Reverse › Module 3 › Lesson 1
Instruction Families
MOV, CMP, JMP, CALL families structure disassembly — read them on $RE_LAB crackmes, not to patch commercial DRM.
Visual · re_instruction_families
Instruction families literacy. $RE_LAB only. Original Cyberlium.
Opening
Assembly is sparse — a handful of families repeat in every crackme check.
Data movement (MOV, LEA), arithmetic (ADD, SUB, XOR), comparison (CMP, TEST), control transfer (JMP, JE, JNE, CALL, RET), and stack ops (PUSH, POP) dominate user-mode disassembly. Recognizing families speeds reading password gates on $RE_LAB toy binaries. Cyberlium teaches instruction literacy for static reading before dynamic confirmation. You will NOT use assembly skills for commercial license patches. Next: Calling Conventions.
1. Data movement and arithmetic
MOV copies between registers and memory; LEA computes addresses. XOR reg,reg zeroes registers — common in crackme prologues. ADD/SUB adjust counters in loops.
On $RE_LAB, highlight MOV/CMP pairs feeding conditional jumps in YOUR toy check function.
Command guide
Try these commands — Data movement and arithmetic
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
objdump -d — https://sourceware.org/binutils/docs/binutils/objdump.html (instruction families) x86 instruction ref — https://www.felixcloutier.com/x86/ (mov/cmp/jmp literacy) GNU as — https://sourceware.org/binutils/docs/as/ (assembly syntax)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install binutils sudo apt install build-essential
macOS: Built-in (Xcode CLI) or brew install binutils
Command — copy this
xcode-select --install # or brew install gcc
Windows: Use WSL binutils Use WSL or MinGW
═══ LINUX / macOS ═══
Command — copy this
export LAB_RE=${LAB_RE:-$HOME/cyberlium-lab/t23-re}
objdump -d "$LAB_RE/bin/check" | grep -oE '\b(mov|add|sub|cmp|jmp|je|jne|call|ret|push|pop|lea)\b' | sort | uniq -c | sort -rn | head -12
objdump -d "$LAB_RE/bin/check" | grep -E 'mov|call|ret' | head -10Primary tools to practice this lesson: objdump, gcc. Reference sites: objdump -d (https://sourceware.org/binutils/docs/binutils/objdump.html); x86 instruction ref (https://www.felixcloutier.com/x86/); GNU as (https://sourceware.org/binutils/docs/as/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Compare and branch
CMP subtracts without storing result — sets flags. JE/JNE/JZ/JNZ branch on zero flag; JG/JL handle signed compares. Crackmes hide success path behind one conditional jump.
Patch literacy comes later — here you only read which jump guards success on authorized binaries.
3. Call and return
CALL pushes return address and jumps; RET pops into RIP. Library calls (strcmp, printf) appear as PLT entries — trace arguments in registers per convention.
Ship: table — five instruction families, one example mnemonic each, one crackme role each. Next: Calling Conventions.
4. What you ship: instruction families table
Five families with mnemonics and roles on YOUR toy binary. $RE_LAB named. NEVER commercial DRM patches. chmod 600.
5. What you record before the next lesson
Date. Instruction families table. $RE_LAB named. File t23-m03-l01-instruction-families.txt chmod 600.
6. Wrong vs right: commercial piracy vs crackmes/CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Patch je to jne on paid software. Treat every instruction as unique snowflake without families.
Right
Write instruction families table from $RE_LAB disassembly. Next: Calling Conventions.
Mission: name five instruction families
1) List data, arithmetic, compare, branch, call families with one mnemonic each. 2) Tie one family to YOUR toy check function. 3) chmod 600.
Stuck? Ask Cyberlium AI Mentor
CMP + conditional jump is the crackme gate pattern.
Knowledge Check
APPLY: Instruction families literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: CMP sets flags without storing the subtraction result.
True or False
Knowledge Check
APPLY: Crackme success paths often hide behind:
Multiple choice