- Mastering Reverse Engineering
- Reginald Wong
- 470字
- 2021-06-10 19:40:30
Registers
In programming, processing data requires variables. You can simply think of registers as variables in assembly language. However, not all registers are treated as plain variables, but rather, each register has a designated purpose. The registers are categorized as being one of the following:
- General purpose registers
- Segment registers
- Flag registers
- Instruction pointers
In x86 architecture, each general purpose register has its designated purpose and is stored at WORD size, or 16 bits, as follows:
- Accumulator (AX)
- Counter (CX)
- Data (DX)
- Base (BX)
- Stack pointer (SP)
- Base pointer (BP)
- Source index (SI)
- Destination index (DI)
For registers AX, BX, CX, and DX, the least and most significant bytes can be accessed by smaller registers. For AX, the lower 8 bits can be read using the AL register, while the upper 8 bits can be read using the AH register, as shown here:

When running code, the system needs to identify where the code is at. The Instruction Pointer (IP) register is the one that contains the memory address where the next assembly instruction to be executed is stored.
System states and logical results of executed code are stored in the FLAGS register. Every bit of the FLAGS register has its own purpose, with some of the definitions given in the following table:

All of these flags have a purpose, but the flags that are mostly monitored and used are the carry, sign, zero, overflow, and parity flags.
All these registers have an "extended" mode for 32-bits. It can accessed with a prefixed "E" (EAX, EBX, ECX, EDX, ESP, EIP, and EFLAGS). The same goes with 64-bit mode, which can be accessed with a prefixed "R" (RAX, RBX, RCX, RDX, RSP, and RIP).
The memory is divided into sections such as the code segment, stack segment, data segment, and other sections. The segment registers are used to identify the starting location of these sections, as follows:
- Stack segment (SS)
- Code segment (CS)
- Data segment (DS)
- Extra segment (ES)
- F segment (FS)
- G segment (GS)
When a program loads, the operating system maps the executable file to the memory. The executable file contains information to which data maps respective segments. The code segment contains the executable code. The data segment contains the data bytes, such as constants, strings, and global variables. The stack segment is allocated to contain runtime function variables and other processed data. The extra segment is similar to the data segment, but this space is commonly used to move data between variables. Some 16-bit operating systems, such as DOS, make use of the SS, CS, DS, and ES since there are only 64 kilobytes allocated per segment. However, in modern operating systems (32-bit systems and higher) these four segments are set in the same memory space, while FS and GS point to process and thread information respectively.
- Web漏洞分析與防范實(shí)戰(zhàn):卷1
- 工業(yè)控制網(wǎng)絡(luò)安全技術(shù)
- 信息安全案例教程:技術(shù)與應(yīng)用(第2版)
- 情報(bào)驅(qū)動(dòng)應(yīng)急響應(yīng)
- 網(wǎng)絡(luò)安全應(yīng)急響應(yīng)實(shí)戰(zhàn)
- End to End GUI Development with Qt5
- 交換機(jī)·路由器·防火墻(第2版)
- Learn Azure Sentinel
- 黑客攻防從入門到精通:命令版
- 計(jì)算機(jī)系統(tǒng)與網(wǎng)絡(luò)安全研究
- 動(dòng)態(tài)賦能網(wǎng)絡(luò)空間防御
- CPK通向賽博安全之路:理論與實(shí)踐CPK Solution to Cyber Security:Theory and Practice
- ATT&CK視角下的紅藍(lán)對(duì)抗實(shí)戰(zhàn)指南
- 互聯(lián)網(wǎng)域名國際化與安全技術(shù)導(dǎo)論
- ATT&CK框架實(shí)踐指南(第2版)