So.
Hello everyone.
I'm Tiffany here again.
Now, in our previous lecture you have learned about the general purpose registers like accumulator,
base register, counter register and so on and so forth.
Also you learned about the stack pointers.
And um, we also touched a little bit about the instruction pointers which we will be covered that topic
in next lecture.
So instruction pointers remember it is a general special purpose register always contains the address
of the next instructions to be executed.
And the CPU reads from this address every cycle.
And it also has modes like 16 bit mode.
It has we call it with IP in a 32 bit mode.
We call it using E, I p.
It doesn't have uh, it doesn't have any connection by the internet protocol.
By the way.
don't mistaken.
And in the 64 bit we have R.I.P., which will be covered in greater detail for the next lectures here
and now.
You don't typically write to this directly.
Instead, control flow instructions like call or G or interrupts modify it.
Now, uh, what we, as you remember from the introduction of the previous lecture, we divided the
registers into four categories.
And one of them, um, was E flags.
Uh, the flag register.
Yes.
Uh, now this is a 32 bit flag register level right here, which is called E flags.
Lacks.
This influx.
This is a 32 bit register that tracks the result of operation using specific bits.
So each bit represents a flag, which is a binary indicator that affects branching, conditional execution
and processor status.
Now what we will do here.
Now I will go back and remove this again.
We will have several flags here.
And we will also.
So in the and on the left here we will have a from 0 to 11.
In total 12 flags.
We will also write the bits the Abbreviation and all.
And the description for these flags as well.
So we will call it the offset abbreviation and description.
Let's use a different color at offset zero.
We have the.
So.
The description is this is a carry flag.
So this flag is set when an addition operation requires a bit to be carried.
It is also said when a bit needs to be borrowed in a subtraction operation.
So you already know what the bit carrying and bit borrowing means.
Uh, by the binary arithmetic lecture, the one here actually does not mean anything, so it is reserved
in the offset.
Two we have p f.
This is a parity flag.
So this flag indicates if the number of set bits is odd or even from the last instruction operation.
So basically it indicates even or odd number of ones in the last result in the offset.
Three we have also reserved offset for we have adjust flag a f.
This is used in binary coded decimals.
Which BCD this flag is set when a carry happens from the low to high nibble, or when a borrow happens
from the high to low nibble of a byte offset six.
We have the zero flag.
This flag is set when the result of the last instruction operation is zero.
Offset seven.
We have the S.F., which is sin flag.
This flag is set when the result of the last instruction operation is a negative number offset eight.
We have the TF.
This is a trap flag.
This is used when debugging.
This flag is set when breakpoints are encountered.
Setting the trap flag can cause an exception on every instruction, enabling debugging tools to control
step by step debugging.
So basically the trap flag and a short description.
It enables single step debugging.
In the offset nine we have.
I.
This is an interrupt flag.
If this flag is set, the processor responds to interrupts.
So interrupts are instances where errors.
External events or exceptions are triggered from hardware or software.
So basically in short if clear it disables hardware interrupts.
In the offset ten we have the DF.
DF is a direction flag, so when set data is read from memory backwards.
Um, also it dictates the direction of string operations.
And we also have the overflow flag.
And now this overflow flag works.
Uh, if it is set, if an arithmetic operation results in a value larger than what the register can
contain.
So basically, this is not all the, uh, flag registers we have here.
Uh, but, uh, basically, it depends on the, uh, bits our CPU can carry in most cases, uh, like,
it can either carry from, um, like 23 to 31.
So from 23, from 11 to, uh, 23.
Uh, we have another flags as well.
Uh, like E0 pal.
Uh, which is input output privilege level uh, which shows the ability of the program to access input
output ports.
It.
We have the NT which is the nested task, and let's actually write it.
Uh, so uh, in the as an interaction of this, uh, lectures, uh, so beginning sections, we will
not talk about the rest of these flags here because we will not use them widely.
So basically what we will do here from the 11, uh, we have uh, the yeah, after OIF we have IO.
Like the anti uh, which nested task flag.
Uh, this controls the chaining of interrupt tasks or processes.
If set then it is linked to the chain.
Uh, the 15 offset 15 is uh reserved as well.
And uh offset 16 is our.
r f.
It is a resume flag.
It temporarily disables debug exceptions so the next instruction being debugged can be interrupted without
debug exception.
We have the V flag at offset 17, by the way.
Remember.
Uh, so if you ask why you passed the flag 12 and 13, uh, because, uh, the iopl here uses two of
these offsets, both 12 and 13, just to remind you.
So VM basically here sets the program to run in compatibility with the 1886 processors.
We have the AC.
This is a alignment check.
This flag is set when data is written on a memory reference, such as.
The stack is a non-word for four byte boundaries, or non-double word for eight byte boundaries.
However, this flag was more useful before the 486 architecture days.
So as I said, these are secondary.
In our course we will not use these flags much and we have the v I fee, not the VIP here, just the
VIP.
And now this is a virtual interrupt flag similar to the interrupt flag we have learned here.
I uh, but it works when in virtual mode.
And we also have the v I p.
This is a virtual interruption pending flag indicates that triggered interrupts are waiting to be processed.
This also works in a virtual mode.
And lastly we have the ID, we can tell this identification flag at the offset 21.
Uh, indicates if the cpuid instruction can be used, the CPU ID can determine the type of processor
and other processor info.
So basically 20, uh, offset 22 is reserved as well.
But from the offset 23 to 2031, it is also reserved.
And from the offset uh, 32 all the way to offset uh 63, it is also reserved as well.
So these are all reserved flags.
Uh, now.
Yeah.
Understanding this, uh, flags is crucial in reverse engineering because malware often manipulates
them to control flow or hide intentions.