Moving data with assembly
In normal Windows/Linux environment you have heard about moving data or files. What we do is copying data from source location to destination. Assembly MOV instruction is very similar to that. But actually assembly MOV instruction is equal to copy/paste. Because when we move a file data will be removed from the source.
Even in a simple assembly program we use mov command many times. Source and destination can be a register, memory address or any other place. Sometimes we copy a value from stack to a register. In another time we copy the value of each to ebp. For all of such a tasks we can use mov instruction.
Let's see the syntax of the mov instruction. Since we use Intel's assembly syntax following is the format of the instruction.
mov [destination] [source]
(If you prefer using at&t assembly syntax you want to put source first and destination second.)
Ok let's see some examples of moving data from a place to another place.
mov eax 0x1
This Assembly instruction will copy the value 0x1 (0x1 is the hexadecimal representation of one) into the eax register.
Above instruction directly copied a value to a place. So we cal it direct mode or immediate mode.
mov eax ebx
Can you think what above code does? .it will copy what ever value found at ebx to the eax register.
Hear we can see a practice example of above Assembly instruction. I used the GDB debugger to demonstrate it.
(gdb) i r ebp esp ebp 0xbffffd38 0xbffffd38 esp 0xbffffcb8 0xbffffcb8
First I examined esp and ebp using info register command in GDB to see what hold those registers. The esp register holds the value 0xbffffcb8 and ebp holds the value 0xbffffd38.
If you're not familiar with GDB please refer our old tutorials on debugging binaries with GDB.
Next I used x/i $eip to see the Assembly instruction to be executed next. You can see that instruction is mov ebp,esp. Well. You know what it is going to do. After that I used ni command (ni stands for next instruction) to execute that instruction on CPU.
(gdb) x/i $eip 0x80483f5 <main+1>: mov ebp,esp (gdb) ni
Now as we know the CPU will copy whatever found on esp to ebp register. Let's see is it true.
(gdb) i r ebp esp ebp 0xbffffcb8 0xbffffcb8 esp 0xbffffcb8 0xbffffcb8
I used the info register command again to see what's on esp and ebp.You can see the esp register holds the value 0xbffffcb8. That's fine. It is the old value of esp. So value of esp is not changed.
What about ebp .It also holds the value 0xbffffcb8. So we can clearly see that the value of esp copied to ebp. Great. Now we saw it practically.
In the following image you can see a layout of a 32 bit register.
Ok. Now you know how we can copy data from a register to another register. Let's give your focus on following code line.
mov eax [ebx]
If you pay attention closely you may see that this code is not equal to previous one. Hear the source location (ebx) is covered with brackets. What does it mean? Hear we are not copying the value of ebx into eax. Instead of that ebx register acts as a pointer. In c programming you may hared about pointers.
Hear there is a memory address in the ebx register. We get that address and copy whatever found at that memory address into eax register.
Following instruction is very similar to above one.
mov [ebx] eax
It takes the value from eax. Then take the value from ebx and treat it as a memory address. Then go to that address and copy the value found at eax register.
It's also possible to copy a direct value to a pointer location like following.
This will copy the value 0x1 into the location pointed by the value of esp.Hear you can see it practically.
First I examined the value of esp. It is 0xbffffc50 . Now we treat this as a memory address and check what is in that location. We can examine that by entering command x/x 0xbffffc50 . You can see there is a value 0x080485e0.
(gdb) i r esp esp 0xbffffc50 0xbffffc50 (gdb) x/x 0xbffffc50 0xbffffc50: 0x080485e0
Now we examine eip to check next instruction and use ni command to execute it on CPU.
(gdb) x/i $eip 0x80484bc <main+40>: mov [esp],0x1 (gdb) ni
We saw next instruction is mov [esp],0x1. No as the theory 0x1 should be copied to the location that pointed by esp. Let's examine that location again to check it.
(gdb) i r esp esp 0xbffffc50 0xbffffc50 (gdb) x/x 0xbffffc50 0xbffffc50: 0x00000001
Yes. All are going as expected. I think now you understood the concept of pointed locations.
Now. what about following example
(gdb) i r esp eax esp 0xbffffc50 0xbffffc50 eax 0xbffffc6c -1073742740 (gdb) x/x 0xbffffc50 0xbffffc50: 0x00000000 (gdb) x/i $eip 0x804844d <main+21>: mov [esp],eax (gdb) ni (gdb) x/x 0xbffffc50 0xbffffc50: 0xbffffc6c
I don't go to deeply explain it. If you understood previous one you may realize what';s going on hear. It'll take the value of eax and copy it to the location pointed by the vale of esp register
Can you understand what's following Assembly instruction? What it does?
mov eax, [esp+0x5c]
The concept is same as mov eax, [esp]. But this time we add a hexadecimal value to the value of esp register. What does it mean? Read following code and try to understand
(gdb) i r esp eax esp 0xbffffc50 0xbffffc50 eax 0x30 48 (gdb) x/x 0xbffffc50 + 0x5c 0xbffffcac: 0x66666666 (gdb) x/i $eip 0x8048471 <main+57>: mov eax, [esp+0x5c] (gdb) ni (gdb) i r eax eax 0x66666666 1717986918
When we execute mov eax, [esp+0x5c], Followings are happened.
First we get the value of esp. It is 0xbffffc50
Next we add 0x5c to it. The answer is 0xbffffcac. You can use a calculator to do it.
After we treat this answer as a memory address and go to that location. Next we copy whatever found at that location and copy it to eax register.
Let's take another example.
mov [eax] [ebx]
What happens hear?
First we get the value of ebx register. We treat it as a memory address. Let's call this address as A.
Next we take the value from eax and treat that as a memory address. Let's call this address as B.
Now we copy what ever found at address A into address A. Got it? .
Finally it's possible to do something like following.
mov al 0x1
This is a cool trick we use often in shell-coding. Hear al is not actually a register. It is a section of register. To understand this refer following image.
Since we are talking about the 32 bit architecture a CPU register is 32 bit of length. The least significant two bytes of eax is called as ax register. That is 16 bits long. That ax part can be divided into two parts as al and hl. You can learn more about this in our cpu registers tutorial.
So guys that's all for this document. I hope you learned something new. thanks for reading.