Assembly for Malware Analysis

It's clear you're diving into the intricacies of x86 and x64 assembly language, which is a great way to understand how software works at a low level. Here are some key points from your notes, along with additional insights that might help:

Memory Access

• Square Brackets: When you see [address], it means "access memory at this address". For example:

  • mov eax, [rcx] reads four bytes (32 bits) of data from the memory location pointed to by RCX.
  • mov [rdx], rax writes the contents of RAX into the memory location pointed to by RDX.

• Operand Sizes: The size of an operand can be inferred from the instruction, but it doesn't necessarily reflect the original declaration. For example:

  • mov eax, ecx moves a 32-bit value.
  • mov rax, rcx moves a 64-bit value.

Effective Addresses

• Address Calculation: Instructions like lea (load effective address) calculate addresses without accessing memory. For instance:
  • lea rax, [rcx+8] calculates the address RC

Read the full article at InfoSec Write-ups - Medium

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.