5. ASSUME
MAKING AN ASS OUT OF U AND ME
‣ You know data types and sizes
‣ 0xDEADBEEF isn’t a deceased cow to you
‣ You understand endianness
‣ Intel syntax
‣ Have programmed before
6. THE BASICS
THE STACK
▸area of memory given to the program by the OS
▸LIFO data structure
▸Grows to lower memory addresses
▸Remember ESP
▸keeps track of prior called functions, holds local vars, and
used to pass args to functions
7. THE BASICS
THE HEAP & THE REST
▸Dynamic memory allocation
▸grows towards the stack
10. THE BASICS
REGISTERS
segment
CS : stores code segment
DS : stores data segment
ES, FS, GS : far addressing (video mem etc)
SS : Stack segment - usually same as ds
11. THE BASICS
REGISTERS
indexes and pointers
EDI : destination index register. Array ops
ESI : source index register. Array ops
EBP : base pointer
ESP : stack pointer
EIP : instruction pointer
12. THE BASICS
32/16/8 BIT REGISTERS
some registers can be accessed with 8 and 16bit instructions.
Most commonly used
13. THE BASICS
64 BIT
▸twice as good as 32bit
▸extended registers become really extended
rax, rip, rcx, rbp, etc
17. CALLING CONVENTIONS
STDCALL (AKA WINAPI)
▸Arguments are passed right-to-left, and return value passed
in eax
▸The called function cleans the stack
18. CALLING CONVENTIONS
FASTCALL
▸The first 2 or 3 32-bit (or smaller) arguments are passed in
registers, with the most commonly used registers being edx,
eax, and ecx
▸The calling function (usually) cleans the stack
19. CALLING CONVENTIONS
THISCALL (C++)
▸Only non-static member functions. Also no variadics
▸Pointer to the class object is passed in ecx, the arguments
are passed right-to-left on the stack and return value is
passed in eax
▸the called function cleans the stack
33. COMMON CONSTRUCTS
LOOPS
▸ecx is usually loop counter
▸conditional jumps based on loop counter
▸easier to spot in call graphs
int main() {
int x = 0;
int i = 0;
for (i = 20; i > 0; i--) {
x += i;
}
return 0;
}
36. SWITCH STATEMENTS
▸different ways to do it depending on compiler settings and
what the cases are
▸the interesting one to me is the look up table
COMMON CONSTRUCTS
