banner
lca

lca

真正的不自由,是在自己的心中设下牢笼。

"Learning Notes on IDA Reverse Engineering from Scratch" - Chapter 3 (Registers)

image

3.2 Registers#

For example, in the ADD instruction, two numbers in memory cannot be directly added together. The processor must transfer one of the numbers to a register and then add it to the number in another memory address.

The 32-bit general-purpose registers are: EAX, ECX, EDX, EBX, ESP, EBP, ESI, EDI, and EIP.

image

image

  • EAX (accumulator): EAX is commonly used for arithmetic operations and some formatting instructions.
  • EBX (Base index): EBX is commonly used to store the starting memory address.
  • ECX (counter): ECX is used as a counter for various instructions. It also stores the address offset of memory data. Instructions that use the counter include string instructions, offset instructions, shift instructions, and loops.
  • EDX (data): EDX is usually used to store partial digits of a product and the remainder of a division. It can also store the starting memory address.
  • EBP (base pointer): EBP points to a memory address and is mainly used as a base address for parameters and variables in a function.
  • EDI (destination index): EDI is commonly used in string instructions and points to the destination string.
  • ESI (source index): ESI is commonly used in string instructions and points to the source string.
  • EIP: Stores the address of the next instruction to be executed.
  • ESP: Stores the top address of the stack.

The mind map is as follows:

image

image

For EBX, there are BX, BH, and BL sub-registers. For ECX, there are CX, CH, and CL sub-registers. For EDX, there are DX, DH, and DL sub-registers. The 9-16 bits of other general-purpose registers are not named and cannot directly access their contents.

The most basic is that BYTE occupies 1 byte (8 bits) of memory, WORD occupies 2 bytes (16 bits) of memory, DWORD occupies 4 bytes (32 bits) of memory, and QWORD occupies 8 bytes (64 bits) of memory.

64-bit32-bit16-bit8-bit Low8-bit Highcomment
RAXEAXAXALAH
RBXEBXBXBLBH
RCXECXCXCLCH
RDXEDXDXDLDH
RSIESISISIL-
RDIEDIDIDIL-
RBPEBPBPBPL-base pointer
RSPESPSPSPL-stack pointer
R8R8DR8WR8B-
R9R9DR9WR9B-
R10R10DR10WR10B-
R11R11DR11WR11B-
R12R12DR12WR12B-
R13R13DR13WR13B-
R14R14DR14WR14B-
R15R15DR15WR15B-
RIPEIPIP--
RFLAGSEFLAGSFLAGS--

Registers and Sub-registers

image

Data TypeSize(Bits)Typical Use
Byte8Characters, small integers
Word16Characters, integers
Doubleword32Integers, single-precision floating-point
Quadword64Integers, double-precision floating-point
Double Quadword128Packed integers, packed floating-point

Basic Data Types and Memory Occupancy

3.3 MOV Instruction#

The MOV instruction is a data transfer instruction that copies the contents of the source operand (src) to the destination operand (dest).

MOV EAX, EDI

image

In most cases, we can transfer data directly between registers, but the EIP register cannot be directly assigned or read. For example, the instruction MOV EIP, EAX is illegal.

In IDA, when the word "OFFSET" appears before an address, it refers to the value of the address itself, and when the word "OFFSET" is not present, it refers to the content stored at that address.

Loading...
Ownership of this post data is guaranteed by blockchain and smart contracts to the creator alone.