Machine-Level Memory Manipulation in C Programming

1. Machine-Level Representation of Programs II

2. Outline • Pointer in C • Data manipulation • Conditional codes • Suggested reading • Chap 3.4, 3.5, 3.6.1, 3.6.2

3. Pointers in C • In C, an object may be • an integer • a structure or • some other program unit • Declaring Pointers T *p;

4. Pointers in C • In C, the value of a pointer in C is • the virtual address of the first byte of some block of storage • Type information is used to • identify the length of the object • interpret the object *p • Generating Pointers p = &obj

5. Data Movement Example int main() { int a = 4 ; /* “address of” operator creates a pointer */ int b = exchange(&a, 3); printf(“a = %d, b = %d\n”, a, b); }

6. • • • Stack Offset 3 &a %esp Data Movement Example 4 a b Can variable a be in a register?

7. Data Movement Example int exchange(int *xp, int y) { /* operator * performs deferencing */ int x = *xp ; *xp = y ; return x ; }

8. Data Movement Example 1 pushl %ebp 2 movl %esp, %ebp 3 movl 8(%ebp), %eax 4 movl 12(%ebp), %edx 5 movl (%eax), %ecx 6 movl %edx, (%eax) 7 movl %ecx, %eax 8 movl %ebp, %esp 9 popl %ebp int exchange(int *xp, int y) { int x = *xp ; *xp = y ; return x ; }

9. • • • Stack Offset 3 &a Rtn adr %esp Data Movement Example 4

10. • • • Stack Offset • • • Stack 12 3 Offset 8 &a 4 Rtn adr %esp 0 Old %ebp 3 &a Rtn adr %esp Data Movement Example 1 pushl %ebp 4 4

11. • • • Stack Offset 12 3 8 &a 4 Rtn adr %ebp %esp 0 Old %ebp Data Movement Example 2 movl %esp, %ebp 4

12. • • • Stack Offset 12 3 8 &a 4 Rtn adr %ebp %esp 0 Old %ebp Data Movement Example 3 movl 8(%ebp), %eax %eax: xp 4 20(%ebp) How to represent xp by %ebp ?

13. • • • Stack Offset 12 3 8 &a 4 Rtn adr %ebp %esp 0 Old %ebp Data Movement Example 3 movl 8(%ebp), %eax 4 movl 12(%ebp), %edx %eax: xp %edx: 3 4

14. • • • Stack Offset 12 3 8 &a 4 Rtn adr %ebp %esp 0 Old %ebp Data Movement Example 3 movl 8(%ebp), %eax 4 movl 12(%ebp), %edx 5 movl (%eax), %ecx %eax: xp %edx: 3 %ecx: 4 4

15. • • • Stack Offset 12 3 8 &a 4 Rtn adr %ebp %esp 0 Old %ebp Data Movement Example 3 movl 8(%ebp), %eax 4 movl 12(%ebp), %edx 5 movl (%eax), %ecx 6 movl %edx, (%eax) %eax: xp %edx: 3 %ecx: 4 *xp(a): 3 3

16. • • • Stack Offset 12 3 8 &a 4 Rtn adr %ebp %esp 0 Old %ebp Data Movement Example 3 movl 8(%ebp), %eax 4 movl 12(%ebp), %edx 5 movl (%eax), %ecx 6 movl %edx, (%eax) 7 movl %ecx, %eax %eax: xp %edx: y %ecx: 4 *xp(a): 3 %eax: 4 (old *xp) return value 3

17. • • • Stack Offset 12 3 8 &a 4 Rtn adr %esp 0 Data Movement Example 8 movl %ebp, %esp (do nothing) 9 popl %ebp 3

18. Data Movement Example int main() { int a = 4 ; /* “address of” operator creates a pointer */ int b = exchange(&a, 3); printf(“a = %d, b = %d\n”, a, b); }

19. • • • Stack Offset 3 &a %esp Data Movement Example 3 b %eax 4 Return value

20. • • • Stack Offset 4 3 &a %esp Data Movement Example 3 b

21. Arithmetic and Logical Operations

22. Examples for Lea Instruction %eax holds x, %ecx holds y Expression Result leal 6(%eax), %edx 6+x leal (%eax, %ecx), %edx x+y leal (%eax, %ecx, 4), %edx x+4*y leal 7(%eax, %eax, 8), %edx 7+9*x leal 0xA(, %ecx, 4), %edx 10+4*y leal 9(%eax, %ecx, 2), %edx 9+x+2*y

23. Arithmetic and Logical Operations

24. Arithmetic and Logical Operations Instruction Destination Value addl %ecx, (%eax) 0x100 0x100 subl %edx, 4(%eax) 0x104 0xA8 imull $16, (%eax, %edx, 4) 0x10C 0x110 incl 8(%eax) 0x108 0x14 decl %ecx %ecx 0x0 subl %edx, %eax %eax 0xFD

25. Assembly Code for Arithmetic Expressions int arith(int x, int y, int z) { int t1 = x+y; int t2 = z*48; int t3 = t1&0xFFFF; int t4 = t2*t3; return t4; } movl 12(%ebp),%eax Get y movl 16(%ebp),%edx Get z addl 8(%ebp),%eax Compute t1=x+y leal (%edx,%edx,2),%edx Compute 3*z sall $4,%edx Compute t2=48*z andl $0xFFFF,%eax Compute t3=t1&FFFF imull %edx,%eax Set t4 as return val

26. Special Arithmetic Operations

27. Examples Initially x at %ebp+8, y at %ebp+12 1 movl 8(%ebp), %eax 2 imull 12(%ebp) 3 pushl %edx 4 pushl %eax 1 movl 8(%ebp), %eax 2 cltd 3 idivl 12(%ebp) 4 pushl %eax 5 pushl %edx

28. FF C0 %eax %ah %al Addresses BF Stack %edx %dh %dl %ecx %ch %cl Data %ebx %bh %bl 80 Heap 7F %esi %edi Instructions %esp 40 DLLs %ebp 3F Heap %eip Data %eflag 08 Text 00 Assembly Programmer’s View

29. Condition codes • Condition codes • A set of single-bit • Maintained in a condition code register • Describe attributes of the most recently arithmetic or logical operation

30. Condition codes • EFLAGS • CF: Carry Flag • The most recent operation generated a carry out of the most significant bit • Used to detect overflow for unsigned operations • OF: Overflow Flag • The most recent operation caused a two’s complement overflow — either negative or positive

31. Condition codes • EFLAGS • ZF: Zero Flag • The most recent operation yielded zero • SF: Sign Flag • The most recent operation yielded a negative value

32. Setting Conditional Codes • Implicit SettingBy Arithmetic Operations addl Src,Dest C analog: t = a+b • CF set if carry out from most significant bit • Used to detect unsigned overflow • ZF set if t == 0 • SF set if t < 0 • OF set if two’s complement overflow (a>0 && b>0 && t<0) || (a<0 && b<0 && t>=0)

33. Conditional Code • lea instruction • has no effect on condition codes • Xorl instruction • The carry and overflow flags are set to 0 • Shift instruction • carry flag is set to the last bit shifted out • Overflow flag is set to 0

34. Setting Conditional Codes • Explicit Setting by Compare Instruction • cmpl Src2,Src1 • cmpl b,a like computing a-b without setting destination • CF set if carry out from most significant bit • Used for unsigned comparisons • ZF set if a == b • SF set if (a-b) < 0 • OF set if two’s complement overflow (a>0 && b<0 && (a-b)<0) || (a<0 && b>0 && (a-b)>0)

35. Setting Conditional Codes • Explicit Setting by Test instruction • testl Src2,Src1 • Sets condition codes based on value of Src1&Src2 • Useful to have one of the operands be a mask • testl b,a like computing a&b without setting destination • ZF set when a&b == 0 • SF set when a&b < 0

36. Accessing Conditional Codes • The condition codes cannot be read directly • One of the most common methods of accessing them is • setting an integer register based on some combination of condition codes • Set commands

37. Accessing Conditional Codes • After each set command is executed • A single byte to 0 or to 1 is obtained • The descriptions of the different set commands apply to the case • where a comparison instruction has been executed

38. Accessing Conditional Codes

39. Accessing Conditional Codes • The destination operand is either • one of the eight single-byte register elements or • a memory location where the single byte is to be stored • To generate a 32-bit result • we must also clear the high-order 24 bits

40. Accessing Conditional Codes Initially a is in %edx, b is in %eax 1 cmpl %eax, %edx #compare a:b 2 setl %al #set low order by to 0 or 1 3 movzbl %al, %eax #set remaining bytes of %eax to 0