From 7dd27f2a72395e51db76ee344ffba56279d5c6ff Mon Sep 17 00:00:00 2001 From: johannst Date: Sun, 20 Jun 2021 22:11:42 +0000 Subject: deploy: 97c6252800e020af05f0e0d7afc037c04753bc83 --- arch/x86_64.html | 96 +++++++++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 78 insertions(+), 18 deletions(-) (limited to 'arch/x86_64.html') diff --git a/arch/x86_64.html b/arch/x86_64.html index 9797dd3..260b742 100644 --- a/arch/x86_64.html +++ b/arch/x86_64.html @@ -184,26 +184,31 @@ rip eip ip instruction pointer

FLAGS register

rflags
-bits  desc
------------------------------
-[11]  OF overflow flag
-[10]  DF direction flag
- [7]  SF sign flag
- [6]  ZF zero flag
- [4]  AF auxiliary carry flag
- [2]  PF parity flag
- [0]  CF carry flag
+bits    desc                            instr        comment
+--------------------------------------------------------------------------------------------------------------
+   [21]   ID   identification                        ability to set/clear -> indicates support for CPUID instr
+   [18]   AC   alignment check                       alignment exception for PL 3 (user), requires CR0.AM
+[13:12] IOPL   io privilege level
+   [11]   OF   overflow flag
+   [10]   DF   direction flag           cld/std
+    [9]   IF   interrupt enable         cli/sti
+    [7]   SF   sign flag
+    [6]   ZF   zero flag
+    [4]   AF   auxiliary carry flag
+    [2]   PF   parity flag
+    [0]   CF   carry flag
-

Addressing

-
movw [rax], rbx         // save val in rbx at [rax]
-movw [imm], rbx         // save val in rbx at [imm]
-movw rax, [rbx+4*rcx]   // load val at [rbx+4*rcx] into rax
+
Change flag bits with pushf / popf instructions:

+
pushfd                          // push flags (4bytes) onto stack
+or dword ptr [esp], (1 << 18)   // enable AC flag
+popfd                           // pop flags (4byte) from stack
 

-
rip relative addressing:

-
lea rax, [rip+.my_str]       // load addr of .my_str into rax
-...
-.my_str:
-.asciz "Foo"
+

+
There is also pushfq / popfq to push and pop all 8 bytes of rflags.

+

+
Model Specific Register (MSR)

+
rdmsr     // Read MSR register, effectively does EDX:EAX <- MSR[ECX]
+wrmsr     // Write MSR register, effectively does MSR[ECX] <- EDX:EAX
 

 
Size directives

 
Explicitly specify size of the operation.

@@ -212,6 +217,61 @@ mov  word ptr [rax], 0xff    // save 2 byte(s) at [rax]
 mov dword ptr [rax], 0xff    // save 4 byte(s) at [rax]
 mov qword ptr [rax], 0xff    // save 8 byte(s) at [rax]
 

+
Addressing

+
mov qword ptr [rax], rbx         // save val in rbx at [rax]
+mov qword ptr [imm], rbx         // save val in rbx at [imm]
+mov rax, qword ptr [rbx+4*rcx]   // load val at [rbx+4*rcx] into rax
+

+
rip relative addressing:

+
lea rax, [rip+.my_str]       // load addr of .my_str into rax
+...
+.my_str:
+.asciz "Foo"
+

+
String instructions

+
The operand size of a string instruction is defined by the instruction suffix
+b | w | d | q.

+
Source and destination registers are modified according to the direction flag (DF) in the flags register

+
    
+
  • DF=0 increment src/dest registers
    • 
+
  • DF=1 decrement src/dest registers
    • 
+

+
Following explanation assumes byte operands with DF=0:

+
movsb   // move data from string to string
+        // ES:[DI] <- DS:[SI]
+        // DI <- DI + 1
+        // SI <- SI + 1
+
+lodsb   // load string
+        // AL <- DS:[SI]
+        // SI <- SI + 1
+
+stosb   // store string
+        // ES:[DI] <- AL
+        // DI <- DI + 1
+
+cmpsb   // compare string operands
+        // DS:[SI] - ES:[DI]    ; set status flag (eg ZF)
+        // SI <- SI + 1
+        // DI <- DI + 1
+
+scasb   // scan string
+        // AL - ES:[DI]         ; set status flag (eg ZF)
+        // DI <- DI + 1
+

+
String operations can be repeated:

+
rep     // repeat until rcx = 0
+repz    // repeat until rcx = 0 or while ZF = 0
+repnz   // repeat until rcx = 0 or while ZF = 1
+

+
Example: Simple memset

+
// memset (dest, 0xaa /* char */, 0x10 /* len */)
+
+lea di, [dest]
+mov al, 0xaa
+mov cx, 0x10
+rep stosb
+

 
SysV x86_64 ABI

 
Passing arguments to functions

 
    
-- 
cgit v1.2.3