Comp Arch - Lecture 4

Base register; often used as a pointer to data.

Contains the address of the next instruction to be executed.

MOV (move data), ADD (addition), SUB (subtraction), AND (logical AND), OR (logical OR), XOR (logical XOR), CMP (compare)

System V AMD64 ABI and Microsoft x64 calling convention

Buffer overflows, format string vulnerabilities, and integer overflows.

Used to control the flow of execution based on conditions.

Minimize memory access and improve performance.

x64 architecture is widely used in modern desktop, server, and mobile devices.

Accumulator register; used in arithmetic operations and return values.

RIP (Instruction Pointer), RFLAGS (Status Flags)

Base pointer register; used to point to the base of the current stack frame.

Calling conventions are standardized rules for how functions receive arguments and return values.

Analyzing register usage can reveal the program's logic and data manipulation techniques.

Translation Lookaside Buffer (TLB) is a cache for frequently used page table entries.

Adds an offset to the value in a register to access memory.

Used to store status and control bits for system operations.

The registers available and their usage vary across different architectures, affecting portability.

RAX, RBX, RCX, RDX, RSI, RDI, RBP, RSP, R8-R15

Destination index register; used as a pointer to a destination in string operations.

Used for Single Instruction Multiple Data (SIMD) operations, such as vector and parallel processing.

PUSH decrements RSP and then writes data onto the stack; POP reads data from the stack and then increments RSP.

Context switching involves saving the state of the current process (including register values) and loading the state of another process.

Reverse engineering involves analyzing compiled code to understand its functionality.

Uses the value in a register as a pointer to the memory location.

Paging is a memory management technique where memory is divided into fixed-size pages.

Used to implement just-in-time (JIT) compilation, where code is generated at runtime.

RDI, RSI, RDX, RCX, R8, R9

Source index register; used as a pointer to a source in string operations.

Register allocation is the process of assigning registers to hold variables and intermediate values during compilation.

AND, OR, XOR, NOT, SHL (shift left), SHR (shift right), ROL (rotate left), ROR (rotate right)

Used for exception handling and interrupt handling.

Instructions operate on registers to perform arithmetic, logical, and data transfer operations.

Segment registers (CS, DS, SS, ES, FS, GS) are used to point to these segments.

Used for passing arguments to functions and storing return values.

Data register; used in I/O operations and some arithmetic instructions.

RBX, RBP, R12-R15, RSP

Bitwise operations manipulate individual bits within registers.

Assembly language programming, compiler design, and reverse engineering.

Segmentation is a memory management technique where memory is divided into logical segments.

The CALL instruction pushes the return address onto the stack, and the RET instruction pops the return address from the stack.

General-purpose registers used for integer arithmetic and data manipulation.

XMM0-XMM15

RAX, RCX, RDX, RSI, RDI, R8-R11

Profile the code to identify performance bottlenecks, and then optimize register usage in those areas.

The stack grows downward (towards lower memory addresses).

CALL (call a subroutine) and RET (return from a subroutine).

Debugging tools (e.g., GDB, WinDbg) allow you to inspect register values and track program execution.

Used to store metadata about objects, such as their type and size.

Registers can be accessed in different sizes: 64-bit (e.g., RAX), 32-bit (e.g., EAX), 16-bit (e.g., AX), and 8-bit (e.g., AL, AH).

Caller-saved registers must be saved by the calling function if their values need to be preserved after the call. Callee-saved registers must be saved by the called function before they are modified, and restored before returning.

RSP (Stack Pointer)

JE (jump if equal), JNE (jump if not equal), JG (jump if greater), JL (jump if less)

Optimizing code involves using registers efficiently to reduce memory access and improve performance.

Used to store function pointers (addresses of functions).

Registers R8 through R15; additional general-purpose registers.

Uses the value in a register as the operand.

The stack is used to store local variables, return addresses, and to pass additional arguments to functions.

Multimedia eXtensions, Streaming SIMD Extensions, Advanced Vector Extensions

Understanding register usage is critical for optimizing code and debugging issues.

Stack pointer register; points to the top of the stack.

Specifies the memory address directly within the instruction.

RAX

x64 registers are essential for efficient code execution, memory management, and system-level operations.

MMX, SSE, AVX

Used for low-level tasks such as manipulating hardware registers and implementing cryptographic algorithms.

Counter register; used in loops and string operations.

Contains status flags (e.g., zero, carry, overflow) that reflect the result of the most recent arithmetic or logical operation.

Direct addressing, register addressing, indirect addressing, indexed addressing.

Registers and stack

Graph coloring algorithms and linear scan allocation.

Writing secure code involves careful handling of register values and memory addresses to prevent exploits.

CMP (compare) sets flags in the RFLAGS register, which are then used by conditional jump instructions (e.g., JE, JNE, JG, JL).

AH refers to the high byte of the AX register.

Segment registers (CS, DS, SS, ES, FS, GS) define memory segments.

Destination Index; also used for string operations.

AL refers to the low byte of the AX register.

General-purpose registers used for arithmetic and data manipulation.

Code Segment; points to the segment containing the current program code.

Stack Pointer; points to the top of the stack.

32-bit registers (e.g., EAX) are extended versions of 16-bit registers (e.g., AX).

Source Index; used for string operations.

16-bit registers (e.g., AX) can be further divided into 8-bit registers (e.g., AH and AL).

Often used to store function return values.

Extra Segment registers; can be used to point to additional data segments.

Used as a counter in loops and string operations.

Base Pointer; points to the base of the stack frame.

The register that holds the address of the next instruction to be executed.

Instruction Pointer; points to the next instruction to be executed.

Contains flags that indicate the result of operations (e.g., zero, carry).

Data Segment; points to the segment containing data.

Used for addressing memory locations.

Stack Segment; points to the segment containing the stack.

The base and index registers are added to give the segment offset of where the operand is located

Gives status of the last instruction and the processor

Assembly instructions are not case sensitive, comments are preceded by ';', no terminating character, code should be heavily commented

Understand how computers execute code, understand what optimizations the compiler performs, reverse engineer a piece of software, improve efficiency of a program, write programs that have direct control over system hardware

Single memory reference to access data

Overflow, Direction, Interrupt enable, Trace (trap), Sign, Zero, Auxiliary Carry, Parity, Carry

Operand is located at the address given by adding 8 or 16 bit displacement to either Sl or DI and combing the result with a segment register

DS (Data), CS (Code), SS (Stack), ES (Extra), IP (Instruction Pointer)

Displays the disassembly starting from the net instruction to be executed

Registers, ALU, Control Unit, Execution Unit, etc

Immediate data is coded directly in the instruction's machine code

Operand is located at the address given by adding 8 or 16 bit displacement to either BX or BP and combing the result with a segment register

Displays a list of usable commands

Step through the code one line at a time, allowing you to see the CPU state at any point

Arithmetic, logical, and other operations

Go up a level in the folder hierarchy

CPU state is visible and accessible to the program, all CPU state is stored in its register file, i.e. the memory on the CPU

8086 (1979): 20-bit address bus and 16-bit data bus, 80386 (1985): 32-bit address bus and 32-bit data bus, Pentium (1993): 32-bit address bus and 64-bit data bus

Immediate, register, direct, register indirect, based, indexed, based indexed, string, and port addressing

Uses a register instead of a constant to specify the 16-bit offset address of the operand

Run program Prog.exe (must be in your current directory)

Jumps to a line of code in the program

Bus Interface Unit (BIU), Execution Unit (EU)

Specify the method for finding the memory address of an operand

Change directory to the folder called 'FolderName' in your current directory

Objects of different types are declared and allocated memory, memory is accessed by accessing the objects, local variables used to store temporary values, CPU state is hidden from programmer, object type defines what operations can be performed, single statement can perform a complex task

Assembly (human readable, not executable), machine code (binary, executable)

Constant integer (8, 16, or 32 bits), name of a register is specified, reference to a location in memory

Address space is very limited

The I/O ports may be addressed by a byte sized constant, limited to I/O ports in the range 0 to 255

Dumps a section of memory

VERY close to machine code, human-readable encoding of machine code, each instruction corresponds to a machine instruction, not readable by machine (needs to be assembled)

Maintaining the stack

Only a small address field is needed in instruction, no memory references are required

Strings may be up to 64KB in length, string addressing modes uses SI, DI, DS, and ES registers

masm programName.asm (hit enter 4 times), link programName (hit enter 4 times), programName.exe

Translate HLL program to assembly code, assemble assembly code to machine code, link object code with runtime library, yields an executable

Addressing and string operations

Previous command

The set of instructions (and their encodings) that a processor can execute

Four 16-bit registers, eight 8-bit registers

Limited address space

Display contents of current directory, one page at a time

Scrolls through available files/directories that begin with whatever you have started typing

IA32 (aka i386/i486/Pentium)

Base Pointer (BP), Stack Pointer (SP), Destination Index (DI), Source Index (SI)