-------------
A. Registers:
-------------
Registers are variables which are stored in your processor.
The processor uses these variables for basic mathimatical and logical operations.
The mostly used registers are: eax, ebx, ecx and edx.
Sometimes you will see edi, esi, esp, ebp.
There are three types of registers: 32Bit registers, 16Bit registers and 8Bit registers.
The 32Bit registers start with e, such as eax.
There are 16Bit equivalents of these registers.
The only Difference between the two types is the veriable size.
These registers are: ax, bx, cx, dx, di, si, sp, bp.
There are also 8 bit registers.
The 8Bit registers are: al, ah, bl, bh, cl, ch, dl, dh.
l - means the lower 8 bits of the 16Bit register.
h - means the higher 8 bits of the 16Bit register.
Here the l stands for the lower and h for the higher 8 bits of a 16 bit register.
|
--------
B. Flags
--------
Flags are Boolean variables (get 0 or 1 values).
Flags are used by the processor for internal logical and mathematical operations,
in order to get the result of the operation.
The most important flag is the Zero Flag, which can get zero or non-zero (1) values.
|
------------
C. Code Flow
------------
When you are analyzing a piece of code, you must understand that the processor
is actually quite stupid, and all it does is to simply follow the basic instructions,
line by line.
It does anything the code tells it to do, and cannot do anything that is not written
in the code (unless it has been run over by a herd of cows and abducted by aliens).
This is why you have to think like the processor when you're analyzing a piece of code,
and to act like it (just don't get used to it! Inhale, exhale, inhale, exhale... nevermind, stupid joke) :)
You have to do everything the processor does, you have to compare registers and variables, execute jumps and calls,
calculate Basic mathematical operations, store and load register values and addresses, and so on...
The processor has an instruction pointer especially for this, which is also called IP
(it has nothing to do with IP addresses in the Internet Protocol, trust me).
Using the instruction pointer, the processor points to the instruction that is about to be executed.
The processor also has and executes instructions which change the code flow.
These instructions can be function calls, any other routine calls, jumps, conditional jumps, which depend
on the zero flag, negative conditional jumps...
|