📔
Cyber Security Notes
  • Introduction
  • CVEs
    • CVE-2022-33106
  • Paper Reviews
    • Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice
  • Security Basics Notes
    • Identification, Authentication and Authorization
  • Enumeration and Initial Compromise
    • Methodology
    • Footprinting
    • Network Protocols
      • FTP
      • SMB
      • DNS
      • NFS
      • SMTP
      • IMAP/POP3
      • SNMP
      • MySQL
      • MSSQL
      • Oracle TNS
      • IPMI
    • Nifty One Liners
    • Brute-Force Web Pages
      • Hydra
    • Network Pentest
      • Quick SMB cheatsheet
      • SSH keypair basics
      • Compromise using SSH Key
      • Networking fundamentals Interview topics
      • nmap quick cheatsheet
      • Metasploit Quick Reference
    • Web Pentest
      • Web Pentest Interview top topics
      • Wordpress Exploitation
      • Joomla Exploitation
      • Login Bypass using Cookie Tampering/Poisoning
      • Subdomain Enumeration
      • CSRF mitigation
      • XSS mitigation
      • CSP bypass with JSONP
      • PHP Vulnerabilities
      • Python Serialization Vulnerabilities - Pickle
      • SQL Injections
        • SQLmap
      • SSTI
      • XSS
    • Buffer Overflow Prep
      • Understanding CPUs
      • Virtual Memory and Paging
      • Syscalls
      • Theorem Proving
      • Stripping readable function names
      • Insecure C functions
      • Stack Canaries
      • Linking - GOT,PLT
      • Return Oriented Programming
    • Active Directory - Basics
      • AD DS
      • Managing OUs
      • Group Policies
      • Authentications
      • Trees, Forests and Trusts
      • Kerberos
      • Attacking Kerberos
      • Priv Esc (Post Exploitation)
    • DNS/Domain Enum Masterguide
  • Post Exploitation
    • Shell Escape Techniques
    • Getting stable shell after compromise
    • Linux Privilege Escalation
      • Sudoers file
      • Sudoers entry - Yum
      • Wildcards - Basics
      • Wildcards - Chown
      • Wildcards - Tar
      • Linux Permissions & SUID/SGID/Sticky Bit
      • SUID - nmap
      • SUID - bash
      • SUID - man
      • NFS no_root_squash
      • SUID - pkexec
      • Bad permissions
    • Windows Privilege Escalation
      • SeImpersonatePrivilege Token Impersonation
      • Firefox Creds
      • Potatoes
      • Print Spooler Basics
      • Print Spooler CVE 2020-1030
      • SpoolFool
    • Data Exfiltration Post Exploitation
  • Port Forwarding Cheatsheet
  • Powershell Essentials
    • Powershell Basics
    • Powershell Enumeration
    • Powershell Port Scanner
    • Powershell One Liner Port Scanning
    • Powershell Port Scan in a given CIDR
  • Application Security
    • System Calls in Linux
    • Buffer Overflow Defenses
    • Format string vulnerabilities
    • Sample Github Actions
    • Basic Bugs in Demo Application
    • Using AFL++
  • Linux 64-bit Assembly
    • GDB Basics
      • My relevant GDB cheatsheet
      • Task 1 - Tamper strcmp logic
      • Breakpoints
      • Always starting with intel flavor
      • GDB TUI Mode
    • Basic Hello World Program
    • Registers in 64-bit
    • global directive
    • Reducing instructions and Removing NULL-> Optimizing memory in Assembly
    • Data Types
    • Endianness
    • Moving Data
    • push, pop, and the stack
    • Analysis - Writing data on memory location and referencing
    • Arithmetic Operations
    • Bitwise Logical Operations
    • Bit-Shifting Operations
    • Control Instructions
    • Loops
    • Procedures
    • Stack-Frames and Procedures
    • String Operations
    • Shellcoding basics
      • Introduction and Common Rules
      • Basic Shellcodes->Exit
      • Testing shellcode->Skeleton Code
      • Techniques-> JMP,CALL,POP
      • Techniques-> Stack
      • Techniques-> (64-bit only) RIP Relative Addressing
      • Shellcode 1 -> execve(/bin/sh) STACK PUSH
      • Shellcode 1 -> execve(/bin/sh) JMP CALL POP
      • Techniques-> XOR-Encoder
  • Cloud Security
    • Foundational Technology
    • Learning Through Project Omega
    • IAM Essentials
      • Deep dive into IAM - Part 1
    • Amazon S3
    • Risk Management & Data Controls
    • Enumeration
      • S3 - Enum Basics - PwnedLabs
      • S3 - Identify the AWS Account ID from a Public S3 Bucket
      • EBS - Loot Public EBS Volumes
      • S3- Exploit Weak Bucket Policies for Privileged Access
  • API Security
    • WSDL
  • Reverse Engineering
    • Some string Operations
    • Numbers and Inputs
    • Address inputs
    • Recursive Function
    • Crackme: level1
    • Crackme: level2
    • CTF: Memory Dereferencing
    • CTF: Monty Python
  • CTF Challenge Learnings
    • vsCTF 2024
      • Sanity Check
      • not-quite-caesar
      • Intro to reversing
    • NCL Individual 2024
      • Web Challenges
        • PiratePals
        • Pierre's Store
    • Pico CTF 2024
      • Web Exploitation
        • Bookmarklet
        • WebDecode
        • Unminify
        • Trickster
      • General Skills
        • Commitment Issues
        • Time Machine
        • Blame Game
        • Collaborative Development
        • Binary Search
        • Dont-you-love-banners
    • Sunshine CTF
      • Knowledge Repository
    • Amazon WiCys CTF
      • I am Lazy
      • Password Locker on the Web
      • Happy Birthday Card Generator
      • Bloggergate
      • simple offer
      • Bad Actor
      • Secret Server
      • Simple PCAP
      • Hidden Message
    • C code using getenv()
    • Command Injection with filter
    • Pwning
      • Shoddy_CMP
      • PLT_PlayIT
  • Applied Cryptography
    • Linear Congruential Generator
  • Tools for everything
Powered by GitBook
On this page

Was this helpful?

  1. Linux 64-bit Assembly

Arithmetic Operations

Use of RFLAGS register is done majorly

We look at these main important operations:

  1. ADD destination, source

  2. ADC destination, source -> Add with carry

  3. SUB

  4. SBB -> Subtract with borrow

  5. INC -> Increment

  6. DEC -> Decrement

global _start

section .text
_start:

        ; register based addition 

        mov rax, 0x01
        add rax, 0x01 ; Adds 1 to rax

        mov rax, 0xffffffffffffffff
        add rax, 0x01 ; Adds 1 to RAX

        mov rax, 0x09
        sub rax, 0x04 ; Subtracts 4 from RAX


        ; memory based addition 

        mov rax, qword [var1]
        add qword [var4], rax

        add qword [var4], 0x02


        ;  set / clear / complement carry flag 

        clc
        stc
        cmc

        ; add with carry 

        mov rax, 0
        stc
        adc rax, 0x1
        stc
        adc rax, 0x2

        ; subtract  with borrow

        mov rax, 0x10
        sub rax, 0x5
        stc
        sbb rax, 0x4

        ; increment and decrement 

        inc rax
        dec rax

        ; exit the program gracefully  

        mov rax, 0x3c
        mov rdi, 0
        syscall

section .data

        var1    dq      0x1
        var2    dq      0x1122334455667788
        var3    dq      0xffffffffffffffff
        var4    dq      0x0

We can assemble and link this to make an executable and use GDB in TUI mode to see how arithmetic operations are happening.

I'm attaching the screenshots and writing a short description of the programs.

In the screenshots above, I'm first adding 1 to RAX. Then adding 1 again. Then moving fffffffffffff to RAX overwriting 2. Then adding 1 to make it 0. Also note how Carry Flag (CF) becomes 1 (see RFLAGS register)

Then adding 1 and 9 and subtracting 4 finally depicting add and subtract operations.

At this point in time, rax is assignded as the value in address 0x402000. Upon seeing the variables we see it is var1.

This variable has value 1.

Now we are adding rax's value in the variable stored at 0x402018

Then we are adding 2 in this.

Next instruction is clc -> Which clears the carry flag.

stc-> sets the carry flag

CMC -> complement the carry flag. CF was 1 just now, upon cmc, it gets 0 again.

Next three instructions are: mov rax, 0x0 stc adc rax,0x1

This basically means that first rax becomes 0. Then carry flag is set (becomes 1) and then adc-> Add with carry.

ADC=RAX+<value provided>+CF value

Here, value provided is 0x1, CF is also 1, so RAX should become 2.

After adding, notice how CF again becomes 0. Next instructions set it again and adds with carry rax, value and CF's value which becomes 5.

next, we mov value 0x10 to rax then subtract 5 from rax making it 0xb (10 in hex is 16 in decimal. So, 16-5 = 11 which is 0xb)

Now, we have 0xb = 11 in RAX. We set carry flag. Then we use SBB-> Subtract with Borrow.

So, SBB= RAX - Value Provided - Carry Flag

So, SBB makes RAX=11-4-1 = 6

Finally, INC and DEC just increments the register mentioned (RAX) by 1 and decreases by 1.

Then we exit the program

PreviousAnalysis - Writing data on memory location and referencingNextBitwise Logical Operations

Last updated 1 year ago

Was this helpful?