Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

3. x86 Assembly Language > IA-32 Architecture > Flashcards

IA-32 Architecture Flashcards

1
Q

What are the four main components of the CPU?

A
  • Control unit
  • Execution unit
  • Registers
  • Flags
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Control Unit

A
  • retrieve/decode instructions

- retrieve/store data in memory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Execution Unit

A
  • actual execution of instruction happens here
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Registers

A
  • internal memory locations used as “variables”
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Flags

A
  • used to indicate various ‘events’ when execution is happening
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the 6 different IA-32 Registers?

A
  • General Purpose Registers
  • Segment Registers
  • Flags, EIP
  • Floating Point Unit Registers
  • MMX Registers
  • XMM Registers
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the structure of the first 4 General Purpose Registers?

A
  • Each register is 32-bits wide (0-31)
    1. EAX
    • AX (16-bits wide)
  • — AH (8-15), AL (0-7) (each are 8-bits wide)
    2. EBX
    • BX (16-bits wide)
  • — BH (8-15), BL (0-7) (each are 8-bits wide)
    3. ECX
    • CX (16-bits wide)
  • — CH (8-15), CL (0-7) (each are 8-bits wide)
    4. EDX
    • DX (16-bits wide)
  • — DH (8-15), DL (0-7) (each are 8-bits wide)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the structure of the second 4 General Purpose Registers?

A
  • Each register is 32-bits wide (0-31)
  • There are no further divisions into 8-bit halves like the first 4 general purpose registers
    1. ESP
    • SP (16-bits wide)
      2. EBP
    • BP (16-bits wide)
      3. ESI
    • SI (16-bits wide)
      4. EDP
    • DI (16-bits wide)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the common functionality of each of the 8 General Purpose Registers?

A
  • EAX: accumulator register, used for storing operands and result data
  • EBX: base register, pointer to data
  • ECX: counter register, loop operations
  • EDX: data register, I/O pointer
  • ESI/EDI: data pointer registers for memory operations
  • ESP: stack pointer registers
  • EBP: stack data pointer register
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the 6 Segment Registers and what is the purpose and length of each?

A
  • Each Segment Register is 16-bits wide
  • CS: code
  • DS: data
  • SS: stack
  • ES: data
  • FS: data
  • GS: data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

EIP

A
  • Instruction Point (the next instruction executed)
  • Holy Grail for Shellcoding, Exploit Research, etc.
  • 32 bits wide
  • Not like a register where you can change the value with MOV, ADD, SUB, etc
  • Instead, EIP is changed by using JMP operations
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How wide is the FPU?

A
  • Floating Point Unit (x87)

- 80 bits wide

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

SIMD

A
  • Single Instruction Multiple Data
  • 4 extensions
  • Uses MMX and XMM registers
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the four extensions of SIMD?

A
  • MMX
  • SSE
  • SSE2
  • SSE3
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How wide is the MMX register?

A

64 bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How wide is the XMM register?

A

128 bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How do you start the GDB debugger?

A

gdb /bin/bash

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What command do you need to execute before running GDB?

A

break main

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What command do you execute after creating the break point?

A

run

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What command do you run to view the default set of registers?

A

info registers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What command would you execute to see the contents of the EAX register?

A

display /x $eax

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What command shows you the next instruction set to be run?

A

disassemble $eip

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

By default, GDB doesn’t show what three registers?

A
  • FPU
  • MMX
  • XMM
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What command would you run to display ALL registers?

A

info all-registers

25
Q

What are the 2 disassembly “flavors”?

A
  • ATT

- Intel

26
Q

What is the default disassembly flavor of Linux?

A

ATT

27
Q

What command would you use to change the disassembly flavor to Intel?

A
  • set disassembly-flavor intel
28
Q

What are registers?

A
  • volatile, data not meant to stay here for long
  • working memory for the processor
  • data is loaded in to perform computations
  • data is then loaded out for permanent storage elsewhere
  • fixed width
29
Q

The Stack

A
  • An array of data sets
  • LIFO data structure
  • Behaves similar to a stack of books
  • Push puts a data set on top of the stack
  • Pop pulls a data set off the top of the stack
  • Stack pointer holds the position of the top of the stack
  • When you push/pop the pointer is moved to the new position of the top of the stack
  • The Stack pointer is just a register that can be manipulated
30
Q

What is a ‘label’?

A
  • A location in assembly code
  • Syntax is followed by ‘:’
  • Example: ‘_start:’
31
Q

What does ‘int x80’ do?

A
  • This is the interrupt command that transfers control to an interrupt handler and represents the end of the program
  • ‘int’ is the command for ‘interrupt’
  • 0x80 is the hex value for the interrupt handler for system calls
32
Q

What are the steps to create an executable from an assembly file?

A
  1. nasm -f elf32 ex1.asm -o ex1.o

2. ld -m elf_i386 ex1.o -o ex1

33
Q

What is the executable format used by Linux?

A
  • elf

- Executable and Linking Format

34
Q

What does the ‘ld’ command do?

A
  • This is the ‘linking’ command that builds and executable from the output file
35
Q

What does ‘echo $?’ output?

A
  • the ‘exit status’ of the assembly/executable program
36
Q

What is multiplied against EBX in the command ‘mul ebx’

A

EAX

37
Q

What is divided by EBX in the command ‘mul ebx’

A

EAX

38
Q

What is the hex value for a new line character?

A

0x0a

39
Q

What does ‘.data’ do in an assembly program?

A
  • Used to declare the memory region, where data variable are stored for the program
  • This section can not be expanded after the data elements are declared, and remains static throughout the program
  • Contains global or static variables which have a pre-defined value and can be modified.
  • The variables are initially stored within the read-only memory (.text section) and are copied into the .data segment during the start-up routine of the program
40
Q

Which segment does ‘_start:’ belong?

A
  • section .text

- ‘_start:’ is a label, and all labels go within the .text section

41
Q

What does ‘jmp skip’ instruction do?

A
  • jump to the ‘skip:’ label in the .text section
42
Q

What does ‘cmp ecx, 100’ instruction do?

A

compares ECX to 100

43
Q

What does ‘jl skip’ instruction do?

A
  • jumps to the ‘skip:’ label if the preceding ‘compare’ statement evaluates to ‘less than’ status.
  • example: if ‘cmp exc, 100’ was the preceding instruction, and if 100 is less than ECX, then the ‘jl skip’ instruction would execute
44
Q

What does ‘je’ mean?

A

jump if equal

45
Q

What does ‘jne’ mean?

A

jump if not equal

46
Q

What does ‘jg’ mean?

A

jump if greater

47
Q

What does ‘jge’ mean?

A

jump if greater or equal

48
Q

What does ‘jl’ mean?

A

jump if less

49
Q

What does ‘jle’ mean?

A

jump if less or equal

50
Q

What does ‘dec ecx’ instruction do?

A

decrements ECX by 1

51
Q

What would be the outcome of ‘mov [addr], byte ‘H’?

A
  • It is important to note that [addr] references a label without an offset, so it is the first place of a string located at ‘addr’
  • ‘H’ would be placed at the first place of the string located at ‘addr’
  • For example, if ‘addr’ was created in the .data section as ‘addr db “yellow”’, the outcome would be “Hellow”
52
Q

What would be the outcome of ‘mov [addr+5], byte ‘!’

A
  • [addr+5] references the first position of ‘addr’ plus an offset of 5…so it is essentially the sixth place of the string stored at ‘addr’
  • ’!’ would be placed at the sixth position of the string located at ‘addr’
  • For example, if ‘addr’ was created in the .data section as ‘addr db “Hellow”, the outcome would be “Hello!”
53
Q

How large is the value ‘db’?

What are some possible example values?

A
  • 1 byte, 8-bits

- db “string”, db 0xff, db 100

54
Q

How large is the value ‘dw’?

What are some possible example values?

A
  • 2 bytes, 16-bits

- dw 0x1234, dw 1000

55
Q

How large is the value ‘dd’?

What are some possible example values?

A
  • 4 bytes, 32-bits

- dd 0x12345678, dd 100000

56
Q

What are the memory addresses of the Stack for a 32-bit system?

A
  • [00]
  • [04]
  • [08]
  • [12]
  • [16]
  • [20]
  • [24]
  • [28]
57
Q

Where does the Stack pointer (ESP) start before any pushes and pops?

A
  • The bottom of the Stack, [28]
58
Q

If ESP = 28 and the instruction ‘push 1234’ is executed, where does 1234 go and what is the new value of ESP?

A
  • 1234 goes to [24] and ESP = 24
59
Q

If the Stack looks like the example below, what is the outcome if the instruction ‘pop eax’ is executed?

ESP = 12

[00] 0
[04] 0
[08] 0
[12] 357
[16] 246
[20] 8765
[24] 1234
[28] 0
A

ESP = 16

[00] 0
[04] 0
[08] 0
[12] 357
[16] 246
[20] 8765
[24] 1234
[28] 0

** Note: the value of ‘357’ still resides at [12], even though it has been moved to EAX. ‘357’ will remain at [12] until that memory position of the Stack is overwritten with a new value

3. x86 Assembly Language (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions