CS 105 Tour of the Black Holes of Computing Machine Level Programming I Topics Assembly Programmer s Execution Model Accessing Information Registers Memory X86 1 ppt Arithmetic operations IA32 Processors Totally Dominate Computer Market Evolutionary Design Starting in 1978 with 8086 really 1971 with 4004 Added more features as time goes on Still support old features although obsolete Complex Instruction Set Computer CISC Many different instructions with many different formats But only small subset encountered with Linux programs 2 Hard to match performance of Reduced Instruction Set Computers RISC But Intel has done just that CS 105 X86 Evolution Programmer s View Name 4004 Transistors 1971 2 3K 4 bit processor First 1 chip microprocessor Didn t even have interrupts 8008 1972 3 3K 1974 6K Like 4004 but with 8 bit ALU 8080 3 Date Compatible at source level with 8008 Processor in first kit computers Pricing caused it to beat similar processors with better programming model Motorola 6800 MOS Technologies MOSTEK 6502 CS 105 X86 Evolution Programmer s View Name 8086 Transistors 1978 29K 16 bit processor Basis for IBM PC DOS Limited to 1MB address space DOS only gives you 640K 80286 1982 134K Added elaborate but not very useful addressing scheme Basis for IBM PC AT and Windows 386 4 Date 1985 275K Extended to 32 bits Added flat addressing Capable of running Unix By default Linux gcc use no instructions introduced in later models CS 105 X86 Evolution Programmer s View Name Date Transistors 486 1989 1 9M Pentium 1993 3 1M Pentium MMX 1997 4 5M 1995 6 5M Added special collection of instructions for operating on 64bit vectors of 1 2 or 4 byte integer data PentiumPro Added conditional move instructions Big change in underlying microarchitecture 5 CS 105 X86 Evolution Programmer s View Name Pentium III 6 Transistors 1999 8 2M 2001 42M Added streaming SIMD instructions for operating on 128 bit vectors of 1 2 or 4 byte integer or floating point data Pentium 4 Date Added 8 byte formats and 144 new instructions for streaming SIMD mode CS 105 New Species IA64 Name Date Transistors Itanium 2001 10M Extends to IA64 a 64 bit architecture Radically new instruction set designed for high performance Able to run existing IA32 programs On board x86 engine Joint project with Hewlett Packard Compiler writer s nightmare Itanium 2 2002 Big performance boost Hasn t sold well 7 221M CS 105 X86 Evolution Clones Advanced Micro Devices AMD Historically AMD has followed just behind Intel A little bit slower a lot cheaper Recently Recruited top circuit designers from Digital Equipment Corp Exploited fact that Intel distracted by IA64 Now are close competitors to Intel Developed own extension to 64 bits Intel adopted after IA64 bombed 8 CS 105 Assembly Programmer s View CPU E I P Registers Condition Codes Memory Addresses Data Instructions Object Code Program Data OS Data Stack Programmer Visible State EIP Program Counter Address of next instruction Register File Heavily used program data Condition Codes Store status information about most 9 recent arithmetic operation Used for conditional branching Memory Byte addressable array Code user data most OS data Includes stack used to support procedures CS 105 Turning C into Object Code Code in files p1 c p2 c Compile with command gcc O p1 c p2 c o p Use optimizations O Put resulting binary in file p text C program p1 c p2 c Compiler gcc S text Asm program p1 s p2 s Assembler gcc or as binary Object program p1 o p2 o Static libraries a Linker gcc or ld binary 10 Executable program p CS 105 Compiling Into Assembly C Code int sum int x int y int t x y return t Generated Assembly sum pushl ebp movl esp ebp movl 12 ebp eax addl 8 ebp eax movl ebp esp popl ebp ret Obtain with command gcc O S code c Produces file code s 11 CS 105 Assembly Characteristics Minimal data types Integer data of 1 2 or 4 bytes Data values Addresses untyped pointers Floating point data of 4 8 or 10 bytes No aggregate types such as arrays or structures Just contiguously allocated bytes in memory Primitive operations Perform arithmetic function on register or memory data Transfer data between memory and register Load data from memory into register Store register data into memory 12 Transfer control Unconditional jumps to from procedures Conditional branches CS 105 Object Code Code for sum Assembler Translates s into o Some libraries are dynamically linked 0x401040 sum Binary encoding of each instruction 0x55 Total of 13 0x89 Nearly complete image of executable bytes 0xe5 code Each 0x8b Missing linkages between code in instruction 1 0x45 2 or 3 bytes different files 0x0c Starts at 0x03 Linker address 0x45 0x401040 Resolves references between files 0x08 0x89 Combines with static run time 0xec libraries 0x5d E g code for malloc printf 0xc3 Linking occurs when program begins execution 13 CS 105 Machine Instruction Example C Code int t x y Add two signed integers Assembly addl 8 ebp eax Similar to expression y x Add 2 4 byte integers Long words in GCC parlance Same instruction whether signed or unsigned Operands y x t 0x401046 14 03 45 08 Register eax Memory M ebp 8 Register eax Return function value in eax Object Code 3 byte instruction Stored at address 0x401046 CS 105 Disassembling Object Code Disassembled 00401040 sum 0 55 1 89 e5 3 8b 45 0c 6 03 45 08 9 89 ec b 5d c c3 d 8d 76 00 push mov mov add mov pop ret lea ebp esp ebp 0xc ebp eax 0x8 ebp eax ebp esp ebp 0x0 esi esi Disassembler objdump d p 15 Useful tool for examining object code Analyzes bit pattern of series of instructions Produces approximate rendition of assembly code Can be run on either a out complete executable or o file CS 105 Alternate Disassembly Disassembled Object 0x401040 0x55 0x89 0xe5 0x8b 0x45 0x0c 0x03 0x45 0x08 0x89 0xec 0x5d 0xc3 0x401040 0x401041 0x401043 0x401046 0x401049 0x40104b 0x40104c 0x40104d sum sum 1 sum 3 sum 6 sum 9 sum 11 sum 12 sum 13 push mov mov add mov pop ret lea ebp esp ebp 0xc ebp eax 0x8 ebp eax ebp esp ebp 0x0 esi esi Within gdb Debugger gdb p disassemble sum Disassemble procedure x 13b sum 16 Examine the 13 bytes starting at sum CS 105 What Can Be Disassembled objdump d WINWORD EXE WINWORD EXE file format pei i386 No symbols in WINWORD EXE Disassembly of section text 30001000 text 30001000 55 30001001 8b ec 30001003 6a ff 30001005 68 90 10 00 30 3000100a 68 91 dc 4c 30 17 push mov push push push ebp esp ebp 0xffffffff 0x30001090 0x304cdc91 Anything that can be interpreted as executable code Disassembler
View Full Document
Unlocking...