Assembly Opcodes

Question 1

CALL

Answer 1

CALL - Procedure Call - FF Dx. Pushes instruction pointer (and Code Segment for far calls) onto the stack, and loads Instruction Pointer with the address of proc-name. Code continues with execution at CS:IP.

Usage: CALL [destination]

Modifies flags: none

Argument: This could be anything from D0 to D7 based on the register that it’s referencing.

Question 2

JMP

Answer 2

JMP - Unconditional jump - EB. Unconditionally transfers control to the given argument label. Jumps by default are within -32768 and 32678 bytes from the instruction following the jump. NEAR and SHORT jumps cause the IP to be updated while FAR jumps cause CS and IP to be updated.

Usage: JMP [destination]

Modifies flags: none

Question 3

INC

Answer 3

INC - Increment - 4x. Adds one to destination unsigned binary operand.

Usage: INC [destination]

Modifies flags: AF OF PF SF ZF

Fuzzing a program with the ‘A’ character (0x41) will be interpreted as an INC ECX command.

Question 4

DEC

Answer 4

DEC - Decrement - 4x. Unsigned binary subtraction of one from the destination.

Usage: DEC [destination]

Modifies flags: AF OF PF SF ZF

Question 5

JMP ESP

Answer 5

JMP ESP - Jump to ESP - FF E4.