 .text:00000024 .text:00000027 .text:0000002A .text:0000002B .text:0000002E .text:0000002F .text:00000034 .text:00000037 .text:00000039 .text:0000003A push ebp mov ebp, esp mov eax, [ebp+8] mov ecx, [ebp+0Ch] lea eax, [ecx+eax*2] pop ebp retn push ebp mov ebp, esp push ecx mov eax, [ebp+0Ch] mov ecx, [eax+4] push ecx call dword ptr ds:__imp__atoi add esp, 4 mov [ebp-4], eax mov edx, [ebp-4] push edx mov eax, [ebp+8] push eax call _sub add esp, 8 mov esp, ebp pop ebp 88 retn
"r/m32" Addressing Forms

Anywhere you see an r/m32 it means it could be taking a value either from a register, or a memory address. I'm just calling these r/m32 forms because anywhere you see r/m32 in the manual, the instruction can be a variation of the below forms. In Intel syntax, most of the time square brackets [] means to treat the value within as a memory address, and fetch the value at that address (like dereferencing a pointer)
mov eax, ebx mov eax, [ebx] mov eax, [ebx+ecx*X] (X=1, 2, 4, 8) mov eax, [ebx+ecx*X+Y] (Y= one byte, 0-255 or 4 bytes, 0-2^32-1)
Most complicated form is: [base + index*scale + disp]
More info: Intel v2a, Section 2.1.5 page 2-4 in particular Tables 2-2 and 2-3
89
LEA - Load Effective Address

Frequently used with pointer arithmetic, sometimes for just arithmetic in general Uses the r/m32 form but is the exception to the rule that the square brackets [ ] syntax means dereference (value at) Example: ebx = 0x2, edx = 0x1000
lea eax, [edx+ebx*2] eax = 0x1004, not the value at 0x1004
Not covered in book
90
ADD and SUB
Adds or Subtracts, just as expected Destination operand can be r/m32 or register Source operand can be r/m32 or register or immediate No source and destination as r/m32s, because that could allow for memory to memory transfer, which isn't allowed on x86 Evaluates the operation as if it were on signed AND unsigned data, and sets flags as appropriate. Instructions modify OF, SF, ZF, AF, PF, and CF flags add esp, 8 sub eax, [ebx*2]
Add p. 202, Sub p. 210
91
Example2.c - 1
.text:00000000 _sub: .text:00000001 .text:00000003 .text:00000006 .text:00000009 .text:0000000C .text:0000000D .text:00000010 _main: .text:00000011 .text:00000013 .text:00000014 .text:00000017 .text:0000001A .text:0000001B .text:00000021 .text:00000024 .text:00000027 .text:0000002A .text:0000002B .text:0000002E .text:0000002F .text:00000034 .text:00000037 .text:00000039 .text:0000003A push ebp mov ebp, esp mov eax, [ebp+8] mov ecx, [ebp+0Ch] lea eax, [ecx+eax*2] pop ebp retn push ebp mov ebp, esp push ecx mov eax, [ebp+0Ch] mov ecx, [eax+4] push ecx call dword ptr ds:__imp__atoi add esp, 4 mov [ebp-4], eax mov edx, [ebp-4] push edx mov eax, [ebp+8] push eax call _sub add esp, 8 mov esp, ebp pop ebp retn
eax
0xcafe
ecx
edx ebp esp
0xbabe
0xfeed 0x0012FF50 0x0012FF24
0x0012FF30 0x0012FF28 0x0012FF24
0x12FFB0 (char ** argv)

Addr after call _main
0x0012FF2C 0x2 (int argc)
0x0012FF50(saved ebp) undef undef
0x0012FF20
0x0012FF1C undef 0x0012FF18 0x0012FF14 0x0012FF10
undef
undef
0x0012FF0C undef
Key: executed instruction , modified value , arbitrary example start value
92
Example2.c - 2
eax
0xcafe
ecx
edx ebp esp
0xbabe
0xfeed 0x0012FF24 0x0012FF24
0x0012FF30 0x0012FF28 0x0012FF24

Addr after call _main 0x0012FF50 (saved ebp)
0x0012FF20
undef
undef undef
undef
0x0012FF0C undef
93
Example2.c - 3
.text:00000000 _sub: .text:00000001 .text:00000003 .text:00000006 .text:00000009 .text:0000000C .text:0000000D .text:00000010 _main: .text:00000011 .text:00000013 .text:00000014 .text:00000017 Caller-save, or .text:0000001A space for local .text:0000001B var? This time it .text:00000021 turns out to be .text:00000024 space for local var .text:00000027 .text:0000002A since there is no .text:0000002B corresponding pop, .text:0000002E and the address is .text:0000002F used later to refer .text:00000034 to the value we .text:00000037 know is stored in a. .text:00000039 .text:0000003A push ebp mov ebp, esp mov eax, [ebp+8] mov ecx, [ebp+0Ch] lea eax, [ecx+eax*2] pop ebp retn push ebp mov ebp, esp push ecx mov eax, [ebp+0Ch] mov ecx, [eax+4] push ecx call dword ptr ds:__imp__atoi add esp, 4 mov [ebp-4], eax mov edx, [ebp-4] push edx mov eax, [ebp+8] push eax call _sub add esp, 8 mov esp, ebp pop ebp retn
eax
0xcafe
ecx
edx ebp esp
0xbabe
0xfeed 0x0012FF24 0x0012FF20
0x0012FF30 0x0012FF28 0x0012FF24

0x0012FF20
0xbabe (int a)
undef undef
undef
0x0012FF0C undef
94
Example2.c - 4
eax
0x12FFB0
ecx
edx ebp esp
0xbabe
0xfeed 0x0012FF24 0x0012FF20
0x0012FF30 0x0012FF28 0x0012FF24

Getting the base of the argv char * array (aka argv[0])
0x0012FF20
0xbabe (int a)
undef undef
undef
0x0012FF0C undef
95
Example2 - 5
.text:00000000 _sub: .text:00000001 .text:00000003 .text:00000006 .text:00000009 .text:0000000C .text:0000000D .text:00000010 _main: .text:00000011 .text:00000013 .text:00000014 .text:00000017 .text:0000001A .text:0000001B .text:00000021 .text:00000024 .text:00000027 .text:0000002A (I chose .text:0000002B 0x12FFD4 .text:0000002E .text:0000002F arbitrarily since .text:00000034 it's out of the .text:00000037 stack scope .text:00000039 we're currently .text:0000003A push ebp mov ebp, esp mov eax, [ebp+8] mov ecx, [ebp+0Ch] lea eax, [ecx+eax*2] pop ebp retn push ebp mov ebp, esp push ecx mov eax, [ebp+0Ch] mov ecx, [eax+4] push ecx call dword ptr ds:__imp__atoi add esp, 4 mov [ebp-4], eax mov edx, [ebp-4] push edx mov eax, [ebp+8] push eax call _sub add esp, 8 mov esp, ebp pop ebp retn
eax
0x12FFB0
ecx
edx ebp esp
0x12FFD4(arbitrary)
0xfeed 0x0012FF24 0x0012FF20
0x0012FF30 0x0012FF28 0x0012FF24

Getting the char * at argv[1]
0x0012FF20
0xbabe (int a)
undef undef
undef
0x0012FF0C undef
looking at)
96
Example2 - 6
.text:00000000 _sub: .text:00000001 .text:00000003 .text:00000006 .text:00000009 .text:0000000C Saving some .text:0000000D slides .text:00000010 _main: This will push the .text:00000011 address of the .text:00000013 string at argv[1] .text:00000014 (0x12FFD4). atoi() .text:00000017 will read the string .text:0000001A and turn in into an .text:0000001B int, put that int in .text:00000021 eax, and return. .text:00000024 Then the adding 4 .text:00000027 to esp will negate .text:0000002A the having pushed .text:0000002B the input parameter .text:0000002E and make .text:0000002F 0x12FF1C .text:00000034 undefined again .text:00000037 (this is indicative of .text:00000039 cdecl) .text:0000003A push ebp mov ebp, esp mov eax, [ebp+8] mov ecx, [ebp+0Ch] lea eax, [ecx+eax*2] pop ebp retn push ebp mov ebp, esp push ecx mov eax, [ebp+0Ch] mov ecx, [eax+4] push ecx call dword ptr ds:__imp__atoi add esp, 4 mov [ebp-4], eax mov edx, [ebp-4] push edx mov eax, [ebp+8] push eax call _sub add esp, 8 mov esp, ebp pop ebp retn
eax
0x100 (arbitrary)
ecx
edx ebp esp
0x12FFD4
0xfeed 0x0012FF24 0x0012FF20
0x0012FF30 0x0012FF28 0x0012FF24

0x0012FF20
0xbabe (int a)
undef undef
undef
0x0012FF0C undef
97
Example2 - 7
.text:00000000 _sub: .text:00000001 .text:00000003 .text:00000006 .text:00000009 .text:0000000C .text:0000000D .text:00000010 _main: .text:00000011 .text:00000013 .text:00000014 .text:00000017 First setting a .text:0000001A equal to the return .text:0000001B value. Then .text:00000021 pushing a as the .text:00000024 second parameter .text:00000027 in sub(). We can .text:0000002A see an obvious .text:0000002B optimization would .text:0000002E have been to .text:0000002F replace the last two .text:00000034 instructions with .text:00000037 push eax. .text:00000039 .text:0000003A push ebp mov ebp, esp mov eax, [ebp+8] mov ecx, [ebp+0Ch] lea eax, [ecx+eax*2] pop ebp retn push ebp mov ebp, esp push ecx mov eax, [ebp+0Ch] mov ecx, [eax+4] push ecx call dword ptr ds:__imp__atoi add esp, 4 mov [ebp-4], eax mov edx, [ebp-4] push edx mov eax, [ebp+8] push eax call _sub add esp, 8 mov esp, ebp pop ebp retn
eax
0x100
ecx
edx ebp esp
0x12FFD4
0x100 0x0012FF24 0x0012FF1C
0x0012FF30 0x0012FF28 0x0012FF24

0x0012FF20
0x100 (int a)
undef undef
0x0012FF1C 0x100 (int y) 0x0012FF18 0x0012FF14 0x0012FF10
undef
0x0012FF0C undef
98
Example2 - 8
.text:00000000 _sub: .text:00000001 .text:00000003 .text:00000006 .text:00000009 .text:0000000C .text:0000000D .text:00000010 _main: .text:00000011 .text:00000013 .text:00000014 .text:00000017 .text:0000001A .text:0000001B .text:00000021 .text:00000024 .text:00000027 .text:0000002A .text:0000002B Pushing argc .text:0000002E .text:0000002F as the first .text:00000034 parameter (int .text:00000037 x) to sub() .text:00000039 .text:0000003A push ebp mov ebp, esp mov eax, [ebp+8] mov ecx, [ebp+0Ch] lea eax, [ecx+eax*2] pop ebp retn push ebp mov ebp, esp push ecx mov eax, [ebp+0Ch] mov ecx, [eax+4] push ecx call dword ptr ds:__imp__atoi add esp, 4 mov [ebp-4], eax mov edx, [ebp-4] push edx mov eax, [ebp+8] push eax call _sub add esp, 8 mov esp, ebp pop ebp retn
eax
0x2
ecx
edx ebp esp
0x12FFD4
0x100 0x0012FF24 0x0012FF18
0x0012FF30 0x0012FF28 0x0012FF24

0x0012FF20
0x100 (int a)
0x2 (int x) undef
undef
0x0012FF0C undef
99
Example2 - 9
.text:00000000 _sub: .text:00000001 .text:00000003 .text:00000006 .text:00000009 .text:0000000C .text:0000000D .text:00000010 _main: .text:00000011 .text:00000013 .text:00000014 .text:00000017 .text:0000001A .text:0000001B .text:00000021 .text:00000024 .text:00000027 .text:0000002A .text:0000002B .text:0000002E .text:0000002F .text:00000034 .text:00000037 .text:00000039 .text:0000003A push mov mov mov lea pop retn push mov push mov mov push call add mov mov push mov push call add mov pop retn ebp ebp, esp eax, [ebp+8] ecx, [ebp+0Ch] eax, [ecx+eax*2] ebp ebp ebp, esp ecx eax, [ebp+0Ch] ecx, [eax+4] ecx dword ptr ds:__imp__atoi esp, 4 [ebp-4], eax edx, [ebp-4] edx eax, [ebp+8] eax _sub esp, 8 esp, ebp ebp
eax
0x2
ecx
edx ebp esp
0x12FFD4
0x100 0x0012FF24 0x0012FF14
0x0012FF30 0x0012FF28 0x0012FF24

0x0012FF20
0x100 (int a)
0x2 (int x) 0x00000034
undef
0x0012FF0C undef
100
Example2 - 10
eax
0x2
ecx
edx ebp esp
0x12FFD4
0x100 0x0012FF10 0x0012FF10
0x0012FF30 0x0012FF28 0x0012FF24

0x0012FF20
0x100 (int a)
0x2 (int x) 0x00000034
0x0012FF24(saved ebp)
0x0012FF0C undef
101
Example2 - 11
.text:00000000 _sub: .text:00000001 .text:00000003 .text:00000006 Move x into eax, .text:00000009 and y into ecx. .text:0000000C .text:0000000D .text:00000010 _main: .text:00000011 .text:00000013 .text:00000014 .text:00000017 .text:0000001A .text:0000001B .text:00000021 .text:00000024 .text:00000027 .text:0000002A .text:0000002B .text:0000002E .text:0000002F .text:00000034 .text:00000037 .text:00000039 .text:0000003A push ebp mov ebp, esp mov eax, [ebp+8] mov ecx, [ebp+0Ch] lea eax, [ecx+eax*2] pop ebp retn push ebp mov ebp, esp push ecx mov eax, [ebp+0Ch] mov ecx, [eax+4] push ecx call dword ptr ds:__imp__atoi add esp, 4 mov [ebp-4], eax mov edx, [ebp-4] push edx mov eax, [ebp+8] push eax call _sub add esp, 8 mov esp, ebp pop ebp retn
eax
0x2 (no value change)
ecx
edx ebp esp
0x100
0x100 0x0012FF10 0x0012FF10
0x0012FF30 0x0012FF28 0x0012FF24

0x0012FF20
0x100 (int a)
0x2 (int x) 0x00000034
0x0012FF24 (saved ebp)
0x0012FF0C undef
102
Example2 - 12
.text:00000000 _sub: .text:00000001 .text:00000003 .text:00000006 .text:00000009 Set the return value .text:0000000C (eax) to 2*x + y. .text:0000000D Note: neither .text:00000010 _main: pointer arith, nor an .text:00000011 address which .text:00000013 was loaded. Just an .text:00000014 afficient way to do a .text:00000017 calculation. .text:0000001A .text:0000001B .text:00000021 .text:00000024 .text:00000027 .text:0000002A .text:0000002B .text:0000002E .text:0000002F .text:00000034 .text:00000037 .text:00000039 .text:0000003A push ebp mov ebp, esp mov eax, [ebp+8] mov ecx, [ebp+0Ch] lea eax, [ecx+eax*2] pop ebp retn push ebp mov ebp, esp push ecx mov eax, [ebp+0Ch] mov ecx, [eax+4] push ecx call dword ptr ds:__imp__atoi add esp, 4 mov [ebp-4], eax mov edx, [ebp-4] push edx mov eax, [ebp+8] push eax call _sub add esp, 8 mov esp, ebp pop ebp retn
eax
0x104
ecx
edx ebp esp
0x100
0x100 0x0012FF10 0x0012FF10
0x0012FF30 0x0012FF28 0x0012FF24

0x0012FF20
0x100 (int a)
0x2 (int x) 0x00000034
0x0012FF24 (saved ebp)
0x0012FF0C undef
103
Example2 - 13
eax
0x104
ecx
edx ebp esp
0x100
0x100 0x0012FF24 0x0012FF14
0x0012FF30 0x0012FF28 0x0012FF24

0x0012FF20
0x100 (int a)
0x2 (int x) 0x00000034
undef
0x0012FF0C undef
104
Example2 - 14
eax
0x104
ecx
edx ebp esp
0x100
0x100 0x0012FF24 0x0012FF18
0x0012FF30 0x0012FF28 0x0012FF24

0x0012FF20
0x100 (int a)
0x2 (int x) undef
undef
0x0012FF0C undef
105
Example2 - 15
eax
0x104
ecx
edx ebp esp
0x100
0x100 0x0012FF24 0x0012FF20
0x0012FF30 0x0012FF28 0x0012FF24

0x0012FF20
0x100 (int a)
undef undef
undef
0x0012FF0C undef
106
Example2 - 16
eax
0x104
ecx
edx ebp esp
0x100
0x100 0x0012FF24 0x0012FF24
0x0012FF30 0x0012FF28 0x0012FF24

0x0012FF20
undef
undef undef
undef
0x0012FF0C undef
107
Example2 - 17
eax
0x104
ecx
edx ebp esp
0x100
0x100 0x0012FF50 0x0012FF28
0x0012FF30 0x0012FF28 0x0012FF24

Addr after call _main undef
0x0012FF20
undef
undef undef
undef
0x0012FF0C undef
108
Going through Example2.c in Visual Studio

sub: push mov mov pop ret main: push mov call mov pop ret ebp ebp,esp eax,0BEEFh ebp
ebp ebp,esp sub eax,0F00Dh ebp
109
Changing active project
110
Setting command line arguments
Setting command line arguments
111
Instructions we now know (9)

NOP PUSH/POP CALL/RET MOV LEA ADD/SUB
112
Back to Hello World

.text:00401730 main .text:00401730 .text:00401731 .text:00401733 .text:00401738 .text:0040173E .text:00401741 .text:00401746 .text:00401747
push ebp mov ebp, esp push offset aHelloWorld ; "Hello world\n call ds:__imp__printf add esp, 4 mov eax, 1234h pop ebp retn
Are we all comfortable with this now?

Windows Visual C++ 2005, /GS (buffer overflow protection) option turned off 113 Disassembled with IDA Pro 4.9 Free Version

Introduction To Intel x86 Assembly, Architecture, Applications, & Alliteration

Uploaded by

Copyright:

Available Formats

Introduction To Intel x86 Assembly, Architecture, Applications, & Alliteration

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Introduction To Intel x86 Assembly, Architecture, Applications, & Alliteration

Uploaded by

Copyright:

Available Formats

Introduction to Intel x86 Assembly, Architecture, Applications, & Alliteration

Xeno Kovah 2009/2010 xkovah at gmail

Approved for Public Release: 10-3348. Distribution Unlimited

All materials is licensed under a Creative Commons Share Alike license.

Additional Content/Ideas/Info Provided By:

About the Class

Many things will therefore be left out or deferred to later classes.

About the Class 2

What you're going to learn

Ubuntu 8.04, GCC 4.2.4 Disassembled with objdump -d

But it all boils down to

By one measure, only 14 assembly instructions account for 90% of code!

Refresher - Data Types

Refresher - Alt. Radices Decimal, Binary, Hexidecimal

Refresher - Negative Numbers

Architecture - CISC vs. RISC

Big Endian - 0x12345678 stored as is.

Little Endian (Intel)

0x5 0x4 0x3 0x2 0x1 0x0

Low Memory Addresses

On x86-32, registers are 32 bits long On x86-64, they're 64 bits

Architecture - Register Conventions 1

Architecture - Registers Conventions 2

Architecture - Registers Conventions 3

Architecture - Registers 8/16/32 bit addressing 1

Architecture - Registers 8/16/32 bit addressing 2

Your first x86 instruction: NOP

Extra! Extra! Late-breaking NOP news!

XCHG in book p. 112

PUSH - Push Word, Doubleword or Quadword onto the Stack

The push instruction automatically decrements the stack pointer, esp, by 4.

0x00000001 0x00000002 undef undef undef esp

0x0012FF8C 0x0012FF88 0x0012FF84

POP- Pop a Value from the Stack

0x0012FF90 0x0012FF8C esp 0x0012FF88 0x0012FF84

0x00000001 0x00000002 0x00000003 undef undef

Calling Conventions - cdecl

Calling Conventions - stdcall

CALL - Call Procedure

RET - Return from Procedure

Kinda book p. 133

General Stack Frame Operation

General Stack Frame Operation 2

stack bottom Local Variables Caller-Save Registers Arguments to Pass to Callee

General Stack Frame Operation 3

General Stack Frame Operation 4

General Stack Frame Operation 5

General Stack Frame Operation 6

General Stack Frame Layout

Saved Frame Pointer

main() frame foo()'s frame

Stack Frames are a Linked List!

ebp ebp,esp eax,0BEEFh ebp

ebp ebp,esp sub (401000h) eax,0F00Dh ebp

executed instruction, modified value start value

ebp ebp,esp eax,0BEEFh ebp

0x0012FF6C 0x004012E8 0x0012FF68 undef 0x0012FF64

ebp ebp,esp sub (401000h) eax,0F00Dh ebp

0x003435C0 0x0012FFB8 0x0012FF68