x86 Assembly Crash Course
Вставка
- Опубліковано 15 тра 2024
- Written and Edited by: kablaa
Main Website: hackucf.org
Twitter: / hackucf
Facebook: / hackucf
More resources: github.com/kablaa/CTF-Workshop
Music:
"Voice Over Under" Kevin MacLeod (incompetech.com)
Licensed under Creative Commons: By Attribution 3.0
creativecommons.org/licenses/b...
"Twisted" Kevin MacLeod (incompetech.com)
Licensed under Creative Commons: By Attribution 3.0
creativecommons.org/licenses/b...
www.bensound.com
www.purple-planet.com/
If you can read assembly everything is Open Source !
Yeah well, if you like to read through 10 times the loc's of the original project in a particular language ;D
And if you can bruteforce a 512 bit encryption key by looking at it then all doors are open. Pretty much the same statement.
When I look at instruction sets all I see is redheads, brunettes and blondes 😜
@@hereb4theend Nice try, Cypher! 😂
@@Engineer9736 Eventually those encrypted instructions will need to be loaded into memory in an unencrypted state to be ran by the CPU, from which you could then dump the memory, retrieve the machine instructions, convert to assembly, then convert to a higher level language (to varying degrees of success). It just wont end up in much of a readable state, but you'll have it! haha
This is 1000 of google searches simplified and compressed to 11 minutes. Thank you!
damn yes🔥🔥
Exactly! This is exactly what it felt like for me! ...moreover, he explained VERY well!
said a whole lot of nothing
Hell ya! Holy smokes, this 11 minute video help me make sense of things I've learned from other assembly videos.
For Me It's About 50 Google Searches
Holly crap! this was more useful than whole semester on my university. Please keep doing those videos. Thank you very much.
to understand all of this just watching it one time (in 10 mins) you should have gone to that semester
is like a summarising video
awesome video
that was way more informative than my whole semester......true story...
If you guys are doing computer science and you haven't covered all this yet then you must be in your first year.
Absolutely Bud.
eh you probably did not go through a good class i should say? check out something i did pre-university (10th grade) nand2tetris.org.....
For those who might find it useful, this is the transcription of the video (I wrote it to memorize better and to check it whenever I want):
Compilers read the .c file and convert the code into a sequence of operations: each operation is comprised of a sequence of bytes: operation code or opcode. The instructions executed by reading opcodes is impossible, so Assembly translate these instructions into a human-readable language.
ELEMENTS OF AN EXECUTABLE:
Every C program has 4 main components: heap, stack, registers and instructions. The two main architectures that dictate how a program is compiled and executed are 32-bit and 64-bit architectures.
The heap:
The heap is an area in memory designed for the purpose of manual memory allocation. The inner workings of the heap are incredibly complicated. Memory is allocated on the heap whenever functions as malloc and calloc are called or global or static variables are declared.
Registers:
Registers are small storage areas in the processor, used to store memory addresses, values or anything that can be represented with eight bytes or less. In the x86 architecture there are six general-purpose registers: EAX, EBX, ECX, EDX, ESI and EDI, generally used on an as-needed basis. There are also three registers reserved for specific purposes: EBP, ESP and EIP.
The stack:
The stack is a data structure comprised with elements added and removed with two operations, push and pop: push adds an element at the top of the stack and pop removes the top element from the stack. Each element on the stack is assigned to stack address: elements higher on the stack have a lower address than those on the bottom, so the stack grows towards lower memory addresses. When a function is called, that function is set up with what is called a stack frame: all local variables for that function will be stored in that function stack frame. The EBP register, also known as the base pointer, contains the address of the base of the current stack frame, and the ESP register (stack pointer) contains the address of the top element of the current stack frame. The space between these two registers make up the stack frame of the function currently called. All the stack addresses outside are considered to be junked by the compiler.
Let's take for example a function that takes one variable as a parameter and declares two local integers like that:
void func(int x){
int a = 0;
int b = x;
}
First the value of the argument is pushed onto the stack, then the return address of the function is pushed onto the stack. The return address is the four byte address of the instruction executed when the function has gone out of scope, then the base pointer is pushed onto the stack, then the stack pointer is given the value of the base pointer and finally the stack pointer is decremented to make room for the local variables. The number of bytes that the stack pointer is decremented by may vary depending on the compiler. All the space in memory between the stack and the base pointer is the function stack frame: this sequence of instructions is the function prologue, performed when a function is called. Since "a" is initialized to 0, the value will be moved into the memory address 4 bytes below the base pointer because an integer is 4 bytes, so the local variable is now a location EBP -4. The value of a function argument is stored 8 bytes above the base pointer, which is not in the function stack frame. Values of the stack cannot be moved directly to another location on the stack, so general-purpose registers come in: the value of the argument to the function must first be copied into one of these, then the value is moved into the memory address 4 bytes below the first variable and eight bytes below the base pointer. Both of the local variables have been now initialized and can be used later.
There are two syntaxes that Assembly is normally written in: AT&T and Intel. The instructions are the same.
We use the Intel syntax.
Every instruction has two parts: operation and arguments: operation can take either one or two arguments: if an operation take two arguments they're separated by a comma.
The mov instruction takes two arguments and copies the value of the second one in the location referred by the first one. But, if for example we want to move a local variable (stored at EBP -8) on the stack into the EAX register, if the command were to read "move EAX, EBP -0x8" this would not copy the value of the variable into the register, because EBP -8 is the address on the stack where the variable is located, so instead the instruction would copy the address if the variable into the register. To copy the actual value or what EBP -8 is pointing to we use "[]" (like the dereference operator in C): when they're used the value being pointed to is referenced.
The add instruction takes two arguments: it adds their values and stores the result in the first one. For example, if eax has the value of 10, "add eax, 0x5" updates the value of eax to 15.
The sub instruction works the same way, but the value of the second argument is subtracted from the first.
The push instruction places its operand on the top of the stack: it first decrements the stack pointer and then places its operand in the location that it points to.
The pop instruction takes a register as an argument, moves the top element of the stack into that register and then increments the stack pointer.
The lea instruction (load effective adrress) places the address specified by its second operand into the register specified by the first one. It's usually used for obtaining a pointer into a memory region.
The control flow of an executable is where all of the if statements and loops in the code come together to determine the order in which instructions are executed. Every instruction has an address: this is the area in memory where the instruction is stored. The EIP register always contains the address of the instruction that is currently being executed, so the computer executed whatever the instruction pointer is pointing to and then the instruction pointer will be moved to the next one.
The compare instruction is an equivalent of the sub one, but instead of storing the result into the first argument it will set a flag in the processor that contains the value 0, greater than 0 or less than 0. For example, "cmp 1, 3" subtracts 3 from 1 and since -2 is less than 0 the flag will be set accordingly.
Compare instructions are followed by a jump instruction: it takes an instruction address as its argument, checks the current state of the flag and, depending on the state, sets the instruction pointer to its argument. There are many types of jump instructions: some include jump if equal to, jump if not equal to and jump if greater than.
The call instruction calls a function, whether it be a user-defined function or a PLT function (like printf or scanf). It takes one argument and it will push the return address of the function being called onto the stack and then move eip to the first instruction of the function.
The leave instruction is called at the end of every function and it destroys the current stack frame by setting the stack pointer to the base pointer and popping the base pointer off the top of the stack. The return instruction always follows a leave instruction and, since the base pointer has already been popped off the stack, the return address of the function is now on the top of the stack. The return instruction will pop the return address off the top of the stack and then set the instruction pointer to that address.
UA-cam needs a way to store comments!
@@pedromatias5927 copy paste into notepad++
Oh, this is a perspective on how C programmer can understand assembly language. ...Good work....
I am not familar with C. In assembly we do not have to use the calling convention if we want to call one of our subroutines. We can place values for the subroutine inside of CPU register and into the data segment. We can use values of the data segment any time within nested subroutines no matter where the stack pointer is and nothing get lost. Push/Pop instructions are slow on older x86 before Pentium 4.
We can use the LEA instruction on 80386+ for calculating values.
No memory access, no flags touched, the result have fit into the target.
Example with intel syntax:
LEA eax, [eax+ebx*4+224]
It perform two addition and a multiplication in one instruction.
Element of a 16 bit executable
An executable com file starts with CS=DS=SS and a segment size of 64kb at the address cs:0100. It contains no header, only mashine code and data. Ready to switch into the 64 bit mode and start all cores of the multicore CPU.
Did that dude just check back at his notes in the first 3 seconds to remember his name? I fucking love this dude already.
Lmao I wish he would've continued this serious though. Very easy to understand and straight to the point.
😂 gave me a laugh , thanks for pointing.
the only video I ever watched at 0.75x. Absolutely fantastic.
(80% of explainer videos have to be watched at 1.5x)
I started the video thinking I was going to let down by the length, but since it was so short, it wouldn't hurt to watch. Then I saw how good the video was. Damn.
This is literally one of the best instructional videos I have ever watched in my life period. Fantastic job
Damn, that CMP/JMP stuff was so well explained, realizing it's just a SUB instruction essentially makes it and the following JMPs make so much more sense! Thank you!
This was really well done. This is probably one of the best I have come across and it's now 2021.
Thanks for making this! I have an Assembly class this quarter and this is really helping me get ahead of the curve.
Thanks so much. I'm taking the OSCP course and I'm on buffer overflows trying to comprehend how shell code is injected and executed and this is the only video I could find that actually helped me understand how the stack works.
Man I can't thank you enough for this video, it's so sad that you never got to make another one explaining how to overflow a buffer, stack protection and so on. Great work on this one, hope you can make another one eventually.
This is the best explenation I have heard so far! A little bit fast sometimes but soooo comprehensive! So glad you didnt just name push, pop and prologue/epilogue but also went for lea, cmp, jmp & flag!
One of the best tutorial for starting, love the bg music, life saver!
I love this video. You understood what you were teaching and you didn't waste your words and neither did you leave abstract concepts undefined.
Well done !!! 👍👍👍
I've been coding for 20 years. Recently I was considering adding conditional breakpoints to an app I use. I knew it was going to get messy so I figure a bit of information about how Assembly works might motivate me. I tell you what, this video damn sure made me motivated. Excellent work.
Fantastic and coherent explanation. You earned yourself a sub. This might be the quickest/clearest explanation of the basics of how x86 works.
Essentially the same explanation I've read on multiple websites and heard in multiple UA-cam videos, yet just as vague and unsatisfactory.
Morris Laurent You can't become competent in Assembly in a short period of time. You have to want to become good at it *and* you have to devote yourself to it. Dump all your socializing and focus on Assembly because it's more important than all humans.
Note that I capitalized the 'A' in the word 'Assembly' because Assembly rules. It eliminates the middle man, (any high level language).
In addition you must have high discipline and a high tolerance for tedium.
If you love playing games like CandyLand forget Assembly.
So much info cramped in such a short video - and despite that you managed to explain everything clearly. That's talent right there
Dude, you are unbelievable good and explaining!! Do not stop what you are doing, you're contributing to society more than you realize!
Great video. You managed to condense everything I needed to know into 10 minutes, and still made it easily absorbable.
WHERE HAVE YOU BEEN ALL MY LIFE
Well No one wait for none in this COmputer world...!!!!!..jzppatelut...
He was hiding in Greenland.
One of the best tutorial video I have ever seen! Concise, informative, easy to understand! Very good work
Awesome video! I've read chapters in books that didn't explain as much as you did in 10 minutes! Answered a lot of questions I used to have. Thanks!
Awesome work! Looking forward to seeing more of your videos on this topic.
I love you so much for this I wanna cry
This was an amazing video... please continue to make more of these.
Finally! One video at the perfect pace with the perfect amount of information!
Awesome!. I needed to remember ASM and this video was a kind of flashback to me.
Wow! Such a great summary of assembly language, a great refresher! Sadly it is three years old and you never made any more videos. This was a great promising start for a new interesting channel, although a niche topic for most. I thoroughly enjoyed the way you explained. Great video!
There's such a lack of instructional videos on assembly language and this was so helpful
Best tutorial I have ever seen on this subject. Keep it that way.
Hi, is that it? no more videos? I liked what you showed and how you presented it. great potential and interesting topic.
The best video explaining registers on UA-cam. Thank you so much!
Absolutely brilliant, thanks so much!
Really good and concise video with no waffling, great job and keep up the good work.
great video man! although your going fast, you explained everything in a clear manner. I wish our University had tutors like you available for assembly programming.
This video enhanced my understanding of x86 assembly far beyond anything that I have encountered before and since. Excellent material.
man thanks, you seriously helped me a lot, this finally explains everything very clear, respect for this
wow thank you, i love you, will probably (definitely) rewatch!
holy crab, how good of a teacher can one person be!!
this 10 minutes crash course packed more info than i got in a full semester in college, all while being clear and understandable!!
i love it.
Thank you for this great video! It helped me a lot to understand what was on the lectures on my university. It's been quite a while since you published it, but i hope you will make more videos like this.
Oh my god, I have been searching like hell for a video like this. Now I can do my lab. THANK YOU!
This is an awesome lecture I ever witnessed. Thanks man
Annnnnnd just about everything I was confused about was clarified in 10 min. Thank you! I was disappointed to not see anymore uploads. The video made it seem like there was a series. :[
"Hi! My name is Jericho and I'll be leading you on your journey through binary exploitation!"
*Doesn't upload for 4 more years*
Lol
@@abdarafi I think this was enough for 4 years tbh xD
@@makewayforsucess yea Xd assembly is difficult...(but you can understand MS DOS's source code if you know it..)
he must be an intp
I think he gave everything he's got in one go. I thank him anyway.
You are a life saver. Thank you for uploading this video!
The quality of this video is just outstanding
This is incredibly well made. Thank you so much!
I get genuinely excited watching this guy get stoked on these principles
EPIC explanation!!
This was the best video on assembly I've seen so far
Thanks for sharing. Excellent explanation!
went through when I first started video editing, now it's taking a whole new switch and learning soft will only boost my courage for the
Thank you for summarizing a whole class, i remember a good portion now to revisit sample problems (:
That was quite a lot of information in a very short time for someone who didn't know anything about x86 architecture before, but I really appreciate you for not bullshitting around. I'll come back to this video once I have read a bit up on those 20 new terms 😄
Thank you for your Video 🙏
The connection between jump instructions and how we define "Turing Completeness" (operability locating memory/instructions) just clicked a little better in my brain....awesome
Thank you so much for this tutorial. In my opinion you do *not* speak too fast. It is after all, a crash course- not a slow float to the ebp. Extremely helpful and thorough with plenty of room for fresh rabbit holes to fall down (like heap!) Many thanks, and I look forward to checking out more!
THANKS ALOT BUDDY!! CERTAINLY MORE USEFUL THAN WHAT I LITERALLY DID IN THE 2ND YEAR COMPUTER SCIENCE CLASSES
I can say without a doubt this is one of the best videos I've ever seen on youtube.
awesome, now I just need to see a couple more of these and I'll be caught up on what we learned in lecture this week
Phenomenal video concisely explaining x86, much needed for an exam I have next week.
Hey, I hope you keep making this videos, you're an awesome teacher, please I'm waiting for more
Fuking awesome, computes are absolutely awesome, thanks!
Maaaaan this video is great! Keep them coming if you have time.
please keep going to upload more videos this is very helpful
i wish all the internet was with tutorials like this
Amazingly clear explanation!
Amazing video!!!! Thank you SO much for making this, really helped me!
Fascinating stuff. Thanks for your clear explanation. It felt like I learned a lot.
Very informative! Waiting to learn more from your upcoming videos. Thank you.
Amazing. Thank you for making this.
Awesome video!!! wish you could do more.
I understand so much now.
Damn, this was awesome... keep up the great work!!!! learned a lot from this.
Wow! Beautifully done. If you don't teach for a living you should. You were straight forward and to the point. Every sentence had a purpose with no junk we didn't need to know. Subscribed!
Wow dude your explanations are amazing!
This crash course is literal gold. I tip my hat to you sir
Thank you for this clear and vivid explanation
This video is so good. Thank you.
Holy shit, you were right about the amount of information but your explanation pace and clarity makes it very easy to follow. Good work!
wow! just wow! man thanks a ton...this is gold
I know it's supposed to be a video about assembly, but this was a great explanation on how memory works!
Thank you so much, the video was very well explained, keep it up!
Thank you sir, this video was super helpful.
Very well explained in a short concise video
I just learned more in 10 minutes here than an entire semester of assembly in college... great work thanks for the help
Normally i watch at 2x speed cause videos go to slow. Here i needed to rewatch parts to try and keep up. nicely done.
This was about equivalent to 4 lectures, in 10 minutes. Thanks for the review
You are underrated mate. Suscribed. This is GOLD.
Great video, very clear, concise and to the point. Thanks!
Man Oh Man!
You just saved my endless hours of googling and tinkering with pdfs!
TYSM!
This is so clear and helpful! Thank you so much!
Dammnn son, you really do come in clutch when needed.
Great stuff! This is really good work. Happily subscribed. Good on ya!
So sad to find this video so late in life and even sadder this is the only video uploaded to this channel. Sub'ing either way just in case.
Awesome video ! Make more of these... !
sadly this guy uploaded only one video
wish there were more though, super helpful stuff
Dude this is so well made... You really earn more subs!
It was a really nice video. Very informative. Hope you will be posting more such videos! :)
This channel is gold already
Best thing watched on UA-cam today. Fuck 3 months of uni's class.
Fantastic video! Thank you ever so much!