Getting Started for Reverse Engineering 101
Basics of x86 Architecture for Reversing -1
Prerequisites:-
What is Assembly Language?
Assembly is the lowest form of language which the CPU understand, it consists of sets of human readable instruction which are called opcode such as ADD, MOV, etc. The assembly language helps to communicate directly with the corresponding hardware. Each instruction of assembly can be independently executed by the CPU. The opcode depends on the machine architecture.
Registers:- These are directly connected to the CPU and store data values temporarily.
Eg, AX,SI,etc
Opcode:- It’s the mnemonic code representation for the instruction.
Eg, ADD,MUL,etc
Get Anoni’s stories in your inbox
Join Medium for free to get updates from this writer.
Operand:- Its passed on with opcode it completes the instruction telling which value is used in that operation. Eg, [SI+10h], 12h,etc
Intel’s x86 Architecture
The internals of any modern computer follows Von Nemann architectures including the intel x86 and x86–64 Architecture.
There are three Hardware components:-
- CPU
It is the Central Processing Unit which is the actual unit responsible for code execution and control of the complete system.
The CPU consists of:-
Registers:- Registers hold the data temporary for the instruction currently executing in the ALU, there are specific registers for various purpose.
ALU:- Arithmetic Logic Unit is responsible for performing arithmetic operation such as addition, bit shift, etc, this unit directly modifies the data according to the microcode instruction given and uses registers to load and store the result.
Control Unit:- Responsible for timing the CPU as well as controlling the flow of the Code Execution and handling other control related task. - I/O Devices
Input/Output is an interface through which communication with other peripherals components of a computer is possible such as keyboards,disk drives,etc - RAM
This is the Main Memory of the program where all the programs are loaded the instructions are fetched from main memory and executed in CPU and the result is available in register which then can be useful for later instruction.
Main Memory consists of:-
Data:- This section stores the data values such as text, strings, etc which are static value and available to the program globally.
Code:- In this section the actual instructions which will be executed are stored of the program.
Heap:- This memory is the Dynamic memory of the program here the code may create a buffer space for the variables,struct or data block which cannot be loaded into stack memory, the OS or the program is responsible for the management of heap memory.
Stack:- This part of the memory is responsible for storing local variable and creating a space for individual spaces for the functions and program to store values such as parameters and function return values it helps in controlling the flow too.
Instruction set and x86 Assembly
Instructions are atomic meaning each instruction is independent and it executes a single operation or a set of steps to reach a specific task result. Instruction in x86 Assembly are made of mnemonic and zero, one or more operands.
Syntax
Operands
Operands tell the instruction what data needs to be used they refer a data value directly or reference to it.Operands which give the immediate value such as 0x02h are immediate and ones which refer a register are termed register operand, and pointing to the memory are termed as memory operand.
This methods of addressing data come under addressing modes there are many ways in which the data can be addressed.
Registers
Registers are located next to the Execution Unit and they hold data value temporarily they each individual register has the same size as that of the CPU architecture.Registers are used so that data can be quickly within nano seconds.
In x86 assembly the registers are divided into four different types:-
- General Purpose Registers
These register are available to CPU to store data or memory address.
Each General purpose register serves its own purpose though the name might not reflect it they are coined to specific function listed below per register.
EAX — Extended Accumulator holds the result after the arithmetic operation,stores return value.
EBX — Stores the Base Address of data segment.
ECX — Count register used to store the iteration number for loops and string operation.
EDX — Can be considered as true general purpose register, used in division and multiplication also used for I/O operations.
ESI — Source Index register, it points to the data store in Data Segment, used as an offset address in string and array operation.
EDI — Destination Index register, similar to ESI but for Extra Segment.
EBP — Base Pointer register points to the current stack frame bottom.
ESP — Stack Pointer register points to the top of the current stack frame.
All the above registers are extended registers in 32-bit or 4 byte(Double Word), in x86–64 which is 64-bit or Quad Word this are named as Register directly such as RAX,RBP, and each such register is backward compatible and addressable.
RAX — 64 bit but can use 32-bit as EAX and 16 bit as AX and 8-bit as AL and upper high bits of 16bit as AH. - Segment Registers
The memory of a program is divided into different segment each represent specific type of data stored in that region only, to access this memory region we need segment registers which does the logical partition.This register directly point to the start of that segment.
CS — Code Segment register, this segment consist of the actual code section of the program, the pointer to the start address of code section is stored in CS.
DS — Data Segment register, a segment used to the static data and variable data of the program.
SS — Stack Segment register used to store the starting value of the stack for the program.
ES — Extra Segment register used for extra memory typicaly for string operations.
FS — Extra Segment register.
GS — Extra Segment register. - Flag Register
This is a single register which helps in controlling the state and flow of the program.It shows the status after the execution of an instruction.
EFLAG
Its a 32-bit in x86 and each bit is a flag and is set to 0 or 1 indicating a result of the execution output.
Few needed for reversing
ZF — The zero flag is set when the result of an operation is equal to zero.
CF — Indicates that a carry was generated by the operation.
SF — Sign flag indicating the result is negative otherwise unset for positive value.
TP — Trap flag set to setup a breakpoints at the immediate next instruction for halting and debugging purpose.
DF — Direction flag is used to indicate the direction in which the ESI/EDI register should move towards, for string operations.
PF — Parity flag used to check if the least significant byte of result contains even no’s of 1 or no, set for even parity 0 for odd parity.
AF — Auxiliary Carry flag used to tell if in a byte a nibble generates a carry/borrow or not. Set when true.
IF — Interrupt flag is set to notify whether an interrupt request can be generated or not. - EIP The Instruction Pointer
It stores the next execution instruction pointer, is used to direct the flow of the program.
Next in the series:-
Basics of x86 Architecture for Reversing -2
