Difference between revisions of "Assembler"

From Cheat Engine
Jump to navigation Jump to search
(IDT)
Line 24: Line 24:
  
 
== IDT ==
 
== IDT ==
The IDT is a table of descriptors that describe what should happen when an interrupt occurs. It contains the used code segment, and the EIP/RIP address to call
+
The IDT is a table of descriptors that describe what should happen when an interrupt occurs. It contains the used code segment, and the EIP/RIP address to call, but also information like the DPL of the interrupt and if it's a callgate, taskgate or interrupt gate
  
 
== Flags ==
 
== Flags ==

Revision as of 18:38, 11 August 2009

This entry needs a lot of work. Please contribute if you can.

Check this page to see if there are some suggestions for adding to Assembler.

To describe:

  • Flags
  • Segments
  • CPL/DPL
  • IDT/GDT(/LDT)


Segments

Segment registers: cs,es,ds,ss,fs,gs
Bits 0,1 describe the RPL , request privilege level
Bit 2 describes if the LDT is used or not
Bits 3 to 15 contain the offset into the GDT or LDT table (when shifted left by 3)

example:
CS of 8 = 1000b = 1 0 00 : RPL=0, LDT=0, so GDT is used, offset in GDT table is (1 << 3) = 8 CS of 0x23 = 100011b = 100 0 11 : RPL=3, LDT=0 (GDT), offset in GDT table is 100b=4, (4 << 3) = 32

Note that even though 64-bit mode is used, bits 3 to 15 still only need to be shifted by 3 to point to the proper offset

GDT

The gdt is a table of descriptors that describe what should happen when entering a specific segment and setting it's rights. (What access rights, the limits, if it's data or code, etc...)


IDT

The IDT is a table of descriptors that describe what should happen when an interrupt occurs. It contains the used code segment, and the EIP/RIP address to call, but also information like the DPL of the interrupt and if it's a callgate, taskgate or interrupt gate

Flags

ID, VIP, VIF, AC, VM, RF, NT, IOPL, OF, DF, IF, TF, SF, ZF, AF, PF, CF

Opcodes

Most commonly used opcodes:

.... ADD

SUB

MOV

NOP = No Operation , usually used when removing the code that decreases life

XOR

....

External links