Reverse Basics

Page content

Binary Stuff

4 Bit   ->  Nibble
8 Bit   = 1 Byte
16 Bit  = 2 Byte  -> Word
32 Bit  = 4 Byte  -> Double Word
64 Bit  = 8 Byte  -> Quad Word

Hex

0xffffd040 is 4 bytes and is a double word

CPU

4 Parts

1) Control Unit   Retrieves and decodes instructions from the CPU and then storing and retrieving them to and from memory 
2) Execution Unit Where the execution of fetching and retrieving instructions occurs
3) Registers      Internal CPU memory locations used a temporary data storage 
4) Flags          Indicate events when execution occurs

Registers

EIP:  Instruction Pointer   contains the address of the next instruction to be fetched from memory and then executed

General-purpose Registers

EAX:  Main register used in arithmetic calculations. Also known as accumulator, as it holds results of arithmetic operations and function return values.

EBX:  The Base Register. Pointer to data in the DS segment. Used to store the base address of the program.

ECX:  The Counter register is often used to hold a value representing the number of times a process is to be repeated. Used for loop and string operations.

EDX:  A general purpose register. Additionally used for I/O operations. In addition will extend EAX to 64-bits.

ESI:  Source Index register. Pointer to data in the segment pointed to by the DS register. Used as an offset address in string and array operations. It holds the address from where to read data.

EDI:  Destination Index register. Pointer to data (or destination) in the segment pointed to by the ES register. Used as an offset address in string and array operations. It holds the implied write address of all string operations.

EBP:  Base Pointer. Pointer to data on the stack (in the SS segment). It points to the bottom of the current stack frame. It is used to reference local variables.

ESP:  Stack Pointer (in the SS segment). It points to the top of the current stack frame. It is used to reference local variables.

32, 16, 8 Bit Registers

1F          F     7     0
---------- EAX ----------
            ---- AX -----
            - AH -|- AL -

EAX:  32 Bit, Extended AX
AX:   16 Bit
AH:   8  Bit, A Higher
AL    8  Bit, A Lower

Segment Registers

CS: Code segment register stores the base location of the code section (.text section) which is used for data access.

DS: Data segment register stores the default location for variables (.data section) which is used for data access.

ES: Extra segment register which is used during string operations.

SS: Stack segment register stores the base location of the stack segment and is used when implicitly using the stack pointer or when explicitly using the base pointer.

FS: Extra segment register.

GS: Extra segment register.

Flags

sha256: 075664b4bc05cae22ab43d48935a4e86c9d3bf828c80213b60ce236dd9d7af59