Practical Malware Analysis

The x86 Architecture

The internals of most modern computer architectures (including x86) follow the Von Neumann architecture, illustrated in Figure 4-2. It has three hardware components:

• The central processing unit (CPU) executes code.

• The main memory of the system (RAM) stores all data and code.

• An input/output system (I/O) interfaces with devices such as hard drives, keyboards, and monitors.

Figure 4-2. Von Neumann architecture

As you can see in Figure 4-2, the CPU contains several components: The control unit gets instructions to execute from RAM using a register (the instruction pointer), which stores the address of the instruction to execute. Registers ...