Declare Labels in Assembly
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
Obfuscation-Resilient Executable Payload Extraction from Packed
Obfuscation-Resilient Executable Payload Extraction From Packed Malware Binlin Cheng, Hubei Normal University & Wuhan University; Jiang Ming, Erika A Leal, and Haotian Zhang, The University of Texas at Arlington; Jianming Fu and Guojun Peng, Wuhan University; Jean-Yves Marion, Université de Lorraine, CNRS, LORIA https://www.usenix.org/conference/usenixsecurity21/presentation/cheng-binlin This paper is included in the Proceedings of the 30th USENIX Security Symposium. August 11–13, 2021 978-1-939133-24-3 Open access to the Proceedings of the 30th USENIX Security Symposium is sponsored by USENIX. Obfuscation-Resilient Executable Payload Extraction From Packed Malware Binlin Cheng∗† Jiang Ming∗‡ Hubei Normal University & Wuhan University, China The University of Texas at Arlington, USA [email protected] [email protected] Erika A Leal and Haotian Zhang Jianming Fu† and Guojun Peng† The University of Texas at Arlington, USA Wuhan University, China {erika.leal,haotian.zhang}@mavs.uta.edu {jmfu,guojpeng}@whu.edu.cn Jean-Yves Marion Université de Lorraine, CNRS, LORIA, F-54000 Nancy, France [email protected] Abstract obfuscation schemes and more coverage on resolved Win- Over the past two decades, packed malware is always a ve- dows API names. Since July 2019, we have tested API-Xray ritable challenge to security analysts. Not only is determining in practice to assist security professionals in malware analy- the end of the unpacking increasingly difficult, but also advan- sis: we have successfully rebuilt 155;811 executable malware ced packers embed a variety of anti-analysis tricks to impede programs and substantially improved the detection rate for reverse engineering. -
Inside an Assembly-Language Game
Simulations Issue A CWC/I PUBLICATION 1984 JUNE USA $2.95 CAN $3.50 THE MAGAZINE FOR TRS-80 COLOR COMPLJTERIDAND MC-10® lJSERS InsideLearn How the an Pieces Assembly-Language Work Together Game 00700 * 00710 ********PRINTER ROUTINE********* 86 FE 00720 PSTART LDA #$0FE LOA D WITH #-2 Buy Low, Sell High 97 6F 00730 STA $6F AT 'DEVNUM' 00740 CLRB Stock Market Simulator 00750 LDX #$400 TOP OF SCREEN 00760 PLOOP LDA ,X+ GET A CHARACT 00770 INCB AND COUNT IT 00780 BSR GETCHR CONVERT AND P 90 CMPB #$20 32 CHARACTERS • BNE GSKIPl Build Your ....., .1..,: I' CLRB ' LDA #$0D SEND A LINE F Own Atari / JSR [ $A002] TO [CHROUT] ' I I I MPX #$5E0 END OF SCREEN Joystick lnterf ace / ' ............ LOOP NO, PRINT SOM � TITLE DONE / .... .... I ' CORRECT I PAGE I POKE VALUE / ' I ' ' Win (or Lose) Big / /..__ Q,�A"2 o I ' ' SET·UP ''*o At Bringmee Downs , ', � I ROUTINE ' I '' ' ' SCORE ' \ ROUTINE \ \ \ Plus: Elite-Word and \ The Business Accountmg '-� System Reviewed 015E GSKIP2 I LOOP I START LLOOP 06 0 A 74470 12067 II SEND Dealer FOR FREE inquiries CATALOG invited TM ABC'S IN COLOR SPELL BOMBER In the ABC program, all 26 letters spring up in As captain of your ship, you must destroy the enemy bomber by spelling color to the familiar ABC tune. Then, colorful the mystery word. In this exciting and educational game the bomber gets detailed pictures depicting each individual letter closer with each inaccurate letter. You have only EIGHT tries to guess of the alphabet appear one by one.Your child's the mystery word or your ship will be bombed! If you guess the word fascination will mount as he or she correctly correctly, GENERAL QUARTERS will sound and your ship will fire a presses the letter on the keyboard and is missile to destroy the bomber, Three levels are available: EASY, rewarded with a musical tune before the next MEDIUM. -
Ubicom™ SX Cross Assembler User's Manual
www.ubicom.com Ubicom™ SX Cross Assembler User’s Manual Lit. No.: UM02-04 SASM Cross Assembler User’s Manual Rev. 1.3 © 2000 Ubicom, Inc. All rights reserved. Revision History www.ubicom.com Revision History REVISION RELEASE DATE SUMMARY OF CHANGES 1.0 July 14, 1999 Initial Release 1.1 May 15, 2000 Updated to reflect latest SX devices 1.2 August 30, 2000 Updated to support SASM vl. 45.5 and higher revisions 1.3 December, 2000 Updated to describe the improved macro lan- guage provided by SASM v1.46, including minor revisions 1.47 and 1.48. ©2000 Ubicom, Inc. All rights reserved. No warranty is provided and no liability is assumed by Ubicom with respect to the accuracy of this documentation or the merchantability or fitness of the product for a particular application. No license of any kind is conveyed by Ubicom with respect to its intellectual property or that of others. All information in this document is subject to change without notice. Ubicom products are not authorized for use in life support systems or under conditions where failure of the product would endanger the life or safety of the user, except when prior written approval is obtained from Ubicom. Ubicom™ and the Ubicom logo are trademarks of Ubicom, Inc. All other trademarks mentioned in this document are property of their respective companies. Ubicom, Inc., 1330 Charleston Road, Mountain View, CA 94043 USA Telephone: +1 650 210 1500, Web site: hhtp://www.ubicom.com SX Cross Assambler 1.3 2 ©2000 Ubicom, Inc. All rights reserved. -
PSCOPE-86 HIGH-'LEVEL PROGRAM DEBUGGER USER's GUIDE (SUPPORTING the Irmxtm-86 OPERATING SYSTEM)
PSCOPE-86 HIGH-'LEVEL PROGRAM DEBUGGER USER'S GUIDE (SUPPORTING THE iRMXTM-86 OPERATING SYSTEM) Ipyright 1984, Intel Corporation el Corporation, 3065 Bowers Avenue, Santa Clara, California 95051 Order Number: 165496-001 I I PSCOPE-86 HIGH-LEVEL PROGRAM DEBUGGER USER'S GUIDE (SUPPORTING THE iRMX™ -86 OPERATING SYSTEM) Order Number: 165496-001 I I Copyright 1984, Intel Corporation Intel Corporation, 3065 Bowers Avenue, Santa Clara, California 95051 Additional copies of this manual or other Intel literature may be obtained from: Literature Department Intel Corporation 3065 Bowers A venue Santa Clara, CA 95051 The information in this document is subject to change without notice. Intel Corporation makes no warranty of any kind with regard to this material, including, but not limit ed to, the implied warranties of merchantability and fitness for a particular purpose. Intel Corporation assumes no responsibility for any errors that may appear in this document. Intel Corporation makes no commitment to update nor to keep current the information contained in this document. intei Corporation aSSUfTlt:S 110 fesponsibiiiiy for the use of aliY circuitry other than CiicuitiY embodied in an Intel product. No other circuit patent licenses are implied. Intel software products are copyrighted by and shall remain the property of Intel Corporation. Use, duplication or disclosure is subject to restrictions stated in Intel's software license, or as defined in ASPR 7-104.9(a)(9). No part of this document may be copied or reproduced in any form or by any means without prior writ ten consent ofIntel Corporation. Intel Corporation makes no warranty for the use of its products and assumes no responsibility for any errors which may appear in this document nor does it make a commitment to update the information contained herein. -
Where to Go from Here?
AFTERWORD Where to Go from Here? After you have worked your way through this book, you have mastered the basics of modern assembly programming. The next step depends on your needs. This afterword contains some ideas. Security analysts can use the acquired knowledge to study malware, viruses, and other ways to break into computers or networks. Malware, in binary format, tries to get into computers and networks. You can take this binary code, reverse engineer it, and try to figure out what the code is doing. You would, of course, do that in an isolated lab system. Study how to reverse engineer and acquire the necessary tooling. You should consider learning ARM assembly for analyzing code on smartphones. As a higher-level language programmer, you may consider building your own library of high-speed functions to be linked with your code. Study how you can optimize code; the code in this book was not written for high performance but for illustration purposes. In the book, we referred to a couple of texts that can help you write optimized code. If you want a thorough understanding of the Intel processors, download the Intel manuals and study them. There is a lot of interesting information to digest, and knowing how the hardware and software works together will give you an edge in developing system software or diagnosing system crashes. As a higher-level language programmer with a grasp of assembly language, you are now better equipped to debug your code. Analyze your .obj and .lst files and reverse engineer your code to see what happens. -
Asxxxx Documentation As a Single PDF File
ASxxxx Assemblers and ASLINK Relocating Linker Version 5.40 March 2021 Table Of Contents CHAPTER 1 THE ASSEMBLER 1-1 1.1 THE ASXXXX ASSEMBLERS 1-1 1.1.1 Assembly Pass 1 1-2 1.1.2 Assembly Pass 2 1-2 1.1.3 Assembly Pass 3 1-3 1.2 SOURCE PROGRAM FORMAT 1-3 1.2.1 Statement Format 1-3 1.2.1.1 Label Field 1-4 1.2.1.2 Operator Field 1-6 1.2.1.3 Operand Field 1-6 1.2.1.4 Comment Field 1-7 1.3 SYMBOLS AND EXPRESSIONS 1-7 1.3.1 Character Set 1-7 1.3.2 User-Defined Symbols 1-11 1.3.3 Reusable Symbols 1-12 1.3.4 Current Location Counter 1-13 1.3.5 Numbers 1-15 1.3.6 Terms 1-15 1.3.7 Expressions 1-16 1.4 GENERAL ASSEMBLER DIRECTIVES 1-17 1.4.1 .module Directive 1-18 1.4.2 .title Directive 1-18 1.4.3 .sbttl Directive 1-18 1.4.4 .list and .nlist Directives 1-19 1.4.5 .page Directive 1-20 1.4.6 .msg Directive 1-21 1.4.7 .error Directive 1-22 1.4.8 .byte, .db, and .fcb Directives 1-22 1.4.9 .word, .dw, and .fdb Directives 1-23 1.4.10 .3byte and .triple Directives 1-23 1.4.11 .4byte and .quad Directive 1-24 1.4.12 .blkb, .ds, .rmb, and .rs Directives 1-24 1.4.13 .blkw, .blk3, and .blk4 Directives 1-24 1.4.14 .ascii, .str, and .fcc Directives 1-25 1.4.15 .ascis and .strs Directives 1-25 1.4.16 .asciz and .strz Directives 1-26 1.4.17 .assume Directive 1-27 1.4.18 .radix Directive 1-27 1.4.19 .even Directive 1-28 1.4.20 .odd Directive 1-28 1.4.21 .bndry Directive 1-28 1.4.22 .area Directive 1-30 1.4.23 .bank Directive 1-32 1.4.24 .org Directive 1-33 1.4.25 .globl Directive 1-34 1.4.26 .local Directive 1-35 1.4.27 .equ, .gblequ, and .lclequ Directives 1-36 -
Introduction to Saturn Assembly Language
Introduction to Saturn Assembly Language Written by Gilbert Fernandes Edited and Maintained by Eric Rechlin Authors: Gilbert Henri Fernandes Eric Rechlin 1 rue des Gâte Ceps 3212 Winnipeg Drive F-92210 Saint-Cloud Bismarck, ND 58503-0453 France USA [email protected] [email protected] ICQ: 78327407 ICQ: 783944 This book, as well as the included examples, is a free work. You may print this for your own purposes or for any other person. This book may be transmitted or reproduced in any form or by any means as long as credit to the original authors is not modified. In plain English: This is free, so widely distribute it! Just make sure you give credit to us. Hewlett-Packard and HP are registered trademarks of the Hewlett-Packard Company. Edition 3: July 16, 2005 Copyright 1999-2005 Gilbert Fernandes and Eric Rechlin Distribute freely to all your HP calculator-owning friends. Preface Assembly language is very different from most other programming languages. When learning a typical programming language, one of the first lessons will usually explain how to make a simple “Hello World” program. But with assembly language, it’s not that simple. First, before any assembly language code can be written, one must understand the concepts of how the processor works and how the operating system works with it. In addition, many commands must be learned in order to do something as simple as printing to the display. In this book you will have to go through forty pages of introductory material before even picking up your calculator. -
Scenix™ SX Cross Assembler User's Manual
Scenix™ SX Cross Assembler User’s Manual Lit. No.: SXL-UM02-03 SX Cross Assambler 1.2 1 ©2000 Scenix Semiconductor, Inc. All rights reserved. Revision History REVISION RELEASE DATE SUMMARY OF CHANGES 1.0 July 14, 1999 Initial Release 1.1 May 15, 2000 Updated to reflect latest SX devices 1.2 August 30, 2000 Updated to support SASM vl. 45.5 and higher revisions ©2000 Scenix Semiconductor, Inc. All rights reserved. No warranty is provided and no liability is assumed by Scenix Semiconductor with respect to the accuracy of this documentation or the merchantability or fitness of the product for a particular application. No license of any kind is conveyed by Scenix Semiconductor with respect to its intellectual property or that of others. All information in this document is subject to change without notice. Scenix Semiconductor products are not authorized for use in life support systems or under conditions where failure of the product would endanger the life or safety of the user, except when prior written approval is obtained from Scenix Semiconductor. Scenix™ and the Scenix logo are trademarks of Scenix Semiconductor, Inc. All other trademarks mentioned in this document are property of their respective companies. Scenix, Inc., 1330 Charleston Rroad, Mountain View, CA 94043 USA Telephone: +1 650 210 1500, Web site: hhtp://www.scenix.com www.scenix.com Contents Chapter1 Overview 1.1 Introduction . 7 1.2 Main Features . 7 1.3 Invoking SASM . 7 1.3.1 Compiler Mode . .. .9 1.3.2 Extensions for Various Tool Environments. .9 1.3.3 Output Format.