Basics

Question 1

x86::General Purpose Registers::EAX

Answer 1

Accumulator register - primarily used for common calculations, assigned one-byte opcodes for efficient calculations, also used for storing function return values

Question 2

x86::General Purpose Registers::EBX

Answer 2

No special purpose in 32-bit architecture, often used as a catch-all for available storage

Question 3

x86::General Purpose Registers::ECX

Answer 3

Counter register - used primarily for loop and counter iteration, can also store data

Question 4

x86::General Purpose Registers::EDX

Answer 4

Data register - similar to EAX in purpose, used for mathematical operations often in conjunction with EAX, or to store function variables

Question 5

x86::General Purpose Registers::ESI

Answer 5

Source index - often used to store the pointer to a read location

Question 6

x86::General Purpose Registers::EDI

Answer 6

Destination index - Designed to hold storage pointers for functions, can be used to store data

Question 7

x86::General Purpose Registers::EBP

Answer 7

Base pointer - Maintains pointer to base of stack, often used to locate objects in the stack by specifying base + offset

Question 8

x86::General Purpose Registers::ESP

Answer 8

Stack pointer - Maintains pointer to top of stack, decrements/increments as objects are moved around, rarely ever used for any other purpose

Question 9

x86::Special Purpose Registers::EIP

Answer 9

Instruction pointer - Maintains pointer to next instruction

Question 10

x86::Segment Registers

Answer 10

Products of old addressing schemes and memory models, still used for backwards compatibility, other functions, and storage

Question 11

x86::EFLAGS Register

Answer 11

Comprised of a series of flags that represent Boolean values, can be used for if/when logic, conditional jumps, etc

Question 12

x86::Assembly::Instructions::ADD/SUB

Answer 12

Add or subtract two operands, store the result in the first operand

Question 13

x86::Assembly::Instructions::XOR EAX, EAX

Answer 13

Exclusive or - in this case since the destination and source registers are the same, EAX will be zeroed out

Question 14

x86::Assembly::Instructions::INC/DEC

Answer 14

Increment or decrement an operand by one

Question 15

x86::Assembly::Instructions::CMP

Answer 15

Compare the value of two operands and set the appropriate EFLAGS value

Question 16

x86::Assembly::Instructions::JMP

Answer 16

Jump, also includes conditional jump instructions such as je, jz. Used to move around within the execution flow/instruction set.

Question 17

x86::Assembly::Instructions::MOV EAX, [ebx]

What do the brackets signify?

Answer 17

Brackets indicate that the value stored at the memory address contained within EBX should be moved into EAX, as opposed to the contents of EBX itself

Question 18

Decimal 23
Hex __
Binary 00010111

Answer 18

0x18