Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Assembly > Assembly Basics > Flashcards

Assembly Basics Flashcards

1
Q

Immunity Debugger - F9

A

Play/Run Program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Immunity Debugger - F7

A

Step into next instruction (but pause execution)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

EAX

A 
Accumulator Register
32-bits
common calculations (ADD / SUB)
efficient - one-byte opcodes
good for limited available buffer space (compact shellcode)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

AX

A

Lower half of EAX

16-bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

AH

A

Higher half of AX 8-bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

AL

A

Lower half of AX 8-bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

EBX

A

Base Register
32-bits
Catch-all register
No special purpose

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

BX

A

Lower half of EBX

16-bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

BH

A

Higher half of BX 8-bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

BL

A

Lower half of BX 8-bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

ECX

A

Counter Register
32-bits
Frequently used for Loop and Function repetition counter
Can store any data like EAX

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

CX

A

Lower half of ECX

16-bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

CH

A

Higher half of CX 8-bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

CL

A

Lower half of CX 8-bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

EDX

A 
Data Register
32-bits
Mathematical operations
Division / Multiplication
used for overflow were most significant bits stored in EDX and least significant bits stored in EAX
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

DX

A

Lower half of EDX

16-bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

DH

A

Higher half of DX 8-bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

DL

A

Lower half of CX 8-bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

ESI

A

Source Index
Counterpart to EDI
Stores the pointer to the read location
E.g. If a function is designed to read a string, ESI would hold the pointer to the location of that string

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

EDI

A

Destination Index
Can be and is used for general data storage it’s primarily designed to store the storage pointers functions, such as the write address of a string operation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

EBP

A

Base Pointer
Used to keep track of the base/bottom of the stack
Used to reference variables located on the stack by using an offset to the current value of EBP
If parameters are only referenced by register, you may choose to use EBP for general use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

ESP

A

Stack Pointer
Used to track the top of the stack - LIFO
ESP increments/decrements when items are added/removed from the stack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

EIP

A

Instruction Pointer

Points to the memory address of the next instruction to be executed by the CPU

24
Q

EFLAGS

A

Comprised of a series of flags that represent Boolean values resulting from calculations and comparisons and can be used to determine when/if to take conditional jumps

25
Q

ADD/SUB op1,op2

A

add or subtract two operands, storing the result in the first operand
These can be registers, memory locations(limit 1) or constants
E.g. ADD EAX, 10 == add 10 to the VALUE of EAX and store the result in EAX

26
Q

XOR EAX, EAX

A

Perform an ‘exclusive or’ of a register with itself sets it’s value to zero. Easy way of clearing the contents of a register

27
Q

INC/DEC op1

A

Increment or Decrement the value of the operand by one

28
Q

CMP op1, op2

A

compare the value of two operands (register/memory address/constant) and set the appropriate EFLAGS value

29
Q

JMP (Jump) and conditional jump(je, jz, etc)

A

as the name implies these instructions allow you to jump to another location in the execution flow/instruction set. The JMP instruction simply jumps to a location whereas the conditional jumps (je, jz, etc) are taken only if certain criteria are met (using the EFLAGS register values mentioned earlier). For example, you might compare the values of two registers and jump to a location if they are both equal (uses je instruction and zero flag (zf) = 1).

30
Q

Brackets [] E.g. [x] or MOV eax, [ebx]

A

it is referring to the value stored at memory address X. In other words, EBX refers to the contents of EBX whereas [EBX] refers to the value stored at the memory address in EBX.

31
Q

BYTE

A

1 byte or 8 bits

32
Q

WORD

A

2 bytes or 16 bits

33
Q

DWORD (double word)

A

4 bytes or 32 bits

34
Q

NOP

A

No Operation - used as padding

NOP = XCHG (E)AX,(E)AX : just swapping EAX value with itself - does nothing

35
Q

PUSH

A

Push Word, Doubleword, or Quadword onto the stack

36
Q

POP

A

Pop a value from the Stack

Take a DWORD off the stack, put it in a register, and increment ESP by 4

37
Q

CALL

A

CALL’s job is to transfer control to a different function, in a way that control can later be resumed where it left off (EIP)
First it pushes the address of the next instruction on tot the stack - for use by RET for when the procedure is done

38
Q

RET

A

Two forms:

  • Pop the top of the stack into EIP (remember pop increments stack pointer)
  • Pop the top of the stack into EIP and add a constant number of bytes to ESP
39
Q

MOV

A 
Move
Can move :
- register to register
- memory to register, register to memory
- immediate to register, immediate to memory
*Never memory to memory
40
Q

.text

A

contains the executable code/CPU instructions

41
Q

.data

A

contains the program’s global data

42
Q

.rsrc

A

contains non-executable resources, including icons, images, and strings

43
Q

Heap

A

dynamically allocated
store global variables
managed by the program NOT the OS and thus must be freed

44
Q

/proc/{pid}/maps

A

view process organization

45
Q

pmaps

A

view process organization

46
Q

Symbol Files

A 
Info sources
Info variables (not local variables)
Info scope function_name
Info functions
maint print symbols filename_to_store
47
Q

NM Symbol Type - A

A

Absolute Symbol

48
Q

NM Symbol Type - B

A

In the Uninitialized Data Section (BSS)

49
Q

NM Symbol Type - D

A

In the Initialized Data Section

50
Q

NM Symbol Type - N

A

Debugging Symbol

51
Q

NM Symbol Type - T

A

In the Text Section

52
Q

NM Symbol Type - U

A

Symbol Undefined right now

53
Q

Strace

A

Traces all System Calls made by the program

54
Q

Strace Filter for system calls

A

strace -r -e {list of calls} file_name args

55
Q

Strace attach to running process

A

Strace -p process_id

Assembly (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions