Hello and welcome.
In this video, we are going to talk about assembly language basics for malware analysis of native exe
files.
What is the stack?
Stack stands for LIFO, last in, first out data structure.
It stores local variables and return addresses for functions.
Is accessed through push pop.
Call and read instructions and the ram memory layout for the stack are as follows.
It starts at a high address as shown in the diagram here, and as more values are pushed, smaller and
smaller addresses are used and the lower addresses are at the top of the stack.
So this whole thing is a stack.
Here is part of the Ram memory and the EVP is the base pointer is the register which stores the address
of the bottom of the stack.
The ESP is another pointer which stores the address of the top of the stack.
So these are all registers which are useful for creating a stack.
What is the hip?
Hip are used for globally storing memory.
All functions can access it because it is stored globally.
They are typically stored in a data section of a program.
In this API.
RTL allocate heap can be used to create a heap.
Malware.
Use heap as a storage area for anything it is going to use and you can look up the mSDN help in the
Google description of this API function.
Next we look at CPU registers.
The CPU registers consists of the following registers.
Ekb.
All the way to IP X is typically known as the accumulator for arithmetic operations.
EB is the base pointer to point to data.
X is usually a counter for shifting rotating instructions and for looping.
X is for data arithmetic and IO esi is a source.
Index is a pointer to the source.
In string operations, EDI is a destination index pointer to destination in string operations.
EB is a base pointer which points to the base of the stack which we have seen.
ESP is a stack pointer which points to the top of the stack and EIP is the instruction pointer, which
stores the address of the next instruction that is going to execute.
There are also segment registers.
SS is a stack pointer.
CS is a good pointer.
DS Data pointer and so on.
The important ones are SS, CS and DS, and these are called segment registers.
You can access parts of a register, for example.
A register.
In this example is 32 bit register consists of four bytes, which is also known as the DWord, four
bytes, 32 bits.
If you only wanted to access half of it, which is actually accessing the word the lower two bytes,
which is 16 bits, you can use this symbol a x instead of x.
And if you wanted to access the lower lower most byte, which is the eight bits, then you can use Al.
So Al accesses the lower byte.
H accesses the higher byte.
So example is this.
Supposing the x has got this hex values one, two, three, four, five, six, seven and eight.
If you are going to access the x, this is this is a DWord.
If you want to access the word, then he will use a X.
If he wanted to access the higher byte, you use a and lower byte al.
So this is what you will get.
A X will give you five, six, seven, eight.
H will give you five, six and Al will give you seven eight.
The same thing applies to all the other registers.
For example, if you are accessing x, you will use for the word and for the lower byte will be b,
l, higher byte will be B and so on.
We also have the flex register.
This is the register where each bit acts as a flag containing a one or a zero.
The important ones are as follows.
The CF is a carry flag.
It is set when the result of an operation is too large for the destination operand.
The zero flag.
It is set when the result of an operation is equal to zero.
The sign flag is set if the result of an operation is negative.
And the DF flag, also known as a trap flag, is set.
If you are doing step by step, debugging and malware can detect this sometimes if they have Anti-debugging
functionality.
Assembly language Instructions.
Three main categories.
Data flow.
For example.
The Move instruction.
Control Flow.
For example.
Push.
Call and jump.
Arithmetic and logic.
For example.
Xor or.
And mul.
And add.
Examples of data transfer instructions are.
Move.
The purpose is to move.
For example, move source to destination.
An example will be move the value stored in the address to the x register.
Move x which means move zero extended for example, move source to destination.
So this will move the hexadecimal 123 into x and pad the higher order bits with zeros.
LDA load effective address for example for source to destination.
This will load the address after u minus four zero inches hex from EB and store.
The resulting address in exchange is to swap the values between two registers.
For example, exchange source and destination will swap whatever is in source into destination and whatever
in destination into source.
Examples of control flow instructions jumps.
So this is an unconditional jump where it will jump no matter what the condition is prior to it.
Example we jump to the value stored in this address.
J is a conditional jump.
It jumps only if the zero flag is one.
For example, J address jump not zero jump not zero will jump if the zero flag is zero.
If jump is preceded by either a test or compare instruction.
However, jump is a unconditional jump and not preceded by any test or compare.
Here is an example of a jump.
So this jump will only take place if the comparison here is is equal to zero.
For example, if x minus SC is zero, then this will jump.
This JB is jumped below.
So this jump below only happens if the x minus the value stored in Ed's plus C is less than zero.
Then if we jump.
And over here, jump.
Not equal.
Jump not equal.
Only happen if the.
X minus.
I is not equal to zero.
Then only it will jump.
Examples of arithmetic instructions add sub email and inc.
So examples would be.
Add source to destination, which means that you take whatever is in source, add to destination and
store the results in destination.
Sub just the same thing, but just minus.
Email is where you multiply source by the value and then store the result in destination.
Increment in C means you increment whatever is in the register by one.
And these are examples here.
Examples of logic instructions.
XOR performs bitwise xor for example.
Source Source Destination.
And then here, shift left.
That means you shift all the bits by left, by by the number of bits indicated in source.
For example, if x is one, then you shift every bit here to the left by one and perform bitwise and.
So here you perform an n operation with a source and a destination.
Test and compare instructions.
This is where you perform a bitwise and on two operands.
If the result is zero zero flag is set.
Often used with conditional jumps.
CMP is where you compare the first operation with the second operation by subtraction.
So this is an example here where you take argument one minus, argument two jump instructions always
come immediately after a test or a compare, as I've just demonstrated earlier on return values.
X Register is used to hold the return value of a function call.
The return value could be an integer or a zero or even negative one, which is denoted in hex by all
F's.
It can also be an address, for example, this hexadecimal address.
Take for example this output from the x64 DBG.
Over here you will see a bush seven.
So push seven will push seven to the stack down here and then call after it calls this function.
It will return the result of the call in X.
That's all for this primer on assembly language.
Thank you for watching.