. However, some of these are used in a single processor mode, including 15 general-purpose registers (R0 to R14), one or two status registers (CPSR/SPSR), and program counters (PC/R15).R0 ~ R14 can be divided into two categories, namely: the Non-group register (R0 ~ R7) and the group register (R8 ~ R14). The so-called non-grouping, that is, the register in each processor mode share the same physical register, so-called grouping, that is, the register
where these routines come from. They can be compiled from C, Pascal, or in assembly language.APCs defines:
Limits on the use of registers.Stack conventions.Pass/return parameters between function calls.Stack-based structure format that can be traced back to provide a list of functions (and parameters) from the failure point to the program entry.APCs StandardIn general, there are multiple versions of APCs (actually 16 ). We only care about what we may encounter on the risc OS.APCS-AThat is, APCs
I. Optional instruction suffixes
"S" Suffix: The instruction uses the "S" suffix. After the instruction is executed, the condition flag of the Status Register will be refreshed. If the "S" suffix is not used, the condition flag of the Status Register does not change after the command is executed. This flag is often used to test conditions, for example, whether to overflow or carry. Based on these changes, you can determine whether the flag is greater than or equal, this may affect the command ex
Http://blog.sina.com.cn/s/blog_6e5b342e0100m87x.html
Arm Assembly programming is essentially a programming of CPU registers. So we need to first find out what registers arm has? How are these registers used?
Arm registers are classified into two types: common registers and status registers.
Register TypeRegister name in assemblyRegisters actually accessed in each modeUserSystemManagementAbortUndefinedInterruptedFast interruptionGeneral registers and program countersR0 (A1)R0R1 (A2)R1R2 (A3)R2R3
register.
R0, R2, and SP in the above Code are ARM registers.
The ARM processor has 31 general-purpose registers and 6 State registers. However, in a certain processor mode, it is used as a part, including 15 general-purpose registers (R0 ~ R14), one or two status registers (CPSR/SPSR) and program counters (PC/R15 ).
R0 ~ R14 can be divided into two types: Non-grouping registers (R0 ~ R7) and grouping register (R8 ~ R14 ). The non-grouping means tha
spsrMSR cpsr_c, R0; transmits R0 content to spsr, but only modifies the control bit domain in CPSR
LDM (or sTM) commandsThe format of the LDM (or sTM) command is:LDM (or sTM) {condition} {type} base address register {!}, Register list {register}The LDM (or sTM) command is used to send from one contiguous memory indicated by the base address register to multiple mails indicated by the register listThis command is used to import the content of multiple registers into or out of the stack. Among th
.
ThumbInstruction Set andArmDifferences in Instruction Sets
The thumb instruction set does not contain coprocessor instructions, semaphore commands, and instructions for accessing CPSR or spsr. It does not have multiplication instructions or 64-bit multiplication instructions, and the second operand of commands is limited; except for the conditional execution function of redirect command B, all other commands are executed unconditionally. Most thumb data processing commands use the 2-addres
working states:
1. Arm
2. Thumb
CPU power-on in arm State
3. Registers
Arm has 31 General 32-bit registers and 6 program status registers, which are divided into 7 groups. Some registers are shared by all working modes, some registers belong to each working mode;
R13 -- Stack pointer register, used to save the stack pointer;
R14-program connection register. When executing the BL subroutine call command, R14 gets the R15 backup, and R14 s
processing commands adopt the 2-address format. the differences between thumb Instruction Set and arm instruction set are as follows:Jump commandPrograms are relatively transferred. In particular, the conditional jump has more restrictions than the redirection in arm code, and the redirection subroutine is unconditional.Data processing commandsData processing commands operate on General registers. In most cases, the operation results must be put in one of the operand registers, rather than the
mentioned the attack in chrome. Chrome uses the v8 engine, which compiles javascript into machine code before execution to improve performance.After analysis, the application is basically the same as Spectre in logic. Index is first put into the simpleByteArray. put a small number of lengths into malicious_x, let the cpu predict that malicious_X is smaller than the length, and then speculate that the code after execution, the subsequent calculations and assignments are only placed in the cpu ca
.
Difference between thumb Instruction Set and arm Instruction Set
The thumb instruction set does not contain coprocessor instructions, semaphore commands, and instructions for accessing CPSR or spsr. It does not have multiplication instructions or 64-bit multiplication instructions, and the second operand of commands is limited; except for the conditional execution function of redirect command B, all other commands are executed unconditionally. Most thumb data processing commands use the 2-
, enhanced mobile Broadband) has been extensively applied and validated under the R15 standard, but it can still be improved by introducing new features and new technologies in R16 to support richer 5G scenarios. In the R16 standard discussion, Huawei proposed a series of candidate key technologies such as multi-code word, DMRs (demodulation Reference Signal) optimization enhancement, downlink signaling Design Enhancement Receiver, the application of
gets the R15 backup, and R14 saves the R15 return value in case of interruption or exception;
R15 -- program counter;
Fast interrupt mode has 7 backup register R8-R14, which makes it possible to go into fast interrupt mode to execute a large part of the program without even having to save any register;
Other privileged modes contain two independent register copi
Gadget,pop6retEXP+=P64 (0) #令pop RBX to 0 to make call execute correctlyEXP+=P64 (1) #令pop RBP is 1, the equivalent result is obtained for CMP comparisonEXP+=P64 ([email protected]) #pop R12 This decision after the content of call, why use got table, because the PLT inside is instruction Ah, can not take.EXP+=P64 (8) #pop R13 No. 3rd parameter.Exp+=p64 (leak adress) #pop R14 No. 2nd parameter.EXP+=P64 (1) #pop R15 No. 1th parameter.Exp+=p64 (0x040088
I wrote it using NASM, running on 32-bit Windows and Linux hosts, but later the demand increased and needed to run on 64-bit Windows and Linux, and Windows itself had a WOW (Windows on Windows) mechanism, 32-bit programs can run on 64-bit machines without porting at all, while Linux does not have a LOL mechanism (Linux on Linux, not laugth out loud ha, hehe ~), but Linux can install Ia-libs libraries (IA should be Intel x86 Archive to the LOL effect, however, compiling ELF64 and Win64obj is also
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.