x86 Software Reverse-Engineering, Cracking, and Counter-Measures

CHAPTER 3x86 Assembly: Instructions

Cracking and reverse engineering involve reading, writing, and modifying assembly code. In this book, the focus is on the x86 assembly language.

It isn't necessary to understand every detail of x86 assembly to be a reverse engineer or even to write programs in assembly. This chapter explores the fundamentals of x86 and the main instructions that make up more than 90 percent of assembly code for software.

x86 Instruction Format

Mnemonics are used in x86 assembly to make human-readable assembly code. Each of these mnemonic instructions is assembled into the machine code that controls the processor. So, the processor has no notion of mnemonics, only the machine code. For example, the mnemonic add assembles to the machine code value 0x04.

In x86, instructions are written in a particular format. An example of a simple x86 instruction is:

add eax, 1

In this instruction, add is the mnemonic used to instruct the processor on what to do. This instruction also includes a couple of operands that indicate the data to be used in this operation. In this case, the operands are the register eax and the value 1. An x86 instruction under normal conditions can have up to three operands if it has any at all. There are special extensions to the language that allow extensions up to four operations (VEX prefix), but we won't be delving into this corner of assembly.

The operands to x86 instructions can be registers, immediates, or memory addresses. Registers ...