Let's start writing some simple assembly programs using sixty four assembly.
I have a directory called X 86 and escort 64 in my home country.
Let's navigate there.
And inside this bakery, I'm going to create another directorate called Ehrsson and let's navigate to
ask them directly.
And let's create a new file called Move Dot Nazim.
Here it is.
I'm using them here.
You can use your favorite text editor.
And let's start with a directive called Global, which tells our link with the entry point of this program
is So I'm typing Global Space Underscore Stop.
So we are basically specifying that the entry point of this program is underscored start and let's start
writing our actual code within this entry point, which is underscore, start, select type, underscore,
start calling.
And this is going to be our entry point.
Now let's begin writing some move instructions.
Let's begin by writing a move instruction to move the valuate into Register IREX.
We can do that by typing move on x comma eight.
We can also move hex values into the registers.
Let's try moving hex a which is decimal then into our X move at X zero x a.
In the first instruction, we are moving decimal eight and in the next instruction we are moving Hecks
A we are telling the program that we are moving a hex value that stem by preventing zero to eight.
Now let's try to move the value of a register into another register.
For instance, we have the value of hex error in the register Artex.
Let's try to move that into the RBA register.
So I'm typing move r, b, x, comma r x.
There is another type of move instruction which will essentially move the value which is pointed by
the address of the register.
Let's see one such instruction move as the X comma.
RSP, which is surrounded by square brackets, it will try to pick the edges of Arizpe and it will move
the value that is pointed by this arizpe register into Rs6.
Now, it may sound confusing, but let's try to debunk this program using GDB in a moment and you will
understand what I mean.
OK, that's pretty much it.
We can now save the program and Taiping Control see and Colin WQ, so the changes will be saved.
Now let's use Nazan to assemble this program.
So I'm typing Nazan moved out nazem.
Basco moved out of Dasht f f 64.
We are specifying that it's a 64 week program I'm hitting enter now.
Let's link it using Ellie.
Ellie moved at all, which is the output from the previous command.
And let's produce the output and let's name it.
Move, let's render.
So move is going to be the final binary to be able to examine the registers and the values that are
being moved into registers.
Let's open this program using Jilib.
So I'm typing GDB.
Don't move.
If you notice we are seeing a Jeff terminal because we have installed Jeff for GDB.
This makes our life so easy during exploit development.
Trust me, you are going to love it by the time you reach the end of the course.
Now let's set up a breakpoint at the entry point of this program.
If you remember, our entry point is underscored start.
So I'm typing break space and let's go start hitting enter.
If you notice there is a breakpoint set at this particular address.
Now if we type run, the program will run and it will pass the execution at the entry point because
we did set up a breakpoint.
I am hitting enter.
And look at this, currently, the next instruction to be executed is this, and if you notice, there
is a breakpoint, so the execution is stopped.
Now, there are a few things that we would need to observe in this output.
Number one, call, if you notice, this is the code section.
You can see it here.
It is highlighted and these are the instructions that are going to be executed when we run this program.
So this is the area where we are going to notice all the instructions that get executed.
So the next section is stack.
This area shows the stack.
We are going to use it extensively later in this course.
So it is good to know where the stack is in our output after that.
Let's take a look at the registers.
If you see this, these are the registers once again.
Remember, we are going to make extreme use of these registers stack and the code section.
So it is good to note when they are in your output.
Now, within these registers, let's take a look at the RHP register.
If you notice, the IP register is pointing to this address, which is ending with four zero one triple
zero.
So let's scroll down.
And if you notice, this is the address and as you can see, this is the beginning of our program and
this is the next instruction to be executed.
And if you look at this address, this is same as what we have just seen in the AP register.
What it means is RHP always holds the address of the next instruction to be executed.
One interesting thing to note here is that the first instruction has the register egs instead of adex.
This means some optimisations have been made by the assembler.
Now let's try to execute this instruction and see what happens to the value of attacks before that.
Let's check what we have in Artex register.
If you notice, IREX currently has the zero and we are about to execute the instruction, which is going
to move the valuate into the register area.
So let's type aside, which stands for single step, which means execute one instruction.
OK, so let's hit enter and see what happens to Alex Register.
I have executed one instruction, if you notice, this is the next instruction to be executed now,
but before executing that, let's take a look at the ATX register.
If you notice, the valuate is now placed in Artex register.
All right.
That is expected.
Now, let's step aside once again and see if this value zero eight is going to be moved into this register.
So let's take a let's once again examine Artex register and look at that.
The value of zero eight is now placed in Artex and the value valuate is overridden.
And the next instruction to be executed is move objects, come up attacks, this means whatever the
value that we have in our eggs is going to be moved into the register RBA.
So let's first take what we have in the RBA register.
Here it is, currently Albrecht's registered contains the Value Zero and the ATX register contains the
value zero eight.
So once the instruction gets executed, Disvalue zero eight should also be available in our register.
Remember, more is not literally moving.
It is basically copying.
So we will still have the value in ATX register as well.
So let's try aside now.
Once again, let's examine the registers.
Look at that, the register RBA is now holding the value zero eight.
All right, now, if you notice the next instruction, as I mentioned earlier, it is going to move
the value that is pointed by the address of Arizpe into R6.
So let's first check what fees arizpe or stack pointer is always going to point to the top of the stack.
If you look at this, Arizpe is currently pointing to this particular value, this is the address off
the top of the stack and it is pointing to this particular value.
So currently on the top of the stack, we have the value one.
So if you type a site, which is a single step, we should see this value one in register Rs6.
So let's see if our theory is correct.
First, as usual, let's once again check what R6 currently contains.
As you can see, it contains the value of zero.
So I'm just going to type site.
And let's once again go back and check what R6 has, as you can see, it now contains the value one,
which is actually taken from the top of the stack.
Well, that's the end of it.
And this is how more inspections work in 64 bit assembly language.