Techzone/Assembly Language

Assembly Language

3 min readArticle

Assembly is the lowest-level human-readable programming language. Each instruction maps (almost) 1:1 to a machine code instruction for a specific CPU architecture. Security relevance: shellcode is written in assembly, malware analysis requires reading assembly in disassemblers (IDA, Ghidra, Binary Ninja), and exploit development depends on understanding CPU internals.

Why Assembly Matters for Security

  • Shellcode — exploit payloads are assembly → machine code
  • Reverse engineering — all compiled code disassembles to assembly
  • Exploit development — buffer overflows, ROP chains require asm knowledge
  • Malware analysis — read what malware is actually doing at CPU level
  • CTF pwn challenges — almost always involve asm/shellcode

Architecture Differences

Arch Used In Notes
x86 (32-bit) Legacy Windows, 32-bit Linux Older but common in CTFs
x86-64 (AMD64) Modern Windows/Linux Most common today
ARM Mobile (iOS/Android), Raspberry Pi, Apple Silicon Growing importance
ARM64 (AArch64) Modern mobile, M1/M2 Macs Increasingly common

x86-64 Key Registers

shell 
Registers (64-bit):
  RAX, RBX, RCX, RDX  — General purpose
  RSP  — Stack pointer (top of stack)
  RBP  — Base pointer (start of current stack frame)
  RIP  — Instruction pointer (current instruction address)
  RSI, RDI  — Source/destination (function args 2nd, 1st)
  R8-R15   — Additional general purpose

32-bit halves: EAX, EBX, ECX, EDX (lower 32 bits of RAX etc)
16-bit: AX, BX... 8-bit: AL, AH...

Linux System Call Convention (x86-64)

nasm 
; syscall number in RAX
; args: RDI, RSI, RDX, R10, R8, R9
; return value in RAX

; write(1, "Hello\n", 6)
mov rax, 1          ; sys_write
mov rdi, 1          ; fd = stdout
lea rsi, [msg]      ; buf = pointer to message
mov rdx, 6          ; count = 6
syscall

Basic x86-64 Assembly

nasm 
section .data
    msg db "Hello, World!", 0x0a
    len equ $ - msg

section .text
    global _start

_start:
    ; write syscall
    mov rax, 1      ; sys_write
    mov rdi, 1      ; stdout
    mov rsi, msg    ; message address
    mov rdx, len    ; length
    syscall

    ; exit syscall
    mov rax, 60     ; sys_exit
    mov rdi, 0      ; exit code 0
    syscall

Compile and Run

bash 
# Assemble with NASM
nasm -f elf64 -o hello.o hello.asm

# Link
ld -o hello hello.o

# Run
./hello

# Disassemble to verify
objdump -d hello

Reading Assembly in Disassemblers

Common patterns to recognize:

nasm 
; Function prologue
push rbp
mov rbp, rsp
sub rsp, 0x20       ; allocate 32 bytes on stack

; Function epilogue
leave               ; equivalent to: mov rsp, rbp; pop rbp
ret

; Comparison and jump
cmp rax, 0          ; compare RAX with 0
je  .equal          ; jump if equal (ZF=1)
jne .notequal       ; jump if not equal
jg  .greater        ; jump if greater (signed)

; Function call
call some_function  ; push RIP+1, jump to function

; Loop
xor ecx, ecx        ; ecx = 0
.loop:
    ; body
    inc ecx
    cmp ecx, 10
    jl .loop        ; jump if less than 10

Shellcode Basics

Classic x86-64 execve /bin/sh shellcode:

nasm 
; execve("/bin/sh", NULL, NULL)
xor rdi, rdi
push rdi            ; null terminator
mov rdi, 0x68732f6e69622f2f  ; "//bin/sh"
push rdi
mov rdi, rsp        ; rdi = pointer to "/bin/sh"
xor rsi, rsi        ; argv = NULL
xor rdx, rdx        ; envp = NULL
mov rax, 59         ; sys_execve
syscall

Tools

  • Ghidra — free NSA-developed disassembler/decompiler
  • IDA Pro — industry standard (expensive, has free IDA Freeware)
  • Binary Ninja — modern, popular alternative
  • GDB with PEDA/pwndbg — debug and analyze at asm level
  • pwntools — Python library for exploit development

Resources

  • "Hacking: The Art of Exploitation" — Erickson (assembly + exploits)
  • pwn.college — free assembly/exploit training
  • godbolt.org — online compiler → assembly viewer

See Also

  • cpp-programming-guide - C++ compiles to assembly
  • bash-scripting-guide - For automating exploit pipelines
techzonesite.comUnlock Your IT Potential