MineSwepperASM/ASM_CHEATSHEET.md
2025-03-20 19:00:03 +00:00

12 KiB
Raw Permalink Blame History

Registers

General Purpose

Register Usage
rax Accumulator for general use and syscall number
eax Lower 32 bits of rax
ax Lower 16 bits of rax
al Lower 8 bits of ax
rbx Base register
ebx Lower 32 bits of rbx
bx Lower 16 bits of rbx
bl Lower 8 bits of bx
rcx Counter register (loops)
ecx Lower 32 bits of rcx
cx Lower 16 bits of rcx
cl Lower 8 bits of cx
rdx Data register
edx Lower 32 bits of rdx
dx Lower 16 bits of rdx
dl Lower 8 bits of dx

Index and Pointer

Register Usage
rsi Source for data (string operations)
esi Lower 32 bits of rsi
si Lower 16 bits of rsi
sil Lower 8 bits of si
rdi Destination for data
edi Lower 32 bits of rdi
di Lower 16 bits of rdi
dil Lower 8 bits of di
rsp Stack pointer
esp Lower 32 bits of rsp
sp Lower 16 bits of rsp
spl Lower 8 bits of sp
rbp Base pointer for stack frames
ebp Lower 32 bits of rbp
bp Lower 16 bits of rbp
bpl Lower 8 bits of bp

Extended

Register Usage
r8r15 Extra general-purpose registers
r8dr15d Lower 32 bits of r8r15
r8wr15w Lower 16 bits of r8r15
r8br15b Lower 8 bits of r8r15

Data Movement

Command Description
mov dest, src Copy data from src to dest
movzx dest, src Zero-extend src into dest
movsx dest, src Sign-extend src into dest
lea dest, [addr] Load effective address into dest
rel addr Relative address
push src Push value of src onto the stack
pop dest Pop value from the stack into dest
pusa Pushes all registers to the stack
popa Pops all registers from the stack
xchg dest, src Exchange values of dest and src
cmovcc dest, src Conditional move
movs dest, src Move string
movsb Move byte from [rsi] to [rdi]
movsw Move word from [rsi] to [rdi]
movsd Move doubleword from [rsi] to [rdi]
movsq Move quadword from [rsi] to [rdi]

Arithmetic

Command Description
add dest, src Add src to dest
sub dest, src Subtract src from dest
imul dest, src Multiply dest by src (signed)
mul src Multiply rax by src (result in rdx:rax)
idiv src Divide rdx:rax by src (quotient in rax, remainder in rdx)
xor dest, src XOR (useful for clearing, e.g., xor rax, rax)
inc reg Increment reg by 1
dec reg Decrement reg by 1
adc dest, src Add with carry
sbb dest, src Subtract with borrow
neg dest Negate (two's complement)
div src Unsigned divide rdx:rax by src
cbw Convert byte to word
cwd Convert word to doubleword
cdq Convert doubleword to quadword
cqo Convert quadword to octword

Logical

Command Description
and dest, src Bitwise AND
or dest, src Bitwise OR
xor dest, src Bitwise XOR
not dest Bitwise NOT
shl dest, imm Shift bits in dest left by imm
shr dest, imm Shift bits in dest right by imm
sal dest, imm Arithmetic shift left
sar dest, imm Arithmetic shift right
rol dest, imm Rotate bits left
ror dest, imm Rotate bits right
rcl dest, imm Rotate through carry left
rcr dest, imm Rotate through carry right
test dest, src Test bits (AND without storing result)

Control Flow

Command Description
jmp label Unconditional jump to label
cmp op1, op2 Compare op1 and op2
je label Jump if equal
jne label Jump if not equal
jg label Jump if greater (signed)
jl label Jump if less (signed)
jge label Jump if greater or equal (signed)
jle label Jump if less or equal (signed)
ja label Jump if above (unsigned)
jb label Jump if below (unsigned)
jae label Jump if above or equal (unsigned)
jbe label Jump if below or equal (unsigned)
call label Call a function at label
ret Return from a function
loop label Loop to label
loope label Loop while equal
loopne label Loop while not equal
jecxz label Jump if ecx is zero
jrcxz label Jump if rcx is zero

Syscall Interface (Linux/macOS)

Register Description
rax Syscall number
rdi First argument
rsi Second argument
rdx Third argument
r10 Fourth argument
r8 Fifth argument
r9 Sixth argument

Common Syscall Numbers

Syscall rax Description
sys_exit 0x2000001 Exit program
sys_write 0x2000004 Write to file descriptor
sys_read 0x2000003 Read from file descriptor

Stack Manipulation

Command Description
push reg Push register value onto the stack
pop reg Pop top of stack into register
call addr Call a subroutine at addr
ret Return from subroutine
enter imm, imm Create stack frame
leave Destroy stack frame

String Operations

Command Description
movsb Move byte from [rsi] to [rdi]
movsw Move word from [rsi] to [rdi]
movsd Move doubleword from [rsi] to [rdi]
movsq Move quadword from [rsi] to [rdi]
stosb Store byte from al to [rdi]
stosw Store word from ax to [rdi]
stosd Store doubleword from eax to [rdi]
stosq Store quadword from rax to [rdi]
lodsb Load byte from [rsi] into al
lodsw Load word from [rsi] into ax
lodsd Load doubleword from [rsi] into eax
lodsq Load quadword from [rsi] into rax
scasb Scan byte in al against [rdi]
scasw Scan word in ax against [rdi]
scasd Scan doubleword in eax against [rdi]
scasq Scan quadword in rax against [rdi]
cmpsb Compare byte at [rsi] with byte at [rdi]
cmpsw Compare word at [rsi] with word at [rdi]
cmpsd Compare doubleword at [rsi] with doubleword at [rdi]
cmpsq Compare quadword at [rsi] with quadword at [rdi]

Data Definition

Command Description
db value Define byte (1 byte)
dw value Define word (2 bytes)
dd value Define doubleword (4 bytes)
dq value Define quadword (8 bytes)
dt value Define ten bytes (80 bits)

Examples:

assembly:

    section .data
        byteVar db 0x1                  ; Define a byte variable
        wordVar dw 0x1234               ; Define a word variable
        dwordVar dd 0x12345678          ; Define a doubleword variable
        qwordVar dq 0x123456789ABCDEF0  ; Define a quadword variable

    section .text
        global main

    main:
        mov al, [byteVar]               ; Move byteVar into al
        mov ax, [wordVar]               ; Move wordVar into ax
        mov eax, [dwordVar]             ; Move dwordVar into eax
        mov rax, [qwordVar]             ; Move qwordVar into rax

Tips for Debugging

  • Use xor rax, rax or mov rax, 0 to zero out rax.
  • Use comments liberally to track which registers hold what values!
  • Step through your code with gdb or an equivalent debugger to watch registers change.
  • If things seem off, double-check your mov, cmp, and syscall logic.