IA-32 Registers
General puprose Registers
All registers are 32-bit in length (4bytes).
Each of the 2 lower bytes in the EAX,EBX,ECX and EDX registers can be referenced by AX and then subdivided by the names AH,BH,CH and DH for high bytes and AL,BL,CL and DL for the low bytes which are 1 byte each.
In addition, the ESI,EDI,EBP and ESP can be referenced by their 16-bit equivalent which is SI,DI,BP and SP.
For example:
EAX = 32 bit
AX = 16 bit
AH = upper 8 bit of AX
AL = lower 8 bit of AX
+=========================+==============+===============+
| | | |
| | | |
+=========================+==============+===============+
{ EAX }
{ AX }
{ AH }{ AL }
EAX
Mostly used for return values Main register used in arithmetic calculations. Also known as accumulator, as it holds results of arithmetic operations and function return values.
EBX
The base register. Pointer to data in the DS segment. Used to store the base address of the program.
ECX
The Counter register is often used to hold a value representing the number of times a process is to be repeated. Used for loop and string operations.
EDX
A general purpose register. Additionally used for I/O operations. In addition will extend EAX to 64-bits.
ESI
Source Index register. Pointer to data in the segment pointed to by the DS register. Used as an offset address in string and array operations. It holds the address from where to read data.
# EDI
Destination index register. Pointer to data ( or destination ) in the segment pointed to by the ES register. Used as an offset address in string and array operations. It holds the implied write address of all string operations.
EBP
Base Pointer. Pointer to data on the stack ( in the SS segment ). It points to the bottom of the current stack frame. It is used to reference local variables.
ESP
Stack Pointer ( in the SS segment ). It points to the top of the current stack frame. It is used to reference local variables.
Segment Registers
The segment registers are used specifically for referencing memory locations. There are three different methods of accessing system memory.
Each segment register is 16-bit and contains the pointer of the start of the memory-specific segment.
Segment registers are considered part of the OS and can neither read nor be changed directly in almost all cases.
CS (Code segment)
Code segment register stores the base location of the code section (.text section) which is used for data access.
It contains the pointer to the code segment in memroy where the cpu instructions are stored. The processor retrieves instruction codes from memory base on the CS registers values and an offset value contained in the EIP register. The CS register cannot be changed as the value gets assigned by the initial memory space.
DS (Data segment)
Data segment register stores the default location for variables (.data section) which is used for data access.
ES (Extra segment)
Extra segment register which is used during string operations.
SS (Stack segment)
Stack segment register stores the base location of the stack segment and is used when implicitly using the stack pointer or when explicitly using the base pointer
FS (Extra segment register)
n/a
GS (Extra segment register)
n/a
Control Registers
The data can´t be directly accessed but moved to a general-purpose register.
CR0
System flag that control the operating mode and various states of the processor.
Also includes a flag that controls paging.
CR1
Currently not implemented.
This register is reserved and should not be accessed.
CR2
Memory page fault information.
Contains the linear address that caused a page fault.
CR3
Memory page directory information.
Contains the physical address of the initial structure used for address translation.
It is updated during context switches when a new task is scheduled.
CR4
Flags that enable processor features and indicate feature capabilities of the processor.
Includes PAE.
Flags (EFLAGS)
There are three kinds of flags which are as following:
Status Flag
CF (Carry Flag)
Is set when a math operation on an unsigned integer value generates a carry or borrow for the most significatn bit. This is an overflow condition for the register involved in the math operation. When this occurs, the remaining data in the register is not the correct answer to the math operation.
PF (Parity Flag)
Is used to indicate corrupt data as a result of a math operation in a register. When checked, the parity flag is set if the total number of 1 bits in the result is even and is clreaed if the total number of 1 bits in th result is odd. When the parity flag is checked, an application can determine whether the register has been corrupted since the operation.
AF (Adjust Flag)
The adjust flag is used in Binary Coded Decimal math operations and is set if a carry or borrow operation occurs from bit 3 of the register used for the calculation.
ZF (Zero Flag)
Is set if the result of an operation is zero.
SF (Sign Flag)
Is set to the most significant bit of the result which is the sign bit and indicates whether the result is positive or negative.
OF (Overflow Flag)
Is used in signed integer arithmetic when a positive value is too big or a negative value is too small to be represented in the register.
Control Flags
Control Flags are utilized to control specific behavior in the processor.
The DF flag which is the direction flag is used to control the way strings are handled by the processor. When set, string instructions automatically decrement memory addresses to get the next byte in the string. When cleared, string instructions automatically increment memory addresses to get the next byte in the string.
System flags are used to control OS level operations which should NEVER be modified by any respective program or application
TF (Trap Flag)
Is set to enable single-step mode and when in this mode the processor performs only one instruction code at a time, waiting for a signal to performs only one instruction code at a time, waiting for a signal to perform the next instruction.
IF (Interrupt Enable Flag)
The interrupt enable flag controls how the processor responds to signals received from external sources
IOPL (I/O Privilege Level Flag)
The I/O privilege field indicates the input-output privilege level of the currently running task and defines access levels for the input-output address space which must be less than or equal to the access level required to access the respective address space. In the case where it is not less than or equal to the acces level required, any request to access the address space will be denied.
NT (Nested Task Flag)
The nested task flag controls whether the currently running task is linked to the previously executed task and is used for chaining interrupted and called tasks.
VM (Virtual-8086 Mode Flag)
The VM flag indicates that the processor is operating in virtual-8086 mode instead of protected or real mode.
TODO: more info about this mode
AC (Alignment Check Flag)
Is used in conjunction with the AM bit in the CR0 control register to enable alignment checking of memory references.
VIF (Virtual Interrupt Flag)
The virtual interrupt flag replicates the IF flag when the procesor is operating in virtual mode.
VIP (Virtual Interrupt Pending Flag)
The virtual interrupt pending flag is used when the processor is operating in virtual mode to indicate that an interrupt is pending.
ID (Identification Flag)
The ID flag indicates whether the processor supports the CPUID instruction
TODO: Get more info about CPUID
Special Registers
Every core contains those two independent registers
Global Descriptor Table (GDTR)
Local Descriptor Table (LDTR)
Paging
Allows physical memory to be broken up into fixed-length sections called pages.
When a program attempts to access a linear address, this mapping uses memory-resident page directories and page tables to translate the linear address into a physical address.
In the typical scenario of a 4KB page the 32-bit virtual address is broken into three sections, each of which is used as an index in the paging structure hierarchy or the associated physical page.
The IA-32 architecture also supports pages of size 4MB, whose translation requires only a page directory. By using different paging structures for different processes, an operating
system can provide each process the appearance of a single-programmed environment through a virtualized linear address space.
Physical Address Extension (PAE)
PAE is the mode in which most modern operating systems execute.
Provides the following features:
- Virtual Memory
- Paging
- Privilege levels
- Segmentation
Interrupt Descriptor Table (IDT)
PC architectures often provide a mechanism for interrupting process execution and pass- ing control to a privileged mode software routine. For the IA-32 and Intel 64 architectures, the routines are stored within the Interrupt Descriptor Table (IDT). Each processor has its own IDT composed of 256 8-byte or 16-byte entries, in which the first 32 entries are reserved for processor-defined exceptions and interrupts. Each entry contains the address of the interrupt service routine (ISR) that can handle the particular interrupt or exception. In the event of an interrupt or exception, the specified interrupt number serves as an index into the IDT (which indirectly references a segment in the GDT), and the CPU will call the respective handler. After most interrupts, the operating system will resume execution where it was originally interrupted. For example, if a thread attempts to access a memory page that is invalid, it generates a page fault. The exception number 0xE handles page faults on x86 and Intel 64 architectures. Thus, the IDT entry for 0xE contains the function pointer for the operating system’s page fault handler. Once the page fault handler executes, control can return to the thread that attempted to access the memory page. Operating systems also use the IDT to store handlers for numerous other events, including system calls, debugger breakpoints, and other faults.
Questions
- Which register allows a function to keep track of required arguments, local variables, and the return address? EBP
- Which register is a general purpose register that is often used to store the results of logical instructions? EAX
- Which register controls the execution flow of the program by storing the address of the next instruction to be executed? EIP
- Which register stores the lowest memory address (top) of the stack and is dynamic based on how much memory a function needs to store data, arguments, and pointers? ESP