Reversing : The Hacker's Guide to Reverse Engineering

■■ Register name: The name of a general-purpose register to be read from

or written to. In IA-32, this would be something like EAX, EBX, and so on.

■■ Immediate: A constant value embedded right in the code. This often

indicates that there was some kind of hard-coded constant in the origi-

nal program.

■■ Memory address: When an operand resides in RAM, its memory

address is enclosed in brackets to indicate that it is a memory address.

The address can either be a hard-coded immediate that simply tells the

processor the exact address to read from or write to or it can be a regis-

ter whose value will be used as a memory address. It is also possible to

combine a register with some arithmetic and a constant, so that the reg-

ister represents the base address of some object, and the constant repre-

sents an offset into that object or an index into an array.

The general instruction format looks like this:

Instruction Name (opcode) Destination Operand, Source Operand

Some instructions only take one operand, whose purpose depends on the

specific instruction. Other instructions take no operands and operate on pre-

defined data. Table 2.2 provides a few typical examples of operands and

explains their meanings.

Basic Instructions

Now that you’re familiar with the IA-32 registers, we can move on to some

basic instructions. These are popular instructions that appear everywhere in a

program. Please note that this is nowhere near an exhaustive list of IA-32

instructions. It is merely an overview of the most common ones. For detailed

information on each instruction refer to the IA-32 Intel Architecture Software

Developer’s Manual, Volume 2A and Volume 2B [Intel2, Intel3]. These are the

(freely available) IA-32 instruction set reference manuals from Intel.

Table 2.2 Examples of Typical Instruction Operands and Their Meanings

OPERAND DESCRIPTION

EAX Simply references EAX, either for reading or writing

0x30004040 An immediate number embedded in the code (like a

constant)

[0x4000349e] An immediate hard-coded memory address—this can be a

global variable access

48 Chapter 2