assembly we can consider its a mid level language between human and machine languages , if you reverse engineer or a malware analyst you should learn assembly to able to read and understand the code .

"note each cpu archticture has its own assembly instruction here is the basics of Intel 32 arch assembly 86"

in this article just a quick intro to it and some important notes .

sourcecode ➡ assembler make objectcode("machine language") ➡ linker make it exe ➡ os loader get it in output when we run it

registers is small unit in cpu , they are used to store data and instructions that the CPU needs to access quickly , there is general purpose refisters , flags and segment registers

general purpose refisters:

flags:

EIP //NEXT INSTRUCTION POINTER

stack memory is a type of memory that stores data in a Last In First Out (LIFO) format. It is a special type of memory that is used to store local variables and function parameters when a program is running. It is also used to store return addresses when functions are called. Stack memory is allocated and released very efficiently, making it the most efficient type of memory for storing temporary data .

stack (LIFO)last in first out , stack used 2 instructions PUSH AND POP : push its put data and pop get data out

there is two syntax to write asm86 instruction (opcode) we will foucus on the intel syntax

it takes the source from the right side put in the left side , like = operaton in high lvl programming language

also its not always can be like this it can be instructionOnly and instruction destination

like nop "no operation"

like inc,dec,push,pop,etc...

1-register eax ,edx,...

2-place in memory DWORD [1254554566 this example number]...

byte "8 bit"

word "16 bit"

dword "32 bit"

qword "64 bit"

and increment the same as above

3-Acess STACK

same like dest or immediate value "just a number or value"

data manipulation

ADD,SUB,MUL,DIV,NEG,INC,DEC

OR,XOR,AND,NOT

SHL,SHR,ROL,ROR

data transfer

MOV,MOVZX,MOVSX "mov data form src to dst"

XCHG "Replace data"

PUSH,POP,PUSHAD,POPAD

MOVSB,LODSB,STOSB

program control is two cases :

1-unconditional JMP, "" CALL,RET "call and return function"

2-conditional JNZ,JZ,JCC...,LOOP "like if , if else , else , and loop"

Resources to learn assembly x86

watch it first

Arabic dr ahmed sallam

Arabic shell code with assembly