x86 Assembly for Reverse Engineers (Crash Course)

https://sensepost.com/blogstatic/2014/01/SensePost_crash_course_in_x86_assembly-.pdf

1.1
Introduction
The hardest part of learning x86 assembly in 2013 is find
ing
good
tutorials
. As the popularity
of low level languages
decreases
the
incitement
to create fresh up to date
tutori
als
is limited.
At  the  same  time  x86  assembly  is  critical
in  many  security  related  fields
such  as  malware
ana
lysis, vulnerability research and
exploit
development
.
This
document
was created
to address the lack of
tutorials
in a fast, pedagogical and cheap
manner.  While  it  is  not  a  complete  introduction,  it  addresses  enough  to  prepare  careful
readers
with the
necessary knowledge
base to be able to decipher non
-
obfuscated assembly.
And it does so within less than thirty pages.
For  pedagogical  reasons
focus  i
s  kept  to  what  the  reader
assumedly
knows  about  C  or  C
-
based  languages
(like  Java  or  C#)
.  Hopefully  this  minimizes  the  confusion  that  usually
appears when people are trying to learn a stack based language for the first time.

1
T
ABLE OF
C
ONTENTS
1
Table of Contents
................................
................................
................................
..............
2
1.1
Introduction
................................
................................
................................
................
3
1.2
Bits, bytes, words, double words
................................
................................
...............
4
1.3
Registers
................................
................................
................................
....................
5
1.3.1
General purpose registers
................................
................................
.................
5
1.3.2
Segment registers
................................
................................
..............................
6
1.3.3
Status flag registers
................................
................................
...........................
6
1.3.4
EIP
-
Extended Instruction Pointer
................................
................................
....
7
1.4
Segments & offsets
................................
................................
................................
....
8
1.4.1
The sta
ck
................................
................................
................................
...........
8
1.4.2
Stack frames
................................
................................
................................
......
8
1.4.3
The Heap
................................
................................
................................
...........
8
1.5
Instructions
................................
................................
................................
..............
10
1.5.1
Arithmetic operations
-
ADD , SUB, MUL, IMUL, DIV, IDIV...
.........................
11
1.5.2
Bitwise operations
–
AND, OR, XOR, NOT
................................
.....................
12
1.5.3
Branching
–
JMP, JE, JLE, JNZ, JZ, JBE, JGE...
................................
...........
13
1.5.4
Data moving
–
MOV, MOVS, MOVSB, MOVSW, MOVZX, MOVSX, LEA...
..
14
1.5.5
Loops
–
LOOP, REP...
................................
................................
....................
15
1.5.6
Stack management
–
POP, PUSH
................................
................................
..
16
1.5.7
Functions
–
CA
LL, RET
................................
................................
...................
16
1.5.8
Interrupts, Debugger  traps
–
INT, trap flag
................................
.....................
18
1.6
Calling conventions
................................
................................
................................
..
19
1.6.1
stdcall
................................
................................
................................
...............
19
1.6.2
cdecl
................................
................................
................................
.................
19
1.6.3
pascal
................................
................................
................................
...............
19
1.6.4
fastcall
................................
................................
................................
..............
19
1.6.5
Others calling conventions
................................
................................
...............
19
1.7
C to x86 assembly
................................
................................
................................
...
20
1.7.1
Single
-
Branch Conditionals
................................
................................
.............
20
1.7.2
Two
-
way Conditionals
................................
................................
......................
21
1.7.3
L
ogical operations
-
AND
................................
................................
.................
22
1.7.4
Logical operations
-
OR
................................
................................
...................
23
1.7.5
Loops
................................
................................
................................
...............
24
1.7.6
Function ca
lls
................................
................................
................................
...
25
1.8
Reverse engineering tools
................................
................................
.......................
26
1.8.1
OllyDBG tutorials
................................
................................
.............................
26
1.8.2
IDA Pro tutorials
................................
................................
...............................
26