CIS 310 Exam 2

Finite-State Machine

a machine that consists of a fixed set of possible states with a set of allowable inputs that change the state and a set of possible outcomes

IDIV

signed integer division (see slides for examples, 2/27/2019)

Types of Transfers

• Unconditional Transfer: Control is transferred to a new location in all cases; a new address is loaded into the instruction pointer, causing execution to continue at the new address. The JMP instruction does this. • Conditional Transfer: The program branches if a certain condition is true. A wide variety of conditional transfer instructions can be combined to create conditional logic structures. The CPU interprets true/false conditions based on the contents of the ECX and Flags registers.

Addition and Subtraction

•Inc and Dec Instructions •Add and Sub Instructions •Neg Instruction •Implementing Arithmetic Expressions •Flags Affected by Arithmetic -Zero -Sign -Carry -Overflow

Section Review

1. (True/False): The OFFSET operator always returns a 16-bit value. 2. (True/False): The PTR operator returns the 32-bit address of a variable. 3. (True/False): The TYPE operator returns a value of 4 for doubleword operands. 4. (True/False): The LENGTHOF operator returns the number of bytes in an operand. 5. (True/False): The SIZEOF operator returns the number of bytes in an operand.

When not to push a register

??? (see 2/13/2019)

The CPU Status Flags

Boolean instructions affect the Zero, Carry, Sign, Overflow, and Parity flags. Here's a quick review of their meanings: • The Zero flag is set when the result of an operation equals zero. • The Carry flag is set when an instruction generates a result that is too large (or too small) for the destination operand. • The Sign flag is a copy of the high bit of the destination operand, indicating that it is negative if set and positive if clear. (Zero is assumed to be positive.) • The Overflow flag is set when an instruction generates a result that is outside the signed range of the destination operand. • The Parity flag is set when an instruction generates an even number of 1 bits in the low byte of the destination operand.

LENGTHOF operator

Returns the length of the array.

Flags affected by Arithmetic

These flags will tell us if we are successful or not. -Zero flag: set when desitination = 0 -Sign flag: set when destination is negative -Carry flag: set when unsigned value is out of range -Overflow flag: set when signed value is out of range The MOV instruction never affects the flags.

Block-Structured IF Statement

(see page 210)

Array Sum example

(see slides, week of 2/11/2019)

Set Intersection

the overlapping of sets mov eax, setX and eax, setY

Fast Multiplication (SHL)

(see slides for example, 2/25/2019) Shifting left by 1 multiplies the number by 2. Before: 00000101 (5) Shift bits to the left by 1 After: 00001010 (10) Also, shifting left n bits multiplies the operand by 2^n.

While Loops

(see slides for implementations and examples, 2/20/2019)

IMUL Instruction

(signed integer multiply) Both IMUL and MUL affect the overflow flags.

Stack operations

- Add an element to Stack - Remove an element from Stack - Read the top element of Stack - LAST IN, FIRST OUT - In assembly language, we use the ESP register called the stack pointer register - ESP always points to the last value to be added to, or pushed on, the top of stack.

Integer Constants

-Positive or negative -binary, decimal, hexadecimal, or octal digits - Common radix characters: -h- hexadecimal (6Ah) -d- decimal (default) Ex: 30d, 42 -b- binary (1101b) -r- encoded real (floating point) (notice the h, d, b...) If you have a hexadecimal that starts with a letter (A5h for instance), you must precede it with a 0, otherwise the assembler will understand it as a letter. (0A5h)

Section Review

1. (True/False): A JMP instruction can only jump to a label inside the current procedure. 2. (True/False): JMP is a conditional transfer instruction. 3. If ECX is initialized to zero before beginning a loop, how many times will the LOOP instruction repeat? (Assume ECX is not modified by any other instructions inside the loop.) 4. (True/False): The LOOP instruction first checks to see whether ECX is not equal to zero; then LOOP decrements ECX and jumps to the destination label. 5. (True/False): The LOOP instruction does the following: It decrements ECX; then, if ECX is not equal to zero, LOOP jumps to the destination label. 6. In real-address mode, which register is used as the counter by the LOOP instruction? 7. In real-address mode, which register is used as the counter by the LOOPD instruction? 8. (True/False): The target of a LOOP instruction must be within 256 bytes of the current location. 9. (Challenge): What will be the final value of EAX in this example?

Section Review

1. (True/False): Any 32-bit general-purpose register can be used as an indirect operand. 2. (True/False): The EBX register is usually reserved for addressing the stack. 3. (True/False): The following instruction is invalid: inc [esi] 4. (True/False): The following is an indexed operand: array[esi]

Summing an Integer Array

1. Assign the array's address to a register that will serve as an indexed operand. 2. Initialize the loop counter to the length of the array. 3. Assign zero to the register that accumulates the sum. 4. Create a label to mark the beginning of the loop. 5. In the loop body, add a single array element to the sum. 6. Point to the next array element. 7. Use a LOOP instruction to repeat the loop.

Section Review

1. Which register (in 32-bit mode) manages the stack? 2. How is the runtime stack different from the stack abstract data type? 3. Why is the stack called a LIFO structure? 4. When a 32-bit value is pushed on the stack, what happens to ESP? 5. (True/False): Local variables in procedures are created on the stack. 6. (True/False): The PUSH instruction cannot have an immediate operand.

PUSH Operation

A 32-bit push operation decrements the stack pointer by 4 and copies a value into the location in the stack pointed to by the stack pointer.

Logical Shift

A SHIFT instruction used to extract a single bit from a bit string. Fills the newly created bit position with zero. The lowest bit is shifted into the Carry flag.

Conditional Jumps

A conditional jump instruction branches to a destination label when a status flag condition is true.

Direct Memory Operand

A direct memory operand is a named reference to storage in memory. The named reference (label) is automatically dereferenced by the assembler.

Local and Global Variables

A local variable is only visible to statements inside the same procedure. A global variable is visible anywhere.

Nested Procedure Calls

A nested procedure call occurs when a called procedure calls another procedure before the first procedure returns. (example on page 148)

POP Operation

A pop operation removes a value from the stack. After the value is popped from the stack, the stack pointer is incremented (by the stack element size) to point to the next-highest location in the stack.

Pointers

A variable containing the address of another variable is called a pointer. You might use a system call to allocate (reserve) a block of memory, for example, and save the address of that block in a variable. (see book page 122 for example of pointer code)

Add and Sub

Add: add the source to the destination destination + source ----> destination Sub: sub the source from the destination destination - source ----> destination

Procedures

Also known as subroutines. When you create a procedure other than your program's startup procedure, end it with a RET instruction. RET forces the CPU to return to the location from where the procedure was called.

Indexed Operands

An indexed operand adds a constant to a register to generate an effective address. Two ways of syntax: constant[reg] [constant + reg] In the example, let's say we initialized the register to '1' instead of '0'. Then AL would read '20h'.

LOOP instruction

Causes one or more other instructions to repeat a certain number of times. ECX is automatically used as a counter and is decremented each time the loop repeats. If ECX = 0, then the loop does not continue to its destination.

Set Union

Combining all the elements in all sets "U" mov eax, setX or eax, setY

CMP Instruction

Compares the destination operand to the source operand. -Nondestructive, but flags can be set

BT (Bit test) Operation

Copies a specified bit (n) into the Carry flag. The destination operand contains the value in which the bit is located, and the source operand indicates the bit's position within the destination. BT copies bit n to the Carry flag. BTC copies bit n to the Carry flag and complements bit n in the destination operand. BTR copies bit n to the Carry flag and clears bit n in the destination. BTS copies bit n to the Carry flag and sets bit n in the destination.

Xchg Instruction

Exchange the values of two operands. At least one operand must be a register, and no immediate values are permitted.

Compound Expressions

Expressions (Queries) that contain multiple criteria. -When implementing the logical AND operator, consider that HLLs use short-circuit evaluation. -AND (see slides for examples, 2/20/2019) -OR (see slides for examples, 2/20/2019)

Integer expressions

For exam purposes, remember PEMDAS.

Indirect Addressing

Holds the address of a variable, usually an array or string, just like a pointer. It can also be dereferenced.

Array Example with WORD

If we use an array of 16-bit integers, we add 2 to ESI to address each subsequent array element (we don't increment it by one, we increment it by two instead because WORD takes up two bytes):

Arrays

Indirect operands are ideal tools for stepping through arrays. In the next example, arrayB contains 3 bytes. As ESI is incremented, it points to each byte, in order:

MOV instruction

Moving source to destination. Syntax: - move destination, source -No more than one memory operand permitted. -You cannot copy anything to these registers: CS, EIP, and IP -No immediate to segment moves

Instruction Format Examples

No operands -stc ; set Carry flag One operand -inc eax ; register -inc myByte ; memory Two operands -add ebx,ecx ; register, register -sub myByte,25 ; memory, constant -add eax,36 * 25 ; register, constant- expression

Data-Related Operators and Directives

Operators and directives are not executable instructions; instead, they are interpreted by the assembler. You can use a number of assembly language directives to get information about the addresses and size characteristics of data: • The OFFSET operator returns the distance of a variable from the beginning of its enclosing segment. • The PTR operator lets you override an operand's default size. • The TYPE operator returns the size (in bytes) of an operand or of each element in an array. • The LENGTHOF operator returns the number of elements in an array. • The SIZEOF operator returns the number of bytes used by an array initializer.

NOT Instruction

Performs a Boolean NOT operation on a single destination operand.

XOR Instruction

Performs a Boolean exclusive-OR operation between each pair of matching bits in two operands. If X = Y, the result is 0. If X != Y, the result is 1. How is this helpful? Because XOR is a useful way to toggle (invert) the bits in an operand.

Procedure Parameters

Procedure parameters help to make procedures flexible because parameter values can change at runtime. In order to be useful, the parameters need to be applicable to different names. (see slides for examples, 2/13/2019)

NEG (negate) Instruction

Reverses the sign of an operand. Operand can be a register or memory operand.

RCL Instruction

Rotate carry left: Shifts each bit to the left. Copies the carry flag to the least significant bit. Copies the most significant bit to the carry flag. So, the carry flag is included in the rotation.

RCR Instruction

Rotate carry right: Shifts each bit to the right. Copies the carry flag to the most significant bit. Copies the least significant bit to the carry flag. So, the carry flag is included in the rotation.

ROL Instruction

Rotate left shifts each bit to the left. The highest bit is copied into both the carry flag and the lowest bit. No bits are lost.

ROR Instruction

Rotate right shifts each bit to the right. The lowest bit is copied into both the carry flag and the highest bit. No bits are lost.

SAL and SAR Instructions

SAL (shift arithmetic left) is identical to SHL. SAR (shift arithmetic right) is similar to SHR, except that it preserves the sigh of the number.

Bit-Mapped Sets

Set Complement Set Intersection Set Union

Overflow Flag

Set when the result of a *signed* arithmetic operation is too large or too small to fit into the destination

Sign Flag (SF)

Set when the result of an arithmetic or logical operation generates a negative result.

Table-Driven Selection

Table-driven selection is a way of using a table lookup to replace a multiway selection structure. To use it, you must create a table containing lookup values and the offsets of labels or procedures, and then you must use a loop to search the table. This works best when a large number of comparisons are made. (kind of like the case statement in C++)

Current Location Counter

The $ operator (current location counter) returns the offset associated with the current program statement. This can be used to calculate the size of an array. Example: list BYTE 10,20,30,40 $ - list <----this returns '4'

AND Instruction

The AND instruction performs a boolean (bitwise) AND operation between each pair of matching bits in two operands and places the result in the destination operand. Helpful for 'masking': When you use the AND operation, you are affecting the destination, AKA "masking" it.

Example: Converting to Upper Case

The AND instruction provides an easy way to translate a letter from lowercase to uppercase. If we compare the ASCII codes of capital A and lowercase a, it becomes clear that only bit 5 is different. We create a mask (AND) In which the fifth bit is set to 0 to force the letter to become capital.

JMP Instruction

The JMP instruction causes an unconditional transfer to a destination, identified by a code label that is translated by the assembler into an offset. The syntax is: JMP destination Example: jmp begin — Jump to the instruction labeled "begin". You can create an infinite loop using JMP. You cannot go outside your own procedure with a JMP (or a loop function). Your jump range is limited to -128 to +127 from the current EIP value.

LABEL Directive

The LABEL directive lets you insert a label and give it a size attribute without allocating any storage. All standard size attributes can be used with LABEL, such as BYTE, WORD, DWORD, QWORD or TBYTE.

LOOPNZ and LOOPNE

The LOOPNZ (loop if not zero) instruction is the counterpart of LOOPZ. The loop continues while the unsigned value of ECX is greater than zero (after being decremented) and the Zero flag is clear. (see slides for example, 2/20/2019)

LOOPZ and LOOPE

The LOOPZ (loop if zero) instruction works just like the LOOP instruction except that it has one additional condition: the Zero flag must be set in order for control to transfer to the destination label. Useful for scanning an array for the first element that does not match a given value.

OFFSET operator

The OFFSET operator returns the offset of a data label. The offset represents the distance, in bytes, of the label from the beginning of the data segment.

OR Instruction

The OR instruction performs a boolean OR operation between each pair of matching bits in two operands and places the result in the destination operand. The OR instruction is particularly useful when you need to set 1 or more bits in an operand without affecting any other bits.

SHL Instruction

The SHL (shift left) instruction performs a logical left shift on the destination operand, filling the lowest bit with 0. The highest bit is moved to the Carry flag, and the bit that was in the Carry flag is discarded.

SHLD Instruction

The SHLD (shift left double) instruction shifts a destination operand a given number of bits to the left. The bit positions opened up by the shift are filled by the most significant bits of the source operand. The source operand is not affected, but the Sign, Zero, Auxiliary, Parity, and Carry flags are affected.

SHR Instruction

The SHR (shift right) performs a logical right shift on the destination operand. The highest bit position is filled with zero. Shifting right 'n' bits divides the operand by 2^n. Before: 00001010 (10) Shift right by one. After: 00010100 (5)

SHRD Instruction

The SHRD (shift right double) instruction shifts a destination operand a given number of bits to the right. The bit positions opened up by the shift are filled by the least significant bits of the source operand. (see slides for applications of all these rotations)

TEST Instruction

The TEST instruction performs an implied AND operation between each pair of matching bits in two operands and sets the Sign, Zero, and Parity flags based on the value assigned to the destination operand. The only difference between TEST and AND is that TEST does not modify the destination operand. The TEST instruction permits the same operand combinations as the AND instruction. TEST is particularly valuable for finding out whether individual bits in an operand are set.

TYPE Operator

The TYPE operator returns the size, in bytes, of a single element of a variable. For example, the TYPE of a byte equals 1, the TYPE of a word equals 2, the TYPE of a doubleword is 4, and the TYPE of a quadword is 8.

TYPEDEF Operator

The TYPEDEF operator lets you create a user-defined type that has all the status of a built-in type when defining variables.

USES Operator

The USES operator, coupled with the PROC directive, lets you list the names of all registers modified within a procedure. USES tells the assembler to do two things: First, generate PUSH instructions that save the registers on the stack at the beginning of the procedure. Second, generate POP instructions that restore the register values at the end of the procedure.

Set Complement

The complement of a set can be generated using the NOT instruction, which reverses all bits. mov eax. SetX not eax

Carry Flag

This flag is set when the result of an operation generates an unsigned value that is out of range. (too big or too small for the destination operand)

MUL Instruction

Unsigned multiply. Multiplies an 8, 16, or 32-bit operand by either AL, AX, or EAX. (see slides for examples, 2/27/2019)

CALL and RET Functions

Use CALL to call a procedure Use RET within a procedure.

Arithmetic Shift

Used for signed binary numbers. When performing a right shift the bits at the left are replaced by copies of the most significant bit. The newly created bit position is filled with a copy of the original number's sign bit.

Indirect Operands

Using a register as a pointer and manipulating the register's value. When an operand uses indirect addressing, it is called an indirect operand. An indirect operand can be any 32-bit general-purpose register (EAX, EBX, ECX, EDX, ESI, EDI, EBP, and ESP) surrounded by brackets.

Overflow Flag: A Rule of Thumb

When adding two integers, remember that the Overflow Flag is only set when... - Two positive operands are added and their sum is negative -Two negative operands are added and their sum is positive

Sign extension

When the right bit shift fills in on the left end by "extending" the sign bit, whether its a zero or a one. Caveat: Destination must be a register. Moving the sign bit to the new leftmost position and filling in with copies of the sign bit is called _________. a. sign extension b. range extension c. bit extension d. partial extension

Zero extension

When you copy a smaller value into a larger destination, the movzx instruction fills (or extends) the upper half of the destination with zeros. Caveat: Destination must be a register.

SIZEOF operator

Will return the number of bytes of memory used by any data type or variable.

PTR operator

You can use the PTR operator to override the declared size of an operand. This is only necessary when you're trying to access the operand using a size attribute that is different from the one assumed by the assembler.

OFFSET Example

bVal is located in the first position, 00404000. bVal takes up one (1) byte, which is why wVal is located at 00404001. wVal takes up two (2) bytes, which is why dVal is located at 00404003. dVal takes up four (4) bytes which is why dVal2 is located at 00404007.

Jcond Instruction

cond refers to a flag condition identifying the state of one or more flags. The following examples are based on the Carry and Zero flags:

Zero Flag (ZF)

set when the result of an arithmetic or logical operation generates a result of zero. It will set (turn to 1) when the result is = 0, and reset (turn to 0 ) when the destination is not 0.

DIV Instruction

unsigned integer division (see slides for examples, 2/27/2019)