This document discusses 64-bit assembly programming. It covers 64-bit registers used in 64-bit assembly like RIP and RSP. It also discusses limitations of 64-bit addressing in different versions of Windows and how the operating system separates memory used by the OS and user programs. Common opcodes, syscalls, and using sections like .data and .text are described. Examples shown include simple programs, reading and writing data, and encoding text using Caesar cipher and XOR encryption.

1. CNIT 127: Exploit Development
Lecture 7: 64-bit Assembler
Not in textbook
Rev. 3-9-17

2. 64-bit Registers
• rip = Instruction pointer
• rsp = top of stack

4. Windows Limitations
• Windows doesn't implement full 64-bit
addressing
• Windows 2008 Server uses 44 bits
– Max. 16 TB RAM
• Windows 8.1, 2015 revision, uses 48 bits
– Max. 256 TB RAM
• Links Ch L7d, L7e

5. OS Limitations
• OS uses
top half
• User
programs
use lower
half

6. System Calls
• syscall replaces INT 80

7. L7h: Searchable Linux Syscall Table

8. L7c: Introduction to x64 Assembly
Intel Developer Zone
• More details
about
registers

9. Common Opcodes

10. Syscall 1: Write

11. Simplest Program: ABC

12. Works, then Crashes
(no exit)

13. Exit

14. Works Without Crashing

15. Letters in Order

16. Using a .data section
• db = "Define Byte"

17. Objdump

18. Using gdb
• .data and .text sections appear the same

19. .text and .data Sections

20. info registers

21. Using read

22. "echo" with a .data section

23. Works with Junk at End

24. Caesar Cipher

25. Works for 4 Bytes Only

26. Objdump Shows a 32-bit Value

27. Intel 64 and IA-32 Architectures
Software Developer's Manual

28. Must use a Register

29. Now it Works

30. Challenge 1
"Hello from YOURNAME"

31. Challenge 2
Caesar (3 steps back)

32. Challenge 3: XOR Encryption