Assembly OP codes

Question 1

how does MOV work in intel arch?

Answer 1

remember with x86 Intel syntax it’s MOV [dst] [src])

Question 2

XOR EAX, EAX

Answer 2

Performing an ‘exclusive or’ of a register with itself sets its value to zero; an easy way of clearing the contents of a register

Question 3

INC/DEC op1

Answer 3

increment or decrement the value of the operand by one

Question 4

ADD/SUB op1, op2

Answer 4

add or subtract two operands, storing the result in the first operand. These can be registers, memory locations (limit of one) or constants. For example, ADD EAX, 10 means add 10 to the value of EAX and store the result in EAX

Question 5

CMP op1, op2

Answer 5

compare the value of two operands (register/memory address/constant) and set the appropriate EFLAGS value

Question 6

Jump (JMP) and conditional jump (je, jz, etc)

Answer 6

as the name implies these instructions allow you to jump to another location in the execution flow/instruction set. The JMP instruction simply jumps to a location whereas the conditional jumps (je, jz, etc) are taken only if certain criteria are met (using the EFLAGS register values mentioned earlier). For example, you might compare the values of two registers and jump to a location if they are both equal (uses je instruction and zero flag (zf) = 1).

Question 7

op code in [ ]

MOV eax, [ebx]

Answer 7

When you see a value in brackets such as ADD DWORD PTR [X] or MOV eax, [ebx] it is referring to the value stored at memory address X. In other words, EBX refers to the contents of EBX whereas [EBX] refers to the value stored at the memory address in EBX.

Question 8

Relevant size keywords

Answer 8

BYTE = 1 byte, WORD = 2 bytes, DWORD = 4 bytes.

Question 9

PUSH X (x=register)

Answer 9

Pushes “values” of register to the top of the stack

Question 10

POP X (x=register)

Answer 10

POPs the values of the top of the stack and places them register X

Question 11

how Stack Frames and Functions work

Answer 11

When a program function executes, a stack frame is created to store its local variables. Each function gets its own stack frame, which is put on top of the current stack and causes the stack to grow upwards to lower addresses

Question 12

define Little Endian notation. “Endianness”

Answer 12

refers to the order in which bytes are stored in memory. Intel x86 based systems employ Little Endian notation which stores the least significant byte of a value at the smallest memory address (which is why the address is stored in reverse order)