x86-64 ASM#

Assembly Tutorial x86-64 Architecture , 练习平台

基础指令语法#

register rax, rbx, rcx, rdx - al, ah, ax, eax, rax rsp - stack pointer rbp - base pointer rsi, rdi r10, r9, r8 r11, r12, r13, r14, r15 rip - instruction pointer

mov

1
mov rax, 5
2
mov rbx, rax
3
mov rcx, 0x1234
4
mov rdx, [0x401000]

add, sub, inc, dec

1
add rax, 5
2
sub rbx, 3
3
inc rcx
4
dec rdx

RAM

lea ( load effective address )

1
.text
2

3
_start:
4

5
lea rsp, [mem]
6

7
.data
8

9
mem:
10

11
.byte 0x00, 0x01, 0x02
12
.word 0x1234
13
.long 0xdeadbeaf
14
.quad 0x0123456789abcdef

syscall

系统调用号通过 rax 传递，参数依次通过 rdi, rsi, rdx, r10, r8, r9 传递。

print “Hello World!”

1
.intel_syntax noprefix
2
.global _start
3
.text
4

5
_start:
6
mov rax, 1
7
mov rdi, 1
8
lea rsi, [str]
9
lea rdx, [strlen]
10

11
syscall
12

13
mov rax, 60
14
xor rdi, rdi
15
syscall
16

17
.data
18

19
str: .ascii "Hello World!"
20
strlen = . - str

linux-syscall-table

jmp

1
jmp 0xdeadbeaf
2
jmp print_hello

call stack

用于保存函数调用链的地址，call 指令包含了此功能

ret

因为 call 隐含了 push rip ，ret 隐含了 pop rip，所以一个 call 对应一个 ret （除了 _exit ）

condition/loop

1
# Signed
2
jg - jump if greater
3
jge - jump if greater or equal to
4
jl - jump if less than
5
jle - jump if less than or equal to
6

7
# Unsigned
8
ja - jump if above (greater)
9
jae - jump if above or equal to
10
jb - jump if below (less)
11
jbe - jump if below or equal to
12

13
je - jump if equal
14
jz - jump if zero
15
jne - jump if not equal
16
jnz - jump if not zero

if语句实例

1
if (rax == 3) {
2
    printf("rax is 3!");
3
}
4
return 0;

1
.intel_syntax noprefix
2
.global _start
3
.text
4

5
_start:
6

7
mov rax, 3
8
cmp rax, 3
9
jne exit
10

11
print:
12
 mov rax, 1
13
 mov rdi, 1
14
 lea rsi, [str]
15
 lea rdx, [strlen]
16
 syscall
17

18
exit:
19
 mov rax, 60
20
 xor rdi, rdi
21
 syscall
22

23
.data
24

25
str: .ascii "rax is 3!"
26
strlen = . - str

for/while语句实例

1
for (int i = 0; i < 10; i++) {
2
    ...
3
}
4
return 0;

1
.intel_syntax noprefix
2
.global _start
3
.text
4

5
_start:
6

7
mov rax, 0
8

9
loop:
10
 cmp rax, 10
11
 jge exit
12
 inc rax
13
 jmp loop
14

15
exit:
16
 mov rax, 60
17
 xor rdi, rdi
18
 syscall

int3 - interrupt 3 中断

push/pop

push将register压入栈顶，pop则从栈顶弹出到指定register

交换两个寄存器中的值

1
mov rax, 1
2
mov rbx, 9
3
push rax
4
push rbx
5
pop rax
6
pop rbx

mul/imul/div/idiv

mul/div 只接受两个寄存器之间的运算，不能操作及时数, 不能操作负数，rax 为隐式的算式第一位

rax 是积/商的寄存器 rdx 是余数的寄存器以及被除数的高64bit，运算除法前需清空

1
mov rax, 5
2
mov rbx, 3
3
mul rbx
4

5
;# rax 0x0f

1
xor rdx, rdx
2
mov rax, 6
3
mov rbx, 4
4
div rbx
5

6
;# rax 0x01
7
;# rdx 0x02

imul/idiv 的用法更接近 add/sub ，且能处理有符号数, 即时数

1
imul rax, rbx
2
imul rax, -7
3

4
xor rdx, rdx
5
idiv rax, rbx

综合运用#

动态打印多个字符串

1
.intel_syntax noprefix
2
.global _start
3
.text
4

5
_start:
6
lea rdi, [s1]
7
call _print
8

9
lea rdi, [s2]
10
call _print
11

12
_exit:
13
 mov rax, 60
14
 xor rdi, rdi
15
 syscall
16

17
_print:
18
 push rdi
19
 call _strlen
20
 pop rdi
21

22
 mov rdx, rax
23
 mov rsi, rdi
24
 mov rax, 1
25
 mov rdi, 1
26
 syscall
27
 ret
28

29
_strlen:
30
 mov rax, rdi
31
 xor rcx, rcx
32
loop:
33
 mov bl, [rax]
34
 cmp bl, 0
35
 je _strlen_exit
36
 inc rax
37
 inc rcx
38
 jmp loop
39
_strlen_exit:
40
 int3
41
 xor rdi, rdi
42
 mov rax, rcx
43
 ret
44

45
.data
46
s1: .asciz "Hello World!\n"
47
s2: .asciz "Oh! Senbai, Ciallos~"

整数转字符串（数位分离）

1
#include <bits/stdc++.h>
2

3
int main() {
4
    int a = 123;
5
    char buf[10000];
6
    int len = 0;
7
    while (a) {
8
        buf[len++] = a % 10 + '0';
9
        a /= 10;
10
    }
11
    for (int i = len - 1; i >= 0; i--) {
12
        printf("%c", buf[i]);
13
    }
14
    return 0;
15
}

1
.intel_syntax noprefix
2
.global _start
3
.text
4

5
_start:
6
mov rdi, 123
7
call _itoa
8

9
mov rdi, rax
10
call _print
11
call _exit
12

13
_itoa:
14
 mov rbx, 10
15
 mov rax, rdi
16
 lea rdi, [buf + 32]
17
 mov byte ptr [rdi], 0
18

19
_itoa_loop:
20
 xor rdx, rdx
21
 dec rdi
22
 div rbx
23
 add rdx, '0'
24
 mov [rdi], dl
25
 cmp rax, 0
26
 jne _itoa_loop
27
 mov rax, rdi
28
 ret
29

30
_print:
31
 push rdi
32
 call _strlen
33
 pop rsi
34
 mov rdx, rax
35
 mov rax, 1
36
 mov rdi, 1
37
 syscall
38
 ret
39

40
_exit:
41
 mov rax, 60
42
 xor rdi, rdi
43
 syscall
44

45
_strlen:
46
 push rbp
47
 mov rbp, rsp
48
 xor rcx, rcx
49
 _strlen_loop:
50
 mov al, [rdi]
51
 cmp al, 0x0
52
 je _strlen_end
53
 inc rcx
54
 inc rdi
55
 jmp _strlen_loop
56
 _strlen_end:
57
 mov rax, rcx
58
 mov rsp, rbp
59
 pop rbp
60
 ret
61

62
.data
63
buf: .skip 1024

read/write

read(0, 0, addr, buf_len) ，实际长度存储在 rax

1
mov rax, 0
2
mov rdi, 0
3
lea rsi, [buf]
4
mov rdx, 4096 ;# 预留空间
5
syscall

write(1, 1, addr, len)

1
mov rdx, rax ;# 先把实际长度弄过来
2
mov rax, 1
3
mov rdi, 1
4
lea rsi, [buf]
5
syscall

无限循环输入并立刻输出

1
.intel_syntax noprefix
2
.global _start
3
.text
4

5
_start:
6

7
_readline:
8
 mov rax, 0
9
 mov rdi, 0
10
 lea rsi, [buf]
11
 mov rdx, 4096
12
 syscall
13

14
mov byte ptr [rsi + rax], '\n'
15

16
inc rax
17
mov rdx, rax
18
mov rax, 1
19
mov rdi, 1
20
lea rsi, [buf]
21
syscall
22

23
jmp _readline
24

25
mov rax, 60
26
xor rdi, rdi
27
syscall
28

29
.data
30
buf: .skip 4096

实现一个简易shell（包含echo, help, exit）

1
.intel_syntax noprefix
2
.global _start
3
.text
4

5
_start:
6

7
lea rdi, [buf]
8
lea rsi, [bufsize]
9
call readline
10
cmp rax, 0
11
je _start
12

13
lea rdi, [buf]
14
lea rsi, [tokens]
15
call tokenize
16

17
lea r10, [commands]
18
cmd_loop:
19
 mov rax, [r10]
20
 cmp rax, 0
21
 je cmd_notfound
22

23
 mov rdi, [tokens]
24
 mov rsi, rax
25
 call strcmp
26

27
 cmp rax, 0
28
 je cmd_found
29

30
 add r10, 16
31
 jmp cmd_loop
32

33
cmd_found:
34
 add r10, 8
35
 mov rax, [r10]
36
 jmp rax
37

38
cmd_notfound:
39
 lea rdi, [s_nocmd]
40
 call print
41

42
jmp _start
43

44
select_help:
45
 call help
46
 jmp _start
47

48
select_echo:
49
 lea rdi, [tokens + 8]
50

51
 call echo
52
 jmp _start
53

54
help:
55
 lea rdi, [s_help]
56
 call print
57
 ret
58

59
echo:
60
 mov r15, rdi
61

62
 echo_loop:
63
  mov rdi, [r15]
64
  cmp rdi, 0
65
  je echo_ret
66
  call print
67

68
  lea rdi, [space]
69
  call print
70

71
  add r15, 8
72
  jmp echo_loop
73

74
  echo_ret:
75
   lea rdi, [newline]
76
   call print
77
   ret
78

79
strcmp: ;# args: rdi s1, rsi, s2
80
 xor rax, rax
81
 mov al, [rdi]
82
 mov dl, [rsi]
83
 cmp al, dl
84
 jne sc_done
85
 cmp al, 0
86
 je sc_done
87

88
 inc rdi
89
 inc rsi
90
 jmp strcmp
91

92
 sc_done:
93
  sub al, dl
94
  ret
95

96
tokenize:
97
 mov r15, rsi
98

99
 tokenize_loop:
100
  call skipwhite
101
  cmp byte ptr [rdi], 0x0
102
  je tokenize_end
103

104
  mov [r15], rdi
105
  add r15, 8
106
  call findend
107
  cmp byte ptr [rdi], 0
108
  je tokenize_end
109

110
  mov byte ptr [rdi], 0
111
  inc rdi
112
  jmp tokenize_loop
113

114
  tokenize_end:
115
   mov qword ptr [r15], 0
116
   ret
117

118
findend:
119
 cmp byte ptr [rdi], ' '
120
 je findend_ret
121

122
 cmp byte ptr [rdi], 0
123
 je findend_ret
124

125
 inc rdi
126
 jmp findend
127

128
 findend_ret:
129
  ret
130

131
skipwhite:
132
 cmp byte ptr [rdi], ' '
133
 je skipwhite_advance
134

135
 ret
136

137
 skipwhite_advance:
138
  inc rdi
139
  jmp skipwhite
140

141
readline:
142
 lea rdx, [rsi - 1]
143
 mov rsi, rdi
144
 mov rax, 0
145
 mov rdi, 0
146
 syscall
147

148
 mov byte ptr [rsi + rax], 0
149
 ret
150

151
print: ;# args: rdi item addr
152
 push rdi
153
 call slen
154
 mov rdx, rax
155
 pop rsi
156
 mov rax, 1
157
 mov rdi, 1
158
 syscall
159
 ret
160

161
slen:
162
 xor rcx, rcx
163

164
 slen_loop:
165
  mov al, [rdi + rcx]
166
  cmp al, 0
167
  je slen_ret
168
  inc rcx
169
  jmp slen_loop
170

171
 slen_ret:
172
  mov rax, rcx
173
  ret
174

175
_exit:
176
 mov rax, 60
177
 xor rdi, rdi
178
 syscall
179

180
.data
181
buf: .skip 128, 0xaa
182
bufsize = . - buf
183
tokens: .skip 128, 0xbb
184
newline: .asciz "\n"
185
space: .asciz " "
186
s_nocmd: .asciz "\nUnsupported command!\n"
187
s_cmd_exit: .asciz "exit"
188
s_cmd_echo: .asciz "echo"
189
s_cmd_help: .asciz "help"
190
s_help: .asciz "\nSupported commands:\n> echo\n> help\n> exit\n"
191
commands: ;# function ptr
192
 .quad s_cmd_exit, _exit
193
 .quad s_cmd_echo, select_echo
194
 .quad s_cmd_help, select_help

匹配命令使用的是函数指针 + strcmp

写出来是真的长啊……还只是这么简单的功能 QwQ

堆栈#

栈和堆共用一块空间，向彼此延申

栈从高地址到低地址，堆从低地址到高地址

因此，所谓的“栈顶”位于栈的最低地址，也就是视觉上的最上方

rsp 会即时指向栈顶

rbp 则始终指向栈顶的初始位置（base）

allocator#

malloc

memory allocate

从 heap 中申请一块内存，并返回地址

最简单的实现是维护一个 heap pointer：

1
[ used ][ used ][ free... ]
2
                ↑
3
            heap pointer

alignment

memory alignment 内存对齐

内存通常需要按 8/16 bytes 对齐： malloc(5) -> 8 bytes malloc(9) -> 16 bytes

block header 为了支持 free()，每块内存前保存一些信息： [ size | used ][ user data ]

malloc() 返回的是 user data 的地址

free free(ptr) 不会清空内存，只是把对应块标记为： used -> free

之后新的 malloc() 可以重新利用这块空间。

基本流程

1
malloc:
2
    找 free block
3
        → 有就复用
4
        → 没有就从 heap 后面继续分配
5
        → 空间不够就扩展 heap
6
    修改 user data
7
    返回 heap pointer
8

9
free:
10
    找到 block header
11
        → used = 0