Basic Assembly Flashcards
SLAE videos 8-12 + additional reading.
What is NASM?
NASM and LD are used for linking and assembling of binaries.
How do system calls work?
During program execution, a system call may be used for tasks such as printing text to the console. The IA-32 mechanism for invoking system calls is int 0x80, at which point the system call handlers are referenced by the list of interrupt handlers associated with the program.
Where are system calls defined?
/usr/include/i386-linux-gnu/asm/unistd_32.h
Invoking System Call with 0x80
EAX - System Call Number (e.g. 4 for write to screen)
EBX - First Argument
ECX - Second Argument (Hello World string)
EDX - Third Argument
ESI - Fourth Argument
EDI - Fifth Argument
Stepping through Assembly files
Start by setting a breakpoint on the ‘_start’ element of code.
What are the fundamental data types?
Byte - 8 bits Word - 16 bits Double Word - 32 bits Quad Word - 64 bits Double Quad Word - 128 bits
What is Signed and Unsigned?
Unsigned - all 32 bits are dedicated to storing the value
Signed - 31 bits are dedicated to storing the value, with the last bit designating the sign (+ or -).
Declare Uninitialized Data
db
Special Tokens
$ - evaluates to current line
$$ - evaluates to the beginning of current section
Figuring out the startpoint of a binary
shell readelf -h [BINARY_NAME]
Variable information
info variables
x/xb [VARIABLE_ADDRESS]
x/xb &[VARIABLE_NAME]
Instruction breakdown
Instructions may be broken down into Labels, Instructions and Operands.
MOV instruction
The most common instruction in ASM. Responsible for moving data in the following ways:
- Between registers
- Memory to Register and Register to Memory
- Immediate Data to Register
- Immediate Data to Memory
LEA instruction
Load Effective Address - load pointer values
- LEA EAX, [label] (loads the pointer inside EAX.
XCHG instruction
Exchanges (swaps) values
- XCHG Register, Register
- XCHG Register, Memory
gdb hooking
GDB to complete commands as you step through a program. For example:
define hook-stop
>print/x $eax >print/x $ebx >print/x $ecx >print/x $edx >x/8xb &sample >disassemble $eip,+10 >end
The above hook prints the contents of the eax, ebx, ecx and edx registers, the contents of sample, and disassemble the program from the current $eip value (current instruction) for the next 10 instructions.
Displaying Values after runs
display /x [REGISTER/MEMORY]
and then hook to disassmble eip:
define hook-stop
disassemble $eip,+10
How does the Stack work?
The Stack is a LIFO - Last In First Out data structure. Goes from high memory to low memory. As the stack builds up, ESP points to lower and lower and lower addresses.
ESP - extended stack pointer - always points to the top of the stack.
PUSH instruction (to push 32-bit values to the top of the stack) automatically pushes values to the top of the stack and adjusts ESP accordingly.
POP instruction removes the value from the top of the stack, and automatically adjusts ESP accordingly.
