Some Additional Notes

• "Special" general purpose registers
  • Jorgensen Chapter 2, will we ever finish this? YES NOW
  • The rsp (*sp) register is reserved to point to he top of the stack.
    • As you may or may not know, we use the stack for function calls.
    • We put local variables there.
    • We "save" or preserve registers there when we make a function call.
    • We also store information about where to return when the function exits.
    • We manage the stack ourselves, and use this register to do so.
    • Mess this up and you have a problem with function calls.
  • rbp (*bp) is reserverd for use during function calls.
    • This points to the bottom of your frame pointer on the stack.
    • This is used in function calls as well.
    • This should not be used unless needed.
  • rsi and rdi are "scratch" registers
    • They are used to pass parameters to functions (linux)
    • They were used for special assembly instructions in the past.
• Other registers
  • rip is the instruction pointer.
  • Note as we step, it changes.
  • Run the demo program and note the changes in $rip

    Breakpoint 2, _start () at regDemo.asm:7
    7                 mov       rax, 01111111111111111h
    (gdb) p /x $rip
    $8 = 0x401000
    (gdb) s
    9                 mov       eax, 022222222h
    (gdb) p /x $rip
    $9 = 0x40100a
    (gdb) s
    
    Breakpoint 1, _start () at regDemo.asm:11
    11                mov       ax, 03333h
    (gdb) p /x $rip
    $10 = 0x40100f
    (gdb) s
    13                mov       al, 044h
    (gdb) p /x $rip
    $11 = 0x401013
    (gdb) s
    15                mov       al, -1
    (gdb) p /x $rip
    $12 = 0x401015 

  • Can we understand the machine code for these instructions?
    • This is complex, but we can start...
    • Line 7,
      • opcode, register, 64 bit (8 byte) number
      • Possibly 10 bytes.
      • Yep, 401000₁₆ to 40100a₁₆
      • The data is stored in 0,1,2, ..., 9 or 10 spaces.
    • line 9
      • opcode, register, 32 bit (4 bytes) number
      • Possibly 6?
      • 0x40100a₁₆ to 0x40100f₁₆
      • The code is stored in a,b,c,d,e
  • Looking at od -x --endian=big regDemo

      file   
     offset |---------------- data ---------------|
    0010000 48b8 1111 1111 1111 1111 b822 2222 2266
    0010020 b833 33b0 44b0 ff48 c7c0 ffff ffff b83c 

  • We see that b8 occurs multiple times.
  • I am finding it hard to find a readable intel machine code reference, but this page on mov seems right.
    • There are MANY different MOVE instructions.
    • but one set, involves b8+rw iw makes sense
    • Look at the nasm instruction set search for MOV