x86/x64 汇编基础

Welcome to the world of assembly language! This is the lowest-level programming language that humans typically read and write.

It's a symbolic representation of machine code, which are the raw binary instructions that a computer's processor (CPU) understands and executes directly. Think of it as the CPU's native tongue.

For reverse engineers, understanding assembly language is crucial. When you analyze a compiled program, you rarely have the original source code.

Instead, you'll be looking at its assembly representation. Learning assembly helps you:

• Understand exactly how a program executes.
• Identify functions, data, and control flow.
• Uncover hidden behaviors or vulnerabilities.

When we talk about x86/x64 assembly, we're referring to instruction sets for Intel and AMD processors. The main difference is the architecture's 'width':

• x86: Refers to 32-bit architecture.
• x64: Refers to 64-bit architecture, also known as AMD64 or Intel 64.

While x64 introduces more registers and wider data paths, many fundamental instructions remain similar, often with extended versions.

Assembly instructions generally follow a simple format: INSTRUCTION destination, source.

• INSTRUCTION: This is the operation to perform (e.g., move, add, subtract).
• destination: Where the result of the operation will be stored.
• source: The data or location to operate on.

Some instructions might have one operand, or none at all. The order (destination, source) is common in Intel syntax, which we'll use.

The MOV instruction is one of the most fundamental. It stands for 'move' and is used to copy data from a source to a destination.

It's important to note that MOV doesn't 'cut' or 'remove' the data from the source; it simply copies it, leaving the source unchanged.

Its general form is: MOV destination, source

Let's look at some conceptual examples of MOV. We'll use common x86/x64 register names like EAX, EBX, RCX, etc., which are tiny storage locations inside the CPU. Don't worry about their exact function yet!

• MOV EAX, EBX: Copy the value from register EBX into register EAX.
• MOV RCX, RDX: Copy the value from RDX into RCX (64-bit version).
• MOV EAX, 123: Copy the constant value 123 into register EAX.

Beyond just moving data, assembly allows basic arithmetic operations. Two common ones are ADD and SUB.

• ADD destination, source: Adds the source value to the destination value, storing the result in destination.
• SUB destination, source: Subtracts the source value from the destination value, storing the result in destination.

These operations modify the destination operand directly.

Here are some conceptual examples for ADD and SUB:

• ADD EAX, EBX: EAX = EAX + EBX
• SUB RCX, 10: RCX = RCX - 10
• ADD RDX, R8: RDX = RDX + R8 (using a 64-bit general-purpose register R8)

Notice how the destination operand is updated with the result of the operation.

In assembly, the terms 'operand' and 'immediate value' are important:

• Operand: A value or location that an instruction operates on. This can be a register, a memory address, or an immediate value.
• Immediate Value: A constant value that is encoded directly within the instruction itself. For example, in MOV EAX, 123, 123 is an immediate value.

Understanding these terms helps you interpret what kind of data an instruction is handling.

Which of the following best describes the function of the MOV instruction in x86/x64 assembly?

Great job! You've just taken your first steps into the world of assembly language for x86/x64 processors.

We covered:

• What assembly language is and why it's vital for reverse engineering.
• The basic instruction format: INSTRUCTION destination, source.
• Fundamental instructions like MOV (copy), ADD (add), and SUB (subtract).
• The concept of immediate values and operands.

Next, we'll dive deeper into registers and how they interact with memory!