Difference between revisions of "Registers"

From SkullSecurity
Jump to navigation Jump to search
Line 139: Line 139:
<td colspan='2' width='50' align='center'>&nbsp;</td>
<td colspan='2' width='50' align='center'>&nbsp;</td>
<td colspan='2' width='50' align='center'>sp</td>
<td colspan='2' width='50' align='center'>sp</td>
</tr>
</table>
Here are some examples:
<table border='1px' cellspacing='0' cellpadding='0'>
<tr>
<td width='50'>eax</td>
<td width='50'>0x12345678</td>
</tr>
<tr>
<td width='50'>ax</td>
<td width='50'>0x5678</td>
</tr>
<tr>
<td width='50'>ah</td>
<td width='50'>0x56</td>
</tr>
<tr>
<td width='50'>al</td>
<td width='50'>0x78</td>
</tr>
</table>
<table border='1px' cellspacing='0' cellpadding='0'>
<tr>
<td width='50'>eax</td>
<td width='50'>0x00000025</td>
</tr>
<tr>
<td width='50'>ax</td>
<td width='50'>0x0025</td>
</tr>
<tr>
<td width='50'>ah</td>
<td width='50'>0x00</td>
</tr>
<tr>
<td width='50'>al</td>
<td width='50'>0x25</td>
</tr>
</tr>
</table>
</table>


== 64-bit Registers ==
== 64-bit Registers ==

Revision as of 18:41, 12 March 2007

This section is the first section specific to assembly. So if you're reading through the full guide, get ready for some actual learning!

A register is like a variable, except that there are a fixed number of registers. Each register is a special spot in the CPU where a single value is stored. A register is the only play where math can be done (addition, subtraction, etc). Registers frequently hold pointers which reference memory. Movement of values between registers and memory is very common.

Intel assembly has 8 general purpose 32-bit registers: eax, ebx, ecx, edx, esi, edi, ebp, esp. Although any data can be moved between any of these registers, compilers commonly use the same registers for the same uses, and some instructions (such as multiplication and division) can only use the registers they're designed to use.

Different compilers may have completely different conventions on how the various registers are used. For the purposes of this document, I will discuss the most common compiler, Microsoft's.

Volatility

Some registers are typically volatile across functions, and others remain unchanged. This is a feature of the compiler's standards and must be looked after in the code, registers are not preserved automatically (although in some assembly languages they are -- but not in x86). What that means is, when a function is called, there is no guarantee that volatile registers will retail their value when the function returns, and it's the functions responsibility to preserve non-volatile registers.

The conventions used by Microsoft's compiler are:

  • Volatile: ecx, edx
  • Non-Volatile: ebx, esi, edi, ebp
  • Special: eax, esp (discussed later)

eax

eax is a 32-bit general-purpose register with two common uses: to store the return value of a function and as a special register for certain calculations. It is technically a volatile register, since the value isn't preserved. Instead, its value is set to the return value of a function before a function returns. Other than esp, this is probably the most important register to remember for this reason. eax is also used specifically in certain calculations, such as multiplication and division, as a special register. That use will be examined in the instructions section.

Here is an example of a function returning in C:

return 3;  // Return the value 3

Here's the same code in assembly:

mov eax, 3 ; Set eax (the return value) to 3
ret        ; Return

ebx

ebx is a non-volatile general-purpose register. It has no specific uses, but is often set to a commonly used value (such as 0) throughout a function to speed up calculations.

ecx

ecx is a volatile general-purpose register that is occasionally used as a function parameter or as a loop counter.

Functions of the "__fastcall" convention pass the first two parameters to a function using ecx and edx. Additionally, when calling a member function of a class, a pointer to that class is often passed in ecx no matter what the calling convention is.

Additionally, ecx is often used as a loop counter. for loops generally, although not always, set the accumulator variable to ecx. rep- instructions also use ecx as a counter, automatically decrementing it till it reaches 0. This class of function will be discussed in a later section.

edx

edx is a volatile general-purpose register that is occasionally used as a function parameter. Like ecx, edx is used for "__fastcall" functions.

Besides fastcall, edx is generally used for storing short-term variables within a function.

esi

esi is a non-volatile general-purpose register that is often used as a pointer. Specifically, for "rep-" class instructions, which require a source and a destination for data, esi points to the "source". esi often stores data that is used throughout a function because it doesn't change.

edi

edi is a non-volatile general-purpose register that is often used as a pointer. It is similar to esi, except that it is generally used as a destination for data.

ebp

ebp is a non-volatile general-purpose register that has two distinct uses depending on compile settings: it is either the frame pointer or a general purpose register.

If compilation is not optimized, or code is written by hand, ebp keeps track of where the stack is at the beginning of a function (the stack will be explained in great detail in a later section). Because the stack changes throughout a function, having ebp set to the original value allows variables stored on the stack to be referenced easily. This will be explored in detail when the stack is explained.

If compilation is optimized, ebp is used as a general register for storing any kind of data, while calculations for the stack pointer are done based on the stack pointer moving (which gets confusing -- luckily, IDA automatically detects and corrects a moving stack pointer!)

esp

Finally, esp is a special register that stores a pointer to the bottom of the stack (the stack grows towards lower addresses). Math is rarely done directly on esp, and the value of esp must be the same at the beginning and the end of each function. esp will be examined in much greater detail in a later section.

16-bit and 8-bit Registers

In addition to the 8 32-bit registers available, there are also a number of 16-bit and 8-bit registers. The confusing thing about these registers it that they use the same storage space as the 32-bit registers. In other words, every 16-bit register is half of one of the 32-bit registers, so that changing the 16-bit also changes the 32-bit. Furthermore, the 8-bit registers are part of the 16-bit registers.

For example, eax is a 32-bit register. The lower half of eax is ax, a 16-bit register. ax is divided into two 8-bit registers, ah and al (a-high and a-low).

  • There are 8 32-bit registers: eax, ebx, ecx, edx, esi, edi, ebp, esp.
  • There are 8 16-bit registers: ax, bx, cx, dx, si, di, bp, sp.
  • There are 8 8-bit registers: ah, al, bh, bl, ch, cl, dh, dl.

The relationships of these registers is shown in the table below:

32-bit eax   ebx   ecx   edx
16-bit   ax   bx   cx   dx
8-bit     ah al     bh bl     ch cl     dh dl
 
32-bit esi   edi   ebp   esp
16-bit   si   di   bp   sp

Here are some examples:

eax 0x12345678
ax 0x5678
ah 0x56
al 0x78
eax 0x00000025
ax 0x0025
ah 0x00
al 0x25

64-bit Registers