Functions of EAX, ECX, EDX, and EBX registers, ecxebx

Functions of EAX, ECX, EDX, and EBX registers, ecxebx

General registers: AX, BX, CX, DX
AX: cumulative latches, BX: Base latches, CX: Count latches, DX: Data latches

Index latches: SI and DI
SI: source index storage, DI: Destination index Storage

Stack and base latches: SP and BP
SP: stacked indicator latches, BP: Base Indicator latches

EAX, ECX, EDX, and EBX: extensions of ax, bx, cx, and dx, each of which is 32 bits
ESI, EDI, ESP, and EBP: extension of si, di, sp, and bp, 32-bit RMB

Eax, ebx, ecx, edx, esi, edi, ebp, esp, etc. are the names of General registers on the CPU in X86 assembly language, and are 32-bit registers. These registers can be viewed as variables in C language.

For example: add eax,-2; // it can be considered to be a value such as-2 added to the variable eax.

These 32-bit registers have multiple purposes, but each of them has "expertise" and has its own special features.

EAX is the accumulator, which is the default register of many addition multiplication commands.

EBX is a base register that stores the base address in memory addressing.

ECX is the counter and the internal counter of the repeated (REP) prefix command and LOOP command.

EDX is always used to place the remainder produced by integer division.

ESI/EDI are called "source/destination index" (source/destination index), because in many string operation commands, DS: ESI refers to the source string, While ES: EDI points to the target string.

EBP is a base pointer, which is most often used as a frame pointer for calling high-level language functions ). when cracking, you can often see the starting code of a standard function:
　　
Push ebp; Save the current ebp
Mov ebp, esp; EBP is set as the current stack pointer
Sub esp, xxx; reserve xxx bytes for function temporary variables.
...
　　
In this way, EBP forms a framework of this function. The above EBP is the original EBP, return address, and parameters respectively. under EBP is a temporary variable. mov esp, ebp/pop ebp/ret when the function returns.

ESP is specially used as a stack pointer. It is visually called a stack top pointer. The top of the stack is a region with a small address. The more data pushed into the stack, the smaller the ESP. On a 32-bit platform, ESP is reduced by 4 bytes each time.



Part 2 registers:



In addition to EFLAGS and EIP, the status and control register group also has four 32-bit control registers, CR0, CR1, CR2, and C3.

These registers store the overall state of the machine that is not related to the task.

CR0 contains 6 pre-defined labels. 0-bit Protection allows PE (Protedted Enable), which is used to start protection mode. If PE position 1, protection mode starts, if PE = 0, it runs in real mode. The first bit is the monitoring coprocessor MP (Moniter coprocessor), which together with the 3rd bit determines whether the operation code WAIT generates an error signal "the coprocessor cannot be used" When TS = 1. A 3rd-bit Task is a Task Switch. After a Task is converted, it is set to 1 automatically. With TS = 1, the coprocessor cannot be used. The 2nd-bit CRC value is the Emulate coprocessor (EM). If EM = 1, the coprocessor cannot be used. If EM = 0, the coprocessor is allowed. The 4th-bit is the extended Type of the microprocessor (Processor Extension Type), which stores information about the extended Type of the Processor. If ET = 0, it indicates that the system uses the 287 coprocessor, if ET = 1, the system uses the 387 floating point coprocessor. The 31st bits of CR0 are Paging Enable, which indicates whether the Paging part on the chip can work.

CR1 is an undefined control register for future processors.

CR2 is a page fault linear address register that stores all 32-bit linear addresses for the last page fault.

The base address register of the page Directory. It stores the physical address of the page Directory table. The page Directory table is always placed on the memory boundary in 4 K Bytes. Therefore, its 12-bit low address is always 0, does not work, even if the content is written, it will not be ignored.

These registers are closely related to the paging mechanism. Therefore, these registers are involved in process management and virtual memory management, readers should remember the contents of the three registers CR0, CR2, and C3.


Esp: registers store the top pointer of the stack of the current thread
Ebp: registers store the bottom pointer of the current thread.

Eip: registers store the memory address of the next CPU instruction. After the CPU executes the current instruction, it reads the memory address of the next instruction from the EIP register and continues executing the instruction.