Reverse Basics
Page content
Binary Stuff
4 Bit -> Nibble
8 Bit = 1 Byte
16 Bit = 2 Byte -> Word
32 Bit = 4 Byte -> Double Word
64 Bit = 8 Byte -> Quad Word
Hex
0xffffd040 is 4 bytes and is a double word
CPU
4 Parts
1) Control Unit Retrieves and decodes instructions from the CPU and then storing and retrieving them to and from memory
2) Execution Unit Where the execution of fetching and retrieving instructions occurs
3) Registers Internal CPU memory locations used a temporary data storage
4) Flags Indicate events when execution occurs
Registers
EIP: Instruction Pointer contains the address of the next instruction to be fetched from memory and then executed
General-purpose Registers
EAX: Main register used in arithmetic calculations. Also known as accumulator, as it holds results of arithmetic operations and function return values.
EBX: The Base Register. Pointer to data in the DS segment. Used to store the base address of the program.
ECX: The Counter register is often used to hold a value representing the number of times a process is to be repeated. Used for loop and string operations.
EDX: A general purpose register. Additionally used for I/O operations. In addition will extend EAX to 64-bits.
ESI: Source Index register. Pointer to data in the segment pointed to by the DS register. Used as an offset address in string and array operations. It holds the address from where to read data.
EDI: Destination Index register. Pointer to data (or destination) in the segment pointed to by the ES register. Used as an offset address in string and array operations. It holds the implied write address of all string operations.
EBP: Base Pointer. Pointer to data on the stack (in the SS segment). It points to the bottom of the current stack frame. It is used to reference local variables.
ESP: Stack Pointer (in the SS segment). It points to the top of the current stack frame. It is used to reference local variables.
32, 16, 8 Bit Registers
1F F 7 0
---------- EAX ----------
---- AX -----
- AH -|- AL -
EAX: 32 Bit, Extended AX
AX: 16 Bit
AH: 8 Bit, A Higher
AL 8 Bit, A Lower
Segment Registers
CS: Code segment register stores the base location of the code section (.text section) which is used for data access.
DS: Data segment register stores the default location for variables (.data section) which is used for data access.
ES: Extra segment register which is used during string operations.
SS: Stack segment register stores the base location of the stack segment and is used when implicitly using the stack pointer or when explicitly using the base pointer.
FS: Extra segment register.
GS: Extra segment register.
Flags
sha256: 075664b4bc05cae22ab43d48935a4e86c9d3bf828c80213b60ce236dd9d7af59