Hello and welcome.
In this video, we are going to talk about assembly, language, basics, formal analysis of nitty equals.
What is the Steck?
Stake stands for LIFO, last in first structure, ESTOS local variables and return addresses for functions
is assessed to push for call and instructions and the rare memorabilia for the state as follows.
It starts at a higher address shown in the diagram here, and small values have pushed smaller and smaller
addresses use and the addresses I had thought on this time.
So this whole thing is a step.
Here is part of the memory and the EVP is this pointer is a register.
We start the address of the bottom of the stack.
The ESB is another pointer which starts the address of the top of the stack.
So these are registered, which are useful for creating a stack.
What is the heap he may use for globally storing memory or functions can access it because it is stored
globally.
They are typically stored in data section of a program.
In this AP, Arkia alloca, he can be used to create, he never use, he has a storage area for anything
he's going to use and you can look up the EMCDDA and help in the Google description of this API function.
Next, we look at CPU registers.
Disipio Registers consists of the following registers SCBA all the way to IP X, typically known as
the accumulator for Arithmetic Operations SBX and based Point-to-point.
Anita X is usually acounter for shooting with instructions and for looping Eteocles for data arithmetic
and Kylo, yes, it is sauciness is a pointer.
Did a source in string operations.
It is a destination index pointer to destination in string operations EBIZ base pointer, which points
to the base of the stack which we have seen E.S.P stick pointer his pointer a thumb on the stack and
IP is a construction pointer.
We start the address on the next instructions there is going to execute are also similar registers.
SS you squinter six could point to the data pointer and so on.
The important ones are SS six and yes.
And these are called segment registers.
You can assess Bosavi register for example.
Register in.
This example is Streeterville register consists of four bytes, which is also known as a D for the Teletubbies.
If you only wanted SS haveli, which is actually assessing the what to base, which is sixteen, which
you can use the symbol X, he said X.
And if you wanted to assess the lower level Moseby, which is the image, then you can use Heigh-Ho.
So yeah.
Says to Lobi he says is a higher bar.
So example, supposing the SS got this hex values.
One, two, three, four, five, six, seven and eight.
If you are going to assess the X, this is this is Adua.
If you want an SS, that would then he will use X if you wanted SS the higher Y you use H and Lobi.
Yeah.
So this is what you would get.
Yes.
We give you 50 Southeast Asia, give you five, six and here we give you 78.
The same thing applies to all the other registers.
For example, if you are assessing if you will use for good and for the bottom will be the higher highlight
will be B and so on.
We also have the flex register.
This is the register of each flat containing a one or a zero.
The important one size follows.
The siefker is a Karif like it is set when the result of an operation is too large for the destination.
Run the zero flag.
It is the result of an operation equals to zero.
The same flag is set if the result of an operation is negative and deafly also is a trap like a set.
If you are doing step by step debugging and malware can detect this.
Sometimes you get buggy functionality, assembly like instructions.
Three main categories dataflow, for example, the movie instruction controller, for example, push,
call and jump automatic in logic.
For example, I saw on Anmol and examples of data transfer instructions move.
The focus is to move, for example, move source to destination and example, remove the very start
you need.
S address to the register moves, which means moves.
You're extended, for example, moves the source to destination.
So this will move to hexadecimal one, two, three into weeks and pattern higher order.
This is zero allier non-effective address.
For example, LASU destination.
This will address after you minus four zero in hex from MBP and start the resulting address he needs.
Xchange is a swap values between two registers, for example.
S.G. Source and destination with somewhat everything source in the destination and whatever in this
nation into source examples of contraflow instructions jumps.
So this is an unconditional unjam way he would jump no matter what the condition is.
Prior to the example we jump to the value.
We start in this address JDA.
Jump, he jumps only if to zero, flight one, for example, address jump, not zero zero will jump
if the zero zero E journey is preceded by the test or compare instruction.
However, jump is a condition and jump and not preceded by any test.
Here is an example of a jump.
So jump.
You could only take place if the comparison here is is equal to zero, for example, minus Essi zero,
then this region, this JBI is just below.
So this jump will only happen if the U.S., minus the values on its policy, is less than zero then
it time.
And over here, gemological generally could only happen if the.
Yes, minus ESR is not equal to zero then only William.
Examples of aromatic instructions at some, I think so examples would be source to destination, which
means that you take whatever is in sight at the destination and start the resulting destination.
Does the same thing.
But this minus Ilma is where you multiply source by the value.
And in Stoddard's the Indonesian increment I see means increment whatever is in the register by one.
And these are examples here.
Examples of logic, instructions.
Zschau performance being are for example, some sole source of destination.
And then here shelf-life means you see all the bits by left, by, by the number of bits to indicate
any source, for example, which is one.
Then you shift every bit here to the left by one and perform the device in.
So here you perform in an operation with a source and a destination.
Doesn't compare instructions that is very poor from a B, right, and on to parents in a zero zero set
of unusual conditions in camps where you compare the first operation with the second operation by subtraction.
So this is example here today.
You take AGYEMAN one minus arguin to jam instructions always come immediately after a test or compare,
as I just demonstrated, and return values.
Yes, register used to hold the return value of a function call.
The return value could be an integer of zero or even negative one, which is denoted in hex by all.
Yes, you can also be addressed, for example, this hexadecimal address, for example, this output
from the excessive IBG over here you will see push seven.
So push and push seven to the stack down here and then call Hotei cause this function will return.
The result, the call in X.
That's all for this primer on assembly language.
Thank you for watching.