Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

x86 Assembly Language > General Assembly > Flashcards

General Assembly Flashcards

Learn the basic components and terms that relate to x86 Assembly

1
Q

What are the CPU Instructions in Immunity?

A

displays the memory address, opcode and assembly instructions, additional comments, function names and other information related to the CPU instructions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the purpose of the Registers pane in Immunity?

A

displays the contents of the general purpose registers, instruction pointer, and flags associated with the current state of the application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does the STACK pane display in Immunity?

A

shows the contents of the current stack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What does the Memory Dump display in Immunity

A

shows the contents of the application’s memory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What programs can be used to debug a Windows system?

A

Immunity or WinDbg

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the EAX register?

A

The Accumulator Register - it’s the primary register used for common calculations (such as ADD and SUB). and it has preferential status by assigning it more efficient, one-byte opcodes. In addition, EAX is also used to store the return value of a function.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How many bits is the EAX registry?

A

32-bits total in length

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Name EAX least and most significant bits?

A

EAX refers to the 32-bit register in its entirety. AX refers to the least significant 16 bits which can be further broken down into AH (the 8 most high significant bits of AX) and AL (the 8 lowest significant bits).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the EBX register?

A

a catch-all for available storage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the ECX register?

A

frequently used as a loop and function repetition counter, though it can also be used to store any data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the EDX register?

A

often used in mathematical operations like division and multiplication to deal with overflow where the most significant bits would be stored in EDX and the least significant in EAX; also commonly used for storing function variables.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the ESI register?

A

The Source Index, ESI, is often used to store the pointer to a read location.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the EDI register?

A

EDI, the Destination Index, was primarily designed to store the storage pointers of functions, such as the write address of a string operation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the EBP register?

A

EBP, Base Pointer, is used to keep track of the base/bottom of the stack within the current stack frame.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the ESP register?

A

ESP, the Stack Pointer is used to track the top of the stack. As items are moved to and from the stack ESP increments/decrements accordingly.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the EIP?

A

EIP, Instruction Pointer, points to the memory address of the next instruction to be executed by the CPU. Holy grail for shell coding.

17
Q

What is a DLL?

A

Shared code libraries called Dynamic Link Libraries (DLLs), which allows for efficient code reuse and memory allocation. DLLs (also known as modules or executable modules) occupy a portion of the memory. space

18
Q

What is the HEAP?

A

Dynamically allocated (e.g. malloc( )) portion of memory a program uses to store global variables.

19
Q

What is a Program Image?

A

Portion of memory where the executable resides including the .text section (containing the executable code/CPU instructions) the .data section (containing the program’s global data) and the .rsrc section (contains non-executable resources, including icons, images, and strings).

20
Q

What is the Kernel Land?

A

Portion of memory is reserved by the OS for device drivers, system cache, paged/non-paged pool, HAL, etc

21
Q

What is the PEB?

A

Process Environment Block (PEB) residing in user-accessible memory. It contains various user-mode parameters about a running process.

22
Q

What is the TEB?

A

Thread Environment Block (TEB) stores context information for the image loader and various Windows DLLs, as well as the location for the exception handler list.

23
Q

What is ADD, SUB op1,op2?

A

Add or subtract two operands, storing the result in the first operand.

24
Q

What does ‘XOR EAX, EAX’ syntax perform?

A

Performs an ‘exclusive or’ of a register with itself sets its value to zero; an easy way of clearing the contents of a register.

25
Q

What is INC/DEC op1?

A

Increment or decrement the value of the operand by one

26
Q

What is CMP op1, op2?

A

Compare the value of two operands (register/memory address/constant) and set the appropriate EFLAGS value.

27
Q

What does the instruction Jump (JMP) do?

A

The JMP instruction simply jumps to a location.

28
Q

What does the conditional jump (je, jz,) do?

A

Conditional jumps are taken only if certain criteria are met (using the EFLAGS register values).

29
Q

When you see a value in brackets such as ADD DWORD PTR [X] or MOV eax, [ebx], what does it mean?

A

It is referring to the value stored at memory address X. In other words, EBX refers to the contents of EBX whereas [EBX] refers to the value stored at the memory address in EBX.

30
Q

What does the MOV instruction accomplish?

A

The MOV instruction copies a data item from one location to another. With x86 Intel syntax it’s MOV [dst], [src]. Moves data b/w memory & registers, & immediate data to registers or memory.

31
Q

What are relevant size keywords and its coded abbreviations?

A

BYTE (db) = 8 bits, WORD (dw) = 16 bits, DWORD (dd) = 32 bits, QWORD (dq) = 64 bits, DQWORD (dt) = 128 bits

32
Q

What does the times value do in a program?

A

The “times” value multiplies an instruction by a specified value.
Ex:
Data:
Zerobuf: times 64 db 0 (repeat db 0 64 times.)

33
Q

What is resb and resw?

A 
resb = reserves bytes (resb 100) reserves 100 bytes
resw = reserves words (resw20) reserves 20 words
34
Q

What is LEA?

A

Load Effective Address: loads pointer values
Ex:
LEA EAX, [label]

35
Q

What is exchange?

A

exchanges or swaps values
Ex:
XCHG Register, Register
XCHG Register, Memory

x86 Assembly Language (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions