### Assembly

Course
Time
13 hours 15 minutes
Difficulty
Beginner
CEU/CPE
14

### Video Transcription

00:00
Hello. This is Dr Miller, and this is Episode 11.7 of Assembly.
00:07
Today we're gonna talk about pushing and popping in arm.
00:11
So pushing, Pop.
00:13
So as we've talked about in X 86 pushing pop allows to save registers onto the stack.
00:20
The stack is pointed to a by registered called SP, not E S P.
00:25
And then, as we know, calling function can destroy registers, and then you have to save particular ones that you might need inside of your assembly code.
00:34
So the question is, what should you save?
00:37
So generally,
00:38
this will depend on the application binary interface or a B I amid specified down here,
00:45
and we can see that there are a variety of registers that we should know about. So,
00:50
um, to sum it up right are zero through. Our three are for arguments. So if you need to pass an argument to a function, typically it will go in. One of the registers are zero through our three. So those four registers down here,
01:03
and then our four through all our eight r Cali saved registers. So the function you're calling if it's going to modify them than it needs to save them, so you generally wouldn't have to necessarily save them.
01:14
Are nine is kind of up in the air, depending on, um, the platform.
01:19
So when in doubt, right, I would say that
01:22
and our 10 and r 11 r Cali saved,
01:26
and then our 12 through our 15 or our special registers are 12 is the instruction pointer
01:32
are 13 is a stack pointer are 14 is the link register, and ar 15 is the program counter.
01:38
And so those are all special, so you typically wouldn't necessarily need to save those. There wouldn't be something that you would want to resume
01:47
when you're doing it
01:49
so generally right. If you're using our zero through our three, you'll want to save those possibly are nine,
01:55
But otherwise you should be OK.
01:59
So when we push him pop, we can give it a list of registers and then the assembler would prefer if you put them in order
02:06
by their numbers. So I think it will actually reorganize them if you don't
02:10
and then save the ones that you want to keep. So, for example, you could say push R one R three R five and link register you put inside these curly brackets and then you list each one that you want to save.
02:23
Pop. We can do the same thing, and so it should restore all of those registers.
02:30
You also have the ability to give it a consecutive list. So I can say push our one through our five and link register. Or in theory, I can do them one at a time. Push LR push are zero Push our one right And either one of those,
02:43
um would work.
02:46
And then when we're pushing one register right there, assembler actually show us this that if you say push LR,
02:53
that's the same as a store l R. And then stack pointer minus four with right back. And we'll talk about
03:00
right back when we talk about arming, indexing. But I just wanted to show you what those are
03:06
here. We do it the same for our zero on our one. We can see that it's again pushing, storing to a store, register to the data add stack pointer
03:14
and then it's got an offside of four
03:16
and then popping is similar, right? So we got load register are one stack pointer on Then we are gonna add for
03:24
when we're all done.
03:25
But if we end up doing more than one register, it actually uses the push op code in order to push those onto the stack.
03:35
So here is an example showing that we're stepping through the code.
03:39
So again it's showing that if I have the command push LR, that's the same a store L RSP
03:45
minus for bang.
03:47
And so we can We should be able to see that the link register, which is right here. It's 76 e.
03:54
We're going to see that end up being pushed onto the stack. 76 e right. The Link Register matches. Here it is now on top of the stack. The stack was at 1 20 So go back. One slide.
04:06
It's at the top of the stack was at 1 20 now it's at one. See? Right, So it's gone down by four.
04:15
We should see that No other registers other than the program counter is moving to the next one.
04:20
I'm in the stack, pointer gets modified, and so here. Now we're going to do push are zero in our one. So we should see this drop down to and the values of R zero and are one are going to go on top of the stack.
04:32
So now we see that the top of the stack. Right? So we have our 76 e that has been pushed down, right? And we have,
04:41
um this is our one, and this is our zero. So those are both being pushed onto the stack. We can see that those are the same. And now we're at the next instructions of the program. Counter
04:49
points to the next instruction that is listed on there.
04:55
So today we talked about pushing registers and popping registers
05:00
and go again, going forward. We're gonna look at arm indexing modes.
05:04
So how do you save registers? L R R one R zero R three and R eight under the stack
05:14
so we could do a push. Are zero through our three.
05:16
Well, I guess I next added the next register,
05:19
Um, are eight and link register. So again, you want to go in order when you're pushing them.
05:26
So if you have questions, you can contact me, Miller, MJ at you and Kate. I e to you. And you can find me on Twitter at Milhouse 30

### Assembly

This course will provide background and information related to programming in assembly. Assembly is the lowest level programming language which is useful in reverse engineering and malware analysis.

### Instructed By

Matthew Miller
Assistant Professor at the University of Nebraska at Kearney
Instructor