Computer Architecture Part 1: x86/x64

00:00

in the last session, we looked at how to convert numbers between basis. So let's build upon what we've reviewed and examined x 86 x 64 computer architecture. Er.

00:09

In previous sessions, we've stated that all the information in a computer is stored in one's and zero's orbits.

00:15

These bits can represent a number, character or any other piece of information

00:20

in x 86 x 64 architecture. Er, we've got some fundamental data types we've discussed These previously for bits is a nibble. Eight bits is a bite and so on and so forth. As an example on the left, we have one bite. This is represented as the hex number 55.

00:37

Now, just keep in mind, we're going to be using hex to display all of our bytes of data from here on out.

00:43

Now, using these fundamental units, we conform other data types. For instance, if we group two bites together will form a word if we Group four bites together will form a double word if we group eight bytes together will form a quad word and in x 64 architecture er, we also have one double quad board

01:03

now. One thing you want to keep in mind is that one bite or sequence of bites thes could be interpreted differently. For instance, if I give you a binary number of 11000011 This could represent the hex character C three decimal 1 95 or it could even mean Rhett in assembly.

01:23

It all depends on the context.

01:26

Okay, So in the context of data types and memory and bits and bytes, why is this all important?

01:30

Well, because you should start to understand that what we're doing here is we're building larger data structures from smaller ones. Bits are grouped together to form bites. Bites are formed together to form complex data types. And our data types are grouped together to form information as assembly language that we can understand from a high level

01:49

now to process these data structures, we have computer architectures,

01:55

computer architecture. ER is just a set of methods and rules that describe the organization the functionality in the implementation of a computer system.

02:05

Now, in general, we can break up the study of the computer architectures into three main categories. We've got the instruction set, architecture er, the micro architectures and the system's design.

02:17

Now the instruction set architecture or the I say this defines the machine code that the processor reads an ax on, as well as defines the word size, the memory address, processor modes, registers and data types that we've looked at earlier

02:35

now in modern computer architectures, the central processing unit executes machine code, the main memory of the system. This is the RAM. This stores all of the data as well as code and the input output system. This directly interfaces with devices such as monitors, keyboards and hard drives,

02:53

the value or the arithmetic Logical unit. This executes instructions in RAM inputs, results in memory or registers when we'll hit registers in a second. Now the processor. This handles all of the logical arithmetic and control activities, but a processor only understands machine language. But the machine language.

03:12

It's a purely numerical language. It's too obscure and complex for software development.

03:16

So what we did is we created a pneumonic for this language, and that's called assembly language.

03:23

Now, before we get into the next session, which will be about simple language, I want to talk about main memory because the main memory stores, machine code and data for the computer.

03:31

The main memory, as it's displayed here, is an array of bites sequenced in hex format. Now, when we view memory, lower addresses appear at the bottom and they increase towards the top to hire addresses now in X 64 32 bit processors,

03:50

data is stored in what we call little Indian format.

03:53

Now, Little Indian format deals with how we place this data into memory. When we place data into memory using Little Indian, the bites of a word are just starting from the least significant byte to the most significant byte. For example, if we place our word into memory,

04:11

the lowest significant byte is addressed first

04:14

in lower addresses, followed by the most significant bite in higher addresses. Now, how do we know which is the least significant byte? Simple. It's the right most bite.

04:25

How do we know which is the most significant by this is the left most bite Now? The reason why Intel computers use little Indian is so that the processor can perform operations on the data in memory faster. However, when viewing data in memory, you only need to know that little Indian systems store data in the reverse

04:45

that we humans re data

04:46

right to left.

04:47

All right, So before we review the fundamentals of assembly language, let's talk about the CPU. Okay, so the CPU is responsible for executing instructions, and these instructions are in the form of machine code, which, of course, make up our programs. The CPU is made up of the control unit three Alieu,

05:08

the Iot Device control and most importantly, registers.

05:12

Now in programming, we need access to data in a way to process variables. So registers are a temporary storage area that's used by the CPU to hold various pieces of data that are referenced by instructions when they're executed.

05:27

On Intel architecture, we've got four categories of registers. We've got general purpose segment, flat registers and instruction pointers. Now, as malware analysts, we're gonna want to know what the various registers dio So in this section will describe general purpose registers and pointers. And then we'll filter in the other ones

05:46

as they come up.

05:47

Now in x 64 architecture, we have 16 general purpose, 64 bit registers. The first eight, these are our X through RSP and the second eight are named R eight. Through our 15, these registers support access to data for different sizes and locations.

06:06

Now, in this course, we're not going to be looking at

06:10

registers are eight through our 15 very much, but the other registers. They enable us to move data into a location that suits their needs. For instance, if we need to store a quad word, we use the entire 64 bit register. If we need to store a D word, we can access the X 86

06:30

e a X portion of the Rx Register.

06:32

This will accommodate our four bites. If we need to store a word, we can access the to bite a X portion of the Rx register.

06:43

And finally, we can even store a single bite in the Rx Register by utilizing the A L Register. Now. Typically, these general purpose registers they've got a designated purpose. However, this really isn't always the case, but in general we've got the Rx register. It's called the Accumulator,

07:01

and it's typically used to store results from subroutines and functions.

07:05

The R B X Register is used by instructions for indexing and addressing calculations.

07:11

We've got an R C X register, and this is typically used for

07:15

counters in loops.

07:17

The RDX Register is used for input output operations for various arithmetic operations. Thea Rvp Register refers to the stack frame of the currently executing function, and we'll take a look at that later.

07:30

And then we also have the R. C and the R D. I registers thes 0.2 addresses in memory for the means of indexing purposes. Theme. The RC registers, called the Source Index Register and R D. I. Is called the destination index register, and these air just commonly used for data transfer related operations

07:50

like transferring content among strings and arrays and so forth.

07:55

The RSP register is a pointer to the top of the stack, and we're gonna talk about that later as well.