Assembly Cheatsheet

1. General Purpose Registers Overview

The x86 architecture has a set of general-purpose registers used for arithmetic operations, data movement, and addressing. The main registers include:

• rax: Accumulator register (can be accessed as eax, ax, al for lower-order access)
• rbx: Base register (can be accessed as ebx, bx, bl)
• rcx: Counter register (can be accessed as ecx, cx, cl)
• rdx: Data register (can be accessed as edx, dx, dl)
• rsi: Source index register (can be accessed as esi, si, sil)
• rdi: Destination index register (can be accessed as edi, di, dil)
• rbp: Base pointer register (can be accessed as ebp, bp, bpl)
• rsp: Stack pointer register (can be accessed as esp, sp, spl)

In 64-bit mode (x86-64), each of these registers is 64-bits wide and can be accessed at different widths depending on the needs of the instruction set.

Partial Register Access

One of the significant features of the x86 architecture is the ability to access parts of a register:

• The full 64-bit register (e.g., rax, rbx).
• The lower 32-bits of a register (e.g., eax, ebx).
• The lower 16-bits of a register (e.g., ax, bx).
• The lower 8-bits of a register (e.g., al, bl).

Here’s a table illustrating partial register access using rax:

Memory Addresses

As previously mentioned, x86 64-bit processors have 64-bit wide addresses that range from 0x0 to 0xffffffffffffffff, so we expect the addresses to be in this range. However, RAM is segmented into various regions, like the Stack, the heap, and other program and kernel-specific regions. Each memory region has specific read, write, execute permissions that specify whether we can read from it, write to it, or call an address in it.

Whenever an instruction goes through the Instruction Cycle to be executed, the first step is to fetch the instruction from the address it’s located at, as previously discussed. There are several types of address fetching (i.e., addressing modes) in the x86 architecture:

Data Movement

In x86-64 assembly, instructions tell the CPU what actions to perform. Each instruction is typically made up of two main components:

• Opcode: Specifies the operation to be performed (e.g., mov, add, jmp).
• Operands: Specifies the data or registers the operation will act upon (e.g., rax, memory addresses, or immediate values).

Instruction Flow

Assembly instructions generally flow from right to left. This means the value on the right-hand side is moved or manipulated and its result is stored in the left-hand side register or memory location.

Example:

mov rax, rbx  ; Move the value in rbx into rax

Control Flow

Control flow in assembly language is determined by conditional and unconditional jumps.

Unconditional Jumps

• These instructions redirect the execution flow without any condition.
• jmp: Directly jumps to another part of the program.
• call: Calls a function (saves the return address on the stack).
• ret: Returns from a function (pops the return address from the stack).

Conditional Jumps

Conditional jumps depend on the status flags stored in the flags register (eflags). The condition is evaluated, and if it holds true, the jump is executed.

Examples of conditional jumps include:

• je (jump if equal): Jumps if the result of a comparison is equal (zero flag ZF is set).
• jne (jump if not equal): Jumps if the comparison result is not equal (zero flag ZF is clear).
• jg (jump if greater): Jumps if one value is greater than the other (sign flag SF and overflow flag OF are used).
• jl (jump if less): Jumps if one value is less than the other.
• ja (jump if above): Jumps if a value is above another (used for unsigned comparisons).
• jb (jump if below): Jumps if a value is below another (used for unsigned comparisons).

EFLAGS Register

The eflags register is crucial in determining the result of arithmetic operations and conditional jumps. It is updated by instructions like cmp and test.

Key Flags in eflags:

• ZF (Zero Flag): Set if the result of an operation is zero.
• SF (Sign Flag): Set if the result is negative.
• OF (Overflow Flag): Set if an arithmetic overflow occurs.
• CF (Carry Flag): Set if an unsigned overflow occurs.
• PF (Parity Flag): Set if the number of 1-bits in the result is even.

cmp (compare) and test (test) Instructions

• cmp: Subtracts the right operand from the left and updates the flags based on the result. No result is stored; only flags are affected.

Example:

cmp rax, rbx  ; Compare rax and rbx
je equal_label  ; Jump to equal_label if rax == rbx

• test: Performs a bitwise AND between operands and updates flags without storing the result. Often used to check if specific bits are set.

Example:

test rax, rax  ; Test if rax is zero
jz zero_label  ; Jump if rax is zero (ZF is set)

System Calls

A system call is a way for a program to request services from the operating system’s kernel. In x86-64 Linux, the system call interface is highly standardized and rarely changes, making it a powerful and stable interface for interacting with OS-level resources like file systems, network stacks, and process control.

System calls are initiated by the syscall instruction.

Making a System Call

1. The rax register is set with the system call number (each system call has a unique identifier).
2. Arguments for the system call are passed in rdi, rsi, rdx, r10, r8, r9, depending on the system call.
3. The syscall instruction is executed to invoke the system call.

Example:

mov rax, 60     ; syscall number for exit
mov rdi, 0      ; exit status
syscall         ; invoke system call

In this example, rax is set to 60, the syscall number for the exit function, and rdi is set to 0 as the exit status. The syscall instruction triggers the exit process.

Common System Call Numbers:

• 60 - exit: Terminates the process.
• 1 - write: Writes data to a file descriptor.
• 0 - read: Reads data from a file descriptor.

For a complete list of Linux system call numbers, refer to this resource.

Conditional Bit Layout Diagram

Here’s an illustration of how the conditional bit layout works within the eflags register, showcasing how flags like ZF, SF, and OF contribute to conditional jumps:

Data Types

Finally, the x86 architecture supports many types of data sizes, which can be used with various instructions. The following are the most common data types we will be using with instructions:

Whenever we use a variable with a certain data type or use a data type with an instruction, both operands should be of the same size.

For example, we can’t use a variable defined as byte with rax, as rax has a size of 8 bytes. In this case, we would have to use al, which has the same size of 1 byte. The following table shows the appropriate data type for each sub-register:

Assembly and Disassembly

GDB

Assembly Instructions

Functions

Syscall Calling Convention

1. Save registers to stack
2. Set its syscall number in rax
3. Set its arguments in the registers
4. Use the syscall assembly instruction to call it

Function Calling Convention

1. Save Registers on the stack (Caller Saved)
2. Pass Function Arguments (like syscalls)
3. Fix Stack Alignment
4. Get Function’s Return Value (in rax)

Shellcoding

Makefile for nasm/x86 Assembly:

all:
    nasm -f elf64 -o {name}.o {name}.asm
    ld -o {name} {name}.o

clean:
    rm {name} {name}.o

• getShellCode.py

#!/usr/bin/python3
import sys
from pwn import *
context(os="linux", arch="amd64", log_level="error")

file = ELF(sys.argv[1])
shellcode = file.section(".text")
print(shellcode.hex())

• loadShellCode.py

#!/usr/bin/python3
import sys
from pwn import *
context(os="linux", arch="amd64", log_level="error")

run_shellcode(unhex(sys.argv[1])).interactive()

• assembler.sh

#!/bin/bash
filename="${1%%.*}" # remove .s extension
nasm -f elf64 ${filename}".s"
ld ${filename}".0" -o ${filename}
[ "$2" == "-g" ] && gdb -q ${filename} || ./${filename}

• assembler.py

#!/usr/bin/python3
import sys, os, stat
from pwn import *

context(os="linux", arch="amd64", log_level="error")
ELF.from_bytes(unhex(sys.argv[1])).save(sys.argv[2])
os.chmod(sys.argv[2], stat.S_IEXEC)

Manually

Without dynamic linking to the libc library.

nasm -f elf64 example.s
ld -o example example.o
./example

With dynamic linking to the libc library

nasm -f elf64 example.s &&  ld example.o -o example -lc --dynamic-linker /lib64/ld-linux-x86-64.so.2 && ./example

Automated

./assembler.sh example.s
./assembler.sh example.s -g

Automated with Shellcode

Use the assembler.py tool and pass in a shellcode argument and a file to write to.

python3 assembler.py '4831db66bb79215348bb422041636164656d5348bb48656c6c6f204854534889e64831c0b0014831ff40b7014831d2b2120f054831c0043c4030ff0f05' 'helloAcademy'
./helloAcademy

Disassembly

objdump -M intel -d example
objdump -sj .data example

Extract Shellcode

We can use the tool getShellCode.py to extact shellcode from an executable.

python3 getShellCode.py example

Load Shellcode

We can use the tool loadShellCode.py to load shellcode and run it.

python3 loadShellCode.py 'exampleShellCode'

Shellcoding Requirements

1. Does not contain variables
2. Does not refer to direct memory addresses
3. Does not contain any NULL bytes 00