And now let's talk about one of the most fundamental instructions in assembly language, which is the
MOV instruction.
Uh, this single command allows us to move data from one place to another, either from a memory address
to register, or from register to a memory address, or even from one register to another.
So imagine, uh, the CPU as a very fast worker with a clipboard.
Uh, so the clipboard is the register in this case, and the memory as the large archive cabinet full
of boxes, which we can call the memory addresses.
The MOV instruction is like telling the worker, go to the cabinet, pick, uh, for example, this
box and bring it here, or take the note on your clipboard and store it in that cabinet box.
That's let's actually do another example.
Let's move a constant value into a register.
So move x and yeah
0XAABBCC
and d d.
And here we are placing this hexadecimal number a a b b c c d d directly into x register.
So think of x as a special notepad on the CPU's desk.
Now this command simply says that hey, write this number down into your notepad.
And now from there we will have ax hold the value of this right.
And let's do another example.
Let's move the data between registers.
How we can do that.
Again same move x register and E register.
And this one copies whether in the id into an x register.
It's like saying copy what's on the notepad.
Uh, the uh let's call it notepad B into a notepad A in this case E x register.
And now let's get into memory access.
Now let's write this memory dump here.
Uh, let's write hypothetical memory address here 0000 60 again zero
78 zero.
Now these are the addresses right?
And at the right we will have bytes in bytes let's say.
And yes, instead of writing it one by one I just wrote it here.
And let's now analyze this one here so we can understand it better.
Yes.
Uh, here, uh, let's look at this, uh, memory dump, uh, hypothetical here we have six zeros as
seven zero and eight zero.
Uh, yes.
Now, each line shows a sequence of bytes stored in a memory starting from, uh, this particular address.
Now, let's read from the memory.
Right.
Now let's delete the old examples here.
Put our memory dump here.
And yes, now we will use directives like byte, word or Dword.
Peter.
Here is means a pointer to tell the assembler what size of data we are dealing with.
Now in this case, let's get started writing here.
So don't worry, we will get more practical as we learn more deeply.
But this is just a this might be more painful compared to just writing a code in a Visual Studio notepad
for assembly code.
But this is a must.
So let's write this down.
Now the next three lines will be read from the memory.
So first move a all, uh, bite and tr and here we will enter.
What?
000007100000071.
And you will understand why we wrote the seven one here.
So we are reading the bar one byte, one byte.
In this case a L which equals to zero x 71.
And in the second line we will use move c x.
And again.
Now instead of using byte we will use word.
Again.
Same.
71.
And with this word we are reading two byte and c x, which in this case it's going to be.
Since we are reading two bytes 7271
here 7271.
And now let's use the another.
In this case we will use E.
Since we will use Dword.
So we will need a much bigger space.
Peter.
Now we will read the same memory address as well.
I will write just more smaller since we will read four byte.
And it's going to be what the x.
X.
And here we will read four bytes from here.
So
74737271737271.
Now let's now make the markings on this memory dump.
At this a l here instruction we read one byte.
Which was this.
Right.
This is what a l.
And then let's use a different color.
Then we use the key to get the two bytes 7271.
So here two bytes.
Let's actually use the ctx.
And then We had here the four bytes with the D word.
Right.
So.
Here here we have the four bytes 74737271.
And this was what it was the ed also called D word.
Now notice how a reading a word or d word pulls more than one byte.
Now the CPU grabs the bytes starting at the address and then combines them according to little endian
format.
You remember that from the little endian and bigger Indian from the previous lectures.
At least significant byte and most significant byte.
If you forgot.
Yeah.
Now in here we was reading.
Reading from the memory right now.
What we need to do here is let's write it right now for the writing.
We will have, uh, we will need, uh, for instructions.
Let's write some, uh, values, uh, back into the memory here again.
Uh, let's use a different color for the writing.
Uh, we will use the move.
Let's use more lighter color.
Move e x move right.
Hexadecimal 01120112.
Yeah
011223344H.
And now we will also move the byte tr move byte pit.
Notice how we use how how we are using pointers to write into memory.
Again here it's going to be, uh.
What?
Uh, yeah.
Yeah.
Let's use this, uh.
Address that ends with eight zero.
So, yeah, 000000
and 880.
Notice we will use 80 and we will increment, uh, by one again here.
L and now we will store 44 at address 0X80.
It will be.
Maybe it will make more sense when we complete our code.
And as I as always I will explain it.
00000081.
Here we will use a X.
And here we will store 23.
Uh.
So here we will store the.
Let's actually instead of saying like store, let's just write writes the value in A to the address.
This one, uh, does the same.
Writes the A to the address.
Now last line is going to be address by the address here is uh ends with eight zero and here eight one.
And now, uh, as the last line.
Move the world again.
TR.
000083.
Here we will use X.
And again this basically writes value in x into a memory address at here.
And afterwards what the memory will look like is.
Since in the x we had stored this, the memory will like look like in the eight zero, the 70, the
80.
In the address 80, the we will delete it.
It will transition to 4440 444.
Since this is little endian, we will use the least significant byte.
(444) 433-4422
and one one.
And yes.
And after that, uh 87, we will not touch it, because the way our registers and instructions, uh,
manipulates the memory, and you can see how values got injected into memory at exact addresses using
the right directive.
And yeah, this is the heart of the reverse engineering.
Uh, if you can understand how memory is accessed and manipulated, uh, you can uncover how a program
works, intercept what they store, or change how they behave just by shifting around the bytes and
values.