Another approach to convert an unsigned integer to a string and write it: section .text global _start _start: mov eax, 1234567890 mov ebx, 5 add eax, ebx ; Convert EAX to ASCII and store it onto the stack sub esp, 16 ; reserve space on the stack mov ecx, 10 mov ebx, 16 .L1: xor … Read more
mov-store + mfence and xchg are both valid ways to implement a sequential-consistency store on x86. The implicit lock prefix on an xchg with memory makes it a full memory barrier, like all atomic RMW operations on x86. (x86’s memory-ordering rules essentially make that full-barrier effect the only option for any atomic RMW: it’s both … Read more
Accessing raw CPUID information is actually very easy, here is a C++ class for that which works in Windows, Linux and OSX: #ifndef CPUID_H #define CPUID_H #ifdef _WIN32 #include <limits.h> #include <intrin.h> typedef unsigned __int32 uint32_t; #else #include <stdint.h> #endif class CPUID { uint32_t regs[4]; public: explicit CPUID(unsigned i) { #ifdef _WIN32 __cpuid((int *)regs, (int)i); … Read more
Assuming 32-bit x86, use the following function: get_eip: mov eax, [esp] ret Then, to get the value of EIP in EAX, simply: call get_eip
In x86-64, 32-bit instructions implicitly zero-extend: bits 32-63 are cleared (to avoid false dependencies). So sometimes that’s why you’ll see odd-looking instructions. (Is mov %esi, %esi a no-op or not on x86-64?) However, in this case the previous mov-load is also 32-bit so the high half of %rax is already cleared. The mov %eax, %eax … Read more
You’ll need the Linux kernel sources in order to see the actual source of the system calls. Manual pages, if installed on your local system, only contain the documentation of the calls and not their source itself. Unfortunately for you, system calls aren’t stored in just one particular location in the whole kernel tree. This … Read more
Recent GAS in binutils has a .nops N pseudo-instruction that expands to the requested number of bytes for the target: .nops size[, control]
esp is the stack pointer, ebp is/was for a stack frame so that when you entered a function ebp could get a copy of esp at that point, everything on the stack before that happens, return address, passed in parameters, etc and things that are global for that function (local variables) will now be a … Read more
One significant difference between LEA and ADD on x86 CPUs is the execution unit which actually performs the instruction. Modern x86 CPUs are superscalar and have multiple execution units that operate in parallel, with the pipeline feeding them somewhat like round-robin (bar stalls). Thing is, LEA is processed by (one of) the unit(s) dealing with … Read more
JE and JZ are just different names for exactly the same thing: a conditional jump when ZF (the “zero” flag) is equal to 1. (Similarly, JNE and JNZ are just different names for a conditional jump when ZF is equal to 0.) You could use them interchangeably, but you should use them depending on what … Read more