akde/infosec

Information security is ultimately about managing risk

Basic x86/x64 assembly registers and commands

Registers

General purpose registers

Reg­is­ter x86Reg­is­ter x64NameDescrip­tion
EAXRAXAccu­mu­la­torFor results of cal­cu­la­tions and return codes
EBXRBXBase reg­is­terGen­er­al purpose
ECXRCXCount reg­is­terFor num­ber of iter­a­tions, often used for loops
EDXRDXData reg­is­terFor data of cal­cu­la­tions or a point­er to large data
ESIRSISource indexPoint­er to a loca­tion to read from
EDIRDIDes­ti­na­tion indexPoint­er to a loca­tion to write into
EBP( RBP )Extend­ed base point­er in x68
Gen­er­al pur­pose reg­is­ter in x64		Fixed point­er dur­ing a func­tion call as a ref­er­ence to access vari­ables on the stack.
ESPRSPStack point­erHolds the top address of the stack

Segment registers

These are all 16 bit register.

Reg­is­terNameDescrip­tion
CSCode seg­ment reg­is­ter (also: Text seg­ment register)Point­er to the start address of the exe­cute­able code
SSStack seg­ment registerPoint­er to some off­set address with­in the stack
DSData seg­ment registerPoint­er to an address of some data structure
ESExtra seg­ment registerPoint­er to an address of some data structure
FSExtra data seg­ment registerPoint­er to an address of some data struc­ture.
Win­dows: Point­er to the TIB Thread Infor­ma­tion Block
GSExtra data seg­ment registerPoint­er to an address of some data struc­ture.
Win­dows: Point­er to the TLS Thread Local Storage

Commands

Com­mandDescrip­tion
push %edi1. Writes the val­ue from %edi on top on the stack and
2. decreas­es the ESP Stack Pointer
pop %ebp1. Loads the val­ue on top of the stack into the giv­en reg­is­ter $ebp and
2. increas­es the ESP Stack Pointer.
ret1. Sets the IP Instruc­tion point­er to the address on top of the stack and
2. increas­es the ESP Stack Pointer.
call func1. Stores the next address (after the call func­tion) on top on the stack (basi­cal­ly the return address),
2. decreas­es the ESP Stack Point­er and
3. sets the IP Instruc­tion Point­er to the address of func.
mov %eax, %ediAT&T syn­tax: Copies the val­ue of %eax into %edi.
mov edi, eaxIntel syn­tax: Copies the val­ue of eay into edi.
xchg %eax, %eaxSwaps the val­ues from both registers.

Leave a Reply

About

Personal collection of some infosec stuff. Primary purpose of this site is to collect and organize for myself.

Note: Some content is not publicly visible due to copyright issues. Therefore, some links could be broken.

Checklists

Categories

Checklists: Ports

python -c 'import pty;pty.spawn("/bin/bash")';

python3 -c 'import pty;pty.spawn("/bin/bash")';