Latest revision as of 04:37, 28 May 2012

Basic Assembly

NOTE: Heavy editing is going on with this page at the moment. Don't be surprised if some content is missing, or seems to be raw/unedited. Just check back in a bit, we're adding a lot of content.

-m4

Preface

Understanding of assembly and stack growth are important for the machine coder. In assembly, there are a limited amount of temporary variables, also called registers, with only the stack or heap to contain additional application data. These registers are of a fixed size and fulfil various functions; the general purpose registers work as small variables for use by the machine coder, whereas special registers such as the instruction pointer fulfil specific functions.

There is a limited number of instructions that can be issued to a processor. While assembly instructions can be compared to the functions of higher-level languages, it is important to keep in mind that they are processor-specific operations that are performed, often peforming alterations on the registers mentioned in the previous paragraph. It is possible to write cross-operating-system shellcoded applications, also known as flat binaries, or flat binary applications.

Because of the limitations of most shellcoding and overflow tutorials, the code examples and notations in this article will be given in both AT&T and Intel Syntax. Intel Syntax and AT&T System V syntax are syntax standards for coding assembly. The two syntaxes are both translated into the same machine code, however they are translated from machine code to human-readable code differently. On Windows XP SP2 systems, we will be demonstrating our code in Intel 32 Bit Standard Syntax. On Linux and UNIX systems, we will be demonstrating our code in AT&T System V syntax, of course for the intel 32 bit processor.

Again, there is no functional difference between the two syntaxes. They are simply methods of displaying assembly (as much as assembly itself is a method of displaying machine code); opinions differ on which of the two is more readable.

On the low level, a machine is actually very simple. A processor is able to understand absolute hexadecimal values, then perform mathematical operations(add, subtract, multiply, divide) upon them as it is asked to. Other than that, the functionality of a processor is mostly limited to memory operations and execution procedures, such as the management of functions and stack growth.

The C programming language is more or less assembly that is arranged so that it is more easily written by humans, including the C libraries that provide a framework with which to work.

From assembly to machine code

Assembly is a user friendly method of writing machine code. There are two stages to the conversion of the code into an executable program:

1. An assembler is used to translate the assembly instructions into machine code equivalent(opcode). The machine code includes numerical representations of mathematical operations including binary, hexadecimal, octal and decimal formats.

2. Linking occurs which combines various object files into a single executable, and also creates references to dynamically linked libraries.

In linux platforms, assembly is done using GNU as, or the `as command':

 user@host ~ $ as test.s -o test.o

The file generated (test.o) is called an object file. The object file has an ELF format header and needs to be linked with the kernel in order to become a valid executable:

 user@host ~ $ ld test.o -o test

Binary & Hexadecimal

Although this section is not directly related to the assembly coding itself, bitwise math and binary/hexadecimal operations are unavoidable when coding in assembly. It is vital to understand the concepts that drive the processor.

Counting

Introduction to Binary

Binary math and hex math have slight differences to decimal math but the same principles apply. For example, in the binary number 1111, has a ‘1’ in the “eights” placeholder, '1' in the "fours" placeholder, a ‘1’ in the “twos” placeholder and '1' in the "ones" placeholder. Add these together and you get 15 in decimal numbers.

A nybble consists of 4 bits, a half-byte, or one hexadecimal digit - all three of these are the same thing. Hex works in conjunction with binary based on this fact. Hexadecimal is base 16, using the characters 0-9 and a-f, each nybble is able to represent values 0-15. Binary works by base 2, using only the values 0 or 1, corresponding to the on or off state. Binary is the same as our own numerary system, the key difference being that there are only 2 'numbers' (0-1 instead of 0-9) that a place value can hold.

Bitwise Math

Basic Addition

Much like the decimal system, binary numbers can be added together. For this example, we are going to use the binary numbers 0110 and 0010 and add them.

Thus by using decimal addition(4 + 2 + 2 = 8), we can determine the value of the two binary numbers together is 8.

Binary to Hexadecimal

For the past exercises, we have been working with 4 bits at once (4 values ranging from 0-1, e.g. 0001). This is a nybble in hexadecimal. A byte is made of two nybbles as 8 bits make a byte. In hexadecimal, we have a 1’s placeholder and a 16’s placeholder. Hexadecimal is 0 through 9 and A through F. A nybble can hold 16 unique values but the highest value is 15 because one of the values is 0. A nybble is a single hex digit. So, A = 10, B = 11, so on and so forth, F = 15.

So in hex, say we’ve got AF as a byte, AF = 175 in decimal because A is in the 16’s placeholder, A = 10, 10*16=160, plus F which is in the 1’s placeholder, 15*1=15. Therefore 160(A)+15(F) = 175.

NOT, AND, OR and XOR

NOT

Not is an instruction that takes only ONE operand. The best way to describe it is that it inverts the binary value.

Example:

 A = 1010 in binary or 10 in decimal. NOT A results in the inversion of 1010 which is 0101. Therefore NOT A = 5.

AND

Our next instruction is AND, which returns “TRUE” per bits that are the same and takes two operands. True is 1 and false is 0. It operates bit by bit, just like NOT. AND compares each bit and if both bits per placeholder are true, then it returns a true for that placeholder, all else gets turned into 0.

Example:

               -----------
 6 = 0110 so...> 0|1|1|0 < - The second and third bits are true.
               -----------
 5 = 0101 so...> 0|1|0|1 < - The second and fourth bits are true.
               -----------
 0100          > 0|1|0|0 < - The second bit is the only true values in both 6 and 5.
               -----------

OR

OR will return true for each placeholder if ANY of the bits are true.

Example: 5 OR C

 (0101 = 5) OR (1100 = C) = 1101 which equals D.
               -----------
 5 = 0101 so...> 0|1|0|1 < - The second and fourth bits are true.
               -----------
 C = 1100 so...> 1|1|0|0 < - The first and second bits are true.
               -----------
 D = 1101      > 1|1|0|1 < - The first, second and fourth bits are true in at least one instance.
               -----------

Table of OR:

XOR

Xor is kind of a strange command, if the placeholder bits are different, it returns a true bit. If they are the same, it returns a false bit. Thus, anything XOR’d with itself, results in 0.

General Examples:

 1 xor 1 = 0

 0 xor 0 = 0

 1 xor 0 = 1

Detailed Example: A xor F = 5

               -----------
 A = 1010 so...> 1|0|1|0 < - The first and third bits are true.
               -----------
 F = 1111 so...> 1|1|1|1 < - The first, second and third bits are true.
               -----------
 0101 = 5      > 0|1|0|1 < - The second and fourth bits are true in ONLY one instance as opposed
                             to two found in bits 1 and 3.
               -----------

The 1’s placeholders are the same so they return 0, same with the 8’s placeholder. The 4’s and 2’s are different, therefore return true. XOR is really WHICH BITS ARE NOT THE SAME.

Analyzing Code

Time to go to expanded view and show you WHY the addresses work the way they do, notice that the machine code in the middle contains a certain amount of bytes. Now we'll take a look at the expanded view of the execution stack or what is refered to as the .text segment. Instead of viewing it by one line of assembly instructions at a time, we'll view it one Byte at a time.

Now if we look at the expanded view, we can tell how 0x101c87a2 is the beginning of the next line of code, and even get a feel for certain raw instructions. How can we do this? Well, we can see the code for each instruction:

<syntaxhighlight lang="asm"> mov eax, 1 ; \xb8\x01\x00\x00\x00 add eax, 3 ; \x83\xc0\x03 </syntaxhighlight>

So lets rip this apart a little bit. We know that the eax register can contain a DWORD value, so lets extrapolate on the mov eax, 1 instruction. Because eax can hold a DWORD value, we can safely assume that the machine code instruction for moving or setting a value to the eax register must be done in proper DWORD format, that is, it must take 4 bytes. So we notice that the value \x01 is followed by \x00\x00\x00. These are three "null bytes". Seeing these null bytes and knowing the way that assembly operates, we can safely say that the value of eax is assigned backwards in DWORD format. Following all of these logical trains of thought, we can draw the following conclusions:

The machine code instruction "\xb8" is equivilent to mov eax, [dword].

<syntaxhighlight lang="asm"> mov eax, 1  ; \xb8 \x01\x00\x00\x00 mov eax, 0x00000001 ; \xb8 \x01\x00\x00\x00 </syntaxhighlight>

All of these instructions are synonymous. Now lets analyze the add eax, 3 instruction:

<syntaxhighlight lang="asm"> add eax, 3 \x83\xc0 \x03

add eax, \x03 \x83\xc0, 3 </syntaxhighlight>

Can also be seen to be all synonymous. Therefore we can draw the conclusion that the machine code instructions \x83\xc0 is equivilent to the assembly instructions add eax, [byte].

Instructions & Concepts

Registers

So, now we have a good framework of the concepts of assembly language, but how can we see them be utilized to actually do something? Well, we'll start with explaining a bit about registers. General purpose registers on an intel 32 bit processor are 4 bytes in length, also referred to as a "double word" or "DWORD". A Byte consists of 8 bits. It takes four bits to compose a hexadecimal digit, or a nybble.

There are other forms of "words" in assembly - these are naming conventions that refer to "chunks" of data. The computer can handle all this data running into each other, but we use these naming conventions to avoid confusion - for example, attempting to copy 4 bytes of data into a 2-byte register will end in disaster.

A DWORD is, as previously noted, 4 bytes in length. All the registers on an intel 32 bit processor are DWORDS. There are also WORDS, which are a meager 2 bytes in length. There are also bytes and nibbles, which are composed of bits, the 'indivisble unit' of a computer.

NOTE: Some naming conventions choose to call a 4-bytes chunk a WORD and a 2-byte chunk a HALFWORD. It doesn't matter which convention you use, so long as you are consistent.

Although a register is 4 bytes in length, it is not always necessary to use the entirety of the register. For operations requiring an increment smaller than 4 bytes, each register is split into subregisters. Take %eax, for example. The least significant 2 bytes of %eax form their own subregister, which is referred to as %ax. These are further divided into the 1 byte subregisters, %ah and %al. %ah is the most significant byte of %ax, and %al is the least significant byte.

This syntax persists with other registers - for example, instead of %ax, %ah and %al, the register %ebx has %bx, %bh and %bl. Special purpose registers also have their subregisters. %ebp, %esp, %esi and %edi are split into %bp, %sp, %si and %di. However, the special purpose registers are not subdivided past their WORD-sized subregisters.

The WORD sized subregisters are sometimes known as 16-bit subregisters, while the 1-byte subregisters are sometimes known as 8-bit subregisters. Likewise, the normal DWORD registers such as %eax are known as 32-bit registers, hence the name "32-bit processor".

There is another form of register beyond the 32-bit registers that are only found on 64-bit processors. These registers can hold a single QWORD, which is equal to 8 bytes. These are prefixed with the letter 'r' - for example, %eax is the least significant 4 bytes of the larger register %rax, which is 8 bytes. Likewise, there is %rbx, %rcx, %rdx, %rbp etc...





Subregisters can be used not only for size optimisation, but also to perform operations on the register as a whole. If you wished to zero out only the least significant byte of %eax while leaving the rest untouched, you could simply do

<syntaxhighlight lang="asm">xor %al, %al</syntaxhighlight>

A register can be considered to be a fundamental variable; they can store variable data of a fixed size (up to 4 bytes in intel 32-bit processors) and are limited in number. You cannot create new registers; there is a set of registers hardwired into the processor, and you must work with these. Some of the registers can simply be used as variables, whereas others have specific function - like the instruction pointer, which holds the memory address of the next instruction to be executed. When an instruction is executed, one of the available gates (which determine the possible instructions that a processor can carry out) is used. The function of the gates is simply to receive a value, perform an operation on it and return it.

Because of the shortage of available registers, some registers - particularly the general purpose ones - will serve many functions. For example, eax can serve as a general variable. When making a kernel interrupt however, the value stored in eax is taken as the argument for the system call to be executed. Likewise, the values in ebx, ecx and edx are used to represent arguments to the syscall made.

The general-purpose registers include eax, ecx, ebx, edi, and edx. Other, non general purpose registers are esi, esp, ebp, and eip.

Special Registers

These registers are not intended to be used for general data processing, but have some specific function that they are used by the processor for.

ESP

Stack Pointer - This register remembers the current index of the stack. At the beginning of the small code with the pushes, esp is 0x100010ff, and then it becomes 0x100010f8, f0, so on and so forth as DWORD values are pushed onto the stack. The program uses this to keep track of where it is pushing and popping data from inside of the stack.

Whenever a new value is added to the stack or removed from it, the value stored in esp is changed. For example, if the top of the stack is located at address 0xbffffb1c, then the value held in esp will be 0xbffffb1c. However, if I push a 4-byte value onto the stack, then 4 will be subtracted from the value in esp (remember, the stack grows downwards so by subtracting we are moving the top of the stack up) so that it now points 4-bytes higher in the stack that it did before, to the new top of the stack.

EIP

Instruction Pointer - This register represents the location of the actual code executing. For example, when the instruction 'add eax,1' is to be executed, the memory address in eip will be the address where the opcode \x83 (which represents the instruction) is located in our program. EIP can be dangerous if not secured properly, as being in control of eip will allow you to execute whatever memory it points to as if it was executable code - in buffer overflows, this is exploited to overwrite eip with the address of injected code in the buffer, thus executing arbitrary code.

EBP

Base Pointer - This points to the very bottom of the stack, however it can be used to hold addresses of other bases. It is common practice when using the C Calling Convention to push the value of ebp onto the stack, then use ebp to store the current value of esp so that when esp changes, ebp can still be used as a pointer to the top of the stack at the point that ebp was stored.

ESI

Function call register - when a function is called using the call instruction, the location of the beginning of the function is placed into esi.

Needless to say, our goal when attempting a buffer overflow is going to be manipulating the value of the eip register to make the computer execute our code as opposed to the original code. There are several ways to do this, but first we need to look at a few of our "special instructions" in assembly:

Instructions

So lets test out a few small instructions to get the hang of this. In intel syntax, to put the value of 1 into eax, we will say

<syntaxhighlight lang="asm">mov eax, 1</syntaxhighlight>

In AT&T System V syntax, we would say

<syntaxhighlight lang="asm">movl $1, %eax</syntaxhighlight>

Intel syntax uses the format:

 [instruction] [destination],[source]

Whereas AT&T System V syntax uses the syntax format:

 [instruction] [source],[destination]

Now in our small amount of code, eax = 1. If we want to add 3 to eax, we would say:

Intel:

<syntaxhighlight lang="asm">add eax, 3</syntaxhighlight>

AT&T:

<syntaxhighlight lang="asm">addl $3, %eax</syntaxhighlight>

This is the simple explanation of some instructions. A full list of instructions and a table of their purpose is as follows :

Basic Arithmetic

Bitwise Operations

• xor
• or
• and
• not
• test
• shl
• shr
• ror
• rol

Control Flow & Stack Instructions