banner
lca

lca

真正的不自由,是在自己的心中设下牢笼。

"Learning Notes - 6 (Integers and Logical Operations) of 'Starting from Zero to Learn IDA Reverse Engineering'"

6.1 Integer Arithmetic Instructions#

ADD#

The ADD A,B instruction adds the value of B to A and stores the result in A. A can be a register or a memory value, while B can be a register, a constant, or a memory value. However, A and B cannot both be memory values in the same instruction.

In the example shown in the image, the first operand is a register and the second operand is a constant. When the program is executed, the constant is added to the register value, and the result is stored back in the register.

Another example in the image shows the ADD instruction adding a constant to the value stored at the memory address pointed to by ECX. If the program has write permission for this address, the calculated result will also be stored at that address. For example, if ECX is 0x10000 and the constant is 0xffffffff, the address 0x10030 will be added to 1, resulting in 0, which will be stored at the address 0x10030.

The ADD instruction allows for various combinations of registers and memory values as long as A is not a constant and A and B are not both memory values.

SUB#

The SUB A,B instruction is similar to the ADD instruction, but it subtracts the value of B from A and stores the result in A. The allowed combinations of operands for SUB are the same as those for ADD.

INC & DEC#

The INC A and DEC A instructions increment and decrement a register or a memory value by 1, respectively. These instructions are often used to manipulate counters.

IMUL#

The IMUL instruction performs signed integer multiplication. There are two ways to use this instruction: IMUL A,B and IMUL A,B,C.

In the first case, A and B are multiplied, and the result is returned to A. In the second case, B and C are multiplied, and the result is returned to A.

In both cases, A can only be a register, B can be a register or a memory value (constant in the first case), and C can only be a constant.

IDIV#

The IDIV A instruction specifies the divisor for division. The dividend is not specified because its storage location is fixed.

In 32-bit operations, EDX and EAX form a 64-bit number, with EDX as the high part and EAX as the low part. When this 64-bit number is divided by A, the quotient is returned to EAX and the remainder is returned to EDX.

6.2 Logical Operation Instructions#

The logical operation instructions include AND, OR, XOR, NOT, NEG, SHL, SHR, ROL, and ROR.

AND, OR, and XOR perform bitwise operations on two operands and store the result in the first operand. The allowed combinations of operands are the same as those for ADD and SUB.

XOR is often used to clear a register by performing XOR with itself. For example, XOR EAX,EAX clears the EAX register.

AND, OR, and NOT can also be used to manipulate specific bits in a register or memory value.

NEG negates the value of A by converting it to its two's complement representation.

SHL and SHR shift the bits of A to the left or right by a specified number of positions, filling the empty positions with 0. ROL and ROR rotate the bits of A by a specified number of positions, with the bits that exceed the boundary being returned to the other end.

These instructions provide the foundation for integer and logical operations in assembly language.

Loading...
Ownership of this post data is guaranteed by blockchain and smart contracts to the creator alone.