x86-64 Instruction

computer-architecture

Definition

x86-64 Instruction

An x86-64 instruction is a single machine operation the CPU executes, written in assembly as an operation followed by zero-to-three operands. An operand can name a register, a memory location, or an immediate value. The instructions fall into three categories: data manipulation (arithmetic, boolean, bit-shift), data transfer (move / push / pop), and branching and conditionals (jump / call / compare / test).

Common Instructions

The instructions the binary-analysis labs reuse

Mnemonic	Effect
mov <dst>, <src>	move the value in <src> into <dst>
add <dst>, <src>	add <src> into <dst>
sub <dst>, <src>	subtract <src> from <dst>
and <dst>, <src>	bitwise AND of <src> and <dst>, result in <dst>
push <target>	push <target> onto the stack
pop <target>	pop a value from the stack into <target>
cmp <dst>, <src>	subtract <src> from <dst> and set flags (no write-back)
call <address>	push the return address, then jump to <address>
ret	pop the return address and jump to it
leave	restore the frame (rsp <- rbp, then pop rbp)
jmp <target>	jump to <target>, copying it into RIP
jle <target>	jump to <target> iff the previous cmp had src <= dst
lea <dst>, <src>	load the address of <src> into <dst> (without dereferencing)
int <value>	raise software interrupt <value> — the 32-bit syscall idiom
syscall	invoke a system call on x86-64
nop	no operation

The 32-bit near-jump jmp <imm> is read as RIP = RIP + <imm> — a relative offset.

NOP Sled

NOP slide

Several consecutive nop instructions in a row form a NOP sled (or nop-slide): a stretch of instructions that do nothing, used so that landing anywhere inside it slides the program counter forward harmlessly until it reaches the attacker’s payload at the end. NOP sleds appear in classic stack-exploitation payloads to absorb uncertainty about the exact return address the overflow will jump to. They are a fingerprint, not a defence.