├── .gitignore ├── LICENSE ├── Makefile ├── README ├── apfcp.pdf ├── apfcp.tex ├── examples ├── 99_bottles_of_beer.S ├── Makefile ├── README ├── example-addrstack.c ├── example-arith-mov.S ├── example-cdecl.S ├── example-cond-jmp.S ├── example-ebp.S ├── example-hello-nasm.asm ├── example-indirect-mem.S ├── example-insecure.c ├── example-insecure_exploit.sh ├── example-libc.S ├── example-shellcode1.S ├── example-shellcode2.S ├── example-stack.S ├── example-static-alloc.S ├── example-string1.S ├── example-string2.S ├── example-strlen.c ├── example-syscall.S ├── extra │ ├── Makefile │ ├── base64.S │ ├── hexdump.S │ ├── line_counter.S │ └── line_counter_c.c ├── fibonacci.S ├── linked_list.S ├── morse_encoder.S └── tee.S ├── figures ├── 386fetch_decode_execute0.png ├── 386fetch_decode_execute1.png ├── 386fetch_decode_execute2.png ├── 386fetch_decode_execute3.png ├── 386fetch_decode_execute4.png ├── 386fetch_decode_execute5.png ├── 386fetch_decode_execute6.png ├── 386fetch_decode_execute7.png ├── 386state.png ├── 386statemem.png ├── 8086state.png ├── BORROWED_FIGURES.txt ├── apfcp_figures.svg ├── bufferoverflow.png ├── cpustate.png ├── eflags.png ├── gears.svg ├── hamster.jpg ├── ia32-eflags.png ├── lifostack.png ├── memlayout.png ├── memlayoutvm.png ├── monolithic.png ├── simd.png ├── stackframe.png ├── syscalls.png ├── x86stack.png ├── x86stackalloc.png ├── x86stackpop.png └── x86stackpush.png └── pygments_objdump_mods.diff /.gitignore: -------------------------------------------------------------------------------- 1 | misc 2 | pygments 3 | apfcp.aux 4 | apfcp.log 5 | apfcp.nav 6 | apfcp.out 7 | apfcp.snm 8 | apfcp.toc 9 | apfcp.vrb 10 | apfcp.pyg 11 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | All apfcp figures and source, with the exception of the items listed below, are 2 | licensed Creative Commons Attribution-ShareAlike 3.0 Unported (CC BY-SA 3.0), 3 | - EXCEPT FOR the glibc strlen() snippet in examples/example-1.c, which 4 | is licensed GNU Lesser General Public License 5 | - EXCEPT FOR the three figures described in figures/BORROWED_FIGURES.txt 6 | 7 | Full license text is available at http://creativecommons.org/licenses/by-sa/3.0/. 8 | 9 | -------------------------------------------------------------------------------- /Makefile: -------------------------------------------------------------------------------- 1 | PROJECT=apfcp 2 | 3 | # Note: I modified the default pygments objdump lexer to syntax highlight 4 | # objdump output without expecting tabs (\t) on each line, so I could fit 5 | # source examples into the slides. 6 | # 7 | # The modifications are contained in hg diff pygments_objdump_mods.diff 8 | 9 | all: 10 | rm -f $(PROJECT).toc $(PROJECT).aux $(PROJECT).log $(PROJECT).nav $(PROJECT).out $(PROJECT).pdf $(PROJECT).snm $(PROJECT).vrb texput.log 11 | PATH=pygments/:$(PATH) pdflatex -shell-escape $(PROJECT).tex 12 | PATH=pygments/:$(PATH) pdflatex -shell-escape $(PROJECT).tex 13 | mupdf $(PROJECT).pdf 14 | 15 | clean: 16 | rm -f $(PROJECT).toc $(PROJECT).aux $(PROJECT).log $(PROJECT).nav $(PROJECT).out $(PROJECT).snm $(PROJECT).vrb texput.log 17 | -------------------------------------------------------------------------------- /README: -------------------------------------------------------------------------------- 1 | x86 Assembly Primer for C Programmers 2 | Ivan Sergeev 3 | Date: Jan 22 07:00pm - 09:00pm, Jan 24 07:00pm - 09:00pm in 4-231 4 | 5 | A solid grasp of assembly language makes you a better programmer. Understanding 6 | assembly gives you: 7 | * insight into the true cost of high-level language operations (is modulus % 8 | cheap? when is it and when is it not?) 9 | * a keen understanding of how program memory is managed and manipulated 10 | * ability to debug at the lowest level, which means you can catch the subtlest 11 | of bugs 12 | * ability to utilize processor-specific instructions that squeeze the most out 13 | of every clock cycle and available processor features 14 | * the appreciation of time / space advantages that different compiler 15 | optimization settings can yield 16 | * a fluency with low-level detail that makes it easy to pick up new computer 17 | architectures 18 | 19 | Come to the x86 Assembly Primer and get a full introduction into x86 assembly 20 | language, program memory, stack frames, system calls, the role of libc, some of 21 | the convoluted nuances of x86, the x86-64 architecture, and some comparisons to 22 | other architectures. Enhance your quest in becoming a systems programming ninja 23 | here! 24 | 25 | Platform: strictly x86-32 GNU/Linux, gcc toolchain. 26 | Assembly Syntax: AT&T/GAS. 27 | Prereqs: Intermediate C 28 | 29 | -------------------------------------------------------------------------------- /apfcp.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/vsergeev/apfcp/a8077d9d63ef418a1c40a7a24c4755ead8f6eced/apfcp.pdf -------------------------------------------------------------------------------- /apfcp.tex: -------------------------------------------------------------------------------- 1 | \documentclass[11pt,xcolor=dvipsnames]{beamer} 2 | \usepackage{minted} 3 | \usepackage{graphics} 4 | 5 | \usecolortheme[named=Brown]{structure} 6 | \usetheme{CambridgeUS} 7 | 8 | \setbeamertemplate{navigation symbols}{} 9 | \setbeamertemplate{section in toc}[ball unnumbered] 10 | \setbeamertemplate{itemize item}[square] 11 | \setbeamertemplate{itemize subitem}[square] 12 | \setbeamerfont{frametitle}{size*={12}{1}} 13 | \setbeamerfont{section in head/foot}{size*={9.5}{1}} 14 | \setbeamersize{text margin left = 1em} 15 | 16 | \usemintedstyle{perldoc} 17 | \newminted{gas}{fontsize=\fontsize{9}{8},obeytabs=true} 18 | \newminted{customobjdump}{fontsize=\fontsize{9}{8},obeytabs=true} 19 | 20 | \newminted{c}{fontsize=\fontsize{9.25}{8.5},obeytabs=true} 21 | \newminted{nasm}{fontsize=\fontsize{9.25}{8.5},obeytabs=true} 22 | \newminted{bash}{fontsize=\fontsize{9.25}{8.5},obeytabs=true} 23 | \newminted{text}{fontsize=\fontsize{9.25}{8.5},obeytabs=true} 24 | 25 | \newcommand{\vs}{\vspace{0.5em}} 26 | \newcommand{\mvs}{\vspace{-0.95em}} 27 | 28 | \AtBeginSection{ 29 | \begin{frame} 30 | \begin{center} 31 | \structure{\huge \insertsection} 32 | \end{center} 33 | \end{frame} 34 | } 35 | 36 | \makeatletter 37 | \setbeamertemplate{footline} 38 | { 39 | \leavevmode% 40 | \hbox{% 41 | \begin{beamercolorbox}[wd=.50\paperwidth,ht=2.25ex,dp=1ex,center]{title in head/foot}% 42 | \usebeamerfont{title in head/foot}\insertshorttitle 43 | \end{beamercolorbox}% 44 | \begin{beamercolorbox}[wd=.50\paperwidth,ht=2.25ex,dp=1ex,right]{date in head/foot}% 45 | \usebeamerfont{date in head/foot}\insertshortdate{}\hspace*{2em} 46 | \insertframenumber{} / \inserttotalframenumber\hspace*{2ex} 47 | \end{beamercolorbox}}% 48 | \vskip0pt% 49 | } 50 | \makeatother 51 | 52 | \makeatletter 53 | \setbeamertemplate{headline} 54 | { 55 | \leavevmode% 56 | \hbox{% 57 | \begin{beamercolorbox}[wd=\paperwidth,ht=5ex,dp=2.5ex,left]{section in head/foot}% 58 | \hspace*{2ex}\usebeamerfont{section in head/foot}\insertsectionhead 59 | \end{beamercolorbox} }% 60 | % \begin{beamercolorbox}[wd=.30\paperwidth,ht=5ex,dp=2.5ex,left]{subsection in head/foot}% 61 | % \usebeamerfont{subsection in head/foot}\hspace*{2ex}\insertsubsectionhead 62 | % \end{beamercolorbox}}% 63 | \vskip0pt% 64 | } 65 | \makeatother 66 | 67 | \begin{document} 68 | 69 | \title{x86 Assembly Primer for C Programmers} 70 | \author{Ivan Sergeev} 71 | \institute{\url{https://github.com/vsergeev/apfcp} \\ \vs {\ttfamily git clone git://github.com/vsergeev/apfcp.git}} 72 | \date{January 22/24, 2013} 73 | 74 | %%% Title Slide 75 | \begin{frame}[plain] 76 | \titlepage 77 | \end{frame} 78 | 79 | \section*{Introduction and Example} 80 | 81 | %%% Introduction and Example Slide 0 82 | \begin{frame}[fragile,t] 83 | \frametitle{Why Assembly?} 84 | \begin{itemize} 85 | \item Embedded Systems 86 | \item Well-characterized execution time 87 | \item Bootstrapping an OS 88 | \item Compilers 89 | \item Debugging 90 | \item Fancy instructions 91 | \vs \vs 92 | \pause 93 | \item {\bf Sharpened intuition} on computing 94 | \begin{itemize} 95 | \item Gut instinct on implementation and feasibility 96 | \item Justification for liking powers of two 97 | \item Turing completeness is a special cage 98 | \end{itemize} 99 | \end{itemize} 100 | \end{frame} 101 | 102 | 103 | %%% Introduction and Example Slide 1 104 | \begin{frame}[fragile,t] 105 | \frametitle{Reasonable strlen (example-strlen.c)} 106 | Reasonable implementation of \verb+strlen()+ in C:\vs 107 | \begin{ccode} 108 | size_t ex_strlen(const char *s) { 109 | size_t i; 110 | for (i = 0; *s != '\0'; i++) 111 | s++; 112 | return i; 113 | } 114 | \end{ccode} 115 | \end{frame} 116 | 117 | %%% Introduction and Example Slide 2 118 | \begin{frame}[fragile,t] 119 | \frametitle{Reasonable strlen (example-strlen.c) Disassembly} 120 | Let's compile and disassemble it.\vs 121 | \begin{customobjdumpcode} 122 | $ gcc -O1 example-strlen.c -o example-strlen 123 | $ objdump -d example-strlen 124 | 125 | ... 126 | 080483b4 : 127 | 80483b4: 8b 54 24 04 mov 0x4(%esp),%edx 128 | 80483b8: b8 00 00 00 00 mov $0x0,%eax 129 | 80483bd: 80 3a 00 cmpb $0x0,(%edx) 130 | 80483c0: 74 09 je 80483cb 131 | 80483c2: 83 c0 01 add $0x1,%eax 132 | 80483c5: 80 3c 02 00 cmpb $0x0,(%edx,%eax,1) 133 | 80483c9: 75 f7 jne 80483c2 134 | 80483cb: f3 c3 repz ret 135 | ... 136 | \end{customobjdumpcode} 137 | \begin{itemize} 138 | \item Output of optimization levels 2 and 3 only differs with added padding bytes for memory alignment. 139 | \end{itemize} 140 | \end{frame} 141 | 142 | %% Introduction and Example Slide 3 143 | \begin{frame}[fragile,t] 144 | \frametitle{Reasonable strlen (example-strlen.c) Disassembly} 145 | Commented disassembly for \verb+ex_strlen()+:\vs 146 | \begin{gascode} 147 | # size_t strlen(const char *s); 148 | ex_strlen: 149 | mov 0x4(%esp),%edx # %edx = argument s 150 | mov $0x0,%eax # %eax = 0 151 | cmpb $0x0,(%edx) # Compare *(%edx) with 0x00 152 | je end # If equal, jump to return 153 | 154 | loop: 155 | add $0x1,%eax # %eax += 1 156 | cmpb $0x0,(%edx,%eax,1) # Compare *(%edx + %eax*1), 0x00 157 | jne loop # If not equal, jump to add 158 | 159 | end: 160 | repz ret # Return, return value in %eax 161 | \end{gascode} 162 | \end{frame} 163 | 164 | %%% Introduction and Example Slide 4 165 | \begin{frame}[fragile,t] 166 | \frametitle{glibc strlen (example-strlen.c)} 167 | glibc's i386 implementation of \verb+strlen()+:\vs 168 | \begin{customobjdumpcode} 169 | $ cat glibc/sysdeps/i386/strlen.c 170 | \end{customobjdumpcode} 171 | \begin{ccode} 172 | ... 173 | size_t 174 | strlen (const char *str) 175 | { 176 | int cnt; 177 | 178 | asm("cld\n" /* Search forward. */ 179 | /* Some old versions of gas need `repne' instead of `repnz'. */ 180 | "repnz\n" /* Look for a zero byte. */ 181 | "scasb" /* %0, %1, %3 */ : 182 | "=c" (cnt) : "D" (str), "0" (-1), "a" (0)); 183 | 184 | return -2 - cnt; 185 | } 186 | ... 187 | \end{ccode} 188 | \end{frame} 189 | 190 | %%% Introduction and Example Slide 5 191 | \begin{frame}[fragile,t] 192 | \frametitle{glibc strlen (example-strlen.c) Disassembly} 193 | Let's compile and disassemble it.\vs 194 | \begin{customobjdumpcode} 195 | $ gcc -O1 example-strlen.c -o example-strlen 196 | $ objdump -d a.out 197 | 198 | ... 199 | 080483cd : 200 | 80483cd: 57 push %edi 201 | 80483ce: b9 ff ff ff ff mov $0xffffffff,%ecx 202 | 80483d3: b8 00 00 00 00 mov $0x0,%eax 203 | 80483d8: 8b 7c 24 08 mov 0x8(%esp),%edi 204 | 80483dc: fc cld 205 | 80483dd: f2 ae repnz scas %es:(%edi),%al 206 | 80483df: b8 fe ff ff ff mov $0xfffffffe,%eax 207 | 80483e4: 29 c8 sub %ecx,%eax 208 | 80483e6: 5f pop %edi 209 | 80483e7: c3 ret 210 | .. 211 | \end{customobjdumpcode} 212 | \end{frame} 213 | 214 | 215 | %%% Introduction and Example Slide 6 216 | %\begin{frame}[fragile,t] 217 | %\frametitle{glibc strlen (example-strlen.c) disassembly} 218 | %Commented disassembly for glibc's \verb+strlen()+:\vs 219 | %\begin{gascode} 220 | %# size_t strlen(const char *s); 221 | %strlen: 222 | % push %edi # Save %edi 223 | % mov $0xffffffff,%ecx # %ecx = 0xffffffff 224 | % mov $0x0,%eax # %eax = 0 225 | % mov 0x8(%esp),%edi # %edi = argument s 226 | % cld # Clear direction flag 227 | % 228 | % repnz scas %es:(%edi),%al # Repeat scan while *(%edi) != 0x0 229 | % 230 | % mov $0xfffffffe,%eax # %eax = 0xfffffffe 231 | % sub %ecx,%eax # %eax = %eax - %ecx 232 | % pop %edi # Restore %edi 233 | % ret # Return, return value in %eax 234 | %\end{gascode} 235 | %\end{frame} 236 | 237 | %%% Introduction and Example Slide 7 238 | \begin{frame}[fragile,t] 239 | \frametitle{Disassembly side-by-side} 240 | A side-by-side comparison of the disassembly:\vspace{-0.8em} 241 | \begin{columns}[T] 242 | \column{0.5\textwidth} 243 | \begin{customobjdumpcode*}{fontsize=\fontsize{6.5}{8},frame=single} 244 | : 245 | # Initialization 246 | 8b 54 24 04 mov 0x4(%esp),%edx 247 | b8 00 00 00 00 mov $0x0,%eax 248 | 80 3a 00 cmpb $0x0,(%edx) 249 | 74 09 je 80483cb 250 | 251 | 252 | # Main loop 253 | 83 c0 01 add $0x1,%eax 254 | 80 3c 02 00 cmpb $0x0,(%edx,%eax,1) 255 | 75 f7 jne 80483c2 256 | 257 | # End 258 | f3 c3 repz ret 259 | \end{customobjdumpcode*} 260 | \column{0.5\textwidth} 261 | \begin{customobjdumpcode*}{fontsize=\fontsize{6.5}{8},frame=single} 262 | : 263 | # Initialization 264 | 57 push %edi 265 | b9 ff ff ff ff mov $0xffffffff,%ecx 266 | b8 00 00 00 00 mov $0x0,%eax 267 | 8b 7c 24 08 mov 0x8(%esp),%edi 268 | fc cld 269 | 270 | # Main loop 271 | f2 ae repnz scas %es:(%edi),%al 272 | 273 | 274 | 275 | # End 276 | b8 fe ff ff ff mov $0xfffffffe,%eax 277 | 29 c8 sub %ecx,%eax 278 | 5f pop %edi 279 | c3 ret 280 | \end{customobjdumpcode*} 281 | \end{columns} 282 | \end{frame} 283 | 284 | %%% Introduction and Example Slide 8 285 | \begin{frame}[fragile,t] 286 | \frametitle{Disassembly side-by-side} 287 | \mvs 288 | A side-by-side comparison of the main loop disassembly:\vspace{-0.8em} 289 | \begin{columns}[T] 290 | \column{0.5\textwidth} 291 | \begin{customobjdumpcode*}{fontsize=\fontsize{6.5}{8},frame=single} 292 | : 293 | ... 294 | # Main loop 295 | 83 c0 01 add $0x1,%eax 296 | 80 3c 02 00 cmpb $0x0,(%edx,%eax,1) 297 | 75 f7 jne 80483c2 298 | ... 299 | \end{customobjdumpcode*} 300 | \column{0.5\textwidth} 301 | \begin{customobjdumpcode*}{fontsize=\fontsize{6.5}{8},frame=single} 302 | : 303 | ... 304 | # Main loop 305 | f2 ae repnz scas %es:(%edi),%al 306 | 307 | 308 | ... 309 | \end{customobjdumpcode*} 310 | \end{columns} 311 | \vs 312 | \begin{itemize} 313 | \item glibc's i386 \verb+strlen()+ "main loop" is only 2 bytes! 314 | \begin{itemize} 315 | \item In fact, it's only one instruction: \verb+repnz scas (%edi),%al+. 316 | \end{itemize} 317 | \pause 318 | \item Reasonable strlen's "main loop" is three instructions, with a conditional branch \verb+jne 0x80483c2+. 319 | \pause 320 | \item An older example of when hand-assembly utilized processor features for a more efficient implementation 321 | \item glibc's i486 and i586 implementations of {\ttfamily strlen()} are still assembly, but much more complicated, taking into account memory alignment and processor pipeline 322 | \end{itemize} 323 | \end{frame} 324 | 325 | % Outline Slide 326 | \section*{Table of Contents} 327 | \begin{frame}{Outline} 328 | \tableofcontents[part=1] 329 | \end{frame} 330 | 331 | \begin{frame}{Outline} 332 | \tableofcontents[part=2] 333 | \end{frame} 334 | 335 | \part{1} 336 | 337 | \section{Topic 1: State, Instructions, Fetch-Decode-Execute} 338 | \begin{frame}[fragile,t] 339 | 340 | \frametitle{State and Instructions} 341 | \begin{itemize} 342 | \item State is retained information 343 | \begin{itemize} 344 | \item CPU Registers: small, built-in, referred to by name \\ ({\ttfamily \%eax, \%ebx, \%ecx, \%edx, ...}) 345 | \item Memory: large, external, referred to by address \\ ({\ttfamily 0x80000000, ...}) 346 | \end{itemize} 347 | \item Instructions affect and/or use state 348 | \begin{itemize} 349 | \item Add a constant to a register, subtract two registers, write to a memory location, jump to a memory location if a flag is set, etc. 350 | \end{itemize} 351 | \vs 352 | \pause 353 | \item Sufficient expressiveness of instructions makes a CPU Turing complete, provided you have infinite memory 354 | \end{itemize} 355 | \end{frame} 356 | 357 | \begin{frame}[fragile,t] 358 | \frametitle{8086 CPU Registers} 359 | \mvs 360 | \begin{figure} 361 | \centering \includegraphics[width=0.85\textwidth]{figures/8086state.png} 362 | \end{figure} 363 | \begin{itemize} 364 | \item Original 8086 was a 16-bit CPU 365 | \end{itemize} 366 | \end{frame} 367 | 368 | \begin{frame}[fragile,t] 369 | \frametitle{386+ CPU Registers} 370 | \mvs 371 | \begin{figure} 372 | \centering \includegraphics[width=0.85\textwidth]{figures/386state.png} 373 | \end{figure} 374 | \begin{itemize} 375 | \item 386+ is a 32-bit CPU, all registers extended to 32-bits 376 | \end{itemize} 377 | \end{frame} 378 | 379 | \begin{frame}[fragile,t] 380 | \frametitle{386+ CPU Registers and Memory} 381 | \mvs 382 | \begin{figure} 383 | \centering \includegraphics[width=0.65\textwidth]{figures/386statemem.png} 384 | \end{figure} 385 | \begin{itemize} 386 | \item Registers + Memory comprise (almost) total system state 387 | \end{itemize} 388 | \end{frame} 389 | 390 | \begin{frame}[fragile,t] 391 | \frametitle{Instructions} 392 | \begin{itemize} 393 | \item x86 instructions manipulate CPU registers, memory, and I/O ports 394 | \item Encoded as numbers, sitting in memory like any other data 395 | \item Uniquely defined for each architecture in its {\bf instruction set} 396 | \item {\ttfamily \%eip} contains address of next instruction 397 | \vs \vs \vs 398 | \pause 399 | \item Fetch-Decode-Execute Simplified CPU Model 400 | \begin{itemize} 401 | \item CPU {\bf fetches} data at address {\ttfamily \%eip} from main memory \\ 402 | \item CPU {\bf decodes} data into an instruction \\ 403 | \item CPU {\bf executes} instruction, \\ possibly manipulating memory, I/O, and its own state, including {\ttfamily \%eip} 404 | \end{itemize} 405 | \end{itemize} 406 | \end{frame} 407 | 408 | \begin{frame}[fragile,t] 409 | \frametitle{Instruction Fetch-Decode-Execute} 410 | \mvs 411 | \begin{figure} 412 | \centering \includegraphics[width=0.65\textwidth]{figures/386fetch_decode_execute0.png} 413 | \end{figure} 414 | \end{frame} 415 | 416 | \begin{frame}[fragile,t] 417 | \frametitle{Instruction Fetch-Decode-Execute} 418 | \mvs 419 | \begin{figure} 420 | \centering \includegraphics[width=0.65\textwidth]{figures/386fetch_decode_execute1.png} 421 | \end{figure} 422 | \end{frame} 423 | 424 | \begin{frame}[fragile,t] 425 | \frametitle{Instruction Fetch-Decode-Execute} 426 | \mvs 427 | \begin{figure} 428 | \centering \includegraphics[width=0.65\textwidth]{figures/386fetch_decode_execute2.png} 429 | \end{figure} 430 | \end{frame} 431 | 432 | \begin{frame}[fragile,t] 433 | \frametitle{Instruction Fetch-Decode-Execute} 434 | \mvs 435 | \begin{figure} 436 | \centering \includegraphics[width=0.65\textwidth]{figures/386fetch_decode_execute3.png} 437 | \end{figure} 438 | \end{frame} 439 | 440 | \begin{frame}[fragile,t] 441 | \frametitle{Instruction Fetch-Decode-Execute} 442 | \mvs 443 | \begin{figure} 444 | \centering \includegraphics[width=0.65\textwidth]{figures/386fetch_decode_execute4.png} 445 | \end{figure} 446 | \end{frame} 447 | 448 | \begin{frame}[fragile,t] 449 | \frametitle{Instruction Fetch-Decode-Execute} 450 | \mvs 451 | \begin{figure} 452 | \centering \includegraphics[width=0.65\textwidth]{figures/386fetch_decode_execute5.png} 453 | \end{figure} 454 | \end{frame} 455 | 456 | \begin{frame}[fragile,t] 457 | \frametitle{Instruction Fetch-Decode-Execute} 458 | \mvs 459 | \begin{figure} 460 | \centering \includegraphics[width=0.65\textwidth]{figures/386fetch_decode_execute6.png} 461 | \end{figure} 462 | \end{frame} 463 | 464 | \begin{frame}[fragile,t] 465 | \frametitle{Instruction Fetch-Decode-Execute} 466 | \mvs 467 | \begin{figure} 468 | \centering \includegraphics[width=0.65\textwidth]{figures/386fetch_decode_execute7.png} 469 | \end{figure} 470 | \end{frame} 471 | 472 | \begin{frame}[fragile,t] 473 | \frametitle{Sampling of Core 386+ User Instructions} 474 | \mvs 475 | \begin{itemize} 476 | \item {\bf Arithmetic:} {\ttfamily adc, add, and, cmp, dec, div, idiv, imul, inc, mul, neg, not, or, rcl, rcr, rol, ror, sal, sar, sbb, shl, shr, sub, test, xor, lea} 477 | \item {\bf Flags:} {\ttfamily clc / stc, cld / std, cli / sti, cmc} 478 | \item {\bf String:} {\ttfamily cmpsb / cmpsw, lodsb / lodsw, movsb / movsw, scasb / scasw, stosb / stosw, repxx} 479 | \item {\bf Stack:} {\ttfamily push, pop} 480 | \item {\bf Memory:} {\ttfamily mov} 481 | \item {\bf Flow Control:} {\ttfamily call, jxx, jmp, ret / retn / retf, loop/loopxx} 482 | \item {\bf Operating System:} {\ttfamily int, into, iret, hlt, pushf, popf, popad, popfd, pushad} 483 | \item {\bf Input/Output:} {\ttfamily in, out} 484 | \item {\bf Misc:} {\ttfamily aaa, aad, aam, aas, daa, cbw, cwd, lahf, lds, les, lock, wait, xchg, xlat, nop} 485 | \end{itemize} 486 | \end{frame} 487 | 488 | \section{Topic 2: Arithmetic, and Data Transfer} 489 | 490 | \begin{frame}[fragile,t] 491 | \frametitle{Instructions in Assembly} 492 | \begin{itemize} 493 | \item Instructions represented by a mnemonic and operands 494 | \item AT\&T/GAS syntax 495 | \begin{itemize} 496 | \item {\bf No operands:} \verb++ 497 | \begin{itemize} 498 | \item {\ttfamily nop} 499 | \end{itemize} 500 | \item {\bf One operand:} \verb+ + 501 | \begin{itemize} 502 | \item {\ttfamily incl \%eax} 503 | \end{itemize} 504 | \item {\bf Two operands:} \verb+ ,+ 505 | \begin{itemize} 506 | \item {\ttfamily addl \$0x1, \%eax} 507 | \end{itemize} 508 | \end{itemize} 509 | \vs 510 | \pause 511 | \item Source and destination operands are typically one of: 512 | \begin{itemize} 513 | \item {\bf Register:} {\ttfamily \%eax, \%ebx, \%ecx, \%edx,} etc. 514 | \begin{itemize} 515 | \item {\ttfamily movl \%eax, \%ebx} 516 | \end{itemize} 517 | \item {\bf Immediate:} constant value embedded in the instruction encoding 518 | \begin{itemize} 519 | \item {\ttfamily movl \$0x1, \%eax} 520 | \end{itemize} 521 | \item {\bf Memory:} constant value representing an absolute (0x80000000) or relative address (+4) 522 | \begin{itemize} 523 | \item {\ttfamily movl 0x800000000, \%eax} 524 | \end{itemize} 525 | \end{itemize} 526 | \end{itemize} 527 | \end{frame} 528 | 529 | \begin{frame}[fragile,t] 530 | \frametitle{Example Arithmetic and Data Transfer (example-arith-mov.S)} 531 | \mvs 532 | \begin{gascode} 533 | .section .text 534 | nop # ; (Do nothing!) 535 | 536 | # add, sub, adc, and, or, xor 537 | addl %eax, %ebx # %ebx = %ebx + %eax 538 | addl magicNumber, %ebx # %ebx = %ebx + *(magicNumber) 539 | addl %ebx, magicNumber # *(magicNumber) = *(magicNumber) + %ebx 540 | addl $0x12341234, %ebx # %ebx = %ebx + 0x12341234 541 | 542 | # inc, dec, not, neg 543 | decl %eax # %eax-- 544 | decw %ax # %ax-- 545 | decb %al # %al-- 546 | 547 | # rol, rcl, shl, shr, sal, sar 548 | shrl $3, %eax # %eax = %eax >> 3 549 | shrl $3, magicNumber # *(magicNumber) = *(magicNumber) >> 3 550 | 551 | # mov 552 | movl %eax, %ebx # %ebx = %eax 553 | movl magicNumber, %eax # %eax = *(magicNumber) 554 | movl %eax, magicNumber # *(magicNumber) = %eax 555 | 556 | .section .data 557 | magicNumber: .long 0xdeadbeef # *magicNumber = 0xdeadbeef; 558 | \end{gascode} 559 | \end{frame} 560 | 561 | \begin{frame}[fragile,t] 562 | \frametitle{Ex. Arithmetic and Data Transfer (example-arith-mov.S) Disassembly} 563 | \mvs 564 | \begin{customobjdumpcode} 565 | $ as example-arith-mov.S -o example-arith-mov.o 566 | $ ld example-arith-mov.o -o example-arith-mov 567 | $ objdump -D example-arith-mov 568 | 569 | Disassembly of section .text: 570 | 08048074 <.text>: 571 | 8048074: 90 nop 572 | 8048075: 01 c3 add %eax,%ebx 573 | 8048077: 03 1d a4 90 04 08 add 0x80490a4,%ebx 574 | 804807d: 01 1d a4 90 04 08 add %ebx,0x80490a4 575 | 8048083: 81 c3 34 12 34 12 add $0x12341234,%ebx 576 | 8048089: 48 dec %eax 577 | 804808a: 66 48 dec %ax 578 | 804808c: fe c8 dec %al 579 | 804808e: c1 e8 03 shr $0x3,%eax 580 | 8048091: c1 2d a4 90 04 08 03 shrl $0x3,0x80490a4 581 | 8048098: 89 c3 mov %eax,%ebx 582 | 804809a: a1 a4 90 04 08 mov 0x80490a4,%eax 583 | 804809f: a3 a4 90 04 08 mov %eax,0x80490a4 584 | 585 | Disassembly of section .data: 586 | 080490a4 : 587 | 80490a4: ef out %eax,(%dx) 588 | 80490a5: be .byte 0xbe 589 | 80490a6: ad lods %ds:(%esi),%eax 590 | 80490a7: de .byte 0xde 591 | 592 | \end{customobjdumpcode} 593 | \end{frame} 594 | 595 | \begin{frame}[fragile,t] 596 | \frametitle{A Note on GAS Syntax} 597 | \begin{itemize} 598 | \item Syntax 599 | \begin{itemize} 600 | \item {\ttfamily \%} precedes a register: {\ttfamily \%eax} 601 | \item {\ttfamily \$} precedes a constant: {\ttfamily \$5, \$0xff, \$07, \$'A, \$0b111} 602 | \item {\ttfamily .} precedes a directive: {\ttfamily .byte, .long, .ascii, .section, .comm} 603 | \item {\ttfamily \#} precedes a comment 604 | \vs 605 | \pause 606 | \item {\bf No special character precedes a dereferenced memory address:} \\ {\ttfamily movl \%eax, 0x80000000 \;\; \# *(0x80000000) = \%eax} 607 | \pause 608 | \item {\ttfamily mylabel:} defines a label, a symbol of name {\ttfamily mylabel} containing the address at that point 609 | \pause 610 | \end{itemize} 611 | \vs 612 | \item Directives 613 | \begin{itemize} 614 | \item Place a raw byte: {\ttfamily .byte 0xff} 615 | \item Place a raw short: {\ttfamily .short 0x1234} 616 | \item Place a raw ASCII string: {\ttfamily .ascii "Hello World!\textbackslash0"} 617 | \item Specify a section (e.g. .text, .data, .rodata, .bss): \\ {\ttfamily .section } 618 | \end{itemize} 619 | \end{itemize} 620 | \end{frame} 621 | 622 | \begin{frame}[fragile,t] 623 | \frametitle{A Note on GAS Syntax} 624 | \begin{itemize} 625 | \item Instruction Size Suffix 626 | \begin{itemize} 627 | \item x86 is backwards compatible to the original 8086 628 | \item Inherited instructions operate on 8-bits, 16-bits, 32-bits 629 | \item Naturally, they often have the same name... 630 | \vs 631 | \pause 632 | \item GAS supports the syntax {\ttfamily } \\ to unambiguously encode the correct instruction \\ 633 | \begin{textcode} 634 | movb $0xff, %al movw %bx, %ax movl memAddr, %eax 635 | incb %ah incw %ax incl %eax 636 | \end{textcode} 637 | \end{itemize} 638 | \end{itemize} 639 | \begin{center} 640 | \begin{tabular}{c|c|c} 641 | \textbf{Name} & \textbf{Size} & \textbf{GAS Suffix} \\ 642 | \hline \hline 643 | byte & 8-bits & b \\ 644 | word & 16-bits & w \\ 645 | dword & 32-bits & l \\ 646 | qword & 64-bits & q \\ 647 | \end{tabular} 648 | \end{center} 649 | \end{frame} 650 | 651 | \section{Basic Tools} 652 | \begin{frame}[fragile,t] 653 | \frametitle{Common Invocations} 654 | \begin{itemize} 655 | \item Assemble: {\ttfamily as prog.asm -o prog.o} 656 | \item Link directly: {\ttfamily ld prog.o -o prog} 657 | \item Link with libc: {\ttfamily gcc prog.o -o prog} 658 | \item Disassemble: {\ttfamily objdump -D prog} 659 | \item View Sections: {\ttfamily objdump -x prog} 660 | \item View Symbols: {\ttfamily nm prog} 661 | \item Debug Disassembly: {\ttfamily gdb prog} 662 | \begin{itemize} 663 | \item Step instruction: {\ttfamily si} 664 | \item Disassembly layout: {\ttfamily layout asm} 665 | \item Set breakpoint at symbol: {\ttfamily b \_start} 666 | \item Set breakpoint at address: {\ttfamily b * 0x80001230} 667 | \item View CPU registers: {\ttfamily info reg} 668 | \item Disassemble next three instructions: {\ttfamily x/3i \$eip} 669 | \item View five dwords of memory starting at {\ttfamily \$esp}: {\ttfamily x/5w \$esp} 670 | \item View five bytes of memory starting at {\ttfamily 0xbffffff0}: {\ttfamily x/5b 0xbffffff0} 671 | \end{itemize} 672 | \end{itemize} 673 | \end{frame} 674 | 675 | \section{Topic 3: Flow Control} 676 | 677 | \begin{frame}[fragile,t] 678 | \frametitle{Modifying Flow of Execution} 679 | \mvs 680 | \begin{itemize} 681 | \item With most instructions, CPU will increment {\ttfamily \%eip} by the executed instruction size to proceed to the next immediate instruction 682 | \end{itemize} 683 | \begin{gascode} 684 | a_label: 685 | nop 686 | addl $5, %eax # %eax = %eax + 5 687 | xorl %ecx, %ebx # %ebx = %ebx ^ %ecx 688 | 689 | another_label: 690 | nop 691 | nop 692 | \end{gascode} 693 | \pause 694 | \begin{itemize} 695 | \item The unconditional {\ttfamily jmp