Preface What this book covers What you need for this book Who this book is for Conventions Reader feedback Customer support Downloading the example code Errata Piracy Questions Intel Architecture Processor registers General purpose registers Accumulators Counter Stack pointer Source and destination indices Base pointer Instruction pointer Floating point registers XMM registers Segment registers and memory organization Real mode Protected mode - segmentation Protected mode - paging Long mode - paging Control registers Debug registers Debug address registers DR0 - DR3 Debug control register (DR7) Debug status register (DR6) The EFlags register Bit #0 - carry flag Bit #2 - parity flag Bit #4 - adjust flag Bit #6 - zero flag Bit #7 - sign flag Bit #8 - trap flag Bit #9 - interrupt enable flag Bit #10 - direction flag Bit #11 - overflow flag Remaining bits Summary Setting Up a Development Environment Microsoft Macro Assembler Installing Microsoft Visual Studio 2017 Community Setting up the Assembly project GNU Assembler (GAS) Installing GAS Step 1 - installing GAS Step 2 - let's test Flat Assembler Installing the Flat Assembler The first FASM program Windows Linux Summary Intel Instruction Set Architecture (ISA) Assembly source template The Windows Assembly template (32-bit) The Linux Assembly template (32-bit) Data types and their definitions A debugger The instruction set summary General purpose instructions Data transfer instructions Binary Arithmetic Instructions Decimal arithmetic instructions Logical instructions Shift and rotate instructions Bit and byte instructions Execution flow transfer instructions String instructions ENTER/LEAVE Flag control instructions Miscellaneous instructions FPU instructions Extensions AES-NI SSE Example program Summary Memory Addressing Modes Addressing code Sequential addressing Direct addressing Indirect addressing RIP based addressing Addressing data Sequential addressing Direct addressing Scale, index, base, and displacement RIP addressing Far pointers Summary Parallel Data Processing SSE Registers Revisions Biorhythm calculator The idea The algorithm Data section The code Standard header The main() function Data preparation steps Calculation loop Adjustment of sine input values Computing sine Exponentiation Factorials AVX-512 Summary Macro Instructions What are macro instructions? How it works Macro instructions with parameters Variadic macro instructions An introduction to calling conventions cdecl (32-bit) stdcall (32-bit) Microsoft x64 (64-bit) AMD64 (64-bit) A note on Flat Assembler's macro capabilities Macro instructions in MASM and GAS Microsoft Macro Assembler The GNU Assembler Other assembler directives (FASM Specific) The conditional assembly Repeat directives Inclusion directives The include directive File directive Summary Data Structures Arrays Simple byte arrays Arrays of words, double words, and quad words Structures Addressing structure members Arrays of structures Arrays of pointers to structures Linked lists Special cases of linked lists Stack Queue and deque Priority queues Cyclic linked list Summary for special cases of linked lists Trees A practical example Example - trivial cryptographic virtual machine Virtual machine architecture Adding support for a virtual processor to the Flat Assembler Virtual code The virtual processor Searching the tree The loop Tree balancing Sparse matrices Graphs Summary Mixing Modules Written in Assembly and Those Written in High-Level Languages Crypto Core Portability Specifying the output format Conditional declaration of code and data sections Exporting symbols Core procedures Encryption/decryption Setting the encryption/decryption parameters f_set_data_pointer f_set_data_length GetPointers() Interfacing with C/C++ Static linking - Visual Studio 2017 Static linking - GCC Dynamic linking Assembly and managed code Native structure versus managed structure Importing from DLL/SO and function pointers Summary Operating System Interface The rings System call System call hardware interface Direct system calls Indirect system calls Using libraries Windows Linking against object and/or library files Object file Producing the executable Importing procedures from DLL Linux Linking against object and/or library files Object file Producing the executable Dynamic linking of ELF The code Summary Patching Legacy Code The executable The issue PE files Headers Imports Gathering information Locating calls to gets() Preparing for the patch Importing fgets() Patching calls Shim code Applying the patch A complex scenario Preparing the patch Adjusting file headers Appending a new section Fixing the call instruction ELF executables LD_PRELOAD A shared object Summary Oh, Almost Forgot Protecting the code The original code The call The call obfuscation macro A bit of kernel space LKM structure LKM source .init.text .exit.text .rodata.str1.1 .modinfo .gnu.linkonce.this_module __versions Testing the LKM Summary