Assembly Instructions

What is the assembly language? As a reverse you will be seeing the most of assembly language. In general you will be examining the disassembly of an application. This means looking at direct instructions that the processor is following. At the end of the day all computer languages are translated down to assembler.

Most instructions in the assembly language have an operation code followed by two operands. However there can be more or less operands depending on the operation code used. Operation code is also known as opcode. These are similar to the syntaxes you may use in other programming languages except that these are direct instructions to your processor. These instructions are also known as mnemnics. Bear in mind that mnmonics are just earlier words that you can remember. They are actually translated from bytes that a processor reads. All values in the assembly language's mnmonics are always hexadecimal.

A typical instruction would be in the form:
OPCODE DESTINATION, SOURCE

Now then i briefly mentioned before about jumping. There are 2 types of jumps conditional jumps and non conditional jumps. Non conditional jumps will lead to a jump no matter what. A jump will let you skip the code and take execution elsewhere. This opcode for non conditional jump is JMP. For example i want to jump to 004000000, this would be the instruction.

JMP 004000000

There are many, many conditional jumps so I have bolded the ones that you will meet most frequently (this is not a full list)




MOV - This is the move instruction. It willt ake two operands and operate on them. You may think of it as copying instead of moving since the operand copied from does not lose its value. The operands that are available are registers, addresses or values.

MOV DESTINATION, SOURCE

The following instructinos would be available:

MOV X, Y; Move Y to X
MOV X, [Y]; Moves what is stored in Y to X
MOV [X], Y; Movie the value of Y into X's value

When there are squre brackets such as [X], then it means the contents of X.

CMP - Compares the two operands and sets C/O/Z flags accordingly

CMP DESTINATION, SOURCE

For example, this instruction:
CMP, EAX[400000]; Compares EAX with the value held at 400000

INC - Increments the value.

For example, this instruction
INC EAX; increases the value of EAX by 1

DEC - Decrements the value
For example
DEC EAX, Decreases teh value of EAX by 1

ADD - Add two operands. The result is stored in teh destination address/register
ADD DESTINATION, SOURCE

ADD EAX 5; adds 5 to teh value of EAX and stores the result in EAX

SUB - Subtracts teh source from destination and stores the result in destination address/register
SUB DESTINATION, SOURCE

SUB EAX,5; Subtracts 5 from EAX and stores the result in EAX

[b]CALL - Pushes a RVA (Relative Virtual Address) of an instruction on the the memory stack and calls a sub program/procedure/function.

You can call with the following methods.

CALL 40000; Call an address
CALL EAX; Call 3register
CALL DWORD PTR[EAX]; Call the address stored at EAX
CALL DWORD PTR[EAX+5]; Call address stored at [EAX+5], notice you can do small calculations.

DIV - DIV divides EAX by a divisor. The divident is EAX as is the where the result is stored. The modulo-value is stored in EDX, ie. the reminder

example

MOV EAX,9
MOV ECX,2
DIV ECX

EAX would end up holding 4 and EDX, 1 because 9-(4*2)

IDIV - The same as DIV except it can handle signed numbers. A signed number means that it can be positive or negetive. The I is an abbreviation for interger (division)


MUL - Multiples either EAX with a value or multiplies two values and puts them into a destination register or it multiplies a register with a value
Example

MUL VALUE
MUL DESTINATION,VALUE,VALUE
MUL DESTINATION,VALUE

IMUL - Interget multiplication, the same as MUL except you can use signed numbers.

INT - Calls an interrupt handler. The value called must be an integer.

example

INT 21

LEA - Load effective address. usually used for doing calculations for addresses quickly.
example

LEA EAX,DWORD PTR(2*EBX-ECX)
Would give EAX the value of 2*EBX-ECX

NOP - No operation. Does nothing, literally. We often use this to overwrite calls, so that instead of that call or instruction, nothing will happen

RET - Returns after a CALL instruction. The return digit cleans teh stack before returning.

Example
RET 4

TEST - performs the logical AND instructin on two operands and results are used to set or clear Z-flag (more on bitwise operators later). Overflow and carry flags are also cleared with this instruction.

example

TEST EAX,EAX

The last two instructions of interest are PUSH and POP but we 've already covered those to a certain extent. Just remember with the stack the first in, last out rule.

I mentioned signed numbers with IDIV and IMUL. You may be wondering how a binary system can negative and positive numbers. One way is to use one of the bits to state whether the number will be positive or negative. Therefore a range of numbers stays the same, the numbers available are not. For example in a 8 bit register there can be 256 different combinations. However the range of the numbers is actually -128-0 and 0-127.


Logical Bitwise Operations.
A bitwise operation is used to operate on one or two bit pattern (set of binary numbers) I will be covering the following bitwise operations:

AND
OR
XOR
NOT

The AND operation will result in 1 only if both corresponding bits are one
(ie. the first one and the second one). Everything else will result in a 0

The OR operation will result in a 1 if either bit has a one
(ie the first one or the second one). Therefore only if the two bits to be operated are zero will the result be a zero.

The XOR operation will result in a 1 only if one of the bits has a one. XOR means exclusive OR which means either one but not both.

The NOT operation will result in a 1 if the bit is a 0 and will become a 0 if it is a 1.

The table below shows all possible combinations for the four bitwise operators described above.

Now then to demonstrate about bitwise operation. I will explain little about ASCII table, ASCII is an encoding system based on the english alphabet.

XOR 1BAAD, SNACK

First of all I would have to use an ASCI table to convert each character into a hexa decimal value

ASCII table can be found in http://www.asciitable.com/