Instruction Families

MOV, CMP, JMP, CALL families structure disassembly — read them on $RE_LAB crackmes, not to patch commercial DRM.

Instruction Families• Audio Walkthrough

00:00/03:18

Visual · re_instruction_families

Instruction families literacy. $RE_LAB only. Original Cyberlium.

Assembly is sparse — a handful of families repeat in every crackme check.

Data movement (MOV, LEA), arithmetic (ADD, SUB, XOR), comparison (CMP, TEST), control transfer (JMP, JE, JNE, CALL, RET), and stack ops (PUSH, POP) dominate user-mode disassembly. Recognizing families speeds reading password gates on $RE_LAB toy binaries. Cyberlium teaches instruction literacy for static reading before dynamic confirmation. You will NOT use assembly skills for commercial license patches. Next: Calling Conventions.

1. Data movement and arithmetic

MOV copies between registers and memory; LEA computes addresses. XOR reg,reg zeroes registers — common in crackme prologues. ADD/SUB adjust counters in loops.

On $RE_LAB, highlight MOV/CMP pairs feeding conditional jumps in YOUR toy check function.

Command guide

Try these commands — Data movement and arithmetic

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

objdump -d — https://sourceware.org/binutils/docs/binutils/objdump.html (instruction families) x86 instruction ref — https://www.felixcloutier.com/x86/ (mov/cmp/jmp literacy) GNU as — https://sourceware.org/binutils/docs/as/ (assembly syntax)

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install binutils
sudo apt install build-essential

macOS: Built-in (Xcode CLI) or brew install binutils

Command — copy this

xcode-select --install  # or brew install gcc

Windows: Use WSL binutils Use WSL or MinGW

═══ LINUX / macOS ═══

Command — copy this

export LAB_RE=${LAB_RE:-$HOME/cyberlium-lab/t23-re}
objdump -d "$LAB_RE/bin/check" | grep -oE '\b(mov|add|sub|cmp|jmp|je|jne|call|ret|push|pop|lea)\b' | sort | uniq -c | sort -rn | head -12
objdump -d "$LAB_RE/bin/check" | grep -E 'mov|call|ret' | head -10

Primary tools to practice this lesson: objdump, gcc. Reference sites: objdump -d (https://sourceware.org/binutils/docs/binutils/objdump.html); x86 instruction ref (https://www.felixcloutier.com/x86/); GNU as (https://sourceware.org/binutils/docs/as/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Compare and branch

CMP subtracts without storing result — sets flags. JE/JNE/JZ/JNZ branch on zero flag; JG/JL handle signed compares. Crackmes hide success path behind one conditional jump.

Patch literacy comes later — here you only read which jump guards success on authorized binaries.

3. Call and return

CALL pushes return address and jumps; RET pops into RIP. Library calls (strcmp, printf) appear as PLT entries — trace arguments in registers per convention.

Ship: table — five instruction families, one example mnemonic each, one crackme role each. Next: Calling Conventions.

4. What you ship: instruction families table

Five families with mnemonics and roles on YOUR toy binary. $RE_LAB named. NEVER commercial DRM patches. chmod 600.

5. What you record before the next lesson

Date. Instruction families table. $RE_LAB named. File t23-m03-l01-instruction-families.txt chmod 600.

6. Wrong vs right: commercial piracy vs crackmes/CTF toys

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Patch je to jne on paid software. Treat every instruction as unique snowflake without families.
Right: Write instruction families table from $RE_LAB disassembly. Next: Calling Conventions.

Hands-on Exercise