AssemblyX86-crashcourse

A Quick intro to assembly X86 , with important notes and resources ASSEMBLY X86

assembly we can consider its a mid level language between human and machine languages , if you reverse engineer or a malware analyst you should learn assembly to able to read and understand the code .

"note each cpu archticture has its own assembly instruction here is the basics of Intel 32 arch assembly 86"

in this article just a quick intro to it and some important notes .

the flow of assembly language to excute is :

sourcecode ➡ assembler make objectcode("machine language") ➡ linker make it exe ➡ os loader get it in output when we run it

registers

registers is small unit in cpu , they are used to store data and instructions that the CPU needs to access quickly , there is general purpose refisters , flags and segment registers

general purpose refisters:

4bytes	2bytes	notes
eax	ax	store value
ecx	cx	counte "looping"
edx	dx	i/o pointer
ebx	bx	base pointer
esp	sp	STACK pointer
ebp	bp	STACK base pointer for local variables1
esi	si	SOURCE
edi	di	DESTINATION

flags:

EIP //NEXT INSTRUCTION POINTER

Stack

stack memory is a type of memory that stores data in a Last In First Out (LIFO) format. It is a special type of memory that is used to store local variables and function parameters when a program is running. It is also used to store return addresses when functions are called. Stack memory is allocated and released very efficiently, making it the most efficient type of memory for storing temporary data .

stack (LIFO)last in first out , stack used 2 instructions PUSH AND POP : push its put data and pop get data out

asm instructions

---

there is two syntax to write asm86 instruction (opcode) we will foucus on the intel syntax

instruction destination, source

it takes the source from the right side put in the left side , like = operaton in high lvl programming language

also its not always can be like this it can be instructionOnly and instruction destination

instructionOnly

like nop "no operation"

instruction dedestination

like inc,dec,push,pop,etc...

destination could be

1-register eax ,edx,...

2-place in memory DWORD [1254554566 this example number]...

memory in assembly has diffrent sizes from :

byte "8 bit"

word "16 bit"

dword "32 bit"

qword "64 bit"

and increment the same as above

3-Acess STACK

source could be

same like dest or immediate value "just a number or value"

note some times [0123345 this just example number ] means get the get the value of the address

---

we can put assembly in 3 categories

data manipulation

ADD,SUB,MUL,DIV,NEG,INC,DEC

OR,XOR,AND,NOT

SHL,SHR,ROL,ROR

data transfer

MOV,MOVZX,MOVSX "mov data form src to dst"

XCHG "Replace data"

PUSH,POP,PUSHAD,POPAD

MOVSB,LODSB,STOSB

program control is two cases :

1-unconditional JMP, "" CALL,RET "call and return function"

2-conditional JNZ,JZ,JCC...,LOOP "like if , if else , else , and loop"

---

Resources to learn assembly x86

watch it first

Arabic dr ahmed sallam

Arabic shell code with assembly

English articles one of best resources (64 bit) 1 2 3 4 5