# Csaw 2018 Tour of x86 pt 1

The goal of this challenge is to answer the following questions.

Starting off this challenge is meant to teach beginners a little bit about x86. The questions were only up during the competition, so I had to grab the questions that were asked from `https://github.com/mohamedaymenkarmous/CTF/tree/master/CSAWCTFQualificationRound2018#a-tour-of-x86---part-1`.

These questions are in regards to the `stage1.asm` file in this directory. That is just a text file which contains assembly code.

#### What is the value of dh after line 129 executes?

Line `129` is:
```
  xor dh, dh  ; <- Question 1
```

This command is xoring the `dh` register with itself, and stores the value in the `dh` register. Due to how the binary operation xoring works, whenever you xor something by itself the result is 0. So the value of dh after line 129 executes is `0x0`.

#### What is the value of gs after line 145 executes?

Line `145` is:
```
  mov gs, dx ; to use them to help me clear     <- Question 2
```

With this instruction the contents of the `dx` register get moved into the `gs` register. So we need to know the contents of the `dx` register. Looking a bit further up in the code, we see this (lines `131` and `132`):

```
  mov dx, 0xffff  ; Hexadecimal
  not dx
```

Here we see that the value `0xffff` is moved into the `dx` register, then not. When not is applied to a value, the bits are flopped. And since with the value `0xffff`, all of the bits are `1s` (for 16 bit values), the result of `dx` will be zero. Also we see that between lines `132` and `145`, there is nothing that would change the value of `dx` to something other than `0x0`. So when the contents of `dx` gets moved into `gs`, the value of `gs` has to be `0x0`.

#### What is the value of si after line 151 executes?

Line `151` is:
```
  mov si, sp ; Source Index       <- Question 3
```

So for this just moves the value of the Stack Pointer register into the Source Index register. In order to know what the value of `si` is after this, we need to know what the value of `sp` is. Looking up in the code, we see this on line `149`:

```
  mov sp, cx ; Stack Pointer
```

So we know that the value of the `sp` register is equal to that of the `cx` register. Looking further up in the code, we see a comment telling us what it is (line 144):

```
  mov fs, cx ; already zero, I'm just going
```

And when we look at line 107, we can see where the register `cx` gets the value `0x0` assigned to it:

```
  mov cx, 0 ; The other two values get overwritten regardless, the value of ch and cl (the two components that make up cx) after this instruction are both 0, not 1.
```


#### What is the value of ax after line 169 executes?

Lines `168-169` are:
```
  mov al, 't'
  mov ah, 0x0e      ; <- question 4
```

This moves the value `0x0e` into the `ah` register, and moves the value `0x74` (hex for `t`) into the `al` register. Now the question asks about the `ax` register, which is a `16` bit register, comprised of the two `8` bit registers `al` and `ah`. Here is how this works:

 15 14 13 12 11 10 9  8  7  6  5  4  3  2  1  0                  
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
|                         |                        |
|           AH          |            AL            |
|                       |                       |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+

The diagram above shows the 16 bits of the `ax` register. The lower 8 bits are comprised of the `al` register. The higher 8 bits are comprised of the `ah` register. Since the `al` register is equal to `0x74`, and the `ah` register is equal to `0x0e`, the `ax` register is equal to `0x0e74`.

#### What is the value of ax after line 199 executes for the first time?

Line `199` is:
```
    mov ah, 0x0e  ; <- Question 5!
```

So we see here that the value `0x0e` is loaded into the `ah` register. So from the previous question, we know that the higher 8 bits of the `ax` register must be equal to `0x0e`. That just leaves the question of the lower 8 bits. Looking at line 197 tells us the value which will be stored in the `al` register (lower 8 bits):

```
    mov al, [si]  ; Since this is treated as a dereference of si, we are getting the BYTE AT si... `al = *si`
```

Looking here we can see that the dereferenced value of `si` is moved into `al`. So whatever value `si` is pointing to, is now the new value in the `al` register. Looking at line `189` helps with that:

```
    mov si, ax  ; We have no syntactic way of passing parameters, so I'm just going to pass the first argument of a function through ax - the string to print.
```

Here we see that the contents of `ax` is moved into `si`. Looking around a bit more we see this.

```
  ; First let's define a string to print, but remember...now we're defining junk data in the middle of code, so we need to jump around it so there's no attempt to decode our text string
  mov ax, .string_to_print
```

So here we see that an address to a string is loaded into the `ax` register. We can also see what string the address points to.

```
.string_to_print: db "acOS", 0x0a, 0x0d, "  by Elyk", 0x00  ; label: <size-of-elements> <array-of-elements>
```

and lastly we can just take a quick look at the entire loop where line `199` resides:

```
; Now let's make a whole 'function' that prints a string
print_string:
  .init:
    mov si, ax  ; We have no syntactic way of passing parameters, so I'm just going to pass the first argument of a function through ax - the string to print.

  .print_char_loop:
    cmp byte [si], 0  ; The brackets around an expression is interpreted as "the address of" whatever that expression is.. It's exactly the same as the dereference operator in C-like languages
                        ; So in this case, si is a pointer (which is a copy of the pointer from ax (line 183), which is the first "argument" to this "function", which is the pointer to the string we are trying to print)
                        ; If we are currently pointing at a null-byte, we have the end of the string... Using null-terminated strings (the zero at the end of the string definition at line 178)
    je .end
   
    mov al, [si]  ; Since this is treated as a dereference of si, we are getting the BYTE AT si... `al = *si`

    mov ah, 0x0e  ; <- Question 5!
    int 0x10      ; Actually print the character
 
    inc si        ; Increment the pointer, get to the next character
    jmp .print_char_loop
    .end:
```

Here is a loop that is printing all of the characters of the string. At the start of this loop the pointer points to the beginning of the string (line 197), then gets incremented (line 202) by one meaning that it moves on to the next character until it hits the null byte (`0x0`), which the comparison happens at line 192. It will print each character with the interrupt a line `200` (check out https://en.wikipedia.org/wiki/INT_10H for more info, the value `0x0e` in the `ah` register is an argument to the inte