Assembly Language for Beginners

6.1. ARGUMENTS PASSING METHODS (CALLING CONVENTIONS) 6.1.7 Modifying arguments. Sometimes, C/C++ programmers (not limited to the ...

6.1. ARGUMENTS PASSING METHODS (CALLING CONVENTIONS) include <stdio.h> // located in some other file void modify_a (int *a ...

6.2 Thread Local Storage mov edx, DWORD PTR [rsp+12] ; reload value from the local stack and pass it to ⤦ Çprintf() mov esi, OFF ...

6.2. THREAD LOCAL STORAGE Win32 UninitializedTLSdata One solution is to add__declspec( thread )modifier to the global variable, ...

6.2. THREAD LOCAL STORAGE mov DWORD PTR _rand_state[ecx], eax and eax, 32767 ; 00007fffH ret 0 _my_rand ENDP _TEXT ENDS rand_sta ...

6.2. THREAD LOCAL STORAGE 9 __declspec( thread ) uint32_t rand_state=1234; 10 11 void my_srand (uint32_t init) 12 { 13 rand_stat ...

6.2. THREAD LOCAL STORAGE __declspec( thread ) uint32_t rand_state; void my_srand (uint32_t init) { rand_state=init; } void NTAP ...

6.3 System calls (syscall-s). TheGS:selector is also used to access theTLS, but in a somewhat different way: Listing 6.18: Optim ...

6.4 Linux mov ebx,1 ; file descriptor. 1 is for stdout mov eax,4 ; syscall number. 4 is for sys_write int 0x80 mov eax,1 ; sysca ...

6.4. LINUX .text:00057A04 lea eax, (aInvalidKindIn_ - 1AF000h)[ebx] ; "! \"invalid⤦ ÇKIND in __gen_tempname\"" .text:00057A0A mo ...

6.4. LINUX .text:000005B6 add esp, 1Ch .text:000005B9 retn .text:000005B9 f1 endp That’s it: the pointers to«returning %d\n»andg ...

6.4. LINUX 6.4.2LD_PRELOADhack in Linux This allows us to load our own dynamic libraries before others, even before system ones, ...

6.4. LINUX vprintf (fmt, va); exit(0); }; static void find_original_functions () { if (inited) return; libc_handle = dlopen ("li ...

6.5 Windows NT Let’s runuptimewhile loading our library before the others: LD_PRELOAD=`pwd`/fool_uptime.so uptime And we see: 01 ...

6.5. WINDOWS NT 12 cmp ds:400000h, ax 13 jnz short loc_401096 14 mov eax, ds:40003Ch 15 cmp dword ptr [eax+400000h], 4550h 16 jn ...

6.5. WINDOWS NT 82 push 1 83 call cinit 84 pop ecx 85 test eax, eax 86 jz short loc_401123 87 push eax 88 call __amsg_exit 89 po ...

6.5. WINDOWS NT abnormally with the following error: runtime error R6030 CRT not initialized Global object initializations in ...

6.5. WINDOWS NT Terminology Module—a separate file, .exe or .dll. Process—a program loaded into memory and currently running. C ...

6.5. WINDOWS NT console (console application) or GUI(non-console). OS version A PE file also specifies the minimal Windows ver ...

6.5. WINDOWS NT typedef struct _IMAGE_SECTION_HEADER { BYTE Name[IMAGE_SIZEOF_SHORT_NAME]; union { DWORD PhysicalAddress; DWORD ...