Assembly Language MCQ

Explanation

Assembly language uses mnemonic codes (MOV, ADD, JMP) representing machine instructions. An assembler converts it to binary machine code.

Explanation

An assembler (e.g., NASM, MASM, GAS) translates assembly mnemonics into binary machine code. A linker then combines object files into an executable.

Explanation

MOV dst, src copies the value from src to dst. It does not clear the source. For example, MOV EAX, 5 loads 5 into EAX.

Explanation

Registers are the fastest storage available. x86-64 has general-purpose registers (RAX, RBX, RCX, RDX, RSI, RDI, RSP, RBP, R8-R15), control registers, and others.

Explanation

ADD EAX, EBX adds EBX to EAX and stores the result in EAX. It sets the Carry, Zero, Sign, and Overflow flags accordingly.

Explanation

RSP (64-bit) / ESP (32-bit) always points to the current top of the stack. PUSH decrements RSP; POP increments RSP.

Explanation

PUSH EAX decrements ESP by 4 (or RSP by 8 in 64-bit) and stores EAX at the new stack top.

Explanation

POP EAX loads the value at the current stack top into EAX, then increments ESP by 4.

Explanation

RIP (64-bit) / EIP (32-bit) is the program counter. It automatically increments after each instruction fetch. JMP and CALL change it directly.

Explanation

JMP label sets the instruction pointer to the address of label, continuing execution from there unconditionally.

Explanation

CMP A, B computes A - B and sets the CPU flags (ZF, SF, OF, CF) without modifying A or B. Conditional jumps (JE, JL, JG) use these flags.

Explanation

ZF is 1 if the last arithmetic/logic result was zero. CMP A, A sets ZF=1 (they are equal). JE (jump if equal) checks ZF.

Explanation

JE (Jump if Equal / Jump if Zero) branches to the target if ZF=1, typically used after CMP.

Explanation

CALL func pushes the address of the next instruction onto the stack (return address), then jumps to func.

Explanation

RET pops the return address (saved by CALL) from the stack and transfers control to that address, returning from the function.

Explanation

loop: is a label. JMP loop or CALL func uses labels. The assembler resolves them to numeric addresses.

Explanation

CF=1 on unsigned overflow (carry out) or underflow (borrow). JC (Jump if Carry) and JNC use CF.

Explanation

SUB EAX, EBX computes EAX = EAX - EBX and sets flags.

Explanation

INC EAX is equivalent to ADD EAX, 1 but more compact. It modifies all flags except CF.

Explanation

DEC ECX is equivalent to SUB ECX, 1. Modifies flags except CF.

Explanation

NOP is used for alignment padding, timing delays, and as a placeholder in shellcode (NOP sled).

Explanation

RBP points to the saved frame base. Local variables are at [RBP-n]; function parameters are at [RBP+n]. Created by the function prologue.

Explanation

The prologue saves the caller's RBP, sets RBP to the current RSP creating a new frame, and optionally allocates local variable space.

Explanation

In x86: byte=8 bits, word=16 bits, dword=32 bits, qword=64 bits. Instructions use size qualifiers: BYTE PTR, WORD PTR, DWORD PTR, QWORD PTR.

Explanation

XOR of any value with itself is 0. XOR EAX, EAX is preferred over MOV EAX, 0 because it produces a shorter encoding and clears flags.

Explanation

AND EAX, 0xFF masks EAX to its lowest 8 bits. AND is used for bit masking and clearing specific bits.

Explanation

OR EAX, 0x01 sets bit 0 of EAX. OR is used for setting specific bits.

Explanation

TEST EAX, EAX checks if EAX is zero (sets ZF=1 if EAX=0) without modifying EAX. Used before JZ/JNZ.

Explanation

x86 is little-endian: the value 0x12345678 stored at address 0x100 is 78 56 34 12 in memory. ARM can be either.

Explanation

System calls (e.g., read, write, exit) are invoked via SYSCALL (x86-64 Linux), INT 0x80 (legacy x86), or SYSENTER.

Explanation

MUL EBX multiplies EAX * EBX. The 64-bit result is in EDX:EAX (high 32 bits in EDX). IMUL is the signed version.

Explanation

DIV EBX divides EDX:EAX by EBX. Quotient → EAX, Remainder → EDX. IDIV is the signed equivalent.

Explanation

Directives like DB (define byte), DW (define word), SECTION, GLOBAL, EXTERN are instructions to the assembler, not the CPU.

Explanation

The .data section holds initialized variables like msg db "Hello", 0. The .bss section holds uninitialized data reserved with RESB/RESW/RESD.

Explanation

The .text section contains the machine code instructions. It is typically read-only and executable.

Explanation

LEA EAX, [EBX + ECX*4 + 8] computes the address and puts it in EAX. Often used for pointer arithmetic or fast multiply tricks.

Explanation

SHL EAX, 1 multiplies EAX by 2. SHL EAX, 3 multiplies by 8. Faster than MUL for power-of-2 multiplication.

Explanation

OF is set when signed overflow occurs (e.g., adding two large positive numbers results in a negative). JO (jump on overflow) uses OF.

Explanation

XCHG EAX, EBX swaps EAX and EBX. XCHG with memory is always atomic (used for spinlock implementations).

Explanation

LOOP target decrements ECX and jumps if ECX != 0. Set ECX to the iteration count beforehand.

Explanation

Calling conventions (cdecl, stdcall, System V AMD64 ABI, Microsoft x64) define argument passing order/registers, caller/callee-saved registers, and return value location.

Explanation

Linux/macOS 64-bit (System V ABI): args in RDI, RSI, RDX, RCX, R8, R9 (then stack). Return in RAX. Callee-saved: RBX, RBP, R12-R15.

Explanation

In System V AMD64: RAX, RCX, RDX, RSI, RDI, R8-R11 are caller-saved. RBX, RBP, R12-R15 are callee-saved (the called function must restore them).

Explanation

x86 is CISC — one instruction can do complex things like load, compute, and store. RISC architectures separate loads, computes, and stores for simpler hardware and pipelining.

Explanation

A 4-byte int should be at an address divisible by 4. Misaligned accesses may work but are slower (or cause a fault on some architectures).

Explanation

CS=Code Segment, DS=Data, SS=Stack, ES/FS/GS=Extra. In 64-bit long mode, segments are mostly flat (base=0), but FS/GS are used for thread-local storage.

Explanation

Hardware interrupts come from devices (keyboard, timer). Software interrupts (INT n) are intentional. The CPU saves state, calls the ISR, and returns with IRET.

Explanation

CPUID with EAX=0 returns vendor string. EAX=1 returns processor type and feature flags (SSE support, etc.). Used for runtime feature detection.

Explanation

SSE (and SSE2/3/4, AVX, AVX-512) provide SIMD (Single Instruction, Multiple Data) operations. ADDPS adds four floats simultaneously using XMM registers.

Explanation

LEAVE is the function epilogue shorthand equivalent to MOV RSP, RBP followed by POP RBP, restoring the caller's stack frame.

Explanation

Signal handlers and interrupt handlers must not use the red zone. Kernel code uses -mno-red-zone. Leaf functions can use [rsp-8] through [rsp-128] without a PUSH.

Explanation

MOVZX EAX, BYTE PTR [mem] loads a byte and pads upper bits with 0. MOVSX EAX, BYTE PTR [mem] replicates the sign bit for signed values.

Explanation

In exploit development, a NOP sled precedes shellcode. If the attacker overflows to any NOP, execution "slides" to the shellcode without needing exact address prediction.

Explanation

ASLR makes it harder for attackers to jump to specific addresses (like gadgets or libraries). Combined with DEP/NX, it significantly raises the bar for exploitation.

Explanation

The compiler inserts a canary value (e.g., GCC's -fstack-protector). Before RET, the canary is checked — if modified by a buffer overflow, the program terminates.

Explanation

ROP defeats DEP/NX by reusing existing executable code. Attackers build a chain of gadget addresses on the stack; each gadget does a small operation then RETurns to the next.

Explanation

LOCK XCHG/CMPXCHG/ADD/INC ensures the read-modify-write operation is atomic on multi-core systems, preventing other CPUs from accessing the same memory location.

Explanation

LOCK CMPXCHG [mem], ECX: if [mem]==EAX, store ECX; else load [mem] into EAX. This is the CAS (Compare-And-Swap) operation for lock-free algorithms.

Explanation

MFENCE serializes all memory operations. LFENCE serializes loads. SFENCE serializes stores. Required when dealing with out-of-order execution and weak memory models.

Explanation

PUSHA pushes AX/CX/DX/BX/SP/BP/SI/DI (or 32-bit equivalents) in one instruction. PUSHA/POPA are not available in 64-bit mode.

Explanation

Pipelining improves throughput but can stall on data hazards (using a result too soon) or control hazards (branch misprediction). Careful instruction ordering can minimize stalls.

Explanation

MUL EBX: unsigned EAX * EBX → EDX:EAX. IMUL EBX: signed EAX * EBX → EDX:EAX. IMUL also has two and three operand forms: IMUL EAX, EBX, 5.

Explanation

SHR EAX, 2 divides EAX by 4 for unsigned values, filling upper bits with 0. SAR (arithmetic right shift) preserves the sign bit for signed division.

Explanation

NEG EAX computes EAX = 0 - EAX. For EAX=5, result is -5 (0xFFFFFFFB in two's complement). Sets CF if operand was non-zero.

Explanation

REP MOVSB copies ECX bytes from DS:ESI to ES:EDI, decrementing ECX and advancing ESI/EDI. Used for memory copy operations.

Explanation

MOVSB copies one byte and increments or decrements ESI and EDI based on the Direction Flag. Used with REP for bulk memory copies.

Explanation

REP STOSD fills ECX dwords at ES:EDI with EAX. Used to initialize memory blocks (e.g., memset).

Explanation

CLD clears DF (forward direction, increment). STD sets DF (backward direction, decrement). The ABI requires DF to be 0 at function calls.

Explanation

In modern 64-bit protected mode, far calls are rarely used directly. In legacy real and protected modes, far calls change the code segment register.

Explanation

SF mirrors the MSB of the result. JNS (Jump if Not Sign) and JS (Jump if Sign) use SF for signed comparisons.

Explanation

PF=1 if the number of set bits in the low byte of the result is even. JPE/JPO use PF. Rarely used in modern code but available for SIMD status operations.

Explanation

Protected mode (introduced with 80286) provides segmentation, paging, and privilege levels. Modern OSes run in protected or long mode. Real mode is 16-bit, 1MB address space.

Explanation

Long mode (IA-32e) provides 64-bit addresses (48 bits currently used), 16 GPRs (RAX-R15), REX prefixes for 64-bit operands, and eliminates most legacy segment limits.

Explanation

PUSHF pushes EFLAGS onto the stack. POPF restores EFLAGS from the stack. Used to save and restore the entire flag state across function calls.

Explanation

Use JBE/JAE/JA/JB for unsigned comparisons. Use JLE/JGE/JG/JL for signed comparisons. Mixing them after CMP produces incorrect results for negative numbers.

Explanation

The prologue establishes the stack frame. The epilogue tears it down. Some leaf functions omit the frame pointer (RBP) for performance. RSP must be 16-byte aligned at CALL.

Explanation

C++ virtual dispatch: MOV RAX, [RCX] loads the vptr; CALL [RAX + n*8] calls the n-th virtual function. Two memory indirections vs one for non-virtual calls.

Explanation

Keeping hot paths in nearby cache lines reduces i-cache misses. PGO (Profile-Guided Optimization) reorders functions to separate hot and cold code sections.

Explanation

movdqa moves 128 bits to/from a 16-byte aligned XMM register. movdqu handles unaligned addresses. On modern Intel/AMD, the penalty is minimal for unaligned accesses.

Explanation

Modern CPUs have multiple ALUs, FPUs, and load/store units. With 4-wide superscalar execution and 6 execution ports, up to 4 instructions can retire per cycle if independent.

Explanation

Modern CPUs speculatively execute branches. Misprediction flushes the pipeline. Write branch-friendly code (predictable patterns, CMOV for branchless alternatives).

Explanation

L1 (~4 cycles), L2 (~12 cycles), L3 (~40 cycles), RAM (~200 cycles). Cache-friendly access patterns (sequential, not random) are the biggest assembly performance factor.

Explanation

VADDPS ymm0, ymm1, ymm2 adds eight 32-bit floats simultaneously using AVX 256-bit registers, achieving 8x throughput over scalar addition.

Explanation

Spectre tricks the CPU's branch predictor to speculatively access memory the attacker shouldn't read. Side-channel timing reveals the speculatively loaded data.

Explanation

Stride prefetchers detect sequential or constant-stride access and prefetch ahead. Random access defeats the prefetcher, causing cache misses. PREFETCHT0 is the software hint.

Explanation

Modern CPUs issue instructions out-of-order when dependencies allow. Results appear in-order (in-order retirement). This can cause up to 4x throughput improvement for independent instructions.

Explanation

Tomasulo's algorithm renames registers to physical registers, eliminating WAR and WAW hazards, allowing independent instructions to execute freely out of order.

Explanation

AArch64 has 31 GPRs (x0-x30), a fixed 4-byte instruction size, explicit load/store (no memory-operand ALU), and uses a link register (x30) for call/return.

Explanation

PMU (Performance Monitoring Unit) counters (RDPMC/RDTSC) track L1 cache misses, branch mispredictions, IPC, etc. Tools like perf and Intel VTune use them.

Explanation

RDTSC is fast but can be reordered. Use LFENCE; RDTSC; LFENCE or RDTSCP for serialized timing. Modern Intel CPUs have a constant TSC not tied to clock scaling.

Explanation

x86 instructions are decoded into 1-4 micro-ops by the front-end. The out-of-order engine schedules uops independently. ADD has 1 uop; PUSH has 2 (compute address + store).

Explanation

The µop cache (e.g., Intel's Decoded ICache) holds ~1500 µops. Hot loops that fit in the µop cache bypass x86 decode entirely, enabling higher throughput.

Explanation

PIC uses RIP-relative addressing (call [rip+offset]) for code and a Global Offset Table (GOT) for data addresses, allowing the OS to load the library at any address.

Explanation

First call to printf goes through PLT → resolver → resolves address → writes to GOT. Subsequent calls go PLT → GOT (direct). Lazy binding reduces startup time.

Explanation

PIE executables use relative addressing and can be loaded at random base addresses by ASLR. Required for full ASLR protection of the main executable.

Explanation

pop rdi; ret followed by an address sets RDI. pop rsi; ret sets RSI. Gadgets performing system call setup let attackers call execve("/bin/sh") without injecting code.

Explanation

Intel CET (Control-flow Enforcement Technology) provides a shadow stack. CALL pushes to both stacks; RET checks they match. Mismatches (ROP) cause a fault.

Explanation

x87's stack model is awkward to compile for and its 80-bit precision causes subtle differences vs C double. Modern compilers use SSE2 (mandated by x86-64 ABI) for float/double.

Explanation

If two variables share a cache line but are written by different CPU cores (false sharing), the cache line ping-pongs between cores. Align hot data to 64 bytes to prevent this.

Explanation

Meltdown: user-mode code reads kernel address speculatively before the permission check raises an exception. Cache timing reveals the value. Fixed by KPTI (kernel page-table isolation).