Hey everybody welcome to the next video in the Operating Systems Internals module.
Now in this video we're going to be going a little bit deeper into the CPO.
Now we're going to be talking about the CPE registers.
Now what is a register.
Think of it as just a simple variable that is special and specific to the CPO.
Now the CPO only has a set number of these because they are they are physical registers in the CPO.
So there's only so much data that can actually physically be held in each one of these.
Now each register is assigned a specific function as far as the CPA is concerned.
Now as a developer working with assembly or anything else you can manipulate the registers as you want.
However understand that if you put something in the wrong register at the wrong time and perform a certain
act a certain action you can crash and cause a system to reboot.
Now there are quite a few registers.
These are the main ones that we're going to focus on and keep in mind this is for 32 bit applications
so the first one is X now E X is the most commonly used register for the return value.
So when you're writing application let's say you're writing a function that calls whatever and then
called a format string and then you return the string to the main application.
So when you whatever you pass as the returns.
So in this case the string would be stored in X for example in this case it's returning or true.
So the value of true would be in X at that point in time when it is returned.
This is considered a special purpose register for things like multiplication and division which will
go over why that's the case and how it's used.
When we get to the assembly tutorial now PBX has no special purposes but it's commonly used to hold
the values 0 since 0 is a very commonly used value when it comes to working with memory and moving things
around in the CPA use zeros is is requires to rebuild 0 normally requires two to three up OP calls or
system calls.
So which will go over up codes at a later point but knowing that it takes three instructions to generate
zero it's easier for a PBX to just hold zero and just make one call to gain access to the value 0 rather
than saving something out of whatever it was in ex hitting three separate instructions to generate zero
and Eby ex perform the calculation then move it back to the original value that was any PBX back into
it.
So it's been restored to its correct state.
So it's very important to understand why things are moved in and out of registers which will go a lot
more in a parent in the assembly tutorial now FCX which is also known as the counting register.
So when you create a loop in programming normally it's like for AI is if I is greater than whatever
number you're going to loop through the code so many times.
Now I in this particular case the variable AI is what would be stored in ECF.
So when you write a loop the counter that you're using is what is what sits in these easy it's normally
goes from 0 up to a digit or down to zero as far as the registers concerned.
Now ADX is commonly used to hold parameters passed by functions and can also be used for temporary data
that the developer wants to use that particular time.
Now that special purpose is for functions so when you pass stuff in and out of functions ADX is as well
as a few other registers will be used depending on how many parameters have to be passed.
And in most cases it's you know the stack everything gets pushed onto the stack then gets popped off
in the order that the parameters are needed.
Now we'll go over the stack and in another video in this in this module so ISI is often as used as a
pointer.
So what it normally points to is the memory address that can be used to reference the data itself.
So you can reference the data without changing it do the pointer.
Now with EDI II it's similar to ISI but will generally point to the actual destination of it.
So it can be changed.
Now BP is most commonly used for just storage at this point.
However it's important understand that when you're compiling applications or building an application
when you set the compiler to be more optimized which will go over when we get to the compilers video
understand that EDI EVP has a flag set to it or a value set to it to tell a compiler whether or not
the the compiled code needs to be optimized at that point in time.
We're not going to go too much into that in this particular video.
Now ESPN has a special purpose register and it is one of the two more important registers which is going
to be the next one following up after this ISP points to the top of the stack.
Now you'll understand why this is important in the next few videos but it points the top of the stack
at that point in time.
Now when you're messing around with binary and trying to inject a backdoor into it and you start changing
things around you need to understand that if the main application has pushed up to the stack it needs
to be able to pop it back off and expects it to be in a particular order.
So if you go ahead and erase ESPN and reverted to a different value or maybe you point to somewhere
else or use it as a temporary value if you don't revert that back the application is going to use the
memory address located in ESB if it's even a memory address and then try to pull it start popping stuff
off in an x amount of bytes from there which will cause a problem.
It will cause the application the most likely crash.
Now it's not normally changed unless it's required to do so like I said it's not used for temporary
storage if you're going to do that and use it for temporary storage for one specific thing make sure
you pop the ISP value onto the stack or push it back on.
Push it onto the stack.
Do whatever you need to do.
And then pop it back off into ESB.
This all makes sense in the assembly tutorial and again while manipulating back doors in GUI binaries
yourself.
This is very important to understand now.
The one not the one I consider the most important register you can use is e IP which is the instruction
pointer now E IP whatever is in the IP is what's going to be executed next.
So this is actual code that our op codes that are going to be executed at any point in time.
Now a buffer overflow which will go over later takes control of the IP so that way when the application
runs its next instruction.
It's what we what we want it to be.
So being able to control e IP is a very important thing but understanding that IP always points to the
instructions that will be executed next is extremely important as well now.
Each register has a high and low version of itself.
Now you try to store against 32 bits which is why we're looking at a 32 bit operating system and in
64 this would be slightly different.
Now let's take the expert example so each x as as a whole if you called it as a X would be 32 bits.
Now there is one called A X which handles the last 16 of the 32 which is fine.
And then we have a l for the low so the lower version of the register so that handles the lower 8 bit.
So the first 8 bits of the 32 and then a h for high version high level of the register handles the 8
through 15 and then the X handles 16 to 32.
It's important to understand the sub registers here because assembly uses your values might be in a
l or a H and not in E X and this is important because when you're running division or you're doing multiplication
specifically for division your remainder will end up.
For example in a L or H rather than just in some random register.
So it's important to understand the registers and what they do and what they are.
So I want you to go a little bit deeper into ESB and e IP in e x.
Those are gonna be your three big ones.
So I want you to take a little bit more time look up a little bit more details on each of those three
registers.