SlideShare une entreprise Scribd logo
1  sur  19
The lost art of AssemblyThe lost art of Assembly
I have learned Assembly 3 times :)
http://www.atmel.com/webdoc/avrassembler/avrassembler.wb_instruction_list.html
I have learned Assembly 3 times :)
I have learned Assembly 3 times :)
I have learned Assembly 3 times :)
Why Assembly?
Registers
EIP - Instruction Pointer
ESP - Stack Pointer
EBP - Frame base pointer (function base pointer)
EAX - RAX (sometimes counter)
EBX - RBX
ECX - RBX
ESI - RSI (source)
EDI - RDI (destination)
Registers
EXX - 32bit RXX - 64bit
XMM - 128bit YMM - 256bit ZMM - 512bit
AVX
512 - 256 ZMM0 - ZMM31
255 - 128 YMM0 - YMM31
127 - 0 XMM0 - XMM31
https://software.intel.com/en-us/isa-extensions
https://software.intel.com/en-us/blogs/2013/avx-512-instructions
Basic instructions
● mov
● add
● jumps
– jcc
– jle
– jne
● int
– call
– ret
int 0x80 Definition
int 0x80 is the assembly language instruction that
is used to invoke system calls in Linux on x86
(i.e., Intel-compatible) processors.
http://www.linfo.org/int_0x80.html
Assembly vs. Disassemby :)
section .data
msg db "Hello, world!", 0x0a
section .text
global _start
_start:
; SYSCALL: write(1, msg, 14)
mov eax, 4
mov ebx, 1
mov ecx, msg
mov edx, 14
int 0x80
; SYSCALL: exit(0)
mov eax, 1
mov ebx, 0
int 0x80
Disassembly of section .text:
08048080 <_start>:
8048080: b8 04 00 00 00 mov eax,0x4
8048085: bb 01 00 00 00 mov ebx,0x1
804808a: b9 a4 90 04 08 mov ecx,0x80490a4
804808f: ba 0e 00 00 00 mov edx,0xe
8048094: cd 80 int 0x80
8048096: b8 01 00 00 00 mov eax,0x1
804809b: bb 00 00 00 00 mov ebx,0x0
80480a0: cd 80 int 0x80
Disassembly of section .data:
080490a4 <msg>:
80490a4: 48 dec eax
80490a5: 65 6c gs ins BYTE PTR es:[edi],dx
80490a7: 6c ins BYTE PTR es:[edi],dx
80490a8: 6f outs dx,DWORD PTR ds:[esi]
80490a9: 2c 20 sub al,0x20
80490ab: 77 6f ja 804911c <_end+0x68>
80490ad: 72 6c jb 804911b <_end+0x67>
80490af: 64 21 0a and DWORD PTR fs:[edx],ecx
48 65 6c 6c 6f 2c 20 77 6f 72 6c 64 21 0a = Hello, world!
https://www.rapidtables.com/convert/number/hex-to-ascii.html
DEMO time
The ELF format
● Executable and Linkable Format
● 4bytes magic number
● 32/64bit binary
● instruction set architecture
● interpreter for the program
https://en.wikipedia.org/wiki/Executable_and_Linkable_Format
http://www.skyfree.org/linux/references/ELF_Format.pdf
readelf
Section Headers:
[Nr] Name Type Addr Off Size ES Flg Lk Inf Al
[ 0] NULL 00000000 000000 000000 00 0 0 0
[ 1] .interp PROGBITS 08048134 000134 000013 00 A 0 0 1
[ 2] .note.ABI-tag NOTE 08048148 000148 000020 00 A 0 0 4
[ 3] .hash HASH 08048168 000168 000028 04 A 4 0 4
[ 4] .dynsym DYNSYM 08048190 000190 000050 10 A 5 1 4
[ 5] .dynstr STRTAB 080481e0 0001e0 00004a 00 A 0 0 1
[ 6] .gnu.version VERSYM 0804822a 00022a 00000a 02 A 4 0 2
[ 7] .gnu.version_r VERNEED 08048234 000234 000020 00 A 5 1 4
[ 8] .rel.dyn REL 08048254 000254 000008 08 A 4 0 4
[ 9] .rel.plt REL 0804825c 00025c 000010 08 AI 4 23 4
[10] .init PROGBITS 0804826c 00026c 00002d 00 AX 0 0 4
[11] .plt PROGBITS 080482a0 0002a0 000030 04 AX 0 0 16
[12] .plt.got PROGBITS 080482d0 0002d0 000008 00 AX 0 0 8
[13] .text PROGBITS 080482e0 0002e0 000220 00 AX 0 0 16
[15] .rodata PROGBITS 0804851c 00051c 000016 00 A 0 0 4
[24] .data PROGBITS 08049710 000710 000008 00 WA 0 0 4
[25] .bss NOBITS 08049718 000718 000008 00 WA 0 0 4
https://greek0.net/elf.html
objdump$ objdump -d -m intel hello-asm
Disassembly of section .text:
08048080 <_start>:
8048080: b8 04 00 00 00 mov eax,0x4
8048085: bb 01 00 00 00 mov ebx,0x1
804808a: b9 a4 90 04 08 mov ecx,0x80490a4
804808f: ba 0e 00 00 00 mov edx,0xe
8048094: cd 80 int 0x80
8048096: b8 01 00 00 00 mov eax,0x1
804809b: bb 00 00 00 00 mov ebx,0x0
80480a0: cd 80 int 0x80
Disassembly of section .data:
080490a4 <msg>:
80490a4: 48 dec eax
80490a5: 65 6c gs ins BYTE PTR es:[edi],dx
80490a7: 6c ins BYTE PTR es:[edi],dx
80490a8: 6f outs dx,DWORD PTR ds:[esi]
80490a9: 2c 20 sub al,0x20
80490ab: 77 6f ja 804911c <_end+0x68>
80490ad: 72 6c jb 804911b <_end+0x67>
80490af: 64 21 0a and DWORD PTR fs:[edx],ecx
Builds :)
hello-dbg-asm: hello.asm
nasm -g -f elf hello.asm && ld hello.o -o hello-asm
hello-c-static: hello.c
gcc -static hello.c -o hello-c-static
hello-asm: hello.asm
nasm -f elf hello.asm && ld hello.o -o hello-asm
for1: for.c
gcc for.c -o for1
for2: for.c
gcc -fopt-info-vec for.c -O2 -ftree-vectorize -o for2
for3: for.c
gcc -fopt-info-vec for.c -O3 -o for3
foravx: for.c
gcc -O3 for.c -fopt-info-vec -mavx -o foravx
# gcc -O3 for.c -fopt-info-vec -mavx2 -o foravx
Inline assembly
#define MSG "Hello, world!"
int main() {
asm(
"int $0x80nt"
:
: "a"(4), "b"(1), "c"(MSG),
"d"(14) );
}
Inline assembly
asm(
"int $0x80nt"
:
: "a"(4),"b"(1),"c"(MSG),"d"(14)
);
// a,b,c,d-registers (eax,ebx,ecx & edx)
asm(
“assembly instructions”
: return values
: assignment variables
https://gcc.gnu.org/onlinedocs/gcc/Extended-Asm.html
Thank you!
https://jobs.siteground.bg/

Contenu connexe

Tendances

When Bad Things Come In Good Packages
When Bad Things Come In Good PackagesWhen Bad Things Come In Good Packages
When Bad Things Come In Good PackagesSaumil Shah
 
Gaztea Tech Robotica 2016
Gaztea Tech Robotica 2016Gaztea Tech Robotica 2016
Gaztea Tech Robotica 2016Svet Ivantchev
 
Show Us: SS7 Update
Show Us: SS7 UpdateShow Us: SS7 Update
Show Us: SS7 UpdateESUG
 
Anonymous Remote Arbitrary Code Execution in Alien Arena
Anonymous Remote Arbitrary Code Execution in Alien ArenaAnonymous Remote Arbitrary Code Execution in Alien Arena
Anonymous Remote Arbitrary Code Execution in Alien ArenaJason Geffner
 
Os Practical Assignment 1
Os Practical Assignment 1Os Practical Assignment 1
Os Practical Assignment 1Emmanuel Garcia
 
Hacklu11 Writeup
Hacklu11 WriteupHacklu11 Writeup
Hacklu11 Writeupnkslides
 
Vhdl practical exam guide
Vhdl practical exam guideVhdl practical exam guide
Vhdl practical exam guideEslam Mohammed
 
Oracle Deep Internal 1 (ver.2)
Oracle Deep Internal 1 (ver.2)Oracle Deep Internal 1 (ver.2)
Oracle Deep Internal 1 (ver.2)EXEM
 
Cilk Plus Parallel Reduction
Cilk Plus Parallel ReductionCilk Plus Parallel Reduction
Cilk Plus Parallel ReductionAlbert DeFusco
 
Watching And Manipulating Your Network Traffic
Watching And Manipulating Your Network TrafficWatching And Manipulating Your Network Traffic
Watching And Manipulating Your Network TrafficJosiah Ritchie
 
Oracle Deep Internal 2 (ver.2)
Oracle Deep Internal 2 (ver.2)Oracle Deep Internal 2 (ver.2)
Oracle Deep Internal 2 (ver.2)EXEM
 
Oracle Deep Internal 3 (ver.2)
Oracle Deep Internal 3 (ver.2)Oracle Deep Internal 3 (ver.2)
Oracle Deep Internal 3 (ver.2)EXEM
 
2² C# 4.0 and .NET 4 Selected Features
2² C# 4.0 and .NET 4 Selected Features2² C# 4.0 and .NET 4 Selected Features
2² C# 4.0 and .NET 4 Selected FeaturesMustafa Isik
 
[ODI] chapter2 what is "undo record chaining"?
[ODI] chapter2 what is "undo record chaining"?[ODI] chapter2 what is "undo record chaining"?
[ODI] chapter2 what is "undo record chaining"?EXEM
 
Rich and Snappy Apps (No Scaling Required)
Rich and Snappy Apps (No Scaling Required)Rich and Snappy Apps (No Scaling Required)
Rich and Snappy Apps (No Scaling Required)Thomas Fuchs
 
Exploring the x64
Exploring the x64Exploring the x64
Exploring the x64FFRI, Inc.
 
NTUSTxTDOH - Pwn基礎 2015/12/27
NTUSTxTDOH - Pwn基礎 2015/12/27NTUSTxTDOH - Pwn基礎 2015/12/27
NTUSTxTDOH - Pwn基礎 2015/12/27Sheng-Hao Ma
 

Tendances (18)

When Bad Things Come In Good Packages
When Bad Things Come In Good PackagesWhen Bad Things Come In Good Packages
When Bad Things Come In Good Packages
 
Gaztea Tech Robotica 2016
Gaztea Tech Robotica 2016Gaztea Tech Robotica 2016
Gaztea Tech Robotica 2016
 
Show Us: SS7 Update
Show Us: SS7 UpdateShow Us: SS7 Update
Show Us: SS7 Update
 
ESUG15: SS7 Update
ESUG15: SS7 UpdateESUG15: SS7 Update
ESUG15: SS7 Update
 
Anonymous Remote Arbitrary Code Execution in Alien Arena
Anonymous Remote Arbitrary Code Execution in Alien ArenaAnonymous Remote Arbitrary Code Execution in Alien Arena
Anonymous Remote Arbitrary Code Execution in Alien Arena
 
Os Practical Assignment 1
Os Practical Assignment 1Os Practical Assignment 1
Os Practical Assignment 1
 
Hacklu11 Writeup
Hacklu11 WriteupHacklu11 Writeup
Hacklu11 Writeup
 
Vhdl practical exam guide
Vhdl practical exam guideVhdl practical exam guide
Vhdl practical exam guide
 
Oracle Deep Internal 1 (ver.2)
Oracle Deep Internal 1 (ver.2)Oracle Deep Internal 1 (ver.2)
Oracle Deep Internal 1 (ver.2)
 
Cilk Plus Parallel Reduction
Cilk Plus Parallel ReductionCilk Plus Parallel Reduction
Cilk Plus Parallel Reduction
 
Watching And Manipulating Your Network Traffic
Watching And Manipulating Your Network TrafficWatching And Manipulating Your Network Traffic
Watching And Manipulating Your Network Traffic
 
Oracle Deep Internal 2 (ver.2)
Oracle Deep Internal 2 (ver.2)Oracle Deep Internal 2 (ver.2)
Oracle Deep Internal 2 (ver.2)
 
Oracle Deep Internal 3 (ver.2)
Oracle Deep Internal 3 (ver.2)Oracle Deep Internal 3 (ver.2)
Oracle Deep Internal 3 (ver.2)
 
2² C# 4.0 and .NET 4 Selected Features
2² C# 4.0 and .NET 4 Selected Features2² C# 4.0 and .NET 4 Selected Features
2² C# 4.0 and .NET 4 Selected Features
 
[ODI] chapter2 what is "undo record chaining"?
[ODI] chapter2 what is "undo record chaining"?[ODI] chapter2 what is "undo record chaining"?
[ODI] chapter2 what is "undo record chaining"?
 
Rich and Snappy Apps (No Scaling Required)
Rich and Snappy Apps (No Scaling Required)Rich and Snappy Apps (No Scaling Required)
Rich and Snappy Apps (No Scaling Required)
 
Exploring the x64
Exploring the x64Exploring the x64
Exploring the x64
 
NTUSTxTDOH - Pwn基礎 2015/12/27
NTUSTxTDOH - Pwn基礎 2015/12/27NTUSTxTDOH - Pwn基礎 2015/12/27
NTUSTxTDOH - Pwn基礎 2015/12/27
 

Similaire à The forgotten art of assembly

Windows Debugging with WinDbg
Windows Debugging with WinDbgWindows Debugging with WinDbg
Windows Debugging with WinDbgArno Huetter
 
Symbolic Debugging with DWARF
Symbolic Debugging with DWARFSymbolic Debugging with DWARF
Symbolic Debugging with DWARFSamy Bahra
 
Scale17x buffer overflows
Scale17x buffer overflowsScale17x buffer overflows
Scale17x buffer overflowsjohseg
 
Windows debugging sisimon
Windows debugging   sisimonWindows debugging   sisimon
Windows debugging sisimonSisimon Soman
 
Finding Xori: Malware Analysis Triage with Automated Disassembly
Finding Xori: Malware Analysis Triage with Automated DisassemblyFinding Xori: Malware Analysis Triage with Automated Disassembly
Finding Xori: Malware Analysis Triage with Automated DisassemblyPriyanka Aash
 
Kernel Recipes 2013 - Deciphering Oopsies
Kernel Recipes 2013 - Deciphering OopsiesKernel Recipes 2013 - Deciphering Oopsies
Kernel Recipes 2013 - Deciphering OopsiesAnne Nicolas
 
Аварийный дамп – чёрный ящик упавшей JVM. Андрей Паньгин
Аварийный дамп – чёрный ящик упавшей JVM. Андрей ПаньгинАварийный дамп – чёрный ящик упавшей JVM. Андрей Паньгин
Аварийный дамп – чёрный ящик упавшей JVM. Андрей Паньгинodnoklassniki.ru
 
Advanced Root Cause Analysis
Advanced Root Cause AnalysisAdvanced Root Cause Analysis
Advanced Root Cause AnalysisEric Sloof
 
Secrets of building a debuggable runtime: Learn how language implementors sol...
Secrets of building a debuggable runtime: Learn how language implementors sol...Secrets of building a debuggable runtime: Learn how language implementors sol...
Secrets of building a debuggable runtime: Learn how language implementors sol...Dev_Events
 
Writing Metasploit Plugins
Writing Metasploit PluginsWriting Metasploit Plugins
Writing Metasploit Pluginsamiable_indian
 
Swug July 2010 - windows debugging by sainath
Swug July 2010 - windows debugging by sainathSwug July 2010 - windows debugging by sainath
Swug July 2010 - windows debugging by sainathDennis Chung
 
Fundamentals of Complete Crash and Hang Memory Dump Analysis
Fundamentals of Complete Crash and Hang Memory Dump AnalysisFundamentals of Complete Crash and Hang Memory Dump Analysis
Fundamentals of Complete Crash and Hang Memory Dump AnalysisDmitry Vostokov
 
other-architectures.ppt
other-architectures.pptother-architectures.ppt
other-architectures.pptJaya Chavan
 
Reverse Engineering Dojo: Enhancing Assembly Reading Skills
Reverse Engineering Dojo: Enhancing Assembly Reading SkillsReverse Engineering Dojo: Enhancing Assembly Reading Skills
Reverse Engineering Dojo: Enhancing Assembly Reading SkillsAsuka Nakajima
 
Whose Stack Is It Anyway?
Whose Stack Is It Anyway?Whose Stack Is It Anyway?
Whose Stack Is It Anyway?Ian Thomas
 
How the stack works(1)
How the stack works(1)How the stack works(1)
How the stack works(1)keithrozario
 

Similaire à The forgotten art of assembly (20)

Windows Debugging with WinDbg
Windows Debugging with WinDbgWindows Debugging with WinDbg
Windows Debugging with WinDbg
 
Symbolic Debugging with DWARF
Symbolic Debugging with DWARFSymbolic Debugging with DWARF
Symbolic Debugging with DWARF
 
Scale17x buffer overflows
Scale17x buffer overflowsScale17x buffer overflows
Scale17x buffer overflows
 
Windows debugging sisimon
Windows debugging   sisimonWindows debugging   sisimon
Windows debugging sisimon
 
ARM 64bit has come!
ARM 64bit has come!ARM 64bit has come!
ARM 64bit has come!
 
Finding Xori: Malware Analysis Triage with Automated Disassembly
Finding Xori: Malware Analysis Triage with Automated DisassemblyFinding Xori: Malware Analysis Triage with Automated Disassembly
Finding Xori: Malware Analysis Triage with Automated Disassembly
 
Kernel Recipes 2013 - Deciphering Oopsies
Kernel Recipes 2013 - Deciphering OopsiesKernel Recipes 2013 - Deciphering Oopsies
Kernel Recipes 2013 - Deciphering Oopsies
 
Debugging 2013- Jesper Brouer
Debugging 2013- Jesper BrouerDebugging 2013- Jesper Brouer
Debugging 2013- Jesper Brouer
 
Аварийный дамп – чёрный ящик упавшей JVM. Андрей Паньгин
Аварийный дамп – чёрный ящик упавшей JVM. Андрей ПаньгинАварийный дамп – чёрный ящик упавшей JVM. Андрей Паньгин
Аварийный дамп – чёрный ящик упавшей JVM. Андрей Паньгин
 
Advanced Root Cause Analysis
Advanced Root Cause AnalysisAdvanced Root Cause Analysis
Advanced Root Cause Analysis
 
Analisis_avanzado_vmware
Analisis_avanzado_vmwareAnalisis_avanzado_vmware
Analisis_avanzado_vmware
 
RISC-V Zce Extension
RISC-V Zce ExtensionRISC-V Zce Extension
RISC-V Zce Extension
 
Secrets of building a debuggable runtime: Learn how language implementors sol...
Secrets of building a debuggable runtime: Learn how language implementors sol...Secrets of building a debuggable runtime: Learn how language implementors sol...
Secrets of building a debuggable runtime: Learn how language implementors sol...
 
Writing Metasploit Plugins
Writing Metasploit PluginsWriting Metasploit Plugins
Writing Metasploit Plugins
 
Swug July 2010 - windows debugging by sainath
Swug July 2010 - windows debugging by sainathSwug July 2010 - windows debugging by sainath
Swug July 2010 - windows debugging by sainath
 
Fundamentals of Complete Crash and Hang Memory Dump Analysis
Fundamentals of Complete Crash and Hang Memory Dump AnalysisFundamentals of Complete Crash and Hang Memory Dump Analysis
Fundamentals of Complete Crash and Hang Memory Dump Analysis
 
other-architectures.ppt
other-architectures.pptother-architectures.ppt
other-architectures.ppt
 
Reverse Engineering Dojo: Enhancing Assembly Reading Skills
Reverse Engineering Dojo: Enhancing Assembly Reading SkillsReverse Engineering Dojo: Enhancing Assembly Reading Skills
Reverse Engineering Dojo: Enhancing Assembly Reading Skills
 
Whose Stack Is It Anyway?
Whose Stack Is It Anyway?Whose Stack Is It Anyway?
Whose Stack Is It Anyway?
 
How the stack works(1)
How the stack works(1)How the stack works(1)
How the stack works(1)
 

Plus de Marian Marinov

Dev.bg DevOps March 2024 Monitoring & Logging
Dev.bg DevOps March 2024 Monitoring & LoggingDev.bg DevOps March 2024 Monitoring & Logging
Dev.bg DevOps March 2024 Monitoring & LoggingMarian Marinov
 
Basic presentation of cryptography mechanisms
Basic presentation of cryptography mechanismsBasic presentation of cryptography mechanisms
Basic presentation of cryptography mechanismsMarian Marinov
 
Microservices: Benefits, drawbacks and are they for me?
Microservices: Benefits, drawbacks and are they for me?Microservices: Benefits, drawbacks and are they for me?
Microservices: Benefits, drawbacks and are they for me?Marian Marinov
 
Introduction and replication to DragonflyDB
Introduction and replication to DragonflyDBIntroduction and replication to DragonflyDB
Introduction and replication to DragonflyDBMarian Marinov
 
Message Queuing - Gearman, Mosquitto, Kafka and RabbitMQ
Message Queuing - Gearman, Mosquitto, Kafka and RabbitMQMessage Queuing - Gearman, Mosquitto, Kafka and RabbitMQ
Message Queuing - Gearman, Mosquitto, Kafka and RabbitMQMarian Marinov
 
How to successfully migrate to DevOps .pdf
How to successfully migrate to DevOps .pdfHow to successfully migrate to DevOps .pdf
How to successfully migrate to DevOps .pdfMarian Marinov
 
How to survive in the work from home era
How to survive in the work from home eraHow to survive in the work from home era
How to survive in the work from home eraMarian Marinov
 
Improve your storage with bcachefs
Improve your storage with bcachefsImprove your storage with bcachefs
Improve your storage with bcachefsMarian Marinov
 
Control your service resources with systemd
 Control your service resources with systemd  Control your service resources with systemd
Control your service resources with systemd Marian Marinov
 
Comparison of-foss-distributed-storage
Comparison of-foss-distributed-storageComparison of-foss-distributed-storage
Comparison of-foss-distributed-storageMarian Marinov
 
Защо и как да обогатяваме знанията си?
Защо и как да обогатяваме знанията си?Защо и как да обогатяваме знанията си?
Защо и как да обогатяваме знанията си?Marian Marinov
 
Securing your MySQL server
Securing your MySQL serverSecuring your MySQL server
Securing your MySQL serverMarian Marinov
 
DoS and DDoS mitigations with eBPF, XDP and DPDK
DoS and DDoS mitigations with eBPF, XDP and DPDKDoS and DDoS mitigations with eBPF, XDP and DPDK
DoS and DDoS mitigations with eBPF, XDP and DPDKMarian Marinov
 
Challenges with high density networks
Challenges with high density networksChallenges with high density networks
Challenges with high density networksMarian Marinov
 
SiteGround building automation
SiteGround building automationSiteGround building automation
SiteGround building automationMarian Marinov
 
Preventing cpu side channel attacks with kernel tracking
Preventing cpu side channel attacks with kernel trackingPreventing cpu side channel attacks with kernel tracking
Preventing cpu side channel attacks with kernel trackingMarian Marinov
 
Managing a lot of servers
Managing a lot of serversManaging a lot of servers
Managing a lot of serversMarian Marinov
 
Let's Encrypt failures
Let's Encrypt failuresLet's Encrypt failures
Let's Encrypt failuresMarian Marinov
 

Plus de Marian Marinov (20)

Dev.bg DevOps March 2024 Monitoring & Logging
Dev.bg DevOps March 2024 Monitoring & LoggingDev.bg DevOps March 2024 Monitoring & Logging
Dev.bg DevOps March 2024 Monitoring & Logging
 
Basic presentation of cryptography mechanisms
Basic presentation of cryptography mechanismsBasic presentation of cryptography mechanisms
Basic presentation of cryptography mechanisms
 
Microservices: Benefits, drawbacks and are they for me?
Microservices: Benefits, drawbacks and are they for me?Microservices: Benefits, drawbacks and are they for me?
Microservices: Benefits, drawbacks and are they for me?
 
Introduction and replication to DragonflyDB
Introduction and replication to DragonflyDBIntroduction and replication to DragonflyDB
Introduction and replication to DragonflyDB
 
Message Queuing - Gearman, Mosquitto, Kafka and RabbitMQ
Message Queuing - Gearman, Mosquitto, Kafka and RabbitMQMessage Queuing - Gearman, Mosquitto, Kafka and RabbitMQ
Message Queuing - Gearman, Mosquitto, Kafka and RabbitMQ
 
How to successfully migrate to DevOps .pdf
How to successfully migrate to DevOps .pdfHow to successfully migrate to DevOps .pdf
How to successfully migrate to DevOps .pdf
 
How to survive in the work from home era
How to survive in the work from home eraHow to survive in the work from home era
How to survive in the work from home era
 
Managing sysadmins
Managing sysadminsManaging sysadmins
Managing sysadmins
 
Improve your storage with bcachefs
Improve your storage with bcachefsImprove your storage with bcachefs
Improve your storage with bcachefs
 
Control your service resources with systemd
 Control your service resources with systemd  Control your service resources with systemd
Control your service resources with systemd
 
Comparison of-foss-distributed-storage
Comparison of-foss-distributed-storageComparison of-foss-distributed-storage
Comparison of-foss-distributed-storage
 
Защо и как да обогатяваме знанията си?
Защо и как да обогатяваме знанията си?Защо и как да обогатяваме знанията си?
Защо и как да обогатяваме знанията си?
 
Securing your MySQL server
Securing your MySQL serverSecuring your MySQL server
Securing your MySQL server
 
Sysadmin vs. dev ops
Sysadmin vs. dev opsSysadmin vs. dev ops
Sysadmin vs. dev ops
 
DoS and DDoS mitigations with eBPF, XDP and DPDK
DoS and DDoS mitigations with eBPF, XDP and DPDKDoS and DDoS mitigations with eBPF, XDP and DPDK
DoS and DDoS mitigations with eBPF, XDP and DPDK
 
Challenges with high density networks
Challenges with high density networksChallenges with high density networks
Challenges with high density networks
 
SiteGround building automation
SiteGround building automationSiteGround building automation
SiteGround building automation
 
Preventing cpu side channel attacks with kernel tracking
Preventing cpu side channel attacks with kernel trackingPreventing cpu side channel attacks with kernel tracking
Preventing cpu side channel attacks with kernel tracking
 
Managing a lot of servers
Managing a lot of serversManaging a lot of servers
Managing a lot of servers
 
Let's Encrypt failures
Let's Encrypt failuresLet's Encrypt failures
Let's Encrypt failures
 

Dernier

Call for Papers - Educational Administration: Theory and Practice, E-ISSN: 21...
Call for Papers - Educational Administration: Theory and Practice, E-ISSN: 21...Call for Papers - Educational Administration: Theory and Practice, E-ISSN: 21...
Call for Papers - Educational Administration: Theory and Practice, E-ISSN: 21...Christo Ananth
 
(PRIYA) Rajgurunagar Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...
(PRIYA) Rajgurunagar Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...(PRIYA) Rajgurunagar Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...
(PRIYA) Rajgurunagar Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...ranjana rawat
 
College Call Girls Nashik Nehal 7001305949 Independent Escort Service Nashik
College Call Girls Nashik Nehal 7001305949 Independent Escort Service NashikCollege Call Girls Nashik Nehal 7001305949 Independent Escort Service Nashik
College Call Girls Nashik Nehal 7001305949 Independent Escort Service NashikCall Girls in Nagpur High Profile
 
Extrusion Processes and Their Limitations
Extrusion Processes and Their LimitationsExtrusion Processes and Their Limitations
Extrusion Processes and Their Limitations120cr0395
 
Top Rated Pune Call Girls Budhwar Peth ⟟ 6297143586 ⟟ Call Me For Genuine Se...
Top Rated  Pune Call Girls Budhwar Peth ⟟ 6297143586 ⟟ Call Me For Genuine Se...Top Rated  Pune Call Girls Budhwar Peth ⟟ 6297143586 ⟟ Call Me For Genuine Se...
Top Rated Pune Call Girls Budhwar Peth ⟟ 6297143586 ⟟ Call Me For Genuine Se...Call Girls in Nagpur High Profile
 
Processing & Properties of Floor and Wall Tiles.pptx
Processing & Properties of Floor and Wall Tiles.pptxProcessing & Properties of Floor and Wall Tiles.pptx
Processing & Properties of Floor and Wall Tiles.pptxpranjaldaimarysona
 
(SHREYA) Chakan Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Esc...
(SHREYA) Chakan Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Esc...(SHREYA) Chakan Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Esc...
(SHREYA) Chakan Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Esc...ranjana rawat
 
UNIT-III FMM. DIMENSIONAL ANALYSIS
UNIT-III FMM.        DIMENSIONAL ANALYSISUNIT-III FMM.        DIMENSIONAL ANALYSIS
UNIT-III FMM. DIMENSIONAL ANALYSISrknatarajan
 
ONLINE FOOD ORDER SYSTEM PROJECT REPORT.pdf
ONLINE FOOD ORDER SYSTEM PROJECT REPORT.pdfONLINE FOOD ORDER SYSTEM PROJECT REPORT.pdf
ONLINE FOOD ORDER SYSTEM PROJECT REPORT.pdfKamal Acharya
 
Introduction to IEEE STANDARDS and its different types.pptx
Introduction to IEEE STANDARDS and its different types.pptxIntroduction to IEEE STANDARDS and its different types.pptx
Introduction to IEEE STANDARDS and its different types.pptxupamatechverse
 
CCS335 _ Neural Networks and Deep Learning Laboratory_Lab Complete Record
CCS335 _ Neural Networks and Deep Learning Laboratory_Lab Complete RecordCCS335 _ Neural Networks and Deep Learning Laboratory_Lab Complete Record
CCS335 _ Neural Networks and Deep Learning Laboratory_Lab Complete RecordAsst.prof M.Gokilavani
 
result management system report for college project
result management system report for college projectresult management system report for college project
result management system report for college projectTonystark477637
 
KubeKraft presentation @CloudNativeHooghly
KubeKraft presentation @CloudNativeHooghlyKubeKraft presentation @CloudNativeHooghly
KubeKraft presentation @CloudNativeHooghlysanyuktamishra911
 
VIP Call Girls Ankleshwar 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Ankleshwar 7001035870 Whatsapp Number, 24/07 BookingVIP Call Girls Ankleshwar 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Ankleshwar 7001035870 Whatsapp Number, 24/07 Bookingdharasingh5698
 
Introduction to Multiple Access Protocol.pptx
Introduction to Multiple Access Protocol.pptxIntroduction to Multiple Access Protocol.pptx
Introduction to Multiple Access Protocol.pptxupamatechverse
 
Booking open Available Pune Call Girls Koregaon Park 6297143586 Call Hot Ind...
Booking open Available Pune Call Girls Koregaon Park  6297143586 Call Hot Ind...Booking open Available Pune Call Girls Koregaon Park  6297143586 Call Hot Ind...
Booking open Available Pune Call Girls Koregaon Park 6297143586 Call Hot Ind...Call Girls in Nagpur High Profile
 
Call Girls Pimpri Chinchwad Call Me 7737669865 Budget Friendly No Advance Boo...
Call Girls Pimpri Chinchwad Call Me 7737669865 Budget Friendly No Advance Boo...Call Girls Pimpri Chinchwad Call Me 7737669865 Budget Friendly No Advance Boo...
Call Girls Pimpri Chinchwad Call Me 7737669865 Budget Friendly No Advance Boo...roncy bisnoi
 
(ANVI) Koregaon Park Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...
(ANVI) Koregaon Park Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...(ANVI) Koregaon Park Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...
(ANVI) Koregaon Park Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...ranjana rawat
 

Dernier (20)

Call for Papers - Educational Administration: Theory and Practice, E-ISSN: 21...
Call for Papers - Educational Administration: Theory and Practice, E-ISSN: 21...Call for Papers - Educational Administration: Theory and Practice, E-ISSN: 21...
Call for Papers - Educational Administration: Theory and Practice, E-ISSN: 21...
 
(PRIYA) Rajgurunagar Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...
(PRIYA) Rajgurunagar Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...(PRIYA) Rajgurunagar Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...
(PRIYA) Rajgurunagar Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...
 
College Call Girls Nashik Nehal 7001305949 Independent Escort Service Nashik
College Call Girls Nashik Nehal 7001305949 Independent Escort Service NashikCollege Call Girls Nashik Nehal 7001305949 Independent Escort Service Nashik
College Call Girls Nashik Nehal 7001305949 Independent Escort Service Nashik
 
Extrusion Processes and Their Limitations
Extrusion Processes and Their LimitationsExtrusion Processes and Their Limitations
Extrusion Processes and Their Limitations
 
Roadmap to Membership of RICS - Pathways and Routes
Roadmap to Membership of RICS - Pathways and RoutesRoadmap to Membership of RICS - Pathways and Routes
Roadmap to Membership of RICS - Pathways and Routes
 
Top Rated Pune Call Girls Budhwar Peth ⟟ 6297143586 ⟟ Call Me For Genuine Se...
Top Rated  Pune Call Girls Budhwar Peth ⟟ 6297143586 ⟟ Call Me For Genuine Se...Top Rated  Pune Call Girls Budhwar Peth ⟟ 6297143586 ⟟ Call Me For Genuine Se...
Top Rated Pune Call Girls Budhwar Peth ⟟ 6297143586 ⟟ Call Me For Genuine Se...
 
Processing & Properties of Floor and Wall Tiles.pptx
Processing & Properties of Floor and Wall Tiles.pptxProcessing & Properties of Floor and Wall Tiles.pptx
Processing & Properties of Floor and Wall Tiles.pptx
 
(SHREYA) Chakan Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Esc...
(SHREYA) Chakan Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Esc...(SHREYA) Chakan Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Esc...
(SHREYA) Chakan Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Esc...
 
UNIT-III FMM. DIMENSIONAL ANALYSIS
UNIT-III FMM.        DIMENSIONAL ANALYSISUNIT-III FMM.        DIMENSIONAL ANALYSIS
UNIT-III FMM. DIMENSIONAL ANALYSIS
 
ONLINE FOOD ORDER SYSTEM PROJECT REPORT.pdf
ONLINE FOOD ORDER SYSTEM PROJECT REPORT.pdfONLINE FOOD ORDER SYSTEM PROJECT REPORT.pdf
ONLINE FOOD ORDER SYSTEM PROJECT REPORT.pdf
 
Introduction to IEEE STANDARDS and its different types.pptx
Introduction to IEEE STANDARDS and its different types.pptxIntroduction to IEEE STANDARDS and its different types.pptx
Introduction to IEEE STANDARDS and its different types.pptx
 
CCS335 _ Neural Networks and Deep Learning Laboratory_Lab Complete Record
CCS335 _ Neural Networks and Deep Learning Laboratory_Lab Complete RecordCCS335 _ Neural Networks and Deep Learning Laboratory_Lab Complete Record
CCS335 _ Neural Networks and Deep Learning Laboratory_Lab Complete Record
 
result management system report for college project
result management system report for college projectresult management system report for college project
result management system report for college project
 
KubeKraft presentation @CloudNativeHooghly
KubeKraft presentation @CloudNativeHooghlyKubeKraft presentation @CloudNativeHooghly
KubeKraft presentation @CloudNativeHooghly
 
VIP Call Girls Ankleshwar 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Ankleshwar 7001035870 Whatsapp Number, 24/07 BookingVIP Call Girls Ankleshwar 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Ankleshwar 7001035870 Whatsapp Number, 24/07 Booking
 
Introduction to Multiple Access Protocol.pptx
Introduction to Multiple Access Protocol.pptxIntroduction to Multiple Access Protocol.pptx
Introduction to Multiple Access Protocol.pptx
 
DJARUM4D - SLOT GACOR ONLINE | SLOT DEMO ONLINE
DJARUM4D - SLOT GACOR ONLINE | SLOT DEMO ONLINEDJARUM4D - SLOT GACOR ONLINE | SLOT DEMO ONLINE
DJARUM4D - SLOT GACOR ONLINE | SLOT DEMO ONLINE
 
Booking open Available Pune Call Girls Koregaon Park 6297143586 Call Hot Ind...
Booking open Available Pune Call Girls Koregaon Park  6297143586 Call Hot Ind...Booking open Available Pune Call Girls Koregaon Park  6297143586 Call Hot Ind...
Booking open Available Pune Call Girls Koregaon Park 6297143586 Call Hot Ind...
 
Call Girls Pimpri Chinchwad Call Me 7737669865 Budget Friendly No Advance Boo...
Call Girls Pimpri Chinchwad Call Me 7737669865 Budget Friendly No Advance Boo...Call Girls Pimpri Chinchwad Call Me 7737669865 Budget Friendly No Advance Boo...
Call Girls Pimpri Chinchwad Call Me 7737669865 Budget Friendly No Advance Boo...
 
(ANVI) Koregaon Park Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...
(ANVI) Koregaon Park Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...(ANVI) Koregaon Park Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...
(ANVI) Koregaon Park Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...
 

The forgotten art of assembly

  • 1. The lost art of AssemblyThe lost art of Assembly
  • 2. I have learned Assembly 3 times :)
  • 4. I have learned Assembly 3 times :)
  • 5. I have learned Assembly 3 times :)
  • 7. Registers EIP - Instruction Pointer ESP - Stack Pointer EBP - Frame base pointer (function base pointer) EAX - RAX (sometimes counter) EBX - RBX ECX - RBX ESI - RSI (source) EDI - RDI (destination)
  • 8. Registers EXX - 32bit RXX - 64bit XMM - 128bit YMM - 256bit ZMM - 512bit AVX 512 - 256 ZMM0 - ZMM31 255 - 128 YMM0 - YMM31 127 - 0 XMM0 - XMM31 https://software.intel.com/en-us/isa-extensions https://software.intel.com/en-us/blogs/2013/avx-512-instructions
  • 9. Basic instructions ● mov ● add ● jumps – jcc – jle – jne ● int – call – ret
  • 10. int 0x80 Definition int 0x80 is the assembly language instruction that is used to invoke system calls in Linux on x86 (i.e., Intel-compatible) processors. http://www.linfo.org/int_0x80.html
  • 11. Assembly vs. Disassemby :) section .data msg db "Hello, world!", 0x0a section .text global _start _start: ; SYSCALL: write(1, msg, 14) mov eax, 4 mov ebx, 1 mov ecx, msg mov edx, 14 int 0x80 ; SYSCALL: exit(0) mov eax, 1 mov ebx, 0 int 0x80 Disassembly of section .text: 08048080 <_start>: 8048080: b8 04 00 00 00 mov eax,0x4 8048085: bb 01 00 00 00 mov ebx,0x1 804808a: b9 a4 90 04 08 mov ecx,0x80490a4 804808f: ba 0e 00 00 00 mov edx,0xe 8048094: cd 80 int 0x80 8048096: b8 01 00 00 00 mov eax,0x1 804809b: bb 00 00 00 00 mov ebx,0x0 80480a0: cd 80 int 0x80 Disassembly of section .data: 080490a4 <msg>: 80490a4: 48 dec eax 80490a5: 65 6c gs ins BYTE PTR es:[edi],dx 80490a7: 6c ins BYTE PTR es:[edi],dx 80490a8: 6f outs dx,DWORD PTR ds:[esi] 80490a9: 2c 20 sub al,0x20 80490ab: 77 6f ja 804911c <_end+0x68> 80490ad: 72 6c jb 804911b <_end+0x67> 80490af: 64 21 0a and DWORD PTR fs:[edx],ecx 48 65 6c 6c 6f 2c 20 77 6f 72 6c 64 21 0a = Hello, world! https://www.rapidtables.com/convert/number/hex-to-ascii.html
  • 13. The ELF format ● Executable and Linkable Format ● 4bytes magic number ● 32/64bit binary ● instruction set architecture ● interpreter for the program https://en.wikipedia.org/wiki/Executable_and_Linkable_Format http://www.skyfree.org/linux/references/ELF_Format.pdf
  • 14. readelf Section Headers: [Nr] Name Type Addr Off Size ES Flg Lk Inf Al [ 0] NULL 00000000 000000 000000 00 0 0 0 [ 1] .interp PROGBITS 08048134 000134 000013 00 A 0 0 1 [ 2] .note.ABI-tag NOTE 08048148 000148 000020 00 A 0 0 4 [ 3] .hash HASH 08048168 000168 000028 04 A 4 0 4 [ 4] .dynsym DYNSYM 08048190 000190 000050 10 A 5 1 4 [ 5] .dynstr STRTAB 080481e0 0001e0 00004a 00 A 0 0 1 [ 6] .gnu.version VERSYM 0804822a 00022a 00000a 02 A 4 0 2 [ 7] .gnu.version_r VERNEED 08048234 000234 000020 00 A 5 1 4 [ 8] .rel.dyn REL 08048254 000254 000008 08 A 4 0 4 [ 9] .rel.plt REL 0804825c 00025c 000010 08 AI 4 23 4 [10] .init PROGBITS 0804826c 00026c 00002d 00 AX 0 0 4 [11] .plt PROGBITS 080482a0 0002a0 000030 04 AX 0 0 16 [12] .plt.got PROGBITS 080482d0 0002d0 000008 00 AX 0 0 8 [13] .text PROGBITS 080482e0 0002e0 000220 00 AX 0 0 16 [15] .rodata PROGBITS 0804851c 00051c 000016 00 A 0 0 4 [24] .data PROGBITS 08049710 000710 000008 00 WA 0 0 4 [25] .bss NOBITS 08049718 000718 000008 00 WA 0 0 4 https://greek0.net/elf.html
  • 15. objdump$ objdump -d -m intel hello-asm Disassembly of section .text: 08048080 <_start>: 8048080: b8 04 00 00 00 mov eax,0x4 8048085: bb 01 00 00 00 mov ebx,0x1 804808a: b9 a4 90 04 08 mov ecx,0x80490a4 804808f: ba 0e 00 00 00 mov edx,0xe 8048094: cd 80 int 0x80 8048096: b8 01 00 00 00 mov eax,0x1 804809b: bb 00 00 00 00 mov ebx,0x0 80480a0: cd 80 int 0x80 Disassembly of section .data: 080490a4 <msg>: 80490a4: 48 dec eax 80490a5: 65 6c gs ins BYTE PTR es:[edi],dx 80490a7: 6c ins BYTE PTR es:[edi],dx 80490a8: 6f outs dx,DWORD PTR ds:[esi] 80490a9: 2c 20 sub al,0x20 80490ab: 77 6f ja 804911c <_end+0x68> 80490ad: 72 6c jb 804911b <_end+0x67> 80490af: 64 21 0a and DWORD PTR fs:[edx],ecx
  • 16. Builds :) hello-dbg-asm: hello.asm nasm -g -f elf hello.asm && ld hello.o -o hello-asm hello-c-static: hello.c gcc -static hello.c -o hello-c-static hello-asm: hello.asm nasm -f elf hello.asm && ld hello.o -o hello-asm for1: for.c gcc for.c -o for1 for2: for.c gcc -fopt-info-vec for.c -O2 -ftree-vectorize -o for2 for3: for.c gcc -fopt-info-vec for.c -O3 -o for3 foravx: for.c gcc -O3 for.c -fopt-info-vec -mavx -o foravx # gcc -O3 for.c -fopt-info-vec -mavx2 -o foravx
  • 17. Inline assembly #define MSG "Hello, world!" int main() { asm( "int $0x80nt" : : "a"(4), "b"(1), "c"(MSG), "d"(14) ); }
  • 18. Inline assembly asm( "int $0x80nt" : : "a"(4),"b"(1),"c"(MSG),"d"(14) ); // a,b,c,d-registers (eax,ebx,ecx & edx) asm( “assembly instructions” : return values : assignment variables https://gcc.gnu.org/onlinedocs/gcc/Extended-Asm.html