56
mov eax, dword ptr [0000003Ah]
(the h-suffix means hex value)
The instruction mov eax, dword ptr [0000003Ah] means: put the value with the size of a DWORD
(32-bit) at memory location 3Ah in register eax. After executing this instruction, eax contains the
value 725E7A25h. Maybe you have noticed that this is the inverse of what's in the memory: 25 7A 5E
72. This is because values are stored in memory using the little endian format. This means that the
rightmost byte is stored in the most significant byte: The byte order is reversed. I think some
examples will make this clear:
the dword (32-bit) value 10203040 hex is stored in memory as: 40, 30, 20,
10 (each value consumes one byte (8-bit))
the word (16-bit) value 4050 hex is stored in memory as 50, 40
Back to the example above. You can do this with other sizes too:
mov cl, byte ptr [34h] ; cl will get the value 0Dh (see table above)
mov dx, word ptr [3Eh] ; dx will get the value 7DEFh (see table above,
remember the reversed byte order)
The size sometimes isn't necessary:
mov eax, [00403045h]
because eax is a 32-bit register, the assembler assumes (and this is the only way to do it, too) it
should take a 32-bit value from memory location 403045hex.
Immediate numbers are also allowed:
mov edx, 5006
This will just make the register edx contain the value 5006. The brackets, [ and ], are used to get a
value from the memory location between the brackets, without brackets it is just a value. A register
as memory location is allowed to (it should be a 32-bit register in 32-bit programs):
mov eax, 403045h ; make eax have the value 403045 hex.
mov cx, [eax] ; put the word size value at the memory location EAX
(403045) into register CX.
In mov cx, [eax], the processor first looks what value (=memory location) eax holds, then what value
is at that location in memory, and put this word (16 bits because the destination, cx, is a 16-bit
register) into CX.
ADD, SUB, MUL, DIV
Many opcodes do calculations. You can guess most of their names: add (addition), sub (substraction),
mul (multiply), div (divide) etc.
The add-opcode has the following syntax:
add destination, source
The calculation performed is destination = destination + source. The following forms are allowed:
Destination Source
Example
Register
Register
add ecx, edx
Register
Memory
add ecx, dword ptr [104h] / add ecx, [edx]
Register
Immediate
value
add eax, 102
Memory
Immediate
value
add dword ptr [401231h], 80
Win32Asm Tutorial
Converted by Atop CHM to PDF Converter free version!
http://www.chmconverter.com
13 / 53
How to C#: Basic SDK Concept of XDoc.PDF for .NET You may add PDF document protection functionality into your C# program. Hyperlink Edit. XDoc.PDF for .NET allows C# developers to edit hyperlink of PDF document
adding hyperlinks to pdf documents; pdf link VB.NET PDF: Basic SDK Concept of XDoc.PDF You may add PDF document protection functionality into your VB.NET program. Hyperlink Edit. XDoc.PDF for .NET allows VB.NET developers to edit hyperlink of PDF
pdf email link; add a link to a pdf in preview
64
Memory
Register
add dword ptr [401231h], edx
This instruction is very simple. It just takes the source value, adds the destination value to it and then
puts the result in the destination. Other mathematical instructions are:
sub destination, source (destination = destination - source)
mul destination, source (destination = destiantion * source)
div source (eax = eax / source, edx = remainer)
Substraction works the same as add, multiplication is just dest = dest * source. Division is a little
different. Because registers are integer values (i.e. round numbers, not floating point numbers) , the
result of a division is split in a quotient and a remainder. For example:
28 /6 --> quotient = 4, remainder = 4
30 /9 --> quotient = 3, remainder = 3
97 / 10 --> quotient = 9, remainder = 7
18 /6 --> quotient = 3, remainder = 0
Now, depending on the size of the source, the quotient is stored in (a part of) eax, the remainder in (a
part of) edx:
Source size
Division
Quotient stored in ...
Remainder Stored
in...
BYTE (8-bits)
ax / source
AL
AH
WORD (16-bits)
dx:ax* / source
AX
DX
DWORD (32-bits)
edx:eax* / source
EAX
EDX
* = For example: if dx = 2030h, and ax = 0040h, dx: ax = 20300040h. dx:ax is a dword value where dx
represents the higher word and ax the lower. Edx:eax is a quadword value (64-bits) where the higher
dword is edx and the lower eax.
The source of the div-opcode can be:
an 8-bit register (al, ah, cl,...)
a 16-bit register (ax, dx, ...)
a 32-bit register (eax, edx, ecx...)
an 8-bit memory value (byte ptr [xxxx])
a 16-bit memory value (word ptr [xxxx])
a 32-bit memory value (dword ptr [xxxx])
The source can not be an immediate value because then the processor cannot determine the size of
the source operand.
BITWISE OPERATIONS
These instructions all take a destination and a source, exept the 'NOT' instruction. Each bit in the
destination is compared to the same bit in the source, and depending on the instruction, a 0 or a 1 is
placed in the destination bit:
Instruction ANDOR XORNOT
Source Bit 0011001100110 0 1
Destination
Bit
010101010101XX
Output Bit 0001011101101 1 0
AND sets the output bit to 1 if both the source and destination bit is 1.
OR sets the output bit if either the source or destination bit is 1
XOR sets the output bit if the source bit is different from the destination bit.
NOT inverts the source bit.
Win32Asm Tutorial
Converted by Atop CHM to PDF Converter free version!
http://www.chmconverter.com
14 / 53
47
An example:
mov ax, 3406
mov dx, 13EAh
xor ax, dx
ax = 3406 (decimal), which is 0000110101001110 in binary.
dx = 13EA (hex), which is 0001001111101010 in binary.
Perform the XOR operation on these bits:
Source
0001001111101010 (dx)
Destination
0000110101001110 (ax)
Output
0001111010100101 (new dx)
The new dx is 0001111010100101 (7845 decimal, 1EA5 in hex) after the instruction.
Another example:
mov ecx, FFFF0000h
not ecx
FFFF0000 is in binary 11111111111111110000000000000000 (16 1's, 16 0's)
If you take the inverse of every bit, you get:
00000000000000001111111111111111 (16 0's, 16 1's), which is 0000FFFF in hex.
So ecx is after the NOT operation 0000FFFFh.
IN/DECREMENTS
There are 2 very simple instructions, DEC and INC. These instructions increase or decrease a
memory location or register with one. Simply put:
inc reg -> reg = reg + 1
dec reg -> reg = reg - 1
inc dword ptr [103405] -> value at [103405] will increase by one.
dec dword ptr [103405] -> value at [103405] will decrease by one.
NOP
This instruction does absolutely nothing. This instruction just occupies space and time. It is used for
filling purposes and patching codes.
Bit Rotation and Shifting
Note: Most of the examples below use 8-bit numbers, but this is just to make the picture clear.
Shifting functions
SHL destination, count
SHR destination, count
SHL and SHR shift a count number of bits in a register/memlocation left or right.
Example:
; al = 01011011 (binary) here
shr al, 3
This means: shift all the bits of the al register 3 places to the right. So al will become 00001011. The
bits on the left are filled up with zeroes and the bits on the right are shifted out. The last bit that is
shifted out is saved in the carry-flag. The carry-bit is a bit in the processor's Flags register. This is not a
Win32Asm Tutorial
Converted by Atop CHM to PDF Converter free version!
http://www.chmconverter.com
15 / 53
68
register like eax or ecx that you can directly access (although there are opcodes to do this), but it's
contents depend on the result of the instruction. This will be explained later, the only thing you'll
have to remember now is that the carry is a bit in the flag register and that it can be on or off. This bit
equals the last bit shifted out.
shl is the same as shr, but shifts to the left.
; bl = 11100101 (binary) here
shl bl, 2
bl is 10010100 (binary) after the instruction. The last two bits are filled up with zeroes, the carry bit is
1, because the bit that was last shifted out is a 1.
Then there are two other opcodes:
SAL destination, count (Shift Arithmetic Left)
SAR destination, count (Shift Arithmetic Right)
SAL is the same as SHL, but SAR is not quite the same as SHR. SAR does not shift in zeroes but
copies the MSB (most significant bit). Example:
al = 10100110
sar al, 3
al = 11110100
sar al, 2
al = 11111101
bl = 00100110
sar bl, 3
bl = 00000010
Rotation functions
rol destination, count ; rotate left
ror destination, count ; rotate right
rcl destination, count ; rotate through carry left
rcr destination, count ; rotate through carry right
Rotation looks like shifting, with the difference that the bits that are shifted out are shifted in again on
the other side:
Example: ror (rotate right)
Bit 7Bit 6Bit 5Bit 4Bit 3Bit 2Bit 1Bit 0
Before
1
0
0
1
1
0
1
1
Rotate, count=
3
1
0
0
1
1 0 1 1 (Shift out)
Result
1
1
0
1
0
0
1
1
As you can see in the figure above, the bits are rotated, i.e. every bit that is pushed out is shift in
again on the other side. Like shifting, the carry bit holds the last bit that's shifted out. RCL and RCR
are actually the same as ROL and RCR. Their names suggest that they use the carry bit to indicate the
last shift-out bit, which is true, but as ROL and ROR do the same, they do not differ from them.
Exchange
The XCHG instruction is also quite simple. It can exchange two registers or a register and a memory
location:
eax = 237h
Win32Asm Tutorial
Converted by Atop CHM to PDF Converter free version!
http://www.chmconverter.com
16 / 53
10
eax = 237h
ecx = 978h
xchg eax, ecx
eax = 978h
ecx = 237h
[top]
Win32Asm Tutorial
Converted by Atop CHM to PDF Converter free version!
http://www.chmconverter.com
17 / 53
50
Win32Asm Tutorial
prev6- File structurenext
6.0 - File Structure
Assembly source files are divided in sections. The sections are code, data, uninitialized data,
constants, resource and relocations. Resource sections are created by a resource file, more about this
later. The relocation section is not important to us (it contains information to make it possible for the
PE-loader to load the program at a different location in memory). Important sections are code, data,
uninitialized data and constants. Code sections contain, well you've guessed it, code. Data contains
data, and has read and write access. The whole data section is included in the exe file and can be
initialized with data.
Unitialized data has no contents at startup, and isn't even included in the exe file itself, it is just a part
of memory reserved by windows. This section has read and write access. Constants is the same as
the data section, but with readonly access. Although this section can be used for constants, it is easier
and faster to just declare constants in include files, and then use it as immediate values.
6.1 Section indicators
In your source files (*.asm), you define sections with the section statements:
.code ; code section starts here
.data ; data section starts here
.data? ; unitialized data starts here
.const ; constants section starts here
Executable files (*.exe, *.dll and more) are (in win32) in the portable executable-format (PE). I won't
discuss this in details but a few things are important. The sections are defined in the PE-header with
a few characteristics:
Section name, RVA, offset, raw size, virtual size and flags. RVA (relative virtual address) is the
relative location in memory where that section will be loaded. Relative here means that it is relative to
the base address, the address in memory where the program is loaded. This address is also in the PE-
header but can be changed by the PE-loader (using the relocation-section). Offset is the raw offset in
the exe file itself where the initial data is. Virtual size is the size it will become in memory. Flags are
the flags for read-access/write-access/executable etc.
6.2 Example program
Here's an example program:
.data
Number1 dd 12033h
Number2 dw 100h,200h,300h,400h
Number3 db "blabla",0
.data?
Value dd ?
.code
mov eax, Number1
mov ecx, offset Number2
add ax, word ptr [ecx+4]
mov Value, eax
This program will not assemble well, but that doesn't matter.
In your assembly program, everything you put in a section will go to the exe file and, when the
program is loaded in memory, at a certain memory location. In the data section above, there are 3
labels: Number1, Number2, Number3. These labels will hold the offset of the location they are in the
Win32Asm Tutorial
Converted by Atop CHM to PDF Converter free version!
http://www.chmconverter.com
18 / 53
48
program so you can use them to indicate a place in your program.
DD directly puts a dword at that place, DW a word and DB a byte. With db, you can also use a
string, because a string is actually a list of byte values. In the example, the data section would
become this in memory:
33,20,01,00,00,01,00,02,00,03,00,04,62,6c,61,62,6c,61,00 (all hex numbers)
(every value is a byte)
I've colored some of the numbers. Number1 points to the memory location where the byte 33 is,
Number 2 points to the location of the red 00, Number3 to the green 62. Now if you use this in your
program:
mov ecx, Number1
It actually means:
mov ecx, dword ptr [location where the dword 12033h is in memory]
But this:
mov ecx, offset Number1
means:
mov ecx, location where dword 12033h is in memory
In the first example, ecx will get the value that is at the memory location of Number1. In the second,
ecx will become the memory location (offset) itself. These two examples below have the same effect:
(1)
mov ecx, Number1
(2)
mov ecx, offset Number1
mov ecx, dword ptr [ecx]
( or mov ecx, [ecx])
Now let's go back to the example:
.data
Number1 dd 12033h
Number2 dw 100h,200h,300h,400h
Number3 db "blabla",0
.data?
Value dd ?
.code
mov eax, Number1
mov ecx, offset Number2
add ax, word ptr [ecx+4]
mov Value, eax
The label Value can be used just like Number1, Number2 and Number3, but it will contain 0 at
startup because it is in the unitialized data section. The advantage of this is, that everything you
define in .data? will not be in the executable, only in memory.
.data?
ManyBytes1 db 5000 dup (?)
.data
ManyBytes2 db 5000 dup (0)
(5000 dup means: 5000 duplicates. Value db 4,4,4,4,4,4,4 is the same as Value db 7 dup (4).)
Win32Asm Tutorial
Converted by Atop CHM to PDF Converter free version!
http://www.chmconverter.com
19 / 53
10
ManyBytes1 will not be in the file itself, just 5000 reserved bytes in memory. But ManyBytes2 will be
in the executable, making the file 5000 bytes bigger. As your file then will contain 5000 zeroes, this is
not very useful.
The code section will just be assembled (converted to raw codes) and placed in the executable (and in
memory when it's loaded of course).
[top]
Win32Asm Tutorial
Converted by Atop CHM to PDF Converter free version!
http://www.chmconverter.com
20 / 53
Documents you may be interested
- Pdf edit hyperlink %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D35-part1565
- Change link in pdf %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D36-part1566
- Pdf links %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D37-part1567
- Adding a link to a pdf in preview %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D38-part1568
- Add hyperlink to pdf online %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D39-part1569
- Add a link to a pdf %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D4-part1570
- Adding links to pdf document %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D40-part1571
- Add links in pdf toefl_student_test_prep_planner1-part159
- Add hyperlinks to pdf %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D41-part1572
- Add links to pdf in preview %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D42-part1573
- Pdf link open in new window %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D43-part1574
- Add hyperlink in pdf %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D44-part1575
- Add links pdf document %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D45-part1576
- Add links to pdf %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D46-part1577
- C# read pdf from url %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D47-part1578
- Add links to pdf online %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D48-part1579
- Add hyperlink pdf %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D49-part1580
- C# read pdf from url %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D5-part1581
- Pdf hyperlink toefl_student_test_prep_planner2-part160
- Pdf hyperlink %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D50-part1582
- Accessible links in pdf %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D51-part1583
- Add links in pdf %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D52-part1584
- Add hyperlinks to pdf %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D53-part1585
- Add links to pdf document %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D54-part1586
- Adding links to pdf document %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D55-part1587
- Pdf link %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D56-part1588
- Change link in pdf file %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D57-part1589
- Add a link to a pdf file %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D58-part1590
- Add links pdf document %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D59-part1591
- Pdf edit hyperlink toefl_student_test_prep_planner3-part161
- Add url pdf %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D6-part1592
- Add links pdf document %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D60-part1593
- Adding links to pdf document %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D61-part1594
- Pdf link to email %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D62-part1595
- Add a link to a pdf %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D63-part1596
- Add links to pdf document %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D64-part1597
- Add hyperlink to pdf in preview %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D65-part1598
- Add hyperlink to pdf in preview %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D66-part1599
- Add link to pdf %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D67-part1600
- Pdf link to attached file %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D68-part1601
- Add hyperlink in pdf The-Great-Gatsby10-part18
- Add hyperlink pdf file toefl_student_test_prep_planner4-part162
- Pdf link to attached file %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D69-part1602
- Add links in pdf %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D7-part1603
- Add hyperlinks to pdf %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D70-part1604
- Chrome pdf from link %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D71-part1605
- Pdf link to specific page %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D72-part1606
- Pdf link to specific page %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D73-part1607
- Pdf hyperlink %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D74-part1608
- Convert doc to pdf with hyperlinks %5BO%60Reilly%5D%20-%20JavaScript.%20The%20Definitive%20Guide,%206th%20ed.%20-%20%5BFlanagan%5D75-part1609
Documents you may be interested
