Hello and welcome back.
In this lesson, we are going to write our first program.
So open the x64_template
.EXE file that I provided for you or the one that you create yourself using x64dbg.
And make sure you use x64dbg and not x32dbg.
So just select it and open.
So now you can scroll down to the entry point.
Entry point is where you see all the—the right-hand column here showing all the text files.
So over here, the first column is your memory addresses.
Second column is your opcodes.
Opcode is the symbol in hex which is the encoded form of the instructions.
And the third column here is your conversion of this opcode into human-readable text.
This is the assembly code itself.
The right-hand column is the comments column.
And the comments column contains comments which you can enter yourself, or comments which x64dbg creates
for you.
For example, over here you can see x64dbg interpreted this string here as a string:
"Enter an integer."
So to find the entry point, just scroll down and then look for the -.
And there is all this string here.
Then the next thing you want to do is to zero out all these.
So select from here to here,
and then right-click and then "Fill with NOPs."
Click "OK."
So we have all the NOPs here.
So NOP stands for "no operation."
The code is 90.
Hex code is 90,
which means that whenever the processor sees 90 as a hex code, it will not execute anything.
It will just slide through all the way down here.
So now you are free to enter your own code here.
So the first code I'm going to show you is the MOV instruction.
MOV instruction moves something to the register.
For example, you want to enter an instruction here.
You press the spacebar here and then you type "MOV" and then the name of the register and then comma, followed
by whatever you want to move into the register.
Suppose you want to move the value one.
So you put hex one.
You can just put one itself
also, or you can put 0x1.
Then you click "OK."
So now it's going to move one to -.
So this is the source.
This is the destination, and this is the instruction.
So now in order to see this working, you have to put a breakpoint.
So we can put the breakpoint by clicking the line here, right-click, "Breakpoint," "Toggle."
So you see this red highlight indicates that there is a breakpoint here.
And then now we can run.
Once you click "Run"—this is the button for run—
it will hit the breakpoint.
Then you can step through it line by line using this "Step Over."
So you can step over line by line.
It goes to the next line.
Then step over.
It goes to the next line.
So now we are here.
If we click "Step Over" again, it's going to execute this instruction.
So it's going to move one to -.
OK.
Somehow it changes it back to -.
But that is OK.
That is OK because the source value is small.
It's all right.
Leave it as it is.
So now you will see the - is here.
This instruction is going to move one to -, and then step over.
Now you see one is there.
So everything is zeroed out and then left one in the first byte.
So this "move one to -" is actually moving one to the whole register.
It's actually -.
But for some reason, x64dbg changes - to -.
So this is the first instruction which does nothing,
simply moves it to the one, the value there.
Now if you want to move to another register, you repeat the same thing.
MOV.
This time we try a bigger number: 0x—
uh, maybe
1122334455667788.
Sorry.
You need to put the destination, comma, followed by the source.
So we're going to move this hex value to -.
So we click "OK."
And now you're going to execute this: step over.
And you see this time it doesn't change this to - because your source argument is a big number.
So that's why it maintains the register - here.
So after you execute this instruction, you notice - now holds this value for us.
Now if we were to move something back into -, it's going to overwrite whatever was there.
So let's try this.
Now let's say we move—
uh, -, let's say you move something big as well.
Um, 11
22
334455667788.
Let's put the 0x there.
So 0x is a prefix to indicate that this is a hex number.
Click "OK."
So now we can execute this and watch what happens to -.
Notice it didn't change this to -.
Now step over,
and you see that now - got this value.
We can also move register to register.
For example, if we want to move - to -, we can do it like this.
Press spacebar, MOV, the destination, comma, followed by the source.
Click "OK" and close this.
So now when you execute this instruction, whatever is in - will be moved into -.
Now - has got a value of one—
so let's run it and see what happens.
Step over.
And now you see - also has got this value.
So we can move register to register.
You can move constant to register.
Later on, I will show you you can move memory to register as well.
So in a future lesson, I will show you how to make use of memory.