Table of Contents for
Mastering Assembly Programming

Version ebook / Retour

Cover image for bash Cookbook, 2nd Edition Mastering Assembly Programming by Alexey Lyashko Published by Packt Publishing, 2017
  1. Mastering Assembly Programming
  2. Title Page
  3. Copyright
  4. Mastering Assembly Programming
  5. Credits
  6. About the Author
  7. About the Reviewer
  8. www.PacktPub.com
  9. Why subscribe?
  10. Customer Feedback
  11. Table of Contents
  12. Preface
  13. What this book covers
  14. What you need for this book
  15. Who this book is for
  16. Conventions
  17. Reader feedback
  18. Customer support
  19. Downloading the example code
  20. Errata
  21. Piracy
  22. Questions
  23. Intel Architecture
  24. Processor registers
  25. General purpose registers
  26. Accumulators
  27. Counter
  28. Stack pointer
  29. Source and destination indices
  30. Base pointer
  31. Instruction pointer
  32. Floating point registers
  33. XMM registers
  34. Segment registers and memory organization
  35. Real mode
  36. Protected mode - segmentation
  37. Protected mode - paging
  38. Long mode - paging
  39. Control registers
  40. Debug registers
  41. Debug address registers DR0 - DR3
  42. Debug control register (DR7)
  43. Debug status register (DR6)
  44. The EFlags register
  45. Bit #0 - carry flag
  46. Bit #2 - parity flag
  47. Bit #4 - adjust flag
  48. Bit #6 - zero flag
  49. Bit #7 - sign flag
  50. Bit #8 - trap flag
  51. Bit #9 - interrupt enable flag
  52. Bit #10 - direction flag
  53. Bit #11 - overflow flag
  54. Remaining bits
  55. Summary
  56. Setting Up a Development Environment
  57. Microsoft Macro Assembler
  58. Installing Microsoft Visual Studio 2017 Community
  59. Setting up the Assembly project
  60. GNU Assembler (GAS)
  61. Installing GAS
  62. Step 1 - installing GAS
  63. Step 2 - let's test
  64. Flat Assembler
  65. Installing the Flat Assembler
  66. The first FASM program
  67. Windows
  68. Linux
  69. Summary
  70. Intel Instruction Set Architecture (ISA)
  71. Assembly source template
  72. The Windows Assembly template (32-bit)
  73. The Linux Assembly template (32-bit)
  74. Data types and their definitions
  75. A debugger
  76. The instruction set summary
  77. General purpose instructions
  78. Data transfer instructions
  79. Binary Arithmetic Instructions
  80. Decimal arithmetic instructions
  81. Logical instructions
  82. Shift and rotate instructions
  83. Bit and byte instructions
  84. Execution flow transfer instructions
  85. String instructions
  86. ENTER/LEAVE
  87. Flag control instructions
  88. Miscellaneous instructions
  89. FPU instructions
  90. Extensions
  91. AES-NI
  92. SSE
  93. Example program
  94. Summary
  95. Memory Addressing Modes
  96. Addressing code
  97. Sequential addressing
  98. Direct addressing
  99. Indirect addressing
  100. RIP based addressing
  101. Addressing data
  102. Sequential addressing
  103. Direct addressing
  104. Scale, index, base, and displacement
  105. RIP addressing
  106. Far pointers
  107. Summary
  108. Parallel Data Processing
  109. SSE
  110. Registers
  111. Revisions
  112. Biorhythm calculator
  113. The idea
  114. The algorithm
  115. Data section
  116. The code
  117. Standard header
  118. The main() function
  119. Data preparation steps
  120. Calculation loop
  121. Adjustment of sine input values
  122. Computing sine
  123. Exponentiation
  124. Factorials
  125. AVX-512
  126. Summary
  127. Macro Instructions
  128. What are macro instructions?
  129. How it works
  130. Macro instructions with parameters
  131. Variadic macro instructions
  132. An introduction to calling conventions
  133. cdecl (32-bit)
  134. stdcall (32-bit)
  135. Microsoft x64 (64-bit)
  136. AMD64 (64-bit)
  137. A note on Flat Assembler's macro capabilities
  138. Macro instructions in MASM and GAS
  139. Microsoft Macro Assembler
  140. The GNU Assembler
  141. Other assembler directives (FASM Specific)
  142. The conditional assembly
  143. Repeat directives
  144. Inclusion directives
  145. The include directive
  146. File directive
  147. Summary
  148. Data Structures
  149. Arrays
  150. Simple byte arrays
  151. Arrays of words, double words, and quad words
  152. Structures
  153. Addressing structure members
  154. Arrays of structures
  155. Arrays of pointers to structures
  156. Linked lists
  157. Special cases of linked lists
  158. Stack
  159. Queue and deque
  160. Priority queues
  161. Cyclic linked list
  162. Summary for special cases of linked lists
  163. Trees
  164. A practical example
  165. Example - trivial cryptographic virtual machine
  166. Virtual machine architecture
  167. Adding support for a virtual processor to the Flat Assembler
  168. Virtual code
  169. The virtual processor
  170. Searching the tree
  171. The loop
  172. Tree balancing
  173. Sparse matrices
  174. Graphs
  175. Summary
  176. Mixing Modules Written in Assembly and Those Written in High-Level Languages
  177. Crypto Core
  178. Portability
  179. Specifying the output format
  180. Conditional declaration of code and data sections
  181. Exporting symbols
  182. Core procedures
  183. Encryption/decryption
  184. Setting the encryption/decryption parameters
  185. f_set_data_pointer
  186. f_set_data_length
  187. GetPointers()
  188. Interfacing with C/C++
  189. Static linking - Visual Studio 2017
  190. Static linking - GCC
  191. Dynamic linking
  192. Assembly and managed code
  193. Native structure versus managed structure
  194. Importing from DLL/SO and function pointers
  195. Summary
  196. Operating System Interface
  197. The rings
  198. System call
  199. System call hardware interface
  200. Direct system calls
  201. Indirect system calls
  202. Using libraries
  203. Windows
  204. Linking against object and/or library files
  205. Object file
  206. Producing the executable
  207. Importing procedures from DLL
  208. Linux
  209. Linking against object and/or library files
  210. Object file
  211. Producing the executable
  212. Dynamic linking of ELF
  213. The code
  214. Summary
  215. Patching Legacy Code
  216. The executable
  217. The issue
  218. PE files
  219. Headers
  220. Imports
  221. Gathering information
  222. Locating calls to gets()
  223. Preparing for the patch
  224. Importing fgets()
  225. Patching calls
  226. Shim code
  227. Applying the patch
  228. A complex scenario
  229. Preparing the patch
  230. Adjusting file headers
  231. Appending a new section
  232. Fixing the call instruction
  233. ELF executables
  234. LD_PRELOAD
  235. A shared object
  236. Summary
  237. Oh, Almost Forgot
  238. Protecting the code
  239. The original code
  240. The call
  241. The call obfuscation macro
  242. A bit of kernel space
  243. LKM structure
  244. LKM source
  245. .init.text
  246. .exit.text
  247. .rodata.str1.1
  248. .modinfo
  249. .gnu.linkonce.this_module
  250. __versions
  251. Testing the LKM
  252. Summary

Linked lists

Linked lists, as the name suggests, consists, of data items (nodes) that are linked to one another by means of pointers. Basically, there are two types of linked lists:

  • Linked list: This is where each node has a pointer to the following node
  • Doubly linked list: This is where each node has a pointer to the following and previous nodes

The following diagram illustrates the difference:

Linked lists of both types may be addressed in a few ways. Obviously, there is at least a pointer to the first node of the list (called top), which is optionally accompanied by a pointer to the last node of the list (called tail). There is, of course, no limit to the amount of auxiliary pointers, should there be a need for such. Pointer fields in the nodes are typically referred to as next and previous. As we can see in the diagram, the last node of a linked list and the first and the last nodes of a doubly linked list have next, previous, and next fields that point nowhere-such pointers are considered terminators denoting the end of the list and are typically populated with null values.

Before proceeding to the sample code, let's make a tiny change to the structure we've been using in this chapter and add the next and previous pointers. The structure should look like this:

struc strtabentry [s]
{
.length dw .pad - .string
.string db s, 0
.pad rb 30 - (.pad - .string)
.previous dd ? ; Pointer to the next node
.next dd ? ; Pointer to the previous node
.size = $ - .length
}

We will leave the make_strtab macro intact as we still need something to build a set of strtabentry structures; however, we will not consider it to be an array of structures any more. Also, we will add a variable (of type double word) to store the top pointer. Let's name it list_top.

Instead or writing a macro instruction that would link the four structures into a doubly linked list, we will write a procedure for adding new nodes to the list. The procedure requires two parameters--a pointer to the list_top variable and a pointer to the structure we want to add to the list. If we were writing in C, then the prototype of the corresponding function would be as follows:

void add_node(strtabentry** top, strtabentry* node);

However, since we are not writing in C, we will put down the following code:

add_node:
push ebp
mov ebp, esp
push eax ebx ecx

virtual at ebp + 8
.topPtr dd ?
.nodePtr dd ?
end virtual
virtual at ebx
.scx strtabentry ?
end virtual
virtual at ecx
.sbx strtabentry ?
end virtual

mov eax, [.topPtr] ; Load pointer to list_top
mov ebx, [.nodePtr] ; Load pointer to new structure
or dword [eax], 0 ; Check whether list_top == NULL
jz @f ; Simply store the structure pointer
; to list_top if true

mov ecx, [eax] ; Load ECX with pointer to current top
mov [.scx.next], ecx ; node->next = top
mov [.sbx.previous], ebx ; top->previous = node

@@:
mov [eax], ebx ; top = node
pop ecx ebx eax
leave
ret 8

Now, having the procedure ready, we will call it from our main procedure:

_start:
push strtabName + 40 ; Let the second structure be the first
push list_top ; in the list
call add_node

push strtabName + 120 ; Then we add fourth structure
push list_top
call add_node

push strtabName + 80 ; Then third
push list_top
call add_node

push strtabName ; And first
push list_top
call add_node

The first, second, third, and fourth refers to positions of structures in memory, not to positions of nodes in the doubly linked list. Thus, after the last line of the preceding code is executed, we have a doubly linked list of strtabentry structures (shown by their position in the linked list) {0, 2, 3, 1}. Let's take a look at the following screenshot for a demonstration of the result:

For the sake of convenience, the structures are named struct_0, struct_1, struct_2, and struct_3 in accordance with the order of their appearance in memory. The last line is the top pointer list_top. As we can see, it points to struct_0, which was the last we added to the list, and struct_0, in turn, only has a pointer to the next structure, while its previous pointer has a NULL value. The struct_0 structure's next pointer points to struct_2, struct_2 structure's next points to struct_3, and the previous pointers lead us back in the reverse order.

Obviously, linked lists (those with a single, either forward or backward), link are a bit simpler than doubly linked lists as we only have to take care of a single pointer member of a node. It may be a good idea to implement a separate structure that describes a linked list node (whether simple or doubly linked) and have a set of procedures for the creation/population of linked lists, search of a node, and removal of a node. The following structure would suffice:

; Structure for a simple linked list node
struc list_node32
{
.next dd ? ; Pointer to the next node
.data dd ? ; Pointer to data object, which
; may be anything. In case data fits
; in 32 bits, the .data member itself
; may be used for storing the data.
}

; Structure for a doubly linked list node
struc dllist_node32
{
.next dd ?
.previous dd ? ; Pointer to the previous node
.data dd ?
}

If, on the other hand, you are writing code for the long mode (64-bit), the only change you need to make is replacing dd (which stands for a 32-bit double word) with dq (which stands for a 64-bit quad word) in order to be able to store long mode pointers.

In addition to this, you may also want or need to implement a structure that will describe a linked list, as a whole, having all the required pointers, counters, and so on (in our example, it was the list_top variable; not quite a structure, but it did its job well enough). However, when it comes to an array of linked lists, it would be much more convenient to utilize an array of pointers to linked lists, as this would provide easier access to members of the array, thus making your code less error prone, simpler, and faster.