This document discusses a lecture on 64-bit assembler. It covers 64-bit registers like RIP and RSP, Windows limitations on addressing over 48 bits, how operating systems separate user and system areas, using syscall to replace INT 80 for system calls, common opcodes, and examples of simple 64-bit assembly programs using read, write, and caesar cipher encryption. It also provides resources for learning more about x64 assembly programming.

1. CNIT 127: Exploit Development
Lecture 7: 64-bit Assembler
Not in textbook
Rev. 4-12-2021

2. 64-bit Registers
• rip = Instruction pointer
• rsp = top of stack

4. Windows Limitations
• Windows doesn't implement full 64-bit
addressing
• Windows Server 2016 Datacenter and Win
10 Pro 64-bit Pro uses 48 bits
– Max. 24 TB RAM
– Could in principle address 256 TB
• Link L7r

5. Windows Version Limitations
• Link L7r

6. OS Limitations
• OS uses
top half
• User
programs
use lower
half

7. System Calls
• syscall replaces INT 80

8. L7h: Searchable Linux Syscall Table

9. L7c: Introduction to x64 Assembly
Intel Developer Zone
• More details
about
registers

10. Common Opcodes

11. Syscall 1: Write

12. Simplest Program: ABC

13. Works, then Crashes
(no exit)
sudo apt install yasm

14. Exit

15. Works Without Crashing

16. Letters in Order

17. Using a .data section
• db = "Define Byte"

18. Objdump

19. Using gdb
• .data and .text sections appear the same
• But _start is in .text section
sudo apt install gdb

20. .text and .data Sections

21. info registers

22. Using read

23. "echo" with a .data section

24. Works with Junk at End

25. Caesar Cipher

26. Works for 4 Bytes Only

27. Objdump Shows a 32-bit Value

28. Intel 64 and IA-32 Architectures
Software Developer's Manual

29. Must use a Register

30. Now it Works

31. Challenge 1
"Hello from YOURNAME"

32. Challenge 2
Caesar (3 steps back)

33. Challenge 3: XOR Encryption