Advanced Cybersecurity Programming - Week 6 Notes

EFLAGS Change with Instructions

  • EFLAGS (Status Register): A status register that contains bits (flags) that provide information about the state of the processor after executing an instruction.

    • Each flag is represented by a two-letter symbol.

    • Recognized flags include:

    • CF (Carry Flag): Indicates an overflow in unsigned arithmetic; also indicates a borrow in subtraction.

    • PF (Parity Flag): Set if the low-order eight bits of the result contain an even number of 1 bits.

    • AF (Auxiliary Carry Flag): Set if there is a carry from the low nibble to the high nibble or a borrow from high to low.

    • ZF (Zero Flag): Set if the result is zero.

    • SF (Sign Flag): Set if the result is negative (highest bit is 1).

    • OF (Overflow Flag): Set when the result cannot be represented in the destination type (overflows).

Conditional Branch Instructions

  • Jcc Instructions: Conditional jumps based on specific flags.

    • Examples include:

    • JO (Jump if Overflow): Jumps if OF = 1.

    • JE (Jump if Equal): Jumps if ZF = 1.

    • JB (Jump if Below): Jumps if CF = 1.

    • JG (Jump if Greater): Jumps if ZF = 0 and SF = OF.

Register Conventions

  • Registers: Volatile memory storage located within the CPU.

    • Includes 8 general-purpose registers and the instruction pointer (EIP).

    • General usage includes:

    • EAX: Accumulator register for arithmetic operations.

    • EBX: Base register, often used for data storage.

    • ECX: Counter, used for loop control.

    • EDX: Data register, used for I/O operations and arithmetic.

    • ESP: Stack pointer, points to the top of the stack.

    • EBP: Base pointer, points to the base of the current stack frame.

Stack Parameters and Call Conventions

  • Stack Parameters: Used to manage function parameters/facilitate function calls.

    • Can pass parameters using Registers or Stack (stack method).

    • Common conventions include caller-clean (the caller is responsible for stack cleanup) and callee-clean (the callee cleans up the stack).

Local Variables

  • Local variables are dynamic; they are created when the procedure is invoked and destroyed when the procedure ends.

    • Local variables can be allocated in registers or on the stack.

    • The LOCAL directive is used to define local variables in procedures.

Example: Creation of Local Variables

  • To create variables:

    assembly MySub PROC push ebp mov ebp, esp sub esp, 8 ; Reserve space for two DWORDs mov DWORD PTR [ebp-4], 10 ; Initialize x=10 mov DWORD PTR [ebp-8], 20 ; Initialize y=20

ENTER and LEAVE Instructions

  • ENTER: Automatically creates a new stack frame in procedures by saving the EBP and allocating space for local variables.

  • LEAVE: Reverts to the previous stack frame by restoring the EBP, clearing the current frame.

Practical Applications

  • Practice Lab Tasks:

    1. Set up an empty C++ project.

    2. Work through Irvine's examples related to stack operations.

    3. Complete programming challenges using concepts such as LEA, OFFSET, PROC, and ENDP.