Mastering Assembly Programming

Description

Key Features

• Understand the Assembly programming concepts and the benefits of examining the AL codes generated from high level languages
• Learn to incorporate the assembly language routines in your high level language applications
• Understand how a CPU works when programming in high level languages

Who This Book Is For

This book is for developers who would like to learn about Assembly language. Prior programming knowledge of C and C++ is assumed.

What You Will Learn

• Obtain deeper understanding of the underlying platform
• Understand binary arithmetic and logic operations
• Create elegant and efficient code in Assembly language
• Understand how to link Assembly code to outer world
• Obtain in-depth understanding of relevant internal mechanisms of Intel CPU
• Write stable, efficient and elegant patches for running processes

In Detail

The Assembly language is the lowest level human readable programming language on any platform. Knowing the way things are on the Assembly level will help developers design their code in a much more elegant and efficient way. It may be produced by compiling source code from a high-level programming language (such as C/C++) but can also be written from scratch. Assembly code can be converted to machine code using an assembler.

The first section of the book starts with setting up the development environment on Windows and Linux, mentioning most common toolchains. The reader is led through the basic structure of CPU and memory, and is presented the most important Assembly instructions through examples for both Windows and Linux, 32 and 64 bits. Then the reader would understand how high level languages are translated into Assembly and then compiled into object code. Finally we will cover patching existing code, either legacy code without sources or a running code in same or remote process.

Style and approach

This book takes a step-by-step, detailed approach to Comprehensively learning Assembly Programming.

Table of Contents

1. Preface
2. What this book covers
3. What you need for this book
4. Who this book is for
5. Conventions
6. Reader feedback
7. Customer support
8. Downloading the example code
9. Errata
10. Piracy
11. Questions
12. Intel Architecture
13. Processor registers
14. General purpose registers
15. Accumulators
16. Counter
17. Stack pointer
18. Source and destination indices
19. Base pointer
20. Instruction pointer
21. Floating point registers
22. XMM registers
23. Segment registers and memory organization
24. Real mode
25. Protected mode – segmentation
26. Protected mode – paging
27. Long mode – paging
28. Control registers
29. Debug registers
30. Debug address registers DR0 – DR3
31. Debug control register (DR7)
32. Debug status register (DR6)
33. The EFlags register
34. Bit #0 – carry flag
35. Bit #2 – parity flag
36. Bit #4 – adjust flag
37. Bit #6 – zero flag
38. Bit #7 – sign flag
39. Bit #8 – trap flag
40. Bit #9 – interrupt enable flag
41. Bit #10 – direction flag
42. Bit #11 – overflow flag
43. Remaining bits
44. Summary
45. Setting Up a Development Environment
46. Microsoft Macro Assembler
47. Installing Microsoft Visual Studio 2017 Community
48. Setting up the Assembly project
49. GNU Assembler (GAS)
50. Installing GAS
51. Step 1 – installing GAS
52. Step 2 – let’s test
53. Flat Assembler
54. Installing the Flat Assembler
55. The first FASM program
56. Windows
57. Linux
58. Summary
59. Intel Instruction Set Architecture (ISA)
60. Assembly source template
61. The Windows Assembly template (32-bit)
62. The Linux Assembly template (32-bit)
63. Data types and their definitions
64. A debugger
65. The instruction set summary
66. General purpose instructions
67. Data transfer instructions
68. Binary Arithmetic Instructions
69. Decimal arithmetic instructions
70. Logical instructions
71. Shift and rotate instructions
72. Bit and byte instructions
73. Execution flow transfer instructions
74. String instructions
75. ENTER/LEAVE
76. Flag control instructions
77. Miscellaneous instructions
78. FPU instructions
79. Extensions
80. AES-NI
81. SSE
82. Example program
83. Summary
84. Memory Addressing Modes
85. Addressing code
86. Sequential addressing
87. Direct addressing
88. Indirect addressing
89. RIP based addressing
90. Addressing data
91. Sequential addressing
92. Direct addressing
93. Scale, index, base, and displacement
94. RIP addressing
95. Far pointers
96. Summary
97. Parallel Data Processing
98. SSE
99. Registers
100. Revisions
101. Biorhythm calculator
102. The idea
103. The algorithm
104. Data section
105. The code
106. Standard header
107. The main() function
108. Data preparation steps
109. Calculation loop
110. Adjustment of sine input values
111. Computing sine
112. Exponentiation
113. Factorials
114. AVX-512
115. Summary
116. Macro Instructions
117. What are macro instructions?
118. How it works
119. Macro instructions with parameters
120. Variadic macro instructions
121. An introduction to calling conventions
122. cdecl (32-bit)
123. stdcall (32-bit)
124. Microsoft x64 (64-bit)
125. AMD64 (64-bit)
126. A note on Flat Assembler’s macro capabilities
127. Macro instructions in MASM and GAS
128. Microsoft Macro Assembler
129. The GNU Assembler
130. Other assembler directives (FASM Specific)
131. The conditional assembly
132. Repeat directives
133. Inclusion directives
134. The include directive
135. File directive
136. Summary
137. Data Structures
138. Arrays
139. Simple byte arrays
140. Arrays of words, double words, and quad words
141. Structures
142. Addressing structure members
143. Arrays of structures
144. Arrays of pointers to structures
145. Linked lists
146. Special cases of linked lists
147. Stack
148. Queue and deque
149. Priority queues
150. Cyclic linked list
151. Summary for special cases of linked lists
152. Trees
153. A practical example
154. Example – trivial cryptographic virtual machine
155. Virtual machine architecture
156. Adding support for a virtual processor to the Flat Assembler
157. Virtual code
158. The virtual processor
159. Searching the tree
160. The loop
161. Tree balancing
162. Sparse matrices
163. Graphs
164. Summary
165. Mixing Modules Written in Assembly and Those Written in High-Level Languages
166. Crypto Core
167. Portability
168. Specifying the output format
169. Conditional declaration of code and data sections
170. Exporting symbols
171. Core procedures
172. Encryption/decryption
173. Setting the encryption/decryption parameters
174. f_set_data_pointer
175. f_set_data_length
176. GetPointers()
177. Interfacing with C/C++
178. Static linking – Visual Studio 2017
179. Static linking – GCC
180. Dynamic linking
181. Assembly and managed code
182. Native structure versus managed structure
183. Importing from DLL/SO and function pointers
184. Summary
185. Operating System Interface
186. The rings
187. System call
188. System call hardware interface
189. Direct system calls
190. Indirect system calls
191. Using libraries
192. Windows
193. Linking against object and/or library files
194. Object file
195. Producing the executable
196. Importing procedures from DLL
197. Linux
198. Linking against object and/or library files
199. Object file
200. Producing the executable
201. Dynamic linking of ELF
202. The code
203. Summary
204. Patching Legacy Code
205. The executable
206. The issue
207. PE files
208. Headers
209. Imports
210. Gathering information
211. Locating calls to gets()
212. Preparing for the patch
213. Importing fgets()
214. Patching calls
215. Shim code
216. Applying the patch
217. A complex scenario
218. Preparing the patch
219. Adjusting file headers
220. Appending a new section
221. Fixing the call instruction
222. ELF executables
223. LD_PRELOAD
224. A shared object
225. Summary
226. Oh, Almost Forgot
227. Protecting the code
228. The original code
229. The call
230. The call obfuscation macro
231. A bit of kernel space
232. LKM structure
233. LKM source
234. .init.text
235. .exit.text
236. .rodata.str1.1
237. .modinfo
238. .gnu.linkonce.this_module
239. __versions
240. Testing the LKM
241. Summary

Author Biography

Alexey Lyashko is an Assembly language addict, independent software reverse engineer, and consultant. At the very beginning of his career, when he was a malware researcher at Aladdin Knowledge Systems, he invented and developed a generic code recognition method known as HOFA (TM). After spending a few years in the anti-malware industry and gaining sufficient experience in low-level development and reverse engineering, Alexey switched to content protection and worked as a reverse engineering consultant with Irdeto’s BD+ department, actively participating in content protection technology development.
Since 2013, he has worked with several software development companies providing reverse engineering and low-level software development consultancy.