1. Practical Session 4 Computer Architecture and Assembly Language

2. Labels Definition - advanced label: (pseudo) instruction operands ; comment valid characters in labels are: letters, numbers, _, $, #, @, ~,., and ? first character can be: letter, _, ?, and. (. has a special meaning)

3. Local Labels Definition A label beginning with a single period (.) is treated as a local label, which means that it is associated with the previous non-local label. Example: label1: mov eax, 3.loop: dec eax jne.loop ret label2: mov eax, 5.loop: dec eax jne.loop ret Each JNE instruction jumps to the closest.loop, because the two definitions of.loop are kept separate. (this is indeed label1.loop) (this is indeed label2.loop)

4. section.data numeric:DD 0x12345678 string:DB 'abc' answer:DD0 section.text global _start ;entry point (main) _start: pushad ; backup registers push dword 2 ; push argument #2 push dword 1 ; push argument #1 CALL myFunc CALL myFunc ; call the function myFunc returnAddress: mov [answer], eax ; retrieve return value from EAX add esp, 8 ; "delete" function arguments popad mov ebx,0 ; exit program mov eax,1 int 0x80 myFunc: push ebp ; save previous value of ebp mov ebp, esp ; set ebp to point to myFunc frame mov eax, dword [ebp+8] ; get function argument #1 mov ebx, dword [ebp+12] ; get function argument #2 myFunc_code: add eax, ebx ; eax = 3 returnFrom_myFunc: mov esp, ebp ; "delete" local variables of myFunc pop ebp ; restore previous value of ebp RET RET ; return to the caller Assembly program with no.c file usage – sample.s GNU Linker ld links together compiled assembly without using.c main file > nasm –f elf sample.s –o sample.o > ld -m elf_i386 sample.o –o sample > sample or with gdb debugger > gdb sample Command-line arguments ld (_start) vs. gcc (main) argv[2] argv[1] argv[0] argc stack ESP &{argv[0],argv[1],argv[2],…} argc stack ESP This is just like C’s main(int argc, char** argv)

5. Producing assembly file for.c file -S (capital letter) option to gcc compiler generates an assembly code to.c program > gcc –m32 –S main.c Compile the following c code with –S option to observe parameters pass in C, compare to material given in class. #include extern int atoi(char*); void main(int argc, char ** argv) { int m, n; if (argc < 3 ) { printf("use : %s num1 num2\n",argv[0]); return 0; } m = atoi(argv[1]); n = atoi(argv[2]); return; }.file "CToAss.c".section.rodata.LC0:.string "use : %s num1 num2\n".text.globl main.type main, @function main:.LFB0:.cfi_startproc pushl %ebp.cfi_def_cfa_offset 8.cfi_offset 5, -8 movl %esp, %ebp.cfi_def_cfa_register 5 andl $-16, %esp subl $32, %esp cmpl $2, 8(%ebp) jg.L2 movl 12(%ebp), %eax movl (%eax), %edx movl $.LC0, %eax movl %edx, 4(%esp) movl %eax, (%esp) call printf jmp.L1.L2: movl 12(%ebp), %eax addl $4, %eax movl (%eax), %eax movl %eax, (%esp) call atoi movl %eax, 24(%esp) movl 12(%ebp), %eax addl $8, %eax movl (%eax), %eax movl %eax, (%esp) call atoi movl %eax, 28(%esp) nop.L1: leave.cfi_restore 5.cfi_def_cfa 4, 4 ret.cfi_endproc.LFE0:.size main,.-main.ident "GCC: (Ubuntu/Linaro 4.6.3- 1ubuntu5) 4.6.3".section.note.GNU-stack,"",@progbits לימוד עצמי

6. Producing a listing file: > nasm -f elf sample.s -l sample.lst The first column (from the left) is the line number in the listing file The second column is the relative address of where the code will be placed in memory The third column is the compiled code Labels do not create code; they are a way to tell assembler that those locations have symbolic names. ‘CALL myFunc’ is compiled to opcode E8 followed by a 4-byte target address, relative to the next instruction after the call.  address of myFunc label = 0x1F  address of the next instruction after the call (i.e. ‘mov [answer], eax’) is 0xA  0x1F-0xA=0x15, and we get exactly the binary code written here ‘E815000000 ’ The forth column is the original code each section starts at relative address 0 executable 0 x 15 is how many bytes EIP should jump forward

7. section.data numeric:DD 0x12345678 string:DB 'abc' answer:DD0 section.text global _start _start: pushad push dword 2 push dword 1 CALL myFunc returnAddress: mov [answer], eax add esp, 8 popad mov ebx,0 mov eax,1 int 0x80 myFunc: push ebp mov ebp, esp mov eax, dword [ebp+8] mov ebx, dword [ebp+12] myFunc_code: add eax, ebx returnFrom_myFunc: mov esp, ebp pop ebp ret print ‘numeric’ global variable numeric into memory – little endian print ‘string’ global variable string into memory – little endian pushad 0xffffd640 – 0xffffd620= 0x20 = 32 bytes = 8 registers * 4 bytes push function’s arguments into stack CALL myFunc return address Debugging with GDB guide - examining memory - examining data

8. שאלות חזרה למבחן

9. שאלה 1 נתונות ההגדרות הבאות : x: dw 1 y: db 2 z: db 3 יש להכפיל את x, y, z ב 2 באמצעות פקודה אחת. ניתן להניח שאין overflow תשובה : נכפול את כל המילה ב 2 shl dword [x], 1

10. עלינו לממש קריאה לפונקציה ללא ארגומנטים. שכתובתה נמצאת ברגיסטר eax. יש לסמן את הקוד שלא יבצע זאת נכון. a)pushnext_a pusheax ret next_a: b)pusheax pusheax ret c)pushnext_a jmpeax next_a: d)calleax שאלה 2

11. עלינו לממש קריאה לפונקציה ללא ארגומנטים. שכתובתה נמצאת ברגיסטר eax. יש לסמן את הקוד שלא יבצע זאת נכון. a)pushnext_a pusheax ret next_a: b)pusheax pusheax ret c)pushnext_a jmpeax next_a: d)calleax שאלה 2

12. ברגיסטר eax נמצא הערך -1 יש לרשום 5 פקודות שונות שכל אחת מהן תגרום לכך שברגיסטר eax יהיה הערך 1 תשובה mov eax, 1 add eax, 2 neg eax shr eax, 31 and eax, 1 שאלה 3

13. עלינו לממש את קטע הקוד הבא: int a, b, x; x = blah(a,&b) מהו קטע הקוד שיבצע זאת נכון ? a) push a c) push dword b push b push dword [a] call blah call blah add esp, 8 add esp, 8 mov [x], eax mov [x], eax b) push dword [b] d) push dword [b] push dword a push dword a call blah call blah add esp, 8 add esp, 8 mov [x], eax pop dword [x] שאלה 5

14. עלינו לממש את קטע הקוד הבא: int a, b, x; x = blah(a,&b) מהו קטע הקוד שיבצע זאת נכון ? a) push a c) push dword b push b push dword [a] call blah call blah add esp, 8 add esp, 8 mov [x], eax mov [x], eax b) push dword [b] d) push dword [b] push dword a push dword a call blah call blah add esp, 8 add esp, 8 mov [x], eax pop dword [x] שאלה 5