banner
lca

lca

真正的不自由,是在自己的心中设下牢笼。

"Learning Notes on Starting from Zero to Learn IDA Reverse Engineering - 6 (Integers and Logical Operations)"

6.1 Integer Arithmetic Instructions#

ADD#

The ADD A,B instruction adds the value of B to A and stores the result in A. A can be a register or a memory value, while B can be a register, a constant, or a memory value. A and B cannot both be memory values in the same instruction.

In the example shown in the image, the first operand is a register and the second operand is a constant. When the program is executed, the constant is added to the register value and the result is stored back in the register.

Another example in the image shows the ADD instruction adding a constant to the value stored at the memory address pointed to by ECX. If the program has write access to this address, the calculated result will be stored at that address. For example, if ECX is 0x10000 and the constant is 0xffffffff, the address 0x10030 will be added to 1, resulting in 0, which will be stored at the address 0x10030.

The ADD instruction allows various combinations of registers and memory values as operands, as long as A is not a constant and A and B are not both memory values.

SUB#

The SUB A,B instruction is similar to the ADD instruction, but it subtracts the value of B from A and stores the result in A. The allowed operand combinations for SUB are the same as those for ADD.

INC & DEC#

The INC A and DEC A instructions increment and decrement a register or memory value by 1, respectively. These instructions are often used to manipulate counters.

IMUL#

The IMUL instruction performs signed integer multiplication. There are two ways to use this instruction: IMUL A,B and IMUL A,B,C.

In the first usage, A and B are multiplied, and the result is returned to A. In the second usage, B and C are multiplied, and the result is returned to A.

In both cases, A can only be a register, B can be a register or a memory value (constant in the first usage), and C can only be a constant.

IDIV#

The IDIV A instruction specifies the divisor for division. The dividend is not specified because it is fixed.

In 32-bit operations, EDX and EAX form a 64-bit number, with EDX in the high bits and EAX in the low bits. When this 64-bit number is divided by A, the quotient is returned to EAX and the remainder is returned to EDX.

6.2 Logical Operation Instructions#

The logical operation instructions are AND, OR, XOR, NOT, and NEG.

AND A,B performs a bitwise AND operation between A and B, and stores the result in A. The same applies to OR and XOR operations.

XOR is often used to clear a register by performing XOR with itself. For example, XOR EAX,EAX clears the EAX register. The truth table for XOR shows that XORing a number with itself always results in 0.

AND, OR, and XOR operations can also be performed in hexadecimal. In Python, XOR is represented by the "^" symbol.

NOT A performs a bitwise NOT operation on A, flipping all the bits, and stores the result in A. In Python, bitwise NOT is represented by the "~" symbol.

NEG A converts A to its negative value. In Python, this can be achieved by performing bitwise NOT on A and then adding 1.

SHL and SHR instructions perform bitwise left and right shifts on the operand. The missing bits are filled with 0. ROL and ROR instructions are similar, but they rotate the bits instead of shifting them.

This chapter provides an introduction to integer and logical operation instructions in assembly language.

Loading...
Ownership of this post data is guaranteed by blockchain and smart contracts to the creator alone.