2021-07-10 · 4분
This post is over 2 years old. The content may be outdated.
Registers: the CPU's variables
- General-purpose register: a kind of variable used by the CPU
- EAX
Does arithmetic calculations and delivers the return value.
It's the most frequently used variable.
- EDX
Multiplication or division of large numbers
- ECX
C: it's Counter.
It plays the role of the counter in loops — the i++ of a for loop — but it works only in the form of storing the value for as many iterations as the loop runs and then decrementing.
- EBX
A kind of variable like EAX, EDX, ECX
- ESI
Used to process strings or various repeated data, or to move memory.
- EDI
A kind of variable
ESI is the source index, EDI is the destination index
[Algorithm/Data structure] - Stack
Stack BOJ #10828 stack problem: https://www.acmicpc.net/problem/10828 What is a stack? A stack is a list structure with restricted access. It's a LIFO (Last In First Out) format where you can insert and remove data only from one end.. — nabomhalang.tistory.com
You need to know the stack.
- ESP: stack pointer
A pointer holding the address of the end point of the stack frame
- EBP: base pointer
A pointer holding the first start address of the stack frame
- EIP: instruction pointer
A pointer to the address of the instruction to be executed next
Endian refers to the method of arranging multiple consecutive objects in a one-dimensional space like computer memory; the method of arranging bytes is called byte order.
Endianness can usually be divided into big-endian, where the larger unit comes first, and little-endian, where the smaller unit comes first; something that belongs to neither or supports both is sometimes called middle-endian.
offset: use square brackets when referencing a specific memory address.
Notation for a memory address 4 away from eax: [eax+4]
mov a, b: put b into a. (a = b)
mov [ecx], eax : *ecx = eax
add a, b: increase a by b (a += b)
sub a, b: decrease a by b (a -= b)
mul a : eax(ax, ah, al) *= a
div a: eax(ax, ah, al) /= a
imul a, b : a *= b
idiv a, b : a /= b
lea a, [b] : put [b] into a. (a = [b]) The difference from mov — mov assigns the value, lea assigns the address
push a: push a onto the stack (esp -= 4)
pop x: pop the value on the stack into a (esp += 4)
Inc a : a++
Dec a : a-- neg a : -a not a : ~a nop : an instruction that does nothing (only eip increments to the next)
and a, b : a &= b
or a, b : a |= b
xor a, b : a ^= b
In the case of xor, doing xor eax, eax initializes eax to 0.
shl a, b : a << b
shr a, b : a >> b
The register set includes flags, which is the status register.
ZF: when the result of such an instruction's operation is 0, the ZF flag becomes 1
operation result == 0 -> 'false' -> ZF: 1
operation result != 0 -> 'true' -> ZF: 0
CF: in an unsigned operation, when a bit carry or bit borrow occurs, CF becomes 1
SF: in a signed operation, when the result is positive — that is, when the most significant bit is 0 — SF = 0, otherwise 1
OF: the role of CF in a signed operation (overflow flag)
call location: an instruction that calls a function; func is the function's address
call: push eip; jmp func
push eip: pushes the address to return to after the function call; this eip is called the (RET) Return address.
jmp location: moves eip to location
Work to release the stack frame
Work to return to the point that first called the function when the function ends
- leave
mov esp, ebp: sets esp equal to ebp (restoring the initial value from when the function started)
pop ebp: changes it back to the original ebp value
- ret
pop eip: brings back the very eip that was pushed with push eip during call
jmp eip: moves to the eip location from before the call
!> ****](https://nabomhalang.tistory.com/entry/%EB%A6%AC%EB%B2%84%EC%8B%B1-%EC%8A%A4%ED%83%9D%ED%94%84%EB%A0%88%EC%9E%84%EC%9D%B4%EB%9E%80)
Additional: [Hacking/Reversing] - [Reversing] What is a stack frame..? [[Reversing] What is a stack frame..? What's the stack frame? A stack frame is a region created to distinguish a function's own stack area when that function is called. This space holds the local variables related to the function — nabomhalang.tistory.com
Source
https://ko.wikipedia.org/wiki/%EC%97%94%EB%94%94%EC%96%B8
Original (Korean): tistory — published 2021-07-10, migrated to this blog. This translation was generated with the help of AI.
…
