Friday, February 3, 2012

Introduction to Buffer Overflow : CPU Register

 If we want to master the Buffer Overflow technique, first we must have a knowledge in CPU Register. Register is the part of the processor's memory that can be accessed with a high speed and always used by microprocessor as the medium to do its work.
An x86 based CPU used 8 register : EAX, EBX, ECX, EDX, ESI, EDI, EBP, and ESP. Each of them designed for a specific job that make the CPU process the information eficiently.

1. EAX Register
Used to perform calculations and store the value returned from the function call. Basic operations such ass add, subtract, and compare is optimized in EAX Register. Special operations such as multiplication and divide are done by EAX Register.

2. EDX Register
EDX is EAX Extention. Helping EAX to perform complex calculations.

3. ECX Register
Can also be called count register. Used to do looping operation.

4. ESI and EDI Register
Used by the looping that processing data. ESI used as the Source, while EDI used to point to what location the result of the calculation will be stored.

5. ESP and EBP Register
ESP stands for Extended Stack Pointer, and EBP stands for Extended Base Pointer. These registers are used to control the calls from function and stack operation. When this function called, the argument function will be pushed into the stack and followed by the address of the sender. While EBP register used to point the lower stack's call.

6. EBX Register
Is the only register that doesn't designed for a specific job. But this register is used as the extra memory for the other registers.

7. EIP Register
EIP register is a register that contain the next instruction that will be executed by the processor. This is the most vulnerable parts of the register.

That little knowledge will help us greatly when developing our own exploit.  :)

"the quieter you become, the more you are able to hear..."

2 comments:

Anonymous said...

kerren!!!

drago-hack said...

I'm still a newbie.. :P

thanks for coming.. :)

Post a Comment