Learning Guide for assembly language (i)

assembly language and CPU as well as memory, ports and other hardware knowledge is linked together. This is why the assembly language is not universal reason. Here's a brief talk about basics (for Intel x86 and its compatible machines)
============================
x86 assembly language instruction, its operation object is the register on the CPU, system memory, or immediately number. Some directive surface does not have the operand, or appears lacks the operand, actually this instruction has the default operation object, for instance the push instruction, must be to the SS:ESP specified memory operation, but CDQ's operation object must be the Eax/edx.

In assembly language, registers are accessed by name. There are several classes of CPU registers, each of which has different uses:

1. General Register:
EAX,EBX,ECX,EDX,ESI,EDI,EBP,ESP (this is generic but rarely used except for the stack pointer)

These 32-bit can be used for a variety of purposes, but each one has "expertise". EAX is the "accumulator" (accumulator), which is the default register for many addition multiplication instructions. EBX is a base register that hosts the base address when memory is addressed. The ECX is the counter (counter), the default counter for the duplicate (REP) prefix instruction and the loop instruction. EdX is ... (Forget it.) haha) but it is always used to put the remainder created by integer division. The low 16 bits of these 4 registers can be accessed individually, using AX,BX,CX and DX respectively. Ax can also individually access the low 8-bit (AL) and high 8-bit (AH), bx,cx,dx similar. The return value of a function is often placed in eax.

Esi/edi is called the source/target index register (source/destination index), because in many string manipulation instructions, Ds:esi points to the source string, and Es:edi to the target string.

EBP is the base pointer, which is most often used as the frame pointer for advanced language function calls (frame pointer). When cracking, you can often see a standard function start code:

Push ebp; Save current EBP
MOV ebp,esp; EBP set as current stack pointer
Sub ESP, xxx; reserve xxx bytes to the function temp variable.
...

Thus, EBP constitutes a framework for the function, which is the original EBP above EBP, and returns the address and parameters. Below the EBP is a temporary variable. function returns when the Mov Esp,ebp/pop Ebp/ret can be.

ESP is used specifically as a stack pointer.

2. Segment Registers:
CS (Code Segment, snippet) specifies the currently executing code snippet. EIP (instruction pointer, instruction pointer) points to a specific instruction in the paragraph. Cs:eip points to which instruction, the CPU executes it. Generally can only use JMP, ret, JNZ, call and other instructions to change the program flow, but not directly to their assignment value.
The DS (data SEGMENT) specifies a data segment. Note: In the current computer system, code and data are not fundamentally different, are a series of binary number, the difference is only how you use it. For example, a CS-made segment is always used as code, and it is generally not possible to modify the segment by the address specified by CS. However, you can request a data segment descriptor "Alias" for the same segment and access/modify it through the DS. Programs that modify code often do so.
Es,fs,gs is a secondary segment register that specifies additional data segments.
The SS (stack SEGMENT) specifies the current stack segment. ESP indicates the current top of the stack in the segment. All Push/pop series instructions only operate on addresses that are indicated by SS:ESP.

3. Logo Register (eflags):

The register has 32 bits, which combine various system flags. EFlags generally not as a whole access, but only for a single sign bit interested. The commonly used logos are:

Carry sign C (CARRY), in addition to produce a carry or subtraction with borrow 1, otherwise 0.
0 symbol Z (ZERO), if the result of the operation is 0 to 1, otherwise 0
Symbol bit s (SIGN), if the result of the operation of the highest position of 1, then the bit also 1.
Overflow flag O (OVERFLOW), if (signed) The result of the operation exceeds the range of representations, then 1 is placed.

The JXX series of instructions is based on these flags to determine whether to jump to achieve conditional branching. Note that many JXX directives are equivalent and correspond to the same machine code. For example, JE and JZ are the same, both when Z=1 is a jump. Only jmp is unconditional jump. The jxx instruction is divided into two groups for unsigned operations and signed operations. The "XX" behind the JXX has the following letters:

Unsigned operation: signed operation:
A = "ABOVE", indicating "above" G = "GREATER", indicating "greater than"
B = "BELOW", indicating "less than" L = "less", indicating "less than"
C = "CARRY", which means "carry" or "borrow" O = "OVERFLOW", which means "overflow"
S = "SIGN", indicating "negative"
Common symbols:
E = "EQUAL" means "equals", equivalent to Z (ZERO)
N = "not" means "not", that is, the flag has no placement. such as JNZ "If Z does not have a position to jump"
Z = "ZERO", same as E.

If you think about it carefully, you will find JA = jnbe, JAE = jnb, Jbe = JNA, JG = Jnle, jge= JNL, jl= jnge, ....

4. Port

The port is where the direct and external devices communicate. Peripheral access to the system, the system will be the peripheral data interface map to a specific port address space, so that the data read from the port is read from the peripheral data, and write to the peripheral data is to the port to write data. Of course, all of this must follow the way peripherals work. The address space of the port is independent of the memory address space, the system provides a total of 64K 8-bit port access, number 0-65535. Adjacent 8-bit ports can be composed of a 16-bit port, and adjacent 16-bit ports can form a 32-bit port. The port input and output is realized by instruction In,out,ins and outs, which can refer to the assembly language books.