Malware Handbook
  • Preface
  • Author
  • Prerequisites for Malware
  • Prerequisites for Lab Set-Up
  • Setting Up Labs
  • Download Sample Malware Exercises
  • Intro to Assembly Language
  • Assembly Language Basics
  • Commonly Used Instructions
  • Win32 Assembly Programming
  • PE Format
    • PE32
    • PE32+
  • Malware
    • Types of Malware
    • Malware Classification by Windows Defender
    • Sourcing Malware
  • Malware Development
  • Malware Analysis
    • Malware Analysis Methodologies
      • Static Analysis
        • Static Analysis Tools/Methods
        • Static Analysis of Sample Files
      • Dynamic Analysis
        • Dynamic Analysis Tools/Methods
        • Analyzing Files with Regshot, Process Monitor, and Wireshark
        • Analyzing calc.exe and Network Activity
      • Manual Code Reversing
        • Reverse Engineering Simple Windows Executable Files
        • Reverse Engineering re_lotsastuff.exe
        • Reverse Engineering re_lotsastuff.exe Using Ghidra
      • Analyzing PowerShell Scripts
      • Analyzing JavaScript Samples
        • Analyzing JavaScript in HTML
      • Analyzing Macro Code in Office Documents
      • Setting Up REMnux Environment
        • Setting Up and Configuring FakeNet in REMnux
      • Analyzing an ELF File
      • Analyzing ASPX Webshells
      • Analyzing JAR Files
    • SAMPLE NOTES (of Notes.txt)
Powered by GitBook
On this page

Assembly Language Basics

Overview

  • Assembly Language: Low-level language close to machine code.

  • Focus: Understanding how assembly language works, specifically x86 assembly, rather than mastering a specific type.

Memory Architecture

  • Little-Endian: Values are written with the least significant byte first.

    • Example: 32-bit double word 0x1BA583D4 is written in memory as D4, 83, A5, 1B.

Instruction Format

  • Operands: x86 instructions can have 0-3 operands. Typically follows the format mnemonic destination, source.

    • Mnemonic: Reserved name used for operations (e.g., MOV for copying values).

    • Opcode: The actual operation code interpreted by hardware.

    • Example: MOV EAX, 0xCODE5AFE - MOV is the mnemonic, EAX is the destination, and 0xCODE5AFE is the source operand.

Registers

  • Data Registers: Used for arithmetic, logical, and other operations.

    • 32-bit Registers: EAX, EBX, ECX, EDX

      • 16-bit Versions: AX, BX, CX, DX

        • 8-bit Versions: AH, AL, BH, BL, CH, CL, DH, DL

    • Primary Accumulator: EAX (used in I/O and arithmetic operations).

    • Base Register: EBX

    • Count Register: ECX (used for loop counts).

    • Data Register: EDX (also used for I/O operations).

  • Pointer Registers:

    • 32-bit: EIP, ESP, EBP

      • 16-bit: IP, SP, BP

    • EIP: Instruction pointer (offset address of the next instruction).

    • ESP: Stack pointer (points to the top of the stack).

    • EBP: Base pointer (references parameter variables in the stack).

  • Index Registers:

    • ESI: Source index (used for string operations).

    • EDI: Destination index (used for string operations).

  • Control Registers (Flags):

    • ZF (Zero Flag): Set to 1 if the result of an operation is zero; 0 otherwise.

Segments

  • Code Segment (CS): Contains executable code.

  • Data Segment (DS): Contains data.

  • Stack Segment (SS): Contains stack data.

  • Extra Segments (ES, FS, GS): For additional data storage.

64-bit vs. 32-bit Registers

  • 64-bit Registers: Use R prefix (e.g., RAX, RBX, RCX, RDX).

    • New Registers: R8 to R15.

    • Stack Size: Larger.

    • Flags: RFLAGS register.

Stack

  • Purpose: Used for temporary data storage, passing arguments to functions, and saving register values.

  • Instructions:

    • PUSH: Stores a value on the stack.

    • POP: Removes a value from the stack.

PreviousIntro to Assembly LanguageNextCommonly Used Instructions

Last updated 9 months ago