Simple Instructions

Assembly Language Tutorial

Please choose a tutorial page: Fundamentals -- Information about C Tools Registers Simple Instructions Example 1 -- SC CDKey Initial Verification Example 2 -- SC CDKey Shuffle Example 2b -- SC CDKey Final Decode The Stack Stack Example Functions Example 3 -- Storm.dll SStrChr Assembly Summary Machine Code Example 4 -- Smashing the Stack Cracking a Game Example 5 -- Cracking a game Example 6 -- Writing a keygen .dll Injection and Patching Memory Searching Example 7 -- Writing a cheat for Starcraft (1.05) Example 7 Step 1 -- Displaying Messages Example 7 Step 1b -- Above, w/ func ptrs Example 7 Final Example 8 -- Getting IX86.dll files 16-bit Assembly Example 9 -- Keygen for a 16-bit game Example 10 -- Writing a loader

Moving Data Around

The commands in this section deal with moving around numbers and pointers.

mov, movsx, movzx

mov is the command used for assignment, much like the "=" sign in most languages. mov can move data between a register and memory, two registers, or a constant to a register. Here are some examples:

mov eax, 1   ; set eax to 1 (eax = 1)
mov edx, ecx ; set edx to whatever ecx is (edx = ecx)
mov eax, 18h ; set eax to 0x18

movsx and movzx are special versions of mov which are designed to be used between signed (movsx) and unsigned (movzx) registers of different sizes.

movsx means move with sign extension. The data is moved from a smaller register into a bigger register, and the sign is preserved by either padding with 0's (for positive values) or F's (for negative values). Here are some examples:

• 0x1000 becomes 0x00001000, since it was positive
• 0x7FFF becomes 0x00007FFF, since it was positive
• 0xFFFF becomes 0xFFFFFFFF, since it was negative (note that 0xFFFF is -1 in 16-bit signed, and 0xFFFFFFFF is -1 in 32-bit signed)
• 0x8000 becomes 0xFFFF8000, since it was negative (note that 0x8000 is -32768 in 16-bit signed, and 0xFFFF8000 is -32768 in 32-bit signed)

movzx means move with zero extension. The data is moved from a smaller register into a bigger register, and the sign is ignored. Here are some examples:

• 0x1000 becomes 0x00001000
• 0x7FFF becomes 0x00007FFF
• 0xFFFF becomes 0x0000FFFF
• 0x8000 becomes 0x00008000

lea

lea is very similar to mov, except that math can be done on the original value before it's used. The "[" and "]" characters always surround the second parameter, but in this case they don't indicate dereferencing (which will be explained later), it's easiest to think of them as just being part of the formula.