Reversing : The Hacker's Guide to Reverse Engineering

Moving Data

The MOVinstruction is probably the most popular IA-32 instruction. MOVtakes
two operands: a destination operand and a source operand, and simply moves
data from the source to the destination. The destination operand can be either
a memory address (either through an immediate or using a register) or a reg-
ister. The source operand can be an immediate, register, or memory address,
but note that only one of the operands can contain a memory address, and
never both. This is a generic rule in IA-32 instructions: with a few exceptions,
most instructions can only take one memory operand. Here is the “prototype”
of the MOVinstruction:

MOV DestinationOperand, SourceOperand

Please see the “Examples” section later in this chapter to get a glimpse of
how MOVand other instructions are used in real code.

Arithmetic

For basic arithmetic operations, the IA-32 instruction set includes six basic
integer arithmetic instructions: ADD, SUB, MUL, DIV, IMUL, and IDIV. The fol-
lowing table provides the common format for each instruction along with a
brief description. Note that many of these instructions support other configu-
rations, with different sets of operands. Table 2.3 shows the most common con-
figuration for each instruction.

Low-Level Software 49

THE AT&T ASSEMBLY LANGUAGE NOTATION

Even though the assembly language instruction format described here follows

the notation used in the official IA-32 documentation provided by Intel, it is not

the only notation used for presenting IA-32 assembly language code. The AT&T

Unix notation is another notation for assembly language instructions that is

quite different from the Intel notation. In the AT&T notation the source operand

usually precedesthe destination operand (the opposite of how it is done in the

Intel notation). Also, register names are prefixed with an %(so that EAXis

referenced as %eax). Memory addresses are denoted using parentheses, so that

%(ebx)means “the address pointed to by EBX.” The AT&T notation is mostly

used in Unix development tools such as the GNU tools, while the Intel notation

is primarily used in Windows tools, which is why this book uses the Intel

notation for assembly language listings.