{"id":3439,"date":"2021-08-20T13:21:22","date_gmt":"2021-08-20T11:21:22","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=3439"},"modified":"2021-08-21T14:44:24","modified_gmt":"2021-08-21T12:44:24","slug":"basic-x86-x64-assembly-registers-and-commands","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=3439","title":{"rendered":"Basic x86\/x64 assembly registers and commands"},"content":{"rendered":"\n

Registers<\/h2>\n\n\n\n

General purpose registers<\/h3>\n\n\n\n
Reg\u00adis\u00adter x86<\/th>Reg\u00adis\u00adter x64<\/th>Name<\/th>Descrip\u00adtion<\/th><\/tr><\/thead>
EAX<\/code><\/td>RAX<\/code><\/td>Accu\u00admu\u00adla\u00adtor<\/td>For results of cal\u00adcu\u00adla\u00adtions and return codes<\/td><\/tr>
EBX<\/code><\/td>RBX<\/code><\/td>Base reg\u00adis\u00adter<\/td>Gen\u00ader\u00adal purpose<\/td><\/tr>
ECX<\/code><\/td>RCX<\/code><\/td>Count reg\u00adis\u00adter<\/td>For num\u00adber of iter\u00ada\u00adtions, often used for loops<\/td><\/tr>
EDX<\/code><\/td>RDX<\/code><\/td>Data reg\u00adis\u00adter<\/td>For data of cal\u00adcu\u00adla\u00adtions or a point\u00ader to large data<\/td><\/tr>
ESI<\/code><\/td>RSI<\/code><\/td>Source index<\/td>Point\u00ader to a loca\u00adtion to read from<\/td><\/tr>
EDI<\/code><\/td>RDI<\/code><\/td>Des\u00adti\u00adna\u00adtion index<\/td>Point\u00ader to a loca\u00adtion to write into<\/td><\/tr>
EBP<\/code><\/td>( RBP<\/code> )<\/td>Extend\u00aded base point\u00ader in x68
Gen\u00ader\u00adal pur\u00adpose reg\u00adis\u00adter in x64<\/td>		Fixed point\u00ader dur\u00ading a func\u00adtion call as a ref\u00ader\u00adence to access vari\u00adables on the stack.<\/td><\/tr>
ESP<\/code><\/td>RSP<\/code><\/td>Stack point\u00ader<\/td>Holds the top address of the stack<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Segment registers<\/h3>\n\n\n\n

These are all 16 bit register.<\/p>\n\n\n\n

Reg\u00adis\u00adter<\/th>Name<\/th>Descrip\u00adtion<\/th><\/tr><\/thead>
CS<\/code><\/td>Code seg\u00adment reg\u00adis\u00adter (also: Text seg\u00adment register)<\/td>Point\u00ader to the start address of the exe\u00adcute\u00adable code<\/td><\/tr>
SS<\/code><\/td>Stack seg\u00adment register<\/td>Point\u00ader to some off\u00adset address with\u00adin the stack<\/td><\/tr>
DS<\/code><\/td>Data seg\u00adment register<\/td>Point\u00ader to an address of some data structure<\/td><\/tr>
ES<\/code><\/td>Extra seg\u00adment register<\/td>Point\u00ader to an address of some data structure<\/td><\/tr>
FS<\/code><\/td>Extra data seg\u00adment register<\/td>Point\u00ader to an address of some data struc\u00adture.
Win\u00addows: Point\u00ader to the TIB<\/span> Thread Infor\u00adma\u00adtion Block<\/em><\/td><\/tr>
GS<\/code><\/td>Extra data seg\u00adment register<\/td>Point\u00ader to an address of some data struc\u00adture.
Win\u00addows: Point\u00ader to the TLS<\/span> Thread Local Storage<\/em><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Commands<\/h2>\n\n\n\n
Com\u00admand<\/th>Descrip\u00adtion<\/th><\/tr><\/thead>
push %edi<\/code><\/td>1. Writes the val\u00adue from %edi on top on the stack and
2. decreas\u00ades the ESP<\/span> Stack Pointer<\/td><\/tr>
pop %ebp<\/code><\/td>1. Loads the val\u00adue on top of the stack into the giv\u00aden reg\u00adis\u00adter $ebp<\/code> and
2. increas\u00ades the ESP<\/span> Stack Pointer.<\/td><\/tr>
ret<\/code><\/td>1. Sets the IP<\/span> Instruc\u00adtion point\u00ader to the address on top of the stack and
2. increas\u00ades the ESP<\/span> Stack Pointer.<\/td><\/tr>
call func<\/code><\/td>1. Stores the next address (after the call func\u00adtion) on top on the stack (basi\u00adcal\u00adly the return address),
2. decreas\u00ades the ESP<\/span> Stack Point\u00ader and
3. sets the IP<\/span> Instruc\u00adtion Point\u00ader to the address of func<\/code>.<\/td><\/tr>
mov %eax, %edi<\/code><\/td>AT<\/span>&<\/span>T syn\u00adtax: Copies the val\u00adue of %eax<\/code> into %edi<\/code>.<\/td><\/tr>
mov edi, eax<\/code><\/td>Intel syn\u00adtax: Copies the val\u00adue of eay<\/code> into edi<\/code>.<\/td><\/tr>
xchg %eax, %eax<\/code><\/td>Swaps the val\u00adues from both registers.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

Reg\u00adis\u00adters Gen\u00ader\u00adal pur\u00adpose reg\u00adis\u00adters Reg\u00adis\u00adter x86 Reg\u00adis\u00adter x64 Name Descrip\u00adtion EAX<\/span> RAX<\/span> Accu\u00admu\u00adla\u00adtor For results of cal\u00adcu\u00adla\u00adtions and return codes EBX<\/span> RBX<\/span> Base reg\u00adis\u00adter Gen\u00ader\u00adal pur\u00adpose ECX<\/span> RCX<\/span> Count reg\u00adis\u00adter For num\u00adber of iter\u00ada\u00adtions, often used for loops EDX<\/span> RDX<\/span> Data reg\u00adis\u00adter For data of cal\u00adcu\u00adla\u00adtions or a point\u00ader to large data ESI<\/span> RSI<\/span> Source index Point\u00ader to a [\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[355],"tags":[423],"class_list":["post-3439","post","type-post","status-publish","format-standard","hentry","category-reverse-engineering","tag-assembly"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/3439","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3439"}],"version-history":[{"count":12,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/3439\/revisions"}],"predecessor-version":[{"id":3457,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/3439\/revisions\/3457"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3439"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3439"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3439"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}