Experiments

5 min read

Assembly

Assembler

  • Converts assembly language to machine language
  • Examples
    • GNU Assembler (GAS)

Disassembler

  • Performs inverse of assembler
  • Translates machine language into assembly language
  • The output of disassembly is typically formatted for human-readability
  • It is used as reverse-engineering tool
  • Examples
    • Ghidra

Decompilers

  • It converts to high level languages instead of Assembly

Assembly Language

Registers

  • Very small fast storage inside CPU
  • There are limited amount of registers typically 32
  • A very large number of registers may increase the clock cycle time simply because it takes electronic signals longer when they must travel farther
  • Types
    • Physical Registers
      • The actual registers implemented in the CPU hardware
      • CPU has many more physical registers compared to architectural registers
      • used for techniques such as register renaming
    • Architectural Registers
      • defined by ISA
  • Types of Architectural Registers
    • General Purpose Registers (GPRs)
      • aka Integer Registers
      • x86_64: 16
        • RAX, RBX, RCX, RDX
        • RSI, RDI, RBP, RSP
        • R8 – R15
      • RISC-V: 32
        • x0 – x31
        • x0 is always 0 and not writable
    • Instruction Pointer Register
      • x86_64: RIP
      • RISC-V: PC
    • Flags Register
      • x86_64: RFLAGS
      • RISC-V: No Flags register
    • Extra/Special Registers
      • defined by ISA extensions
      • Floating point registers

x86_64 General Purpose registers

  • All general purpose registers are 64 bits
    • Each of them have sub-registers
  • Size conventions
    • byte = 8 bits
    • word = 16 bits
    • dword = 32 bits
    • qword = 64 bits
  • RAX, RBX, RCX, RDX
  • RSI (Source index), RDI (Destination Index)
    • Traditionally Source/Destination Index
    • Now used as general purpose registers
  • RBP (stack-frame pointer), and RSP (Stack Pointer)
    • RBP is now used as general purpose register
  • R8 - R15 are newly added registers
  • Examples

    • RAX = 64 bits

      • EAX = lower 32 bits of RAX
        • AX = lower 16 bits of RAX
          • AH = upper 8 bits of RAX
          • AL = lower 8 bits of RAX

    • RSI = 64 bits

      • ESI
        • SI
          • SIL

    • R8 = 64 bits

      • R8D (dword)
        • R8W (word)
          • R8B (byte)
63                                            0
┌─────────────────────────────────────────────┐
│                     RAX                     │
└─────────────────────────────────────────────┘
                       31                     0
                       ┌──────────────────────┐
                       │         EAX          │
                       └──────────────────────┘
                                   15         0
                                   ┌──────────┐
                                   │    AX    │
                                   └──────────┘
                                   15   8 7   0
                                   ┌─────┬────┐
                                   │ AH  │ AL │
                                   └─────┴────┘

x86_64 Instruction pointer register

  • RIP is 64 bit
  • Holds the address of the next instruction to execute
  • Automatically updated as instructions execute

x86_64 Flags register

  • RFLAGS is 64 bit
  • Contains status, control, and system flags
  • Examples:
    • CF — Carry Flag
    • PF — Parity Flag
    • AF — Auxiliary Carry Flag
    • ZF — Zero Flag
    • SF — Sign Flag
    • OF — Overflow Flag
    • DF — Direction Flag
    • IF — Interrupt Enable Flag
    • TF — Trap Flag

Instructions

  • contains
    • operator
    • operands
  • operand order matters
  • Operand Types
    • Register
    • Immediate
    • Memory
add eax, ebx          ; ebx is a register
add eax, [rbx]        ; [rbx] is memory
add eax, 10           ; 10 is an immediate

Arithmetic

  • Add/Subtract
  • Multiply/Divide
  • Signed vs unsigned
  • Overflow
  • Carry
  • Two’s complement
  • Immediate values
  • Basic bitwise arithmetic
 
sub  eax, 10          ; eax = eax - 10, subtract immediate
imul eax, ebx         ; eax = eax * ebx, multiply
idiv ebx              ; divide

Data Transfer

  • Address
  • Pointer
  • Load
  • Store
  • Alignment
  • Stack
  • Heap
mov eax, [rbx]        ; load
mov [rbx], eax        ; store

Logical and Bit Manipulation

  • AND
  • OR
  • XOR
  • NOT
  • AND immediate
  • OR immediate
  • Shift left
  • Shift right logical
  • Shift right arithmetic
    • preserves sign bit
and eax, ebx
or  eax, ebx
xor eax, ebx
not eax
 
and eax, 0xff            ; and immediate
or  eax, 0x10            ; or immediate
 
shl eax, 2               ; shift left
shr eax, 2               ; shift right
sar eax, 2               ; shift right arithmetic

Conditional branching

  • Branch if equal
  • Branch if not equal
  • Branch if less than
  • Branch if greater than
  • Signed vs unsigned comparisons
cmp eax, ebx             ; computes eax - ebx and set flags which are used later
 
je  label                ; jump to label if equal
jne label                ; jump to label if not equal
jl  label                ; jump to label if signed less than
jg  label                ; jump to label if signed greater than
 
jb  label                ; jump to label if unsigned less than
ja  label                ; jump to label if unsigned greater than

Control flow

  • Unconditional jump
  • Conditional jump / branch
  • Indirect jump
  • Function call
  • Function return
  • Jump-and-link / return-address
jmp   label        ; unconditional jump to label
call  function     ; call function
jmp   rax          ; indirect jump to address stored in RAX
ret                ; return from function

Functions

  • Functions are just labels with ret at the end
  • ret is actually optional and assembly does not define functions separately
  • call puts return address on the stack
  • When ret is executed the execution resumes from where the call was made
my_function:
    mov eax, 42
    ret
 
call my_function
  • How to prevent method body execution???

Program Termination

  • ???

Exceptions

  • ???

Privilege

  • System calls

Atomicity and Synchronization

  • Atomic operations
  • LOCK prefix
  • Compare-and-swap
  • Atomic read-modify-write
  • Memory ordering
  • Locks / spinlocks

CPU Microarchitecture

  • Pipeline
  • Cache
  • Branch prediction
  • Speculation
  • Out-of-order execution
  • Register renaming