Intro to x86 Assembly Language (Part 3)

[@SamyHacker]

please do not stop this will help alot of ppl, and between us i already know everything on these videos so far but i still watch them somehow :) really makes you think.

[@invaderstim8804]

This video helped me visualise the stack better than any other video

[@RAINE____]

Mate, you're explaining this so well. Cheers!

[@myles9193]

I just realised how new all of these assembly videos are, please don't stop. Im really enjoying following along

[@nealshin1247]

Best assembly lecture I ever had…why I wasted so much time in uni😂

[@jcfree33]

What Wybiral is doing is called "giving something back". Thank you, sir.

[@Sizifus]

You're really good at explaining the assembly language concepts in easy-to-digest manner. Thank you, you're a life saver

[@Daniel-m4l1p]

Such awesome content and explaination, until now I never learned x86 assembly so well. Thanks!

[@hosseinjavan137]

do not lose that smile. it's beautiful. Thanks for the tutorial!

[@youssefmostafa5788]

just realized this vid is 6 years old

[@philzz6634]

Turning yellow to hello! is magical

[@reizinhodojogo3956]

yellow - y0000w + h00000 = hello

[@colza1025]

You are awesome!! You are an incredible teacher!!! I'll follow you in my whole life!!!

[@elbozo5723]

this guy is just too based

[@N03n03-e5y]

Guys lets pay him by watching all the advertises on his videos without skipping 'em .

[@firmman4505]

that's what I did

[@Npc5150]

I don't know why I decided to watch this video. I could just use the AOAsm book as a refresher... I was just really bored. Pleasantly surprised. I like your format. It's cool that you smile a lot, and you look oddly like Joaquin Phoenix.

[@youngsinatra1]

Thank you so much for your explanations! Some of the best!

[@luanfelipe8882]

you are helping me a lot, im brazillian and i cant find good assembly contents in my language, but i know a little bit of english so it's helping me a lot, thank you :D

[@smit17xp]

thanks. this is really helpful. cleared my confusion about stack a lot

[@yusenliu1845]

For those of you who are using a 64-bit machine and incurred segmentation fault for the last piece of assembly code (ex6.asm), here is one solution: Note that we are using 64-bit registers here - not esp, but rsp. Besides, the syscall invocation is a bit different. 12 global _start 13 14 section .text 15 _start: 16 sub rsp, 4 ; allocate 4 bytes on the stack 17 mov [rsp], byte 'H' ; move 'H' to address esp 18 mov [rsp+1], byte 'e' 19 mov [rsp+2], byte 'y' 20 mov [rsp+3], byte 10 21 22 ; sys_write() 23 mov rax, 1 ; sys_write() 24 mov rdi, 1 ; print to stdout 25 mov rsi, rsp ; pointer to the bytes to write 26 mov rdx, 4 ; number of bytes to write 27 syscall ; do syscall 28 29 ; sys_exit() 30 mov rax, 60 ; sys_exit() 31 mov rdi, 0 ; exit status is 0 32 syscall

[@iconoclastsc2]

Thank you.

[@drjmansplace5174]

When one uses PUSH to push the integer onto the stack, remember that it POP off in the reverse order.

[@DarkLegends2008]

Please continue the assembly series! THKs from Brazil

[@chaoukidhib7545]

Well done! Very well explained. Thanks!

[@ЖукОбычниик]

I was trying to do this 3:15 on a 64-bit operating system and it said: 64-bit operating system doesn’t support 32-bit absolute addressing. Is there anything I can do / change the code somehow?

[@complexitytr9098]

No need to change code. Just do a compile and ld for 64bit system.

[@ЖукОбычниик]

@@complexitytr9098 i solved this a while ago but ok

[@complexitytr9098]

cool

[@longlostwraith5106]

A bit late to the party, but I just want to point out something: (mov [addr], byte 'H'), although accepted by NASM, is ambiguous. There are three possible instructions: (mov mem8, imm8), (mov mem16, imm8) and (mov mem32, imm8), and no sensible way for the assembler to choose between them. On the other hand, if you did: (mov byte [addr], 'H'), there's only a single opcode that can satisfy this instruction.

[@AJSquirrel53]

So NASM knows that 'H' is only one byte, but doesn't know that [addr] is one byte? I'm confused why you don't also need to specify that 'H' is a byte. Why not do both? (mov byte [addr], byte 'H') I guess [addr] could point to any arbitrary spot in memory, but since addr was defined as a byte, shouldn't NASM "know" this?

[@xrafter]

@@AJSquirrel53 Not addr is a pointer not a byte. Pointer is 8 but 4 in x84 But [addr] is the value that pointing to by the pointer in this. Addr = 0x133 ; address in memory [Addr] = 'h' ; the value that Addr point to. Pointer are just pointer you the programmer will make the process read 4 byte or 1 or 6 By 'mov byte ' that will move a one byte and even if you don't give nasm the length of the data It will work because nasm will know somehow the length of the data byte but for better practice use byte and so on. You only need to type byte once not in the both sides . Usually ins first operand . It is just a style really

[@elbozo5723]

wondering why my assembler shit itself, thanks

[@BlancheNuit]

I don't understand what that refers to : (mov mem8, imm8), (mov mem16, imm8) and (mov mem32, imm8) Although, an address points to a memory location that is 1 byte, so when you do : (mov [addr], byte 'H') it should be trying to write as many bytes as is given in the second argument, from the first address in the left argument and to the following addresses until what's on the right is over. Right ? It can't be ambiguous

[@upliftingspirit6873]

1. Is it by convention that 'mov %eax, 4' prints something on the screen? If I do 'mov %eax, 3' is it another sys_call? 2. 6:13 , '1234' Shouldn't go to [28] address? Since it's the first push? 3. Stacks have always 8 cells, each one 4 bytes? (in total 8*4=32)

[@DavyBot]

1. The value of EAX specifies the type of system call and 4 is the code for a sys_write call type. If you set EAX to 3 it would be a sys_read call. Here's a chart of system calls and an explanation of what purpose the other registers serve for each call type: syscalls.kernelgrok.com/ 2. The push operation decreases ESP *first* and then writes the value. So if ESP starts at 28 a push will actually write the value at 24. 3. Stacks can be much larger than 8 integers. If you run "ulimit -s" on a Linux machine it should tell you the maximum stack size in kb. On my machine it's 8192kb which would hold (8192*1024)/4 integers (=2097152)

[@upliftingspirit6873]

3. So what does the x86 has to do with the stack ?

[@cyrilsubramanian4883]

@@upliftingspirit6873 I'm pretty sure 32 bits only represents the number of bits per cell (32 bits, or 4 bytes), not the number of cells in a stack.

[@upliftingspirit6873]

@@cyrilsubramanian4883 You mean 32 cells in the stack?

[@XxStormProductionsxX]

thank you sir for sharing knowledge in such a professional manner

[@joshmadakor3012]

lmao " ~bye ♪ ". Thanks so much for these

[@youssefmostafa5788]

love these tutorials man

[@joaoadm94]

"Welcome back!"

[@kerron68]

Your tutorials are awesome! Can you recommend any books you like that teaches in the same way you do?

[@bonbonpony]

04:00 How about base two? Is there a way to write base-2 number literals?

[@michaeljoshua5040]

Ah, you mean binary! Yes.. you can. Just add the letter *b* after the binary number you write. Example code: mov eax, 1 mov ebx, 01101010b int 0x80 Which will return 106.

[@araujo_88]

Awesome series, thank you so much!

[@arslanrasit]

Why I'm impressed

[@therealxunil2]

Good stuff!

[@samaellovecraft]

Thanks for the knowledge!

[@drygordspellweaver8761]

I dropped a like to help the algorithm. Gotta push asm onto Gen Z before it goes extinct!

[@youssefmostafa5788]

wait how do i view the stack in visual studio

[@f_x9771]

Great video! Can follow up with you, keep up the great work!!

[@greob]

Thank you very much for this series. Very well explained and illustrated. Loved it!

[@tim_allen_jr]

Can't wait till i get to the point where i can write Assembly creativly.

[@WistrelChianti]

Thanks! Very well explained.

[@viktorreusch7690]

That's cool, but how do I print content of registers (eax, ebx and so on)? Thanks in advance!

[@jimivie]

you are good at these thumbs up

[@joshmadakor3012]

Bro you are a Saint.

[@AxOutdoors]

I'm getting a segmentation fault running the code at the end. Any ideas why that might be?

[@complexitytr9098]

Same no idea.

[@DarshanSenTheComposer]

Hello there! Thank you very much for the lessons. I was watching your video while trying out everything on my terminal open on the right. Found something weird running the code at 9:50. It printed a highlighted '%' at the end of the message. So, I increased the stack size and added an 0x0a at the end of the string and added 1 to the contents of the edx register. It seemed that the problem was solved. I tried to see the exit status of the code at the end of part 1 by moving len to the ebx register before exiting. Guess what? It added a 1 to the string length as well! It seems like we need to include the null byte when we address the length of the string. Please feel free to correct me if I went wrong anywhere. Thank you. Stay safe. :)

[@b00i00d]

I was thinking of making a similar comment (about '\0') without running through any code

[@DarshanSenTheComposer]

@@b00i00d :)

[@xrafter]

@@DarshanSenTheComposer No you just print something was in the memory before syscall are little bit tricky i don't know how they works but some of them don't work probably with out aligning the memory. The % is something you left before or a program left it in the stack since the deallocate only affects the esp and ebp but the values of the character is still there and you can access it . Of course some time the byte are usually zero but after using the stack it will change the values and all of that. So the write will print anything that was there before even if it was 0 and in case of 0 mean nothing

[@danielgn6227]

Hey does anyone know why we use [ ] to access the stack? Is it like accessing the index of an array? If I try to execute *mov esp, byte 'H'* I suppose the _value_ of esp gets overwritten with the value of 'H', instead of accessing the _space_ that esp is pointing to. Am I right?

[@DavyBot]

You're exactly right, it's like indexing into an array or dereferencing a pointer in C. This is how you distinguish between operations on the address value itself (which is an integer) or the data located at that address.

[@danielgn6227]

@@DavyBot Thank you! Makes more sense now

[@StrangeIndeed]

That's some good stuff right there

[@henkoegema6390]

Well done !! 😃

[@OmbreeTV]

You are awesome! Thank you so much

[@complexitytr9098]

stuck... getting segmentation fault. Even with the github one(ex6). Any idea?

[@jonahsimmons3645]

Me too. I'm trying to do it for 64bit with (nasm -f elf64 name.asm; ld name.o) and valgrind tells me that "Access not within mapped region". When I assemble and link the way he does it, it works though. I just need to figure how 64 bit stacks work. Hope that helps a bit.

[@Luftbubblan]

To me it feels so strange when assigning system call? and exit status? etc. Why wouldn't stuff like this be at a fixed register? I notice you use eax ebx ecx most of the time. Like, how does the program know that for example mov eax, 4 is supposed to control something, not just be a number in a general register? Sry if i explained that bad but hope someone knows and can clarify :D

[@beyondcatastrophe_]

When you call the system interrupt, the program on their side reads first the eax to decide which function to call. It then reads however many arguments it needs from ebx, ecx, ... For your program those registers are still general purpose, it's just that another program reads those and interprets it, then writes something back as an answer.

[@baruchben-david4196]

After printing the message, my system doesn't place a CR, so my prompt shows up on the same line of the message.

[@ntsystem]

I'm trying to understand, does eax, ebx, ecx, edx have to be used in sequential order? what's stopping people from having "ecx" register as the stdout file descriptor instead of the ebx register?

[@lukaspinoti107]

All of the registers must be used for their purpose. I am not sure what determines this behaviour though.

[@lukaspinoti107]

maybe the bios?

[@shiehuapiaopiao]

@@lukaspinoti107 they are pre-programmed intel registers

[@lukaspinoti107]

Actually no, the syscalls are defined by the Linux kernel. When you do int 0x80 you are talking to Linux.

[@complexitytr9098]

Lol the old me's here!! Took me a 1+ year to figure out these things thanks to garbage search results, its time we need a good search engine.(i wasted huge time, 1 year seriously😭😭, curse these search engines) Nvm back to topic. Its cause you are doing a "sys write". Read about it/search it. Wish, you all find some good websites to have a smooth learning, at least not time wasting, bad sites. Tips: old+security related websites are best

[@thefaith01]

Thanks for this

[@user-ye1eo1qv2i]

Hello, what have i done wrong? global _start section .data: addr db "yellow" section .text: _start: mov [addr], byte 'H' mov [addr+5], byte '!' mov eax, 4 mov ebx, 1 mov ecx, addr mov edx, 6 int 0x80 mov eax, 1 mov ebx, 0 int 0x80 Because im getting segmentation error. Also big thanks to you sir for making this!

[@xrafter]

1.changing a read only data 2 can be fixed by putting . Before data and remove the : after it Because the : make it read only and that doesn't make change

[@jalolturdiev9727]

Thank you

[@adityaband6919]

Awesome

[@lilraahdreadlockvideosandm1648]

Thanks🔥

[@MutalibGozalov]

thanks mate

[@N03n03-e5y]

Bro what you used to make this video i mean what is this editor ?

[@armandothomazini7715]

Why did you set the adress that ESP points to on ecx?

[@xrafter]

Because the syscall need to be in the ecx

[@complexitytr9098]

Lol i was u once. Read about "write" :)

[@shrekkinosciocchino1520]

why use an "int 0x80" every 3-4 lines?

[@complexitytr9098]

It invokes system call. For example- you wrote in a paper the items you need for grocery. Now you handed over the paper to a shop keeper and got the items. Int 0x80 works like the handed down paper to shop keeper(int 0x80 = shop keeper). Do bit searches if you got time and etc.

[@shrekkinosciocchino1520]

@@complexitytr9098 Thanks

[@samlopez3995]

But why is ESP 28? What defines that?

[@complexitytr9098]

Dont know much, as im a newbie too thought its been around a year. Esp- 32bit register. Also it represent top of the stack. The stack thing may be is imaginary. Nvm in the video its 28 cause, he wrote 28 to describe esp. Cause esp is always indicating top of the stack in real program. In a real program you may find esp Different.

[@myartchannel8205]

You didn't specify whether you need global _start or labels in the push example.

[@xrafter]

You always need labels especially start label

[@aa301875]

Thanks.

[@imcnx1563]

The stack was false, when pushing data the pointer will increase & not decrease so when popping data the pointer will decrease

[@cyrilsubramanian4883]

No, it's not incorrect. The stack grows "downwards". Don't get confused about pushing and popping, pushing simply puts things on top of the stack, popping "takes them away" (kinda). When you push, the stack pointer will decrease (that is, go "upwards"), allowing you to place something on "top" of the stack. Remember, the key is that the stack grows downwards.

[@cyrilsubramanian4883]

As proof, try moving esp into ebp, push something (like 0xff) onto the stack. Then call the system_call handler (mov eax, 1) but instead of moving 0 into ebx, move ebp into ebx, and subtract esp from ebx. When you run this, you will find that $? will return 4. This means that the value of esp decreased by 4 at some points, which would've occurred when you pushed 0xff onto the stack.

[@JulesBashizi]

cool

[@AlienAndrew51]

Funny thing is I took computer architecture and design in college and it didn't make as much sense as they way you explain it.

[@HK-sw3vi]

fucking perfect!

[@one_shot_phill2368]

Hey, do you know why esp is represented at the bottom of the stack in his diagram, and moved higher every time something was pushed onto the stack? I would’ve thought it would be at the top of the stack to start with?

[@z00ne15]

Dword.

[@chrod64]

Sword.

[@mistakenmeme]

Nword

[@Thydus.]

Di-sword?

[@blushingbutterfly7742]

How can you put a multi-letter string with db, if db is for a single byte? I am new to asm and I just cannot wrap my head around this.