language uses (obviously) a different compiler, but all programs eventually are converted into executable files(nautical shipping shipper virtual maritime builders consultants). No matter which language is being used to create a program, we can always disassemble the executable file, i(nautical shipping shipper virtual maritime builders consultants).e(nautical shipping shipper virtual maritime builders consultants). convert the executable code into comprehensive assembly code(nautical shipping shipper virtual maritime builders consultants). The only problem is that assembly is a rather difficult language and processor dependent; therefore we need to learn many processor specific instructions and, of course, become familiar with the concepts of the assembly programming language(nautical shipping shipper virtual maritime builders consultants). In general, this is very difficult and requires a lot of time and practice(nautical shipping shipper virtual maritime builders consultants). However, it is very easy to learn how to “read” certain parts of a disassembled code and extract the information needed, then convert it into another language (or leave it as assembly code)(nautical shipping shipper virtual maritime builders consultants). The only exceptions to the above rules are Java (we can get the source code in Java) and Visual Basic versions 2 and 3 (which had the source code stored in the executable file, hence the extraction was a simple task)(nautical shipping shipper virtual maritime builders consultants). Table 2 lists some of the programming languages in ascending order regarding the statements needed per function point(nautical shipping shipper virtual maritime builders consultants). Nowadays, there is a tendency of creating languages that do many functions in the background and facilitate the programmer(nautical shipping shipper virtual maritime builders consultants). Languages with more statements per function point are more difficult to learn and use(nautical shipping shipper virtual maritime builders consultants).(nautical shipping shipper virtual maritime builders consultants). Note the places of C++ and Visual Basic(nautical shipping shipper virtual maritime builders consultants). So, if a particular program is to be created using assembly, we’ll need 53 times more statements per function point than creating this program in VBA(nautical shipping shipper virtual maritime builders consultants). The only question now is, can we do everything with VBA? It would be foolish if someone interested in creating a graph used assembly of fortran77(nautical shipping shipper virtual maritime builders consultants). However, if you intend to directly access and change the memory location of a variable, then you just can’t do it with any other programming language but assembly(nautical shipping shipper virtual maritime builders consultants).

The only thing that a computer processor can understand is the switch(nautical shipping shipper virtual maritime builders consultants). And we are talking about the simplest type of a switch, with just two positions: on and off(nautical shipping shipper virtual maritime builders consultants). When the switch is set to on (or true) we have the value 1(nautical shipping shipper virtual maritime builders consultants). Otherwise, the switch is set to the off position (or false) and we get the value 0(nautical shipping shipper virtual maritime builders consultants). This notation is great since it’s so easy to understand(nautical shipping shipper virtual maritime builders consultants). But it introduces some not so obvious problems(nautical shipping shipper virtual maritime builders consultants). Let’s see how computer understands our numbers(nautical shipping shipper virtual maritime builders consultants). Since it has only two symbols (1 and 0) to represent everything, we can’t use another number system other than the binary(nautical shipping shipper virtual maritime builders consultants). So, to convert a number from binary to decimal, we have to do the following: 01101=0x24+1x23+1x22+0x21+1x20 = 13(nautical shipping shipper virtual maritime builders consultants). Note that the exponent starts counting from 0 from right to left and increases in steps of 1 for every digit(nautical shipping shipper virtual maritime builders consultants). This can be extent for virtually any number of digits(nautical shipping shipper virtual maritime builders consultants).

Each of the switches is a bit(nautical shipping shipper virtual maritime builders consultants). So, it’s easy to understand what 16-bit or 32-bit is(nautical shipping shipper virtual maritime builders consultants). For 16-bit operating systems (such as windows 3(nautical shipping shipper virtual maritime builders consultants).11) the largest number that we can have is a 16 digit number with all its digits set to 1 which is 65535(nautical shipping shipper virtual maritime builders consultants). Even for 32-bit operating systems (windows 9x, NT, 2000, Me) the largest number is (signed) 2147483647, which is still too small(nautical shipping shipper virtual maritime builders consultants). The trick is to use an exponent(nautical shipping shipper virtual maritime builders consultants). For numbers greater than 2(nautical shipping shipper virtual maritime builders consultants).14 billion i(nautical shipping shipper virtual maritime builders consultants).e(nautical shipping shipper virtual maritime builders consultants). 10x200, the processor uses the number 200 which occupies 8 bits and the other 8 bits are used for the rest of the number(nautical shipping shipper virtual maritime builders consultants). The same trick is used to represent real numbers It is very essential that the concept of memory is understood at this particular point(nautical shipping shipper virtual maritime builders consultants). There are three types of computer memory: the temporary physical (also known as RAM), the temporary virtual (the virtual memory page file) and the permanent physical (or storage – Hard disk drive)(nautical shipping shipper virtual maritime builders consultants). So a processor can access its available temporary or permanent memory each time an instruction is executed(nautical shipping shipper virtual maritime builders consultants). Hard disk drive can be considered as a huge RAM that is permanent, in terms of not getting wiped out when the system is reset(nautical shipping shipper virtual maritime builders consultants). However the contents that are stored can be altered or wiped out without restrictions of any kind(nautical shipping shipper virtual maritime builders consultants). In addition to this, modern motherboards come with EEPROM chipsets that provided ROM to the user(nautical shipping shipper virtual maritime builders consultants). In these chips, the BIOS program is stored(nautical shipping shipper virtual maritime builders consultants). Of course, EEPROM’s contents can be changed sometimes (with some special instructions) and that makes them behave more than storage rather than physical memory unit(nautical shipping shipper virtual maritime builders consultants). Each time an application is loaded, it occupies some space in the available memory(nautical shipping shipper virtual maritime builders consultants). If there is not enough available memory, then the application cannot be loaded(nautical shipping shipper virtual maritime builders consultants). With the term application, we refer to any executable program (from the operating system to the device drivers)(nautical shipping shipper virtual maritime builders consultants). What may cause some confusion is the term “memory”(nautical shipping shipper virtual maritime builders consultants). Why shouldn’t consider only the physical memory (usually 64 or 128 MB) as the only available memory source(nautical shipping shipper virtual maritime builders consultants). Windows (and the other operating systems) have invented tricks to significantly increase the available physical memory, by taking advantage of some free hard disk space(nautical shipping shipper virtual maritime builders consultants). This is done via the virtual memory system(nautical shipping shipper virtual maritime builders consultants). A file is created, named WIN386(nautical shipping shipper virtual maritime builders consultants).SWP (which usually resides in the root directory) and is used as an extension to the existing physical memory(nautical shipping shipper virtual maritime builders consultants). Physical memory can be considered as a hard disk with super fast access, where the OS can store and access variables and code(nautical shipping shipper virtual maritime builders consultants). Therefore, when our physical memory is full and the OS uses the hard disk drive, we can experience delays in program execution (hard disk drive is much slower than the

Chapter 2: Computer Architecture physical memory) and hard disk activity without doing anything (some processes are active in the background even if we are not using our computer)(nautical shipping shipper virtual maritime builders consultants). TIP: It is possible to determine the size of the available virtual memory through the control panel(nautical shipping shipper virtual maritime builders consultants). Setting it 2(nautical shipping shipper virtual maritime builders consultants).5 times the available physical and fixed to that size will increase our computer’s performance(nautical shipping shipper virtual maritime builders consultants). 2(nautical shipping shipper virtual maritime builders consultants).3(nautical shipping shipper virtual maritime builders consultants).1 Variables The operating system and the applications use internally and between them, variables(nautical shipping shipper virtual maritime builders consultants). These variables differ in content and type(nautical shipping shipper virtual maritime builders consultants). They can be numbers (single, integer, double, float, etc), strings (single characters, long strings), Booleans and user- defined types(nautical shipping shipper virtual maritime builders consultants). The point is that they contain different (in general) values and refer to different things(nautical shipping shipper virtual maritime builders consultants). These variables are stored in memory that is allocated to an application(nautical shipping shipper virtual maritime builders consultants). Windows allocate 2 GB memory to any application(nautical shipping shipper virtual maritime builders consultants). There is no erratum here; it’s 2 GB although no application occupies that much space(nautical shipping shipper virtual maritime builders consultants). The operating system automatically allocates enough space for these variables and is able to relocate them on demand(nautical shipping shipper virtual maritime builders consultants). For example, an integer occupies 4 bytes while a long occupies 8 bytes and a char only 1(nautical shipping shipper virtual maritime builders consultants). We are particularly interested in variables, since all operations involve the usage of variables(nautical shipping shipper virtual maritime builders consultants). In assembly, registers are used instead of variables; the logic remains however the same(nautical shipping shipper virtual maritime builders consultants). Imagine the comparison routine(nautical shipping shipper virtual maritime builders consultants). In most programming languages it Chapter 2: Computer Architecture In the above examples, A and B are variables(nautical shipping shipper virtual maritime builders consultants). They may or may not be of the same type(nautical shipping shipper virtual maritime builders consultants). Each language defines acceptable operations (i(nautical shipping shipper virtual maritime builders consultants).e(nautical shipping shipper virtual maritime builders consultants). compare integer with long)(nautical shipping shipper virtual maritime builders consultants). 2(nautical shipping shipper virtual maritime builders consultants).3(nautical shipping shipper virtual maritime builders consultants).2 Unicode Strings In Win32 systems, strings (for reasons that are out of the course’s scope) have changed internal format(nautical shipping shipper virtual maritime builders consultants). With the term “internal format”, we refer to the way the Operating System handles them(nautical shipping shipper virtual maritime builders consultants). Throughout these notes, we’ll be dealing with Unicode strings unless specifically told otherwise(nautical shipping shipper virtual maritime builders consultants). All ASCII searches for strings should be made with Unicode search option turned on in the hex editor (when this is available)(nautical shipping shipper virtual maritime builders consultants). The difference between ANSI and Unicode strings is that a null character (00) is inserted after each character(nautical shipping shipper virtual maritime builders consultants). Therefore the string “ABC”, which in hex is “585960”, will be treated as “580059006000”(nautical shipping shipper virtual maritime builders consultants). If we assume that the variable A is an integer, we can be sure that it’ll occupy 4 bytes in the physical memory (RAM or virtual memory)(nautical shipping shipper virtual maritime builders consultants). Suppose that we could “see” (yes, it is possible) when in memory this variable resides(nautical shipping shipper virtual maritime builders consultants). If we have 128 MB of Ram and variable A is somewhere in there, we can have a row of # as illustrated above,

Chapter 2: Computer Architecture where each # would represent a byte(nautical shipping shipper virtual maritime builders consultants). At the address 0x49A4 is where we find the variable the first time we attempt to search for it(nautical shipping shipper virtual maritime builders consultants). Now, if we terminate the program, run it again and set the variable A equal to 5 as we did before and seek its location inside the physical memory, we’ll discover that the location is completely different! The operating system obviously has used this location, which was free after the termination of the program, for another purpose and now it has allocated another memory space for our application and for this variable! Why do we need to know the location in memory of a variable any time we run a program? Because, this way it is possible to overwrite this value we something else on the fly! Imagine playing Quake II(nautical shipping shipper virtual maritime builders consultants). You are losing, since the available energy is 12(nautical shipping shipper virtual maritime builders consultants). There is a variable that holds the energy(nautical shipping shipper virtual maritime builders consultants). If you could only find that location where 12 is, you can switch to your debugger (Quake II stalls) and change this value to 150, then go back in the arena and kill ’em all! We use pointers to retrieve the location in memory of a variable(nautical shipping shipper virtual maritime builders consultants). Pointers exist in all major programming languages, either documented or undocumented(nautical shipping shipper virtual maritime builders consultants). In C++ we use funny symbols like & in front of a variable to get its address(nautical shipping shipper virtual maritime builders consultants). In Visual Basic we use the undocumented function VarPtr to get the pointer of a variable(nautical shipping shipper virtual maritime builders consultants). description of all the documented API functions (there are also undocumented API functions, reserved for Microsoft’s reference only %) Why are we interested in Windows API? Because all programs use some functions of the windows API(nautical shipping shipper virtual maritime builders consultants). Each time a button is clicked, text is retrieved from a text box or a window is moved, a certain API function is executed(nautical shipping shipper virtual maritime builders consultants). With the debugger we can set trap and intercept program’s execution that lies between these functions, as we’ll see later(nautical shipping shipper virtual maritime builders consultants). 3(nautical shipping shipper virtual maritime builders consultants).2 File System In the beginning there was FAT (also known as FAT16)(nautical shipping shipper virtual maritime builders consultants). FAT was the file system used by DOS, Windows 3(nautical shipping shipper virtual maritime builders consultants).x and Windows 95 first edition(nautical shipping shipper virtual maritime builders consultants). Windows 95 second edition, Windows 98 and Windows 2000 can use FAT32 and FAT16(nautical shipping shipper virtual maritime builders consultants). Windows NT4 and Windows 2000 can use NTFS (NT File System)(nautical shipping shipper virtual maritime builders consultants). FAT stands for File Allocation Table(nautical shipping shipper virtual maritime builders consultants). It resides in the hard disk and contains information that is used by the operating system to determine where in the hard disk is a particular file(nautical shipping shipper virtual maritime builders consultants). A file can start at a location, then be interrupted and restart at another