Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

3. x86 Assembly Language > IA-32 Architecture > Flashcards

IA-32 Architecture Flashcards

1
Q

What are the four main components of the CPU?

A
  • Control unit
  • Execution unit
  • Registers
  • Flags
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Control Unit

A
  • retrieve/decode instructions

- retrieve/store data in memory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Execution Unit

A
  • actual execution of instruction happens here
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Registers

A
  • internal memory locations used as “variables”
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Flags

A
  • used to indicate various ‘events’ when execution is happening
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the 6 different IA-32 Registers?

A
  • General Purpose Registers
  • Segment Registers
  • Flags, EIP
  • Floating Point Unit Registers
  • MMX Registers
  • XMM Registers
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the structure of the first 4 General Purpose Registers?

A
  • Each register is 32-bits wide (0-31)
    1. EAX
    • AX (16-bits wide)
  • — AH (8-15), AL (0-7) (each are 8-bits wide)
    2. EBX
    • BX (16-bits wide)
  • — BH (8-15), BL (0-7) (each are 8-bits wide)
    3. ECX
    • CX (16-bits wide)
  • — CH (8-15), CL (0-7) (each are 8-bits wide)
    4. EDX
    • DX (16-bits wide)
  • — DH (8-15), DL (0-7) (each are 8-bits wide)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the structure of the second 4 General Purpose Registers?

A
  • Each register is 32-bits wide (0-31)
  • There are no further divisions into 8-bit halves like the first 4 general purpose registers
    1. ESP
    • SP (16-bits wide)
      2. EBP
    • BP (16-bits wide)
      3. ESI
    • SI (16-bits wide)
      4. EDP
    • DI (16-bits wide)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the common functionality of each of the 8 General Purpose Registers?

A
  • EAX: accumulator register, used for storing operands and result data
  • EBX: base register, pointer to data
  • ECX: counter register, loop operations
  • EDX: data register, I/O pointer
  • ESI/EDI: data pointer registers for memory operations
  • ESP: stack pointer registers
  • EBP: stack data pointer register
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the 6 Segment Registers and what is the purpose and length of each?

A
  • Each Segment Register is 16-bits wide
  • CS: code
  • DS: data
  • SS: stack
  • ES: data
  • FS: data
  • GS: data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

EIP

A
  • Instruction Point (the next instruction executed)
  • Holy Grail for Shellcoding, Exploit Research, etc.
  • 32 bits wide
  • Not like a register where you can change the value with MOV, ADD, SUB, etc
  • Instead, EIP is changed by using JMP operations
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How wide is the FPU?

A
  • Floating Point Unit (x87)

- 80 bits wide

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

SIMD

A
  • Single Instruction Multiple Data
  • 4 extensions
  • Uses MMX and XMM registers
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the four extensions of SIMD?

A
  • MMX
  • SSE
  • SSE2
  • SSE3
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How wide is the MMX register?

A

64 bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How wide is the XMM register?

A

128 bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How do you start the GDB debugger?

A

gdb /bin/bash

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What command do you need to execute before running GDB?

A

break main

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What command do you execute after creating the break point?

A

run

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What command do you run to view the default set of registers?

A

info registers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What command would you execute to see the contents of the EAX register?

A

display /x $eax

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What command shows you the next instruction set to be run?

A

disassemble $eip

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

By default, GDB doesn’t show what three registers?

A
  • FPU
  • MMX
  • XMM
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What command would you run to display ALL registers?

A

info all-registers

25
What are the 2 disassembly "flavors"?
- ATT | - Intel
26
What is the default disassembly flavor of Linux?
ATT
27
What command would you use to change the disassembly flavor to Intel?
- set disassembly-flavor intel
28
What are registers?
- volatile, data not meant to stay here for long - working memory for the processor - data is loaded in to perform computations - data is then loaded out for permanent storage elsewhere - fixed width
29
The Stack
- An array of data sets - LIFO data structure - Behaves similar to a stack of books - Push puts a data set on top of the stack - Pop pulls a data set off the top of the stack - Stack pointer holds the position of the top of the stack - When you push/pop the pointer is moved to the new position of the top of the stack - The Stack pointer is just a register that can be manipulated
30
What is a 'label'?
- A location in assembly code - Syntax is followed by ':' - Example: '_start:'
31
What does 'int x80' do?
- This is the interrupt command that transfers control to an interrupt handler and represents the end of the program - 'int' is the command for 'interrupt' - 0x80 is the hex value for the interrupt handler for system calls
32
What are the steps to create an executable from an assembly file?
1. nasm -f elf32 ex1.asm -o ex1.o | 2. ld -m elf_i386 ex1.o -o ex1
33
What is the executable format used by Linux?
- elf | - Executable and Linking Format
34
What does the 'ld' command do?
- This is the 'linking' command that builds and executable from the output file
35
What does 'echo $?' output?
- the 'exit status' of the assembly/executable program
36
What is multiplied against EBX in the command 'mul ebx'
EAX
37
What is divided by EBX in the command 'mul ebx'
EAX
38
What is the hex value for a new line character?
0x0a
39
What does '.data' do in an assembly program?
- Used to declare the memory region, where data variable are stored for the program - This section can not be expanded after the data elements are declared, and remains static throughout the program - Contains global or static variables which have a pre-defined value and can be modified. - The variables are initially stored within the read-only memory (.text section) and are copied into the .data segment during the start-up routine of the program
40
Which segment does '_start:' belong?
- section .text | - '_start:' is a label, and all labels go within the .text section
41
What does 'jmp skip' instruction do?
- jump to the 'skip:' label in the .text section
42
What does 'cmp ecx, 100' instruction do?
compares ECX to 100
43
What does 'jl skip' instruction do?
- jumps to the 'skip:' label if the preceding 'compare' statement evaluates to 'less than' status. - example: if 'cmp exc, 100' was the preceding instruction, and if 100 is less than ECX, then the 'jl skip' instruction would execute
44
What does 'je' mean?
jump if equal
45
What does 'jne' mean?
jump if not equal
46
What does 'jg' mean?
jump if greater
47
What does 'jge' mean?
jump if greater or equal
48
What does 'jl' mean?
jump if less
49
What does 'jle' mean?
jump if less or equal
50
What does 'dec ecx' instruction do?
decrements ECX by 1
51
What would be the outcome of 'mov [addr], byte 'H'?
- It is important to note that [addr] references a label without an offset, so it is the first place of a string located at 'addr' - 'H' would be placed at the first place of the string located at 'addr' - For example, if 'addr' was created in the .data section as 'addr db "yellow"', the outcome would be "Hellow"
52
What would be the outcome of 'mov [addr+5], byte '!'
- [addr+5] references the first position of 'addr' plus an offset of 5...so it is essentially the sixth place of the string stored at 'addr' - '!' would be placed at the sixth position of the string located at 'addr' - For example, if 'addr' was created in the .data section as 'addr db "Hellow", the outcome would be "Hello!"
53
How large is the value 'db'? | What are some possible example values?
- 1 byte, 8-bits | - db "string", db 0xff, db 100
54
How large is the value 'dw'? | What are some possible example values?
- 2 bytes, 16-bits | - dw 0x1234, dw 1000
55
How large is the value 'dd'? | What are some possible example values?
- 4 bytes, 32-bits | - dd 0x12345678, dd 100000
56
What are the memory addresses of the Stack for a 32-bit system?
- [00] - [04] - [08] - [12] - [16] - [20] - [24] - [28]
57
Where does the Stack pointer (ESP) start before any pushes and pops?
- The bottom of the Stack, [28]
58
If ESP = 28 and the instruction 'push 1234' is executed, where does 1234 go and what is the new value of ESP?
- 1234 goes to [24] and ESP = 24
59
If the Stack looks like the example below, what is the outcome if the instruction 'pop eax' is executed? ESP = 12 ``` [00] 0 [04] 0 [08] 0 [12] 357 [16] 246 [20] 8765 [24] 1234 [28] 0 ```
ESP = 16 ``` [00] 0 [04] 0 [08] 0 [12] 357 [16] 246 [20] 8765 [24] 1234 [28] 0 ``` ** Note: the value of '357' still resides at [12], even though it has been moved to EAX. '357' will remain at [12] until that memory position of the Stack is overwritten with a new value

3. x86 Assembly Language (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions