ASM Cheat Sheet: Master Assembly Language NOW! (Quick Guide)

Assembly Language, the bedrock of systems programming, often feels daunting. This is where an asm cheat sheet becomes invaluable. The Intel architecture, a common target for assembly development, demands a solid understanding of its instruction set. Using an asm cheat sheet can significantly boost your productivity when working with tools like the NASM assembler. Whether you’re debugging with GDB or optimizing kernel code, a well-structured asm cheat sheet provides quick reference to essential commands and syntax.

Assembly Language (ASM) sits at a unique intersection of hardware and software.

It provides a level of control and understanding that’s simply unattainable with higher-level languages.

This guide will serve as your stepping stone into this fascinating world, whether you’re a complete beginner or have some experience under your belt.

What is Assembly Language?

Assembly Language is a low-level programming language that’s closely tied to the architecture of a computer.

Unlike languages like Python or Java, which use abstract concepts and require interpretation or compilation into machine code, ASM uses mnemonics to represent machine instructions directly.

This direct correspondence gives you explicit control over the CPU and memory, but it also demands a deeper understanding of how computers work.

It’s important to learn ASM because it provides insights into how software interacts with hardware at the most fundamental level.

Why a Cheat Sheet?

Learning Assembly Language can feel like learning a completely new language.

There are a lot of things to remember.

That’s where this cheat sheet comes in.

It is designed to be a quick and accessible reference for common ASM concepts, instructions, and syntax.

Think of it as your handy companion as you navigate the complexities of ASM programming.

It’s not intended to be a comprehensive textbook, but rather a practical tool to jog your memory and get you started quickly.

The Benefits of ASM: Beyond the Basics

While modern software development rarely involves writing entire applications in Assembly Language, understanding ASM offers several key advantages:

• Enhanced Debugging Skills: ASM knowledge allows you to understand the root cause of software bugs at the machine level, enabling more effective debugging.
• System Optimization: By directly manipulating hardware resources, you can optimize critical code sections for maximum performance.
• Reverse Engineering: ASM is essential for analyzing and understanding the inner workings of compiled software.
• Security Analysis: ASM skills are invaluable for identifying and exploiting security vulnerabilities in software.
• Deeper Computer Understanding: Learning ASM provides a profound understanding of how computers execute instructions and manage resources.

Who is This Cheat Sheet For?

This cheat sheet is tailored for a broad audience, ranging from beginners who are just starting their ASM journey to intermediate users who want a quick reference for common tasks.

Whether you’re a student learning about computer architecture, a software developer interested in low-level optimization, or a security researcher analyzing malware, this guide will provide you with the essential information you need to get started with Assembly Language.

While modern software development rarely involves writing entire applications in Assembly Language, understanding ASM offers several key advantages. Before diving into specific instructions and syntax, it’s crucial to grasp the fundamental entities that form the building blocks of ASM programs. Think of these entities as the essential components of a machine, each with a specific purpose and interacting in a defined way to achieve a result.

Key Entities: Understanding the Building Blocks

Assembly Language, at its core, is about manipulating data and controlling the flow of execution within a computer. This manipulation is achieved through a set of fundamental entities that work in concert.

Understanding these entities is essential for writing, debugging, and optimizing ASM code. Let’s explore these core concepts, each contributing to the overall functionality of an ASM program.

Assembly Language (ASM): The Language of Machines

Assembly Language is a low-level programming language.

It uses mnemonics to represent machine instructions. These mnemonics offer a human-readable form of the binary code that the CPU directly executes.

ASM allows direct control over the hardware, making it ideal for tasks demanding high performance or direct hardware interaction.

Cheat Sheet: Your ASM Companion

This cheat sheet is designed to be a quick reference guide.

It’s intended to jog your memory on common ASM concepts and syntax.

Use it to quickly look up instruction formats, register names, and directive usage.

It is not a replacement for a comprehensive textbook, but rather a practical tool for efficient ASM programming.

Registers: The CPU’s Workspace

Registers are small, high-speed storage locations within the CPU.

They are used to hold data and addresses that the CPU is actively working with.

Understanding registers is critical because most ASM instructions operate on data stored in registers.

General-Purpose Registers (EAX, EBX, ECX, EDX)

These registers can be used for various purposes, like storing operands for arithmetic operations or holding memory addresses.

Traditionally, EAX is often used for return values from functions, ECX as a loop counter, and EDX to hold I/O port addresses.

Stack Pointer (ESP) and Base Pointer (EBP)

ESP points to the top of the stack.

EBP is used as a reference point for accessing function parameters and local variables on the stack.

Source Index (SI) and Destination Index (DI)

SI and DI are commonly used for string operations.

SI typically points to the source string, and DI points to the destination string.

Instruction Pointer (IP)

IP holds the address of the next instruction to be executed.

It is automatically updated by the CPU as instructions are executed, controlling the flow of program execution.

Instructions: The Action Commands

Instructions are the fundamental commands that the CPU executes.

Each instruction performs a specific operation, such as moving data, performing arithmetic, or controlling the flow of execution.

Data Movement (MOV)

MOV is used to copy data from one location to another, whether between registers, memory locations, or immediate values.

Arithmetic Operations (ADD, SUB)

ADD and SUB perform addition and subtraction, respectively.

These instructions modify the destination operand and set flags in the EFLAGS register based on the result.

Control Flow (JMP, CMP, CALL, RET)

JMP performs an unconditional jump to a specified address.

CMP compares two operands and sets flags in the EFLAGS register, which can then be used by conditional jump instructions like JE (jump if equal) or JNE (jump if not equal).

CALL is used to call a procedure or function, while RET returns from a procedure.

Directives: Guiding the Assembler

Directives are commands for the assembler.

They are not instructions that the CPU executes.

Instead, directives provide information to the assembler about how to assemble the code, such as defining data, allocating memory, or defining constants.

Data Definition (DB, DW, DD, EQU)

DB (Define Byte) allocates a single byte of memory.

DW (Define Word) allocates two bytes.

DD (Define Double Word) allocates four bytes.

EQU is used to define constants, assigning a symbolic name to a value.

Memory Addressing: Accessing Data in Memory

Memory addressing refers to how you specify the location in memory that you want to access.

ASM offers several addressing modes.

Direct Addressing

Specifies the exact memory address.

Indirect Addressing

Uses a register to hold the memory address.

Indexed Addressing

Uses a register as an offset from a base address.

Stack: The Data Structure for Function Calls

The stack is a region of memory used for temporary storage.

It primarily handles function calls and local variables.

It operates on a LIFO (Last-In, First-Out) principle, using PUSH to add data to the top and POP to remove data.

Assemblers: Translating ASM to Machine Code

Assemblers are programs that translate Assembly Language code into machine code that the CPU can execute.

Different assemblers may have slightly different syntax and features.

NASM, MASM, GAS

NASM (Netwide Assembler) is a popular cross-platform assembler with a clean and simple syntax.

MASM (Microsoft Assembler) is commonly used for Windows development.

GAS (GNU Assembler) is often used on Linux systems.

Debuggers: Finding and Fixing Errors

Debuggers are essential tools for finding and fixing errors in ASM code.

They allow you to step through your code line by line, inspect registers and memory, and set breakpoints.

GDB, OllyDbg

GDB (GNU Debugger) is a powerful command-line debugger often used on Linux systems.

OllyDbg is a popular Windows debugger with a graphical interface.

Operating Systems: Interacting with the System

Assembly Language programs often need to interact with the operating system to perform tasks such as reading input, writing output, or accessing files.

Windows, Linux

The way ASM interacts with Windows and Linux can vary, especially when making system calls.

System calls are requests to the operating system kernel to perform specific tasks.

x86 & x64 Architecture: 32-bit vs. 64-bit

The x86 and x64 architectures refer to the processor’s instruction set and memory addressing capabilities.

x86 is a 32-bit architecture, while x64 is a 64-bit architecture.

Key Differences

x64 architecture can address significantly more memory than x86.

x64 also has more general-purpose registers, which can improve performance.

Flags Register (EFLAGS): Tracking the Status of Operations

The EFLAGS register contains a set of flags that reflect the status of the most recent arithmetic or logical operation.

These flags are used by conditional jump instructions to control program flow.

Common Flags

Zero Flag (ZF): Set if the result of an operation is zero.

Carry Flag (CF): Set if an operation results in a carry or borrow.

Sign Flag (SF): Set if the result of an operation is negative.

Overflow Flag (OF): Set if an operation results in an overflow.

Interrupts: Handling External Events

Interrupts are signals that cause the CPU to suspend its current execution and transfer control to an interrupt handler.

Interrupts can be triggered by hardware (e.g., a keyboard press) or software (e.g., a system call).

System Calls: Requesting OS Services

System calls are the primary way that ASM programs interact with the operating system kernel.

They allow programs to request services such as file I/O, memory allocation, and process management.

Data Types: Defining Data Size

Data types in ASM define the size and interpretation of data stored in memory.

Byte, Word, Dword

Byte represents 8 bits of data.

Word represents 16 bits.

Dword represents 32 bits.

These data types are used when defining variables and allocating memory.

Procedures/Functions: Creating Reusable Code Blocks

Procedures (also known as functions) are reusable blocks of code that perform a specific task.

They help modularize your code, making it easier to read, understand, and maintain.

Understanding how to define and call procedures is essential for writing larger ASM programs.

Assembly language isn’t just about raw code; it’s about the actions you command the processor to take. While the previous section introduced the fundamental entities that define the ASM landscape, these entities alone are like tools sitting idle in a workshop. To build anything meaningful, you need instructions – the verbs of the assembly language world.

Essential Instructions: Your ASM Vocabulary

Think of assembly instructions as the vocabulary of your CPU. To speak the language of the machine, you need to know the common "words" and how to use them. This section focuses on the essential instructions, those you’ll encounter most frequently when writing or reading ASM code.

We’ll provide examples of each instruction’s usage with short code snippets to illustrate their function. Instructions will be grouped by category to help clarify their purposes.

Data Transfer Instructions

These instructions are the workhorses for moving data around.

MOV (Move Data)

The MOV instruction is perhaps the most fundamental. It copies data from one location to another. This could be from a register to another register, from memory to a register, from a register to memory, or between a register and an immediate value (a constant).

Example:

MOV EAX, EBX ; Copy the contents of register EBX into register EAX
MOV EBX, 10 ; Move the immediate value 10 into register EBX
MOV [myVar], EAX ; Move the contents of register EAX into memory location myVar

Arithmetic Instructions

These instructions perform mathematical operations.

ADD (Addition)

ADD performs addition. It adds two operands together and stores the result in the first operand.

Example:

ADD EAX, EBX ; Add the contents of register EBX to register EAX, store result in EAX
ADD EAX, 5 ; Add the immediate value 5 to register EAX, store result in EAX

SUB (Subtraction)

SUB performs subtraction, subtracting the second operand from the first and storing the result in the first operand.

Example:

SUB EAX, EBX ; Subtract the contents of register EBX from register EAX, store result in EAX
SUB EAX, 2 ; Subtract the immediate value 2 from register EAX, store result in EAX

CMP (Compare)

CMP compares two operands by subtracting the second from the first. Crucially, it doesn’t store the result. Instead, it sets flags in the EFLAGS register based on the comparison, which are then used by conditional jump instructions (explained later).

Example:

CMP EAX, EBX ; Compare the contents of register EAX and register EBX
CMP EAX, 10 ; Compare the contents of register EAX with the immediate value 10

Control Flow Instructions

These instructions alter the normal sequential execution of code. They are crucial for creating loops, conditional statements, and function calls.

JMP (Unconditional Jump)

JMP transfers control to a specified label or address unconditionally. Execution continues from the new location.

Example:

JMP myLabel ; Unconditionally jump to the code labeled 'myLabel'

JE/JZ (Jump if Equal/Zero)

These instructions conditionally jump to a specified label if the Zero Flag (ZF) in the EFLAGS register is set. JE (Jump if Equal) and JZ (Jump if Zero) are aliases, performing the same operation. The ZF is typically set by a previous CMP instruction.

Example:

CMP EAX, EBX ; Compare EAX and EBX
JE equal ; Jump to label 'equal' if EAX is equal to EBX (ZF is set)

JNE/JNZ (Jump if Not Equal/Not Zero)

These are the opposites of JE and JZ. They conditionally jump if the Zero Flag (ZF) is not set, meaning the compared values were not equal (or the result wasn’t zero). JNE (Jump if Not Equal) and JNZ (Jump if Not Zero) are aliases.

Example:

CMP EAX, EBX ; Compare EAX and EBX
JNE notequal ; Jump to label 'notequal' if EAX is not equal to EBX (ZF is not set)

CALL (Call Procedure)

CALL transfers control to a subroutine (procedure or function). It also pushes the return address (the address of the instruction following the CALL) onto the stack. This allows the subroutine to return to the correct location after it finishes executing.

Example:

CALL myProcedure ; Call the procedure labeled 'myProcedure'

RET (Return from Procedure)

RET returns control from a subroutine back to the calling code. It pops the return address from the stack and jumps to that address.

Example:

RET ; Return from the current procedure

Stack Manipulation Instructions

The stack is a crucial data structure for managing function calls, local variables, and temporary data. These instructions manipulate the stack.

PUSH (Push onto Stack)

PUSH decrements the stack pointer (ESP) and then copies the specified operand onto the top of the stack. It’s used to save register values or arguments before calling a function.

Example:

PUSH EAX ; Push the contents of register EAX onto the stack

POP (Pop from Stack)

POP copies the value from the top of the stack into the specified operand and then increments the stack pointer (ESP). It’s used to restore saved register values or retrieve data from the stack.

Example:

POP EAX ; Pop the value from the top of the stack into register EAX

Logical Instructions

These instructions perform bitwise logical operations.

AND (Bitwise AND)

AND performs a bitwise AND operation between two operands. The result is 1 only if both corresponding bits are 1; otherwise, it’s 0. The result is stored in the first operand.

Example:

AND EAX, EBX ; Perform bitwise AND between EAX and EBX, store result in EAX
AND EAX, 0x0F ; Mask the upper bits of EAX, keeping only the lower 4 bits

OR (Bitwise OR)

OR performs a bitwise OR operation. The result is 1 if either corresponding bit is 1 (or both); otherwise, it’s 0. The result is stored in the first operand.

Example:

OR EAX, EBX ; Perform bitwise OR between EAX and EBX, store result in EAX
OR EAX, 0x10 ; Set the 4th bit of EAX (if it wasn't already set)

XOR (Bitwise XOR)

XOR performs a bitwise exclusive OR operation. The result is 1 if the corresponding bits are different; otherwise, it’s 0. The result is stored in the first operand. XORing a register with itself is a common idiom to quickly set the register to zero.

Example:

XOR EAX, EBX ; Perform bitwise XOR between EAX and EBX, store result in EAX
XOR EAX, EAX ; Set EAX to zero (efficiently)

NOT (Bitwise NOT)

NOT performs a bitwise NOT operation, inverting each bit of the operand (0 becomes 1, and 1 becomes 0). The result is stored back in the operand.

Example:

NOT EAX ; Invert all the bits in register EAX

This is just a starting point. Mastering assembly language requires practice and experimentation. However, by understanding these essential instructions, you’ll be well on your way to deciphering and writing your own ASM code. Remember to consult assembler-specific documentation for detailed syntax and behavior.

Essential instructions provide the verbs; however, memory is where the action happens. Understanding how to manage memory effectively is fundamental to assembly programming. ASM gives you granular control over memory, allowing you to directly access and manipulate data at specific locations. This section explores memory addressing modes and the crucial role of the stack.

Memory Management: Addressing and the Stack

At its core, Assembly Language’s power comes from its direct interaction with memory. You’re not abstracted away by layers of operating systems and libraries. Instead, you can interact with the data at its roots. This section will cover how to access data with addressing modes and what to do with the stack.

Addressing Modes

Memory addressing is how you specify the location in memory that you want to access. Assembly language provides several addressing modes, each with its strengths and use cases.

Direct Addressing

Direct addressing is the simplest form. You directly specify the memory address as a constant value.

Example:

MOV EAX, [0x12345678] ; Move the value at memory location 0x12345678 into EAX

Here, 0x12345678 is the direct memory address. This mode is useful when you know the exact memory location of the data you need.

Indirect Addressing

Indirect addressing uses a register to hold the memory address.

Example:

MOV EBX, 0x12345678 ; Load the address into EBX
MOV EAX, [EBX] ; Move the value at the address stored in EBX into EAX

In this case, EBX holds the address. The square brackets [] tell the assembler to interpret the contents of EBX as a memory address.

This mode is incredibly useful for iterating through arrays or data structures where the address changes dynamically.

Indexed Addressing

Indexed addressing combines a base address with an index and an optional scale factor.

Example:

MOV ESI, 2 ; Index (element number)
MOV EAX, [myArray + ESI*4] ; Access element at index ESI (assuming each element is 4 bytes)

Here, myArray is the base address. ESI is the index, and 4 is the scale factor (because each element is a 4-byte DWORD).

This mode is ideal for accessing elements within arrays or structures.

The Stack: Your Temporary Workspace

The stack is a region of memory used for temporary storage. It operates on a Last-In, First-Out (LIFO) principle. Two key instructions govern stack operations:

• PUSH: Adds an item to the top of the stack.
• POP: Removes an item from the top of the stack.

The ESP (Extended Stack Pointer) register always points to the current top of the stack.

Stack Operations

PUSH decrements ESP and then writes the data to the memory location pointed to by ESP.

POP reads the data from the memory location pointed to by ESP and then increments ESP.

Example:

PUSH EAX ; Push the value of EAX onto the stack
POP EBX ; Pop the value from the top of the stack into EBX

Function Calls and Local Variables

The stack plays a vital role in function calls. When a function is called:

1. Arguments are often pushed onto the stack.
2. The return address (the address of the instruction after the CALL) is pushed onto the stack.
3. The function then allocates space on the stack for local variables by decrementing ESP.

When the function returns:

1. Local variables are deallocated by incrementing ESP.
2. The return address is popped from the stack.
3. Execution resumes at the return address.

This mechanism allows functions to manage their own data without interfering with other parts of the program. By understanding and effectively using memory addressing and the stack, you gain a powerful toolkit for creating efficient and reliable assembly language programs.

Essential instructions provide the verbs; however, memory is where the action happens. Understanding how to manage memory effectively is fundamental to assembly programming. ASM gives you granular control over memory, allowing you to directly access and manipulate data at specific locations. This section explores memory addressing modes and the crucial role of the stack.

Now, having explored how to access and manipulate data within memory, the next critical step is understanding how to define that data in the first place. Assembly language achieves this through the use of directives, special instructions understood by the assembler but not translated directly into machine code. These directives provide the assembler with information about how to allocate memory, define constants, and structure your data.

Directives and Data: Defining Your Data

Assembler directives are your primary tools for carving out space in memory and giving it meaning. Unlike instructions that the CPU executes at runtime, directives are processed by the assembler during the assembly process. They essentially tell the assembler how to translate your source code into machine code and data. Let’s look at some of the most common directives and how they’re used.

Data Definition Directives: DB, DW, DD, and DQ

These directives are used to allocate memory space and initialize it with specific values. The size of the allocated memory depends on the directive used.

• DB (Define Byte): Allocates a single byte (8 bits) of memory.

  myByte DB 10 ; Allocates one byte and initializes it with the value 10
message DB "H" ; Allocates one byte and initializes it with the ASCII value of "H"

• DW (Define Word): Allocates a word (2 bytes or 16 bits) of memory.

  myWord DW 1000 ; Allocates two bytes and initializes them with the value 1000

• DD (Define Double Word): Allocates a double word (4 bytes or 32 bits) of memory. This is commonly used for integers and pointers.

  myDword DD 100000 ; Allocates four bytes and initializes them with the value 100000

• DQ (Define Quad Word): Allocates a quad word (8 bytes or 64 bits) of memory. Useful for storing larger integers or double-precision floating-point numbers.

  myQword DQ 1000000000 ; Allocates eight bytes and initializes them with the value 1000000000

It’s important to remember that the assembler will convert the decimal values in these examples into their appropriate binary representations for storage in memory.

Reserving Memory Space: RESB, RESW, and RESD

Sometimes, you need to allocate memory without initializing it with a specific value. This is where the RESB, RESW, and RESD directives come in handy. They reserve a specified number of bytes, words, or double words, respectively. This is useful when you plan to fill the memory with data later during program execution.

• RESB (Reserve Byte): Reserves a specified number of bytes.

  buffer RESB 256 ; Reserves 256 bytes of memory for a buffer

• RESW (Reserve Word): Reserves a specified number of words.

  word

  _array RESW 100 ; Reserves space for 100 words (200 bytes)

• RESD (Reserve Double Word): Reserves a specified number of double words.

  dword_array RESD 50 ; Reserves space for 50 double words (200 bytes)

These directives do not initialize the reserved memory. The contents of the reserved memory are undefined until you explicitly write data to those locations.

Defining Constants: EQU

The EQU directive allows you to define symbolic constants. This is a powerful way to improve code readability and maintainability. Instead of using hardcoded values throughout your code, you can define a constant with a meaningful name and use that name instead. The assembler will then replace each occurrence of the constant name with its defined value during assembly.

BUFFERSIZE EQU 256 ; Defines BUFFERSIZE as a constant with the value 256
PI EQU 3.14159 ; Defines PI as a constant with the value 3.14159

; Using the constant:
MOV ECX, BUFFER_SIZE ; Moves the value 256 into the ECX register

Key benefits of using EQU:

• Readability: Makes your code easier to understand by using meaningful names for constants.
• Maintainability: If you need to change the value of a constant, you only need to modify it in one place (the EQU definition) rather than searching and replacing every instance of the hardcoded value.
• Error Prevention: Reduces the risk of errors caused by typos or inconsistencies in hardcoded values.

Practical Considerations

When using directives, consider the following:

• Data Alignment: Be mindful of data alignment, especially when working with structures or large data blocks. Unaligned data access can sometimes lead to performance penalties, depending on the processor architecture.

• Assembler Syntax: The specific syntax for directives may vary slightly between different assemblers (NASM, MASM, GAS). Consult your assembler’s documentation for details.

• Labels: Use labels to give meaningful names to memory locations defined by directives. This makes your code more readable and easier to debug.

By mastering these directives, you gain precise control over how data is organized and stored in your assembly language programs, ultimately leading to more efficient and maintainable code.

Having mastered data definition, the ability to create modular and reusable code is the next significant step in assembly language programming. Procedures and functions are essential tools for organizing code, promoting reusability, and simplifying complex tasks. Understanding how to define, call, and manage procedures is crucial for writing efficient and maintainable assembly programs.

Procedures and Functions: Modularizing Your Code

In assembly language, procedures (often called functions in higher-level languages) are self-contained blocks of code designed to perform specific tasks. They enable you to break down complex programs into smaller, more manageable units, improving readability and making it easier to debug and maintain your code.

Defining Procedures

Defining a procedure involves marking its beginning and end, and providing it with a name. The exact syntax varies slightly depending on the assembler you are using (NASM, MASM, GAS), but the core concept remains the same.

In NASM (Netwide Assembler), a common syntax is:

section .text
global my_procedure ; Make the procedure accessible from other files

my_procedure:
; Procedure code goes here
ret ; Return to the caller

Here, my_procedure is the name of the procedure. The ret instruction is essential; it returns control back to the point in the program where the procedure was called.

Calling Conventions

A calling convention is a standardized way for functions to receive arguments from their caller and return results. It dictates how arguments are passed (e.g., via registers or the stack), who is responsible for cleaning up the stack after the call, and how return values are handled. Different operating systems and compilers often use different calling conventions.

Common x86 calling conventions include cdecl, stdcall, and fastcall. Understanding which convention your system uses is crucial for interoperability with other code, particularly when working with libraries written in other languages.

Passing Arguments

Arguments can be passed to procedures via registers, the stack, or a combination of both. When using registers, the calling convention specifies which registers are used for which arguments.

For example, in the cdecl convention (often used in C programs), arguments are typically pushed onto the stack in reverse order. The called function can then access these arguments from the stack.

Example (NASM, cdecl):

; Calling code:
push dword [argument2] ; Push the second argument
push dword [argument1] ; Push the first argument
call my_procedure ; Call the procedure
add esp, 8 ; Clean up the stack (2 arguments * 4 bytes each)

; Access arguments:
mov eax, [ebp + 8]      ; First argument
mov ebx, [ebp + 12]     ; Second argument

; ... procedure logic ...

mov esp, ebp            ; Restore the stack pointer
pop ebp                 ; Restore the old base pointer
ret                     ; Return</code>