Register duties

RIP : Instruction pointer RSP: Stack pointer RBP: (Stack) Base pointer RSI, RDI: Generally used for passing args RAX, RBX, RCX, RDX , R8, R9 …R15 : General purpose


These are bits which set or unset acc. to the latest operation ZF : Zero Flag SF : Sign Flag CF: Carry Flag OF: Overflow Flag PF: Parity Flag AF: Auxillary Flag IF: Interrupt enable Flag DF: Direction Flag

Basic operations

`mov rax, rsi`  		rax = rsi
`add rbx, 0x1`			rbx = rbx +0x1
`sub rax, rbx`  		rax = rax - rbx
`mov rax, [addr.] `		rax = value_at[addr]
`push 0x7`              pushes 0x into stack
'pop eax'				pop the value into eax
`cmp R9, R10`			compares them and later used in decisions like je, jg,..etc 
`test R9 R10`			performs bitwise AND and modifies the flags SF ZF and PF
`jmp addr`				jump to given address , more often comes as je, jne..etc

PS: The stack grows downwards (litle endian)

Most used keywords :
  • pie
  • aslr
  • nx
  • canary

    Application memory structure

    |   Heap      |
    |  -------    |
    |   Stack     |
    |  -------    |
    |  variables  |
    |  -------    |
    | instructions|


  • BOF (buffer overflow)
  • ret2libc and rop
  • ret2plt
  • Format string vuln


To find the occurances of libc functions we can use ltrace and find them checksec ./vuln to perform security check seg fault with demsg