Introduction
In this section we will be continuing our progress on completing course material from the Pentester Academy's SecurityTube Linux Assembly language Expert 64 Bit course. The current topic is the movement of data in a 64 Bit environment. A segment of assembly code is used to demonstrate the various methods and ways that data can be moved from memory to registers, registers to memory, registers to registers and memory to memory.
The demonstration program is assembled, linked and run. Execution is then to be monitored via GDB. We will use the GEF add-on for GDB to enhance the visual presentation from GDB.
Project code is contained in my github.
The program MovingData-64.nasm
The screenshot below displays the contents of the program MovingData-64.nasm. The program contains a series of various types of data movements. We will assemble, link, run and instruction step this program in GDB+GEF. At each step, we will provide a brief description.
The program is assembled with:
$ nasm -felf64 MovingData-64.nasm -o MovingData-64.oAnd linked with:
$ ld MovingData-64.o -o MovingData-64.o
We then use radare2 to look at the executable's objdump:
Running MovingData-64 in GDB + GEF
Setup and before run
Casual observation of the contents of the program MovingData-64.nasm versus its disassebly in GDB+GEF shows a few minor differences. For example, mov opcodes in the assembly code are changed to movabs in the disassembly. Obviously, variable names are replaced with their appropriate memory addresses in the data segment.
Running MovingData-64 in GDB + GEF
Running step 1
We begin by running the first instruction movabs rax, 0xaaaaaaaabbbbbbbb.
This instruction moves 0xaaaaaaaabbbbbbbb into RAX.
This instruction moves 0xaaaaaaaabbbbbbbb into RAX. We see the effects of this instruction in the next step.
Running MovingData-64 in GDB + GEF
Running step 2
The effect of executing movabs rax, 0xaaaaaaaabbbbbbbb.
We can see that after executing the instruction movabs rax, 0xaaaaaaaabbbbbbbb, we have the following effect on RAX:
$rax : 0xaaaaaaaabbbbbbbb
The next instruction to be executed is: mov eax, 0xaaaaaaaa.
This instruction moves the word 0xaaaaaaaa in EAX. EAX is the 32 bit portion of the 64 bit RAX; therefore, all of RAX will be wiped out and replaced with the 32 bit word 0xaaaaaaaa.
Running MovingData-64 in GDB + GEF
Running step 3
Effect of executing mov eax, 0xaaaaaaaa
We can see that after executing the instruction: mov eax, 0xaaaaaaaa, RAX was affected as shown below:
$rax : 0xaaaaaaaa
The next instruction to be executed is: movabs rax, 0xaaaaaaaabbbbbbbb
This instruction will have the same effect on RAX as described previously.
Running MovingData-64 in GDB + GEF
Running step 4
Effect of executing movabs rax, 0xaaaaaaaabbbbbbbb
After executing movabs rax, 0xaaaaaaaabbbbbbbb, RAX will be affected as follows:
$rax : 0xaaaaaaaabbbbbbbb
The next instruction to be executed is: mov al, 0x11. This instruction loads 0x11 into the lowest byte of RAX, known as AL. After this instruction executes, we can expect RAX to contain:
$rax : 0xaaaaaaaabbbbbb11
Notice that unlike when moving an immediate in to EAX, which wiped out the entire RAX with the immediate, moving into AL affects only the lowest byte of RAX.
Running MovingData-64 in GDB + GEF
Running step 5
Effect of executing 0x401019 <_start+25> mov al, 0x11
After executing 0x401019 <_start+25> mov al, 0x11, RAX will be affected as follows:
$rax : 0xaaaaaaaabbbbbb11
Notice that unlike when moving an immediate in to EAX, which wiped out the entire RAX with the immediate, moving into AL affects only the lowest byte of RAX.
The next instruction to be executed is: 0x40101b <_start+27> movabs rax, 0xaaaaaaaabbbbbbbb. This instruction loads 0xaaaaaaaabbbbbbbb into RAX. After this instruction executes, we can expect RAX to contain:
$rax : 0xaaaaaaaabbbbbbbb
Running MovingData-64 in GDB + GEF
Running step 6
Effect of executing 0x40101b <_start+27> movabs rax, 0xaaaaaaaabbbbbbbb
After executing 0x40101b <_start+27> movabs rax, 0xaaaaaaaabbbbbbbb, RAX will be affected as follows:
$rax : 0xaaaaaaaabbbbbbbb
As stated before, this instruction simply moves the immediate 0xaaaaaaaabbbbbbbb into RAX.
The next instruction to be executed is: 0x401025 <_start+37> mov ah, 0xcc. This instruction loads 0xcc into bits 8-15 of RAX. After this instruction executes, we can expect RAX to contain:
$rax : 0xaaaaaaaabbbbccbb
Running MovingData-64 in GDB + GEF
Running step 7
Effect of executing 0x401025 <_start+37> mov ah, 0xcc
After executing 0x401025 <_start+37> mov ah, 0xcc, RAX will be affected as follows:
$rax : 0xaaaaaaaabbbbccbb
This instruction loads 0xcc into bits 8 through 15 of AX. Notice that unlike moving into EAX, the rest of RAX was not modified.
The next instruction to be executed is: 0x401027 <_start+39> movabs rax, 0xaaaaaaaabbbbbbbb. This instruction loads 0xaaaaaaaabbbbbbbb into RAX. After this instruction executes, we can expect RAX to contain:
$rax : 0xaaaaaaaabbbbbbbb
Running MovingData-64 in GDB + GEF
Running step 8
Effect of executing 0x401027 <_start+39> movabs rax, 0xaaaaaaaabbbbbbbb
After executing 0x401027 <_start+39> movabs rax, 0xaaaaaaaabbbbbbbb, RAX will be affected as follows:
$rax : 0xaaaaaaaabbbbbbbb
This instruction loads 0xaaaaaaaabbbbbbbb into RAX.
The next instruction to be executed is: 0x401031 <_start+49> mov ax, 0xdddd. This instruction loads 0xdddd into bit 0 through 15 of RAX. After this instruction executes, we can expect RAX to contain:
$rax : 0xaaaaaaaabbbbdddd
Running MovingData-64 in GDB + GEF
Running step 9
Effect of executing the instruction 0x401031 <_start+49> mov ax, 0xdddd
After executing 0x401031 <_start+49> mov ax, 0xdddd, RAX will be affected as follows:
$rax : 0xaaaaaaaabbbbdddd
This instruction loads 0xdddd into AX. Notice that unlike loading EAX, the rest of RAX remains unmodified.
The next instruction to be executed is: 0x401035 <_start+53> mov rbp, rax. This instruction loads the contents of RAX into RBP. After this instruction executes, we can expect RBP to contain:
$rbp : 0xaaaaaaaabbbbdddd
Running MovingData-64 in GDB + GEF
Running step 10
Effect of executing the instruction 0x401035 <_start+53> mov rbp, rax.
After executing 0x401035 <_start+53> mov rbp, rax, RBP was affected as follows:
$rbp : 0xaaaaaaaabbbbdddd
This instruction loads the contents of RAX into RBP.
The next instruction to be executed is: 0x401038 <_start+56> mov r10, rbp. This instruction loads the contents of RBP into R10. After this instruction executes, we can expect R10 to contain:
$r10 : 0xaaaaaaaabbbbdddd
Running MovingData-64 in GDB + GEF
Running step 11
Effect of executing 0x401038 <_start+56> mov r10, rbp
After executing 0x401038 <_start+56> mov r10, rbp, R10 was affected as follows:
$r10 : 0xaaaaaaaabbbbdddd
This instruction loads the contents of RBP into R10.
The next instruction to be executed is: 0x40103b <_start+59> mov r11d, r10d. This instruction loads bits 0 to 31 of R10 into bits 0 to 31 of R11. This is so because of the "d" suffixes after the register names. After this instruction executes, we can expect R11 to contain:
$r11 : 0xbbbbdddd
Running MovingData-64 in GDB + GEF
Running step 12
Effect of executing 0x40103b <_start+59> mov r11d, r10d
After executing 0x40103b <_start+59> mov r11d, r10d, R11 was affected as follows:
$r11 : 0xbbbbdddd
This instruction loads bits 0 to 31 of R10 into bits 0 to 31 of R11.
The next instruction to be executed is: 0x40103e <_start+62> mov r12w, r11w. This instruction loads bits 0 to 15 of R11 into bits 0 to 15 of R12. This is so because of the "w" suffixes after the register names. After this instruction executes, we can expect R12 to contain:
$r12 : 0xdddd
Running MovingData-64 in GDB + GEF
Running step 13
Effect of executing 0x40103e <_start+62> mov r12w, r11w
After executing 0x40103e <_start+62> mov r12w, r11w, R12 was affected as follows:
$r12 : 0xdddd
This instruction loads bits 0 to 15 of R11 into bits 0 to 15 of R12.
The next instruction to be executed is: 0x401042 <_start+66> mov r13b, r12b. This instruction loads bits 0 to 7 of R12 into bits 0 to 7 of R13. This is so because of the "b" suffixes after the register names. After this instruction executes, we can expect R13 to contain:
$r13 : 0xdd
Running MovingData-64 in GDB + GEF
Running step 14
Effect of executing 0x401042 <_start+66> mov r13b, r12b
After executing 0x401042 <_start+66> mov r13b, r12b, R13 was affected as follows:
$r13 : 0xdd
This instruction loads bits 0 to 7 of R12 into bits 0 to 7 of R13.
The next instruction to be executed is: 0x401045 <_start+69> mov rsi, QWORD PTR ds:0x402008. This instruction loads the contents of memory at QWORD PTR ds:0x402008 into RSI. We examing the contents of memory at this location to obtain:
gef➤ info variables
All defined variables:
Non-debugging symbols:
0x0000000000402000 sample
0x0000000000402008 sample2
0x0000000000402010 sample3Mbr> 0x0000000000402018 __bss_start
0x0000000000402018 _edata
0x0000000000402018 _end
gef➤ x/xg &sample2
0x402008: 0x1122334455667788
gef➤
After executing this instruction, we expect RSI to contain:
$rsi : 0x1122334455667788
Running MovingData-64 in GDB + GEF
Running step 15
Effect of executing 0x401045 <_start+69> mov rsi, QWORD PTR ds:0x402008
After executing 0x401045 <_start+69> mov rsi, QWORD PTR ds:0x402008, RSI was affected as follows:
$rsi : 0x1122334455667788
This instruction loads the contents of memory at QWORD PTR ds:0x402008 into RSI.
The next instruction to be executed is: 0x40104d <_start+77> mov r14d, DWORD PTR ds:0x402000. This instruction loads bits 0 to 31 of the contents of memory at QWORD PTR ds:0x402000 into R14. We examing the contents of memory at this location to obtain:
gef➤ info variables
All defined variables:
Non-debugging symbols:
0x0000000000402000 sample
0x0000000000402008 sample2
0x0000000000402010 sample3Mbr> 0x0000000000402018 __bss_start
0x0000000000402018 _edata
0x0000000000402018 _end
gef➤ x/xg &sample
0x402000: 0x2211ffeeddccbbaa
gef➤
Recall that in the code, the variables were defined as follows:
section .data
sample: db 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x11, 0x22
sample2: dq 0x1122334455667788
sample3: times 8 db 0x00
samples was defined as 0xaabbccddeeff1122 in the code, but was stored as 0x2211ffeeddccbbaa because of little-endianess.
After executing this instruction, we expect R14 to contain:
$r14 : 0xddccbbaa
Running MovingData-64 in GDB + GEF
Running step 16
Effect of executing 0x40104d <_start+77> mov r14d, DWORD PTR ds:0x402000
After executing 0x40104d <_start+77> mov r14d, DWORD PTR ds:0x402000, R14 was affected as follows:
$r14 : 0xddccbbaa
This instruction loads a double word (32 bits) of memory at DWORD PTR ds:0x402000 into R14. We saw in the previous section that the contents of memory location DWORD PTR ds:0x402000 contains:
gef➤ info variables
All defined variables:
Non-debugging symbols:
0x0000000000402000 sample
0x0000000000402008 sample2
0x0000000000402010 sample3Mbr> 0x0000000000402018 __bss_start
0x0000000000402018 _edata
0x0000000000402018 _end
gef➤ x/xg &sample
0x402000: 0x2211ffeeddccbbaa
gef➤
Therefore, loading the first 32 bits at that location would result in R14 containing:
$r14 : 0xddccbbaa
The next instruction to be executed is: 0x401055 <_start+85> mov r15w, WORD PTR ds:0x402000. This instruction loads bits 0 to 16 of the contents of memory at WORD PTR ds:0x402000 into R15. We examing the contents of memory at this location to obtain:
gef➤ info variables
All defined variables:
Non-debugging symbols:
0x0000000000402000 sample
0x0000000000402008 sample2
0x0000000000402010 sample3Mbr> 0x0000000000402018 __bss_start
0x0000000000402018 _edata
0x0000000000402018 _end
gef➤ x/xg &sample
0x402000: 0x2211ffeeddccbbaa
gef➤
Recall that in the code, the variables were defined as follows:
section .data
sample: db 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x11, 0x22
sample2: dq 0x1122334455667788
sample3: times 8 db 0x00
samples was defined as 0xaabbccddeeff1122 in the code, but was stored as 0x2211ffeeddccbbaa because of little-endianess.
After executing this instruction, we expect R15 to contain:
$r15 : 0xbbaabecause only the first 16 bits were loaded from memory at location WORD PTR ds:0x402000 into R15.
Running MovingData-64 in GDB + GEF
Running step 17
Effect of executing 0x401055 <_start+85> mov r15w, WORD PTR ds:0x402000
After executing x401055 <_start+85> mov r15w, WORD PTR ds:0x402000, R15 was affected as follows:
$r15 : 0xbbaa
This instruction loads a word (16 bits) of memory at WORD PTR ds:0x402000 into R15. We saw in the previous section that the contents of memory location WORD PTR ds:0x402000 contains:
gef➤ info variables
All defined variables:
Non-debugging symbols:
0x0000000000402000 sample
0x0000000000402008 sample2
0x0000000000402010 sample3Mbr> 0x0000000000402018 __bss_start
0x0000000000402018 _edata
0x0000000000402018 _end
gef➤ x/xg &sample
0x402000: 0x2211ffeeddccbbaa
gef➤
Therefore, loading the first 16 bits at that location would result in R15 containing:
$r15 : 0xbbaa
The next instruction to be executed is: 0x40105e <_start+94> mov dil, BYTE PTR ds:0x402000. This instruction loads bits 0 to 8 of the contents of memory at WORD PTR ds:0x402000 into bits 0 to 7 of RDI. We examing the contents of memory at this location to obtain:
gef➤ info variables
All defined variables:
Non-debugging symbols:
0x0000000000402000 sample
0x0000000000402008 sample2
0x0000000000402010 sample3Mbr> 0x0000000000402018 __bss_start
0x0000000000402018 _edata
0x0000000000402018 _end
gef➤ x/xg &sample
0x402000: 0x2211ffeeddccbbaa
gef➤
Recall that in the code, the variables were defined as follows:
section .data
sample: db 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x11, 0x22
sample2: dq 0x1122334455667788
sample3: times 8 db 0x00
samples was defined as 0xaabbccddeeff1122 in the code, but was stored as 0x2211ffeeddccbbaa because of little-endianess.
After executing this instruction, we expect RDI to contain:
$rdi : 0xaabecause only the first 8 bits were loaded from memory at location WORD PTR ds:0x402000 into RDI.
Running MovingData-64 in GDB + GEF
Running step 18
Effect of executing 0x40105e <_start+94> mov dil, BYTE PTR ds:0x402000
After executing 0x40105e <_start+94> mov dil, BYTE PTR ds:0x402000, RDI was affected as follows:
$rdi : 0xaa
This instruction loads a byte (8 bits) of memory at WORD PTR ds:0x402000 into RDI. We saw in the previous section that the contents of memory location WORD PTR ds:0x402000 contains:
gef➤ info variables
All defined variables:
Non-debugging symbols:
0x0000000000402000 sample
0x0000000000402008 sample2
0x0000000000402010 sample3Mbr> 0x0000000000402018 __bss_start
0x0000000000402018 _edata
0x0000000000402018 _end
gef➤ x/xg &sample
0x402000: 0x2211ffeeddccbbaa
gef➤
Therefore, loading the first 16 bits at that location would result in R15 containing:
$rdi : 0xaa
The next instruction to be executed is: 0x401066 <_start+102> mov rax, QWORD PTR ds:0x402008. This instruction loads bits 0 to 63 of the contents of memory at QWORD PTR ds:0x402008 into bits 0 to 63 of RAX. We examing the contents of memory at this location to obtain:
gef➤ info variables
All defined variables:
Non-debugging symbols:
0x0000000000402000 sample
0x0000000000402008 sample2
0x0000000000402010 sample3Mbr> 0x0000000000402018 __bss_start
0x0000000000402018 _edata
0x0000000000402018 _end
gef➤ x/xg &sample2
0x402008: 0x1122334455667788
gef➤
Recall that in the code, the variables were defined as follows:
section .data
sample: db 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x11, 0x22
sample2: dq 0x1122334455667788
sample3: times 8 db 0x00
sample2 was defined as sample2: dq 0x1122334455667788 in the code, and that is the way it was stored in memory. Therefore, when defining a quad word immediate, the way it was defined is the way it is stored in memory in terms of endianess.
After executing this instruction, we expect RAX to contain:
$rax : 0x1122334455667788because bits 0 to 63 were loaded from memory at location QWORD PTR ds:0x402008 into RAX.
Running MovingData-64 in GDB + GEF
Running step 19
Effect of executing 0x401066 <_start+102> mov rax, QWORD PTR ds:0x402008
After executing 0x401066 <_start+102> mov rax, QWORD PTR ds:0x402008, RAX was affected as follows:
$rax : 0x1122334455667788
This instruction loads a quad word (64 bits) of memory at QWORD PTR ds:0x402008 into RAX. We saw in the previous section that the contents of memory location WORD PTR ds:0x402008 contains:
gef➤ info variables
All defined variables:
Non-debugging symbols:
0x0000000000402000 sample
0x0000000000402008 sample2
0x0000000000402010 sample3Mbr> 0x0000000000402018 __bss_start
0x0000000000402018 _edata
0x0000000000402018 _end
gef➤ x/xg &sample2
0x402008: 0x1122334455667788
gef➤
Therefore, loading 64 bits at that location would result in RAX containing:
$rax : 0x1122334455667788
The next instruction to be executed is: 0x40106e <_start+110> mov BYTE PTR ds:0x402000, al. This instruction loads bits 0 to 7 of the contents of RAX into memory at BYTE PTR ds:0x402000. We examing the contents of memory at this location to obtain:
gef➤ info variables
All defined variables:
Non-debugging symbols:
0x0000000000402000 sample
0x0000000000402008 sample2
0x0000000000402010 sample3Mbr> 0x0000000000402018 __bss_start
0x0000000000402018 _edata
0x0000000000402018 _end
gef➤ x/xg &sample
0x402000: 0x2211ffeeddccbbaa
gef➤
Recall that in the code, the variables were defined as follows:
section .data
sample: db 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x11, 0x22
sample2: dq 0x1122334455667788
sample3: times 8 db 0x00
sample was defined as sample: db 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x11, 0x22 in the code, but it is stored in memory as: 0x2211ffeeddccbbaa due to little-endianess.
Recall that RAX contains:
$rax : 0x1122334455667788
Before executing this instruction, memory at BYTE PTR ds:0x402000 contains:
gef➤ x/xg &sample
0x402000: 0x2211ffeeddccbbaa
gef➤
After executing this instruction, we expect memory at BYTE PTR ds:0x402000 to contain:
gef➤ x/xg &sample
0x402000: 0x2211ffeeddccbb88
gef➤
Running MovingData-64 in GDB + GEF
Running step 20
Effect of executing 0x40106e <_start+110> mov BYTE PTR ds:0x402000, al
After executing:
0x40106e <_start+110> mov BYTE PTR ds:0x402000, althe memory at BYTE PTR ds:0x402000 was affected as follows:
gef➤ x/xg &sample
0x402000: 0x2211ffeeddccbb88
gef➤
This instruction loads the lower byte (8 bits) of RAX into the location memory at BYTE PTR ds:0x402000. We saw in the previous section that the contents of memory location WORD PTR ds:0x402000 contains:
gef➤ info variables
All defined variables:
Non-debugging symbols:
0x0000000000402000 sample
0x0000000000402008 sample2
0x0000000000402010 sample3Mbr> 0x0000000000402018 __bss_start
0x0000000000402018 _edata
0x0000000000402018 _end
gef➤ x/xg &sample
0x402000: 0x2211ffeeddccbbaa
gef➤
Therefore, loading the lower 8 bits of RAX into that location would result in the location containing:
gef➤ x/xg &sample
0x402000: 0x2211ffeeddccbb88
gef➤
The next instruction to be executed is: 0x401075 <_start+117> mov WORD PTR ds:0x402000, ax. This instruction loads bits 0 to 15 of the contents of RAX into memory at WORD PTR ds:0x402000. We examing the contents of memory at this location to obtain:
gef➤ info variables
All defined variables:
Non-debugging symbols:
0x0000000000402000 sample
0x0000000000402008 sample2
0x0000000000402010 sample3Mbr> 0x0000000000402018 __bss_start
0x0000000000402018 _edata
0x0000000000402018 _end
gef➤ x/xg &sample
0x402000: 0x2211ffeeddccbb88
gef➤
Recall that in the code, the variables were defined as follows:
section .data
sample: db 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x11, 0x22
sample2: dq 0x1122334455667788
sample3: times 8 db 0x00
sample was defined as sample: db 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x11, 0x22 in the code, but it is stored in memory as: 0x2211ffeeddccbbaa due to little-endianess.
Recall that RAX contains:
$rax : 0x1122334455667788
Before executing this instruction, memory at WORD PTR ds:0x402000 contains:
gef➤ x/xg &sample
0x402000: 0x2211ffeeddccbb88
gef➤
After executing this instruction, we expect memory at WORD PTR ds:0x402000 to contain:
gef➤ x/xg &sample
0x402000: 0x2211ffeeddcc7788
gef➤
Running MovingData-64 in GDB + GEF
Running step 21
Effect of executing 0x401075 <_start+117> mov WORD PTR ds:0x402000, ax
After executing:
0x401075 <_start+117> mov WORD PTR ds:0x402000, axthe memory at WORD PTR ds:0x402000 was affected as follows:
gef➤ x/xg &sample
0x402000: 0x2211ffeeddcc7788
gef➤
This instruction loads the lower word (16 bits) of RAX into the location memory at WORD PTR ds:0x402000. We saw in the previous section that the contents of memory location WORD PTR ds:0x402000 contains:
gef➤ info variables
All defined variables:
Non-debugging symbols:
0x0000000000402000 sample
0x0000000000402008 sample2
0x0000000000402010 sample3Mbr> 0x0000000000402018 __bss_start
0x0000000000402018 _edata
0x0000000000402018 _end
gef➤ x/xg &sample
0x402000: 0x2211ffeeddccbb88
gef➤
Therefore, loading the lower 16 bits of RAX into that location would result in the location containing:
gef➤ x/xg &sample
0x402000: 0x2211ffeeddcc7788
gef➤
The next instruction to be executed is: 0x40107d <_start+125> mov DWORD PTR ds:0x402000, eax. This instruction loads bits 0 to 31 of the contents of RAX into memory at DWORD PTR ds:0x402000. We examing the contents of memory at this location to obtain:
gef➤ info variables
All defined variables:
Non-debugging symbols:
0x0000000000402000 sample
0x0000000000402008 sample2
0x0000000000402010 sample3Mbr> 0x0000000000402018 __bss_start
0x0000000000402018 _edata
0x0000000000402018 _end
gef➤ x/xg &sample
0x402000: 0x2211ffeeddcc7788
gef➤
Recall that in the code, the variables were defined as follows:
section .data
sample: db 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x11, 0x22
sample2: dq 0x1122334455667788
sample3: times 8 db 0x00
sample was defined as sample: db 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x11, 0x22 in the code, but it is stored in memory as: 0x2211ffeeddccbbaa due to little-endianess.
Recall that RAX contains:
$rax : 0x1122334455667788
Before executing this instruction, memory at WORD PTR ds:0x402000 contains:
gef➤ x/xg &sample
0x402000: 0x2211ffeeddcc7788
gef➤
After executing this instruction, we expect memory at WORD PTR ds:0x402000 to contain:
gef➤ x/xg &sample
0x402000: 0x2211ffee55667788
gef➤
Running MovingData-64 in GDB + GEF
Running step 22
Effect of executing 0x40107d <_start+125> mov DWORD PTR ds:0x402000, eax
After executing:
0x40107d <_start+125> mov DWORD PTR ds:0x402000, eaxthe memory at DWORD PTR ds:0x402000 was affected as follows:
gef➤ x/xg &sample
0x402000: 0x2211ffee55667788
gef➤
This instruction loads the lower double-word (32 bits) of RAX into the location memory at DWORD PTR ds:0x402000. We saw in the previous section that the contents of memory location DWORD PTR ds:0x402000 contains:
gef➤ info variables
All defined variables:
Non-debugging symbols:
0x0000000000402000 sample
0x0000000000402008 sample2
0x0000000000402010 sample3Mbr> 0x0000000000402018 __bss_start
0x0000000000402018 _edata
0x0000000000402018 _end
gef➤ x/xg &sample
0x402000: 0x2211ffeeddcc7788
gef➤
Therefore, loading the lower 32 bits of RAX into that location would result in the location containing:
gef➤ x/xg &sample
0x402000: 0x2211ffee55667788
gef➤
The next instruction to be executed is: 0x401084 <_start+132> mov QWORD PTR ds:0x402000, rax. This instruction loads bits 0 to 63 of the contents of RAX into memory at QWORD PTR ds:0x402000. We examing the contents of memory at this location to obtain:
gef➤ info variables
All defined variables:
Non-debugging symbols:
0x0000000000402000 sample
0x0000000000402008 sample2
0x0000000000402010 sample3Mbr> 0x0000000000402018 __bss_start
0x0000000000402018 _edata
0x0000000000402018 _end
gef➤ x/xg &sample
0x402000: 0x2211ffee55667788
gef➤
Recall that in the code, the variables were defined as follows:
section .data
sample: db 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x11, 0x22
sample2: dq 0x1122334455667788
sample3: times 8 db 0x00
sample was defined as sample: db 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x11, 0x22 in the code, but it is stored in memory as: 0x2211ffeeddccbbaa due to little-endianess.
Recall that RAX contains:
$rax : 0x1122334455667788
Before executing this instruction, memory at WORD PTR ds:0x402000 contains:
gef➤ x/xg &sample
0x402000: 0x2211ffee55667788
gef➤
After executing this instruction, we expect memory at WORD PTR ds:0x402000 to contain:
gef➤ x/xg &sample
0x402000: 0x1122334455667788
gef➤
Running MovingData-64 in GDB + GEF
Running step 23
Effect of executing 0x401084 <_start+132> mov QWORD PTR ds:0x402000, rax
After executing:
0x401084 <_start+132> mov QWORD PTR ds:0x402000, raxthe memory at QWORD PTR ds:0x402000 was affected as follows:
gef➤ x/xg &sample
0x402000: 0x1122334455667788
gef➤
This instruction loads the full quad-word (64 bits) of RAX into the location memory at QWORD PTR ds:0x402000. We saw in the previous section that the contents of memory location QWORD PTR ds:0x402000 contains:
gef➤ info variables
All defined variables:
Non-debugging symbols:
0x0000000000402000 sample
0x0000000000402008 sample2
0x0000000000402010 sample3Mbr> 0x0000000000402018 __bss_start
0x0000000000402018 _edata
0x0000000000402018 _end
gef➤ x/xg &sample
0x402000: 0x2211ffee55667788
gef➤
Therefore, loading the contents of RAX into that location would result in the location containing:
gef➤ x/xg &sample
0x402000: 0x1122334455667788
gef➤
The next instruction to be executed is: 0x40108c <_start+140> lea rax, ds:0x402000. This instruction loads the effective address of the memory location ds:0x402000 into RAX. We examing the contents of memory at this location to obtain:
gef➤ info variables
All defined variables:
Non-debugging symbols:
0x0000000000402000 sample
0x0000000000402008 sample2
0x0000000000402010 sample3Mbr> 0x0000000000402018 __bss_start
0x0000000000402018 _edata
0x0000000000402018 _end
gef➤ x/xg &sample
0x402000: 0x1122334455667788
gef➤
Therefore, the address of ds:0x402000 is 0x0000000000402000, and this is what will be loaded into RAX
Before executing this instruction, RAX contains:
$rax : 0x1122334455667788
After executing this instruction, we expect RAX to contain:
$rax : 0x0000000000402000
Running MovingData-64 in GDB + GEF
Running step 24
Effect of executing 0x40108c <_start+140> lea rax, ds:0x402000
After executing:
0x40108c <_start+140> lea rax, ds:0x402000RAX is loaded with the memory address ds:0x402000.
We saw in the previous section that the defined variables were:
gef➤ info variables
All defined variables:
Non-debugging symbols:
0x0000000000402000 sample
0x0000000000402008 sample2
0x0000000000402010 sample3Mbr> 0x0000000000402018 __bss_start
0x0000000000402018 _edata
0x0000000000402018 _end
Therefore, loading the memory address of ds:0x402000 into RAX would result in RAX containing:
$rax : 0x0000000000402000
The next instruction to be executed is: 0x401094 <_start+148> lea rbx, [rax]. This instruction loads the effective address of what RAX points to, as indicated by the square brackets, into RBX. We examing the contents of RAX to obtain:
gef➤ x/xg $raxand we examine the contents of RBX to obtain:
0x402000: 0x1122334455667788
gef➤ print $rbx
$1 = 0x0
Therefore RAX contains 0x402000, and when treated as a memory location, the contents of RAX points memory at 0x402000 which contains the value 0x1122334455667788. The address 0x402000 will be loaded into RBX.
Before executing this instruction, RBX contains:
$rbx : 0x0
After executing this instruction, we expect RBX to contain:
$rbx : 0x0000000000402000
Running MovingData-64 in GDB + GEF
Running step 25
Effect of executing 0x401094 <_start+148> lea rbx, [rax]
After executing:
0x401094 <_start+148> lea rbx, [rax]RBX is loaded with the memory address ds:0x402000.
We saw in the previous section that the defined variables were:
gef➤ info variables
All defined variables:
Non-debugging symbols:
0x0000000000402000 sample
0x0000000000402008 sample2
0x0000000000402010 sample3Mbr> 0x0000000000402018 __bss_start
0x0000000000402018 _edata
0x0000000000402018 _end
Therefore, loading the effective address of what RAX points to would result in RBX containing:
$rbx : 0x0000000000402000
The next instruction to be executed is: 0x401097 <_start+151> movabs rax, 0x1234567890abcdef. This instruction simply loads the immediate 0x1234567890abcdef into RAX. We examine the contents of RAX to obtain:
$rax : 0x0000000000402000
After executing this instruction, we expect RAX to contain:
$rax : 0x1234567890abcdef
Running MovingData-64 in GDB + GEF
Running step 26
Effect of executing 0x401097 <_start+151> movabs rax, 0x1234567890abcdef
After executing:
0x401097 <_start+151> movabs rax, 0x1234567890abcdefRAX is loaded with the immediate 0x1234567890abcdef.
The next instruction to be executed is: 0x4010a1 <_start+161> movabs rbx, 0x9999999999999999. This instruction simply loads the immediate 0x9999999999999999 into RBX. We examing the contents of RBX to obtain:
$rbx : 0x0000000000402000
After executing this instruction, we expect RBX to contain:
$rbx : 0x9999999999999999
Running MovingData-64 in GDB + GEF
Running step 27
Effect of executing 0x4010a1 <_start+161> movabs rbx, 0x9999999999999999
After executing:
0x4010a1 <_start+161> movabs rbx, 0x9999999999999999RBX is loaded with the immediate 0x9999999999999999.
The next instruction to be executed is: 0x4010ab <_start+171> xchg rbx, rax. This instruction exchanges the contents of RAX with the contents of RBX. It is an interesting question of whether the CPU has an intermediate location to store the contents of the registers as it exchanges them. We examine the contents of RAX to obtain:
$rax : 0x1234567890abcdefand we examine the contents of RBX to obtain:
$rbx : 0x9999999999999999
After executing this instruction, we expect RAX to contain:
$rax : 0x9999999999999999
And RBX to contain:
$rbx : 0x1234567890abcdef
Running MovingData-64 in GDB + GEF
Running step 28
Effect of executing 0x4010ab <_start+171> xchg rbx, rax
After executing:
0x4010ab <_start+171> xchg rbx, raxThe contents of RAX is exchanged with the contents of RBX.
The next instruction to be executed is: 0x4010ad <_start+173> mov eax, 0x3c. This instruction simply loads the immediate 0x3c into EAX. This in preparation to exit gracefully back to the shell. 0x3c is the number of the system call to execute an exit. We examine the contents of RAX to obtain:
$rax : 0x9999999999999999
After executing this instruction, we expect RAX to contain:
$rax : 0x3c
Running MovingData-64 in GDB + GEF
Running step 29
Effect of executing 0x4010ad <_start+173> mov eax, 0x3c
After executing:
0x4010ad <_start+173> mov eax, 0x3cThe contents of RAX is loaded with the immediate 0x3c.
The next instruction to be executed is: 4010b2 <_start+178> mov edi, 0x0. This instruction simply loads the immediate 0x0c into RDI. This in preparation to exit gracefully back to the shell. The 0x0 represents the exit status of the program. We examine the contents of RDI to obtain:
$rdi : 0xaa
After executing this instruction, we expect RDI to contain:
$rdi : 0x0
Running MovingData-64 in GDB + GEF
Running step 30
Effect of executing 4010b2 <_start+178> mov edi, 0x0
After executing:
4010b2 <_start+178> mov edi, 0x0The contents of EDI is loaded with the immediate 0x0.
The next instruction to be executed is: 0x4010b7 <_start+183> syscall. This instruction calls the system to execute a system call with number in RAX and parameters in RDI. We examine the contents of RAX to obtain:
$rax : 0x3c
We examine the contents of RDI to obtain:
$rdi : 0x0
After executing this instruction, we expect the program to exit with status 0.
Running MovingData-64 in GDB + GEF
Running step 31
Effect of executing 0x4010b7 <_start+183> syscall.
After executing:
0x4010b7 <_start+183> syscallThe program exits gracefully with exit status 0.


Sample Document Classifier
Paste in text in white box below
Click this button to call API
Clear Output
Results
Prediction:
TBD
Confidence:
TBD
Text length:
TBD
Model name/version:
TBD
Model description:
TBD
Text beginning:
TBD
Text end:
TBD


Updating the Sourcery Probe Firmware Using CodeBench
This section describes the steps required to update the firmware that is running on Sourcery Probe Professional and Sourcery Probe Personal.
Procedure
Start Sourcery CodeBench per the instructions in the Sourcery CodeBench Getting Started manual. Close the Welcome screen if it appears.
Select Run > Sourcery Probe > Settings and Firmware Update . The Settings and Firmware Update Dialog Box appears.
Enter the IP address or hostname in the Probe IP/Hostname field for the probe, and click Retrieve Settings . If you do not know the IP address or hostname of your probe, click Discover to view a list of all Sourcery Probe devices currently available on the local subnet and select your probe. See Sourcery Probe Discovery Dialog Box .
Select the Firmware tab from the Settings and Firmware Update dialog box. See Firmware Tab (See Figure A-4) .
Select a valid Update file.
Table A-1.
Valid Update Files for Sourcery Probes
Probe Name
Valid Update File
Sourcery Probe Professional -- OR -- Mentor Embedded GIGA-JTAG Probe
mesp-professional_vXYZbN.mud
Sourcery Probe Personal -- OR -- Mentor Embedded USB-JTAG Probe
mesp-personal_vXYZbN.mud
Click Program Update . This updates the firmware on the Sourcery Probe.
Caution
Do not unplug or otherwise disturb the probe during the update process. Wait for the process to complete before moving on.
Click Close to close the dialog box.
Related Topics
Updating the Sourcery Probe Firmware from the Command Line
Sourcery Probe Personal Settings (ARM and MIPS Only)
Sourcery Probe Professional Settings
Settings and Firmware Update Dialog Box
Sourcery Probe Discovery Dialog Box


Looking to find a great place to eat? Discover a restaurant near you to satifiy your cravings.
Are you looking for some fun in town? You can find your favorite entertainment here!
Looking for a place to stay? Find a great Hotel that meets all of your needs for your stay!
The modern multi-venue Sydney Opera House is among the most recognisable centers of music, theatre and culture in Sydney and the world. 10.9 million people visit annually.
Oysters were so popular in New York in the 19th century that the shells were used to pave Pearl Street. They were also used for lime for the masonry of the Trinity Church.
Bangkok is called the 'Venice of the East'. Just like Venice, Bangkok is a city built on dozens of canals. Most of these canals have now been paved in, the nickname has stuck.


--- layout: post title: 'New Gargoyle Look, Same Ol' Gargoyle Ferocity' sourceurl: http://audreywatters.com/2010/07/26/new-gargoyle-look-same-ol-gargoyle-ferocity/ image: http://hackedu.s3.amazonaws.com/wp-contentuploads201007newg.jpg ---
My friend and fellow Wyomingite Dan DePaolo has designed two really awesome logos for this and for my other blog, Hack Education.
You can check out more of his work here.
Why does the gargoyle matter?


When you press the button to "Hide Ads", you are calling this style (css file), which simply "hides" from your web browser all the ads that the page shows each time we are reading content.
If you find an error, or want to help, or know more about this idea, you can go to the Hide-Ads Github repository.


Hosker's Cinema
Hosker's Cinema
is a canon containing the best one hundred and fifty films yet made.
Book I
BOOKONE
Book II
BOOKTWO
Book III
BOOKTHREE
Book IV
BOOKFOUR
Book V
Part 1
FIVEPARTONE
Part 2
FIVEPARTTWO
Part 3
FIVEPARTTHREE
Part 4
FIVEPARTFOUR
Part 5
FIVEPARTFIVE
THEFOOTER


Do you have the motivation of the few people that manage to get past just dreaming to actually living their dreams? While it is true that we all have dreams, it is not true that we are all living our dreams. You could be stuck and for some reason just unable to get past dreaming. What secrets do those that make their dreams come true possess?
No such thing as Get-Rich-Quick
Some get-rich-quick-schemers will tell you there is a magic formula to success – and they will give it to you - at a fee. Obviously they are only after your money. Get-rich-quick is a good way to get-robbed-quick. Trust me, I’ve tried a few. Shortcuts to success lead to short lived success. Lasting success comes from lasting good habits.
You can really have the life you dream of
Others will say that you cannot have unlimited success, wealth and happiness. They have the view that success is only for the few that are destined by fate to have it and not for you. Obviously they look at you through their own mirror of limitations and failures. Trust me, I know plenty of them.
The only view that makes all the difference to whether you succeed or fail in life is yours - how you see yourself and how you see the world around you. It begins in your mind. Once you create success within it will manifest outwardly.
Success can be can be yours - learn and adapt
I have studied why some people achieve their dreams and why others fail as well as learning from my own successes and failures for years. This study and experience has led me to some startling and amazing discoveries about human potential, achievement, motivation, success and living your dreams.
I want to share what I have learnt with you and help you on your journey to success. It could save you months, if not years, of disappointment and despair. It could make the difference between living your dreams and just dreaming.


Before Change
if db.execute("PRAGMA table_info(bayesdb_table)").fetchall():
db.execute("PRAGMA application_id =<PHONE_NUMBER>")
else:
raise IOError("Invalid application id: 0x%08x" % (application_id,))
elif application_id_ok and application_id != 0x42594442:
raise IOError("Invalid application_id: 0x%08x" % (application_id,))
elif user_version != 3:
After Change
// module"s automatic transaction handling.
with db:
db.executescript(bayesdb_schema_3)
db.executescript(bayesdb_schema_3to4)
if application_id_ok:
assert sqlite3_exec_1(db, "PRAGMA application_id") == 0x42594442
return
elif application_id == 0 and \