Business Development – HCMC

Non Tech Job En
  1. Job description:
  • Searching for business opportunities, taking responsibility before the Sales Manager for the assigned sales targets.
  • Perform business development tasks related to IT equipment, solutions and services. etc; ensure the achievement of business goals and sales targets.
  • Coordinate with technical departments, related departments in the sales implementation process to understand customer needs and make appropriate suggestions and solutions.
  • Making and implementing individual annual/quarterly business plans.
  • Comply with regulations on planning and periodical reporting as required.
  • Communicating, maintaining relationships with relevant partners, identifying and building relationships with potential Accounts.
  • Responsible for managing, supporting, monitoring and taking care of, in order to ensure customer satisfaction with the company’s products and services.
  • Support and build marketing activities and brand for the company.
  • Perform bidding-related jobs and other tasks as assigned by the Deputy General Director in charge of sales and the Sales Manager.

 

  1. Job requirements:
  • At least 3 years of experience in IT product business and 2 years in IT project business.
  • Knowledge of IT, especially in the field of information security.
  • Having worked or had relationships with partners in the industry of: Banking, Finance, Securities, Insurance, IT, state agencies.
  • Good communication skills, dynamic and creative.
  • Good relationship building skills.
  • Ability to work at high intensity and under pressure.
  • Good negotiation and persuasion skills.

 

  1. Benefits:
  • Probationary with 100% salary. ATTRACTIVE negotiable income according to competency.
  • Salary review: twice per year. Flexible working time
  • To be entitled to attend training course to improve professional skills required to be fulfilled. To be entitled to receive financial support to attend training courses on professional skills and soft skills necessary for the job.
  • Quarterly bonus, year-end bonus according to the Company’s business results. Other special bonuses according to the nature of work. Bonus on all holidays and New Year; bonus for introducing internal candidates, seniority bonus;
  • ESOP bonus for excellent employees and managers of the year.
  • 12 days annual leave + 1 day off on birthday. Each year of seniority is increased by 1 day of leave.
  • Fully enjoy insurance policy and holidays and holidays in accordance with the company’s regulations and current laws.
  • Enjoy welfare policy and collective cultural activities: Team Building, Year-end Gala, birthday, holidays, etc.;
  • Working in a friendly, dynamic and professional environment

 

  1. Contact:
    • Hanoi: M Floor, N01A Golden land building, 275 Nguyen Trai, Thanh Xuan Trung Ward, Thanh Xuan District, Hanoi City.
    • Ho Chi Minh City: 18F, Park IX Building, No. 8-10 Phan Dinh Giot Street, Ward 2, Tan Binh District, Ho Chi Minh City

 

VSEC officially launched Deep Penetration Testing Service

Outstanding Redteam Confession
On April 18, Vietnam Cyber Security Joint Stock Company VSEC launched the Red Team Deep Penetration Testing service – a security assessment based on performing attacks by any means to penetrate the business’s system. career as a cybercriminal.
As defined by the Computer Security Resource Center, NIST: Red Team is a group authorized and organized to simulate a potential adversary’s attack or exploit capabilities against a computer security system. enterprise. Red Team’s goal is to improve enterprise cyber security by illustrating the effects of successful attacks and demonstrating what actually works for the defense team (Blue Team) in a operating environment.
VSEC’s team of experts has succeeded in researching and finding Zero day vulnerabilities (unknown and unresolved software or hardware vulnerabilities) from the most popular software such as WordPress, Joomla, … to applications and systems of technology giants such as Microsoft,  Oracle, … all achieve high CVSS scores.
According to VSEC representative, officially announcing the provision of Deep Penetration Testing service – Red Team means that at the present time VSEC has full technological capacity, the team has international standard certificates and Practical experience participating in reputable security assessments, meeting all needs of all domestic and foreign organizations and businesses.
“In Vietnam, not many businesses and organizations are confident in using Red Team because they are still concerned about the capacity of domestic suppliers as well as risks in data issues. VSEC’s official announcement of the Red Team 2023 Deep Penetration Testing service with the full version “Red Team full version” will bring a new perspective on the security capabilities of Vietnamese experts, fully meeting the highest international standards”, Mr. Truong Duc Luong, Chairman of the Board of Directors of VSEC shared.
VSEC is an international standard MSSP (Managed Security Service Provider) information security management service provider operating since 2003. VSEC’s services meet the needs of all organizations and businesses regardless of the scale or complexity of the information technology infrastructure system. VSEC has obtained CREST (UK Information Security Service Standards) certification for Penetration Testing and SOC (Security Operation Center) services in 2021, 2022.
During 20 years of operation, VSEC announced that it has served more than 500 businesses and government organizations. Being a member of domestic and foreign associations and organizations such as VNCert – National Incident Response Network, VNISA – Vietnam Information Security Association, Command 86, FS-ISAC (The Financial Services Information Sharing) and Analysis Center), Blackpanda, RAPID7, Affinitas Global, CoreSecurity, RecordedFuture, …
Download announcement: HERE
See more at:
  • Vietnamnet newspaper: https://vietnamnet.vn/vsec-trien-khai-dich-vu-bao-mat-chuyen-sau-cho-doanh-nghiep-2133969.html
  • Dan Tri Newspaper: https://dantri.com.vn/suc-manh-so/ra-mat-dich-vu-kiem-thu-xam-nhap-sau-red-team-20230419160124678.htm
  • Bao Moi Newspaper: https://baomoi.com/vsec-trien-khai-dich-vu-bao-mat-chuyen-sau-cho-doanh-nghiep/c/45589171.epi
  • Thanh Nien Newspaper: https://thanhnien.vn/vsec-trien-khai-dich-vu-danh-gia-phuong-thuc-bao-mat-chuyen-sau-185230417172647058.htm

Distinguishing Between Pentest and Red Team

For pentester Outstanding Redteam Confession VSEC - BLOG

In the area of security, the terms Pentest and Red Team are often used interchangeably. So, what is the distinction between these two terms? We’ll discuss in this article to assist you learn more about which service would be the greatest fit for your organization.

Penetration Testing:

Pentester is someone who has hacker-like abilities and knowledge who approaches projects from a hacker’s perspective to undertake network, application, and device examinations. They look for ways to circumvent defensive measures and physical obstacles (bypassing) in order to find security flaws within targets or organizations. An skilled pentester can identify a target’s weak points while also building hacker scenarios for prospective attacks, methods of exploitation, and scope of impact, and then make recommendations for the best system handling and defense.

In this activity, Pentester employs automated testing tools to uncover a variety of cybersecurity issues, as well as manual testing to examine the organization’s attack vulnerabilities. Pentesting has become an essential requirement for most companies in assuring data safety in the light of an increasingly complicated cybersecurity ecosystem. Even firms that assume they do not have any valuable information to protect face hazards when hackers take control, install harmful software, disrupt services,… and cause substantial disruptions during operations.

Although many firms have IT teams that build, administer, and oversee daily security policies, it is nevertheless recommended that these units undergo pentesting to acquire a third-party view on the offensive aspects. Even if internal teams are doing well, this evaluation can help assess multidimensional defensive capabilities.

 

Red Team

Pentest’s goal is to find as many vulnerabilities and configuration flaws as possible, exploit them, and assess the level of risk. In contrast to Pentest, which seeks to identify all potential vulnerabilities, Red Team conducts targeted assaults using specialized tactics.

Red Team is often made up of a group of individuals who work together to thoroughly understand the amount of risk and the potential for real-world attacks across an organization’s technical, human, and physical aspects (assets, materials).

The Red Team employs a wide range of attack methods, including traditional deception, non-technical attacks (social engineering) on employees, and even impersonating a staff member in order to get administrator access. Red Team members are well-versed in the strategies, techniques, and processes that an attacker might employ in order to maximize the efficacy of their attacks.

Organizations with a strong presence in the information security business frequently use Red Team. After frequent pentesting and patching of most vulnerabilities, they demand individuals to undertake offensive assaults against the system’s security measures (bypass) in any feasible method, from numerous distinct angles.

 

Red team’s operations

The Red Team begins by doing reconnaissance in order to gather as much information as possible in order to comprehend the human factor, technology, and surroundings. This allows them to build and acquire appropriate tools for the attack. Red Team members can gather deeper insights into the infrastructure, physical assets, and employees by leveraging Open Source Intelligence Gathering, resulting in a better understanding of the target and its operations. This allows them to conduct more sophisticated attacks, such as writing malicious programs and configuring hardware trojans,…

Members of the Red Team will conduct a variety of attack actions, both technical and non-technical, in order to discover weaknesses in the target’s systems and processes. They then exploit these flaws to conduct attacks against servers, applications, networks, or to circumvent physical safeguards in preparation for escalation attacks.

Using Red Team provides organizations with a multifaceted view of their systems and processes, as well as the support of security experts to rectify, patch vulnerabilities, remedy issues, provide training, and address any necessary measures to ensure that those risks do not reoccur.

Security testing for one of the first joint stock commercial banks in Vietnam

Case study VSEC - BLOG

VSEC’s client is one of the first licensed commercial joint stock banks in Vietnam with nearly 300 branches and transaction offices across the country. In order to deliver the finest service possible to their end clients, this company has just begun actively utilizing digital transformation in banking activities. When a breach in information security exposes sensitive company data, the enterprise requires the involvement of a reliable security solution.

Following the data collection procedure, we identified the following distinguishing features of the company:

  • There has never been a thorough evaluation and testing of the information security of the complete IT system.
  • The information security team is currently insufficient to implement a thorough system-wide examination of information security.
  • A lack of an external, objective examination of security measures.

 

VSEC analyzes the situation and then confers with businesses to determine the optimal course of action. Accordingly, VSEC will offer Pentest, an IT security assessment and penetration testing service, to the customer. Server systems, network equipment, internal and external applications, and critical databases are all part of the scope of the project. 

We have uncovered security flaws in our customers’ IT systems with the help of our team of experienced specialists, which has allowed us to paint a more complete picture of our customers’ information safety. Information security risks are reduced, client confidence is maintained, and losses are kept to a minimum while the business benefits from implementation guidance and support.

Providing solutions for customers in the energy sector

Case study VSEC - BLOG

Organizations in the Manufacturing and Energy sectors are always prime targets for hackers. Although VSEC is a member of Vietnam’s leading energy corporation, its customers are no exception this time. The enterprise operates in national key fields, providing, and conducting the business of electric energy services in the Northern provinces.

There is a challenge that the enterprise owning many IT systems at various levels is subject to the regulations on information security of the State management agencies. Therefore, its implementation of information security solutions will have much higher requirements than that of other common enterprises. Like many previous cases seeking the aid of VSEC, this unit also lacks a well-equipped team of specialized personnel in information security to fulfill the requirements of large-scale information security assessment activities. This time, VSEC will have to carefully research and advise on solutions for the enterprise.

Through discussing with the unit and referring to the regulations of the State management agency, VSEC has assessed and tested the information security penetration for the entire IT infrastructure and several critical applications of the unit.

After a period of implementing assessment measures, our experts have detected numerous vulnerabilities in clients’ IT systems, thereby providing a comprehensive overview of the information security for clients. Based on that, they have provided recommendations and supported the client in implementing measures to mitigate information security threats. Moreover, we not only safeguard the client’s reputation but also minimize potential damages to the enterprise.

Security solutions for the pioneering corporation in eco-cities

Case study VSEC - BLOG

The client of VSEC is a major corporation that is the developer of Vietnam’s largest green urban project in the country’s northern region and which also has invested in many different sectors, including but not limited to education, health, clean agriculture, high technology, travel, entertainment, etc.

The cross-industry products are supported by a massive IT infrastructure and a workforce of over 300 personnel.

VSEC faces a difficult problem in maintaining its public business image given that the real estate industry deals with highly personal information about its clients. The company has a large number of servers and workstations, a broad set of operations, a widespread connection system, and frequent upgrades to a huge number of new apps, but no dedicated employees to ensure the security of this infrastructure. 

With nearly 20 years in the industry, we have successfully implemented a wide range of security solutions for clients including:

  • Conduct a comprehensive analysis of the existing IT system and current supported applications.
  • Deploy and monitor all servers and workstations of the enterprise
  • Forewarning and coordinated analysis to forestall data security breaches
  • Launch your account’s management page to take charge of all monitored components.
  • Export periodic reports and overview of information security events

Our experienced team has found security flaws in the client’s IT application system after conducting a Pentest and doing a system analysis. We then provide our clients with guidance and assistance during deployment in an effort to lessen their exposure to information security threats, protect their reputations as well as limit any resulting damage.

Meeting information security needs of Vietnam’s leading energy corporation

Case study VSEC - BLOG

As an energy production enterprise and a member of Vietnam’s leading energy corporation in Vietnam, VSEC operates in national key fields.

Operating in national key fields, owning a level 4 system, and complying with the regulations on information security of the State management agency. Having not yet met the requirements of information security activities as the specialized personnel team in charge of information security is still understaffed

Evaluating and reviewing the entire Information Technology system of the unit. Implementing a monitoring plan for all servers, workstations, and network devices of the unit. Alerting and coordinating to analyze and prevent information security threats.

Detecting vulnerabilities in clients’ information technology systems, thereby providing recommendations and supporting them to reduce information security risks. Monitoring information security 24/7 for clients’ information technology systems, promptly identifying information security problems to take appropriate handling measures. Helping clients meet the requirements and regulations of State agencies on ensuring information security in units operating in national key fields.

Deploying information security monitoring for multinational corporations

Case study VSEC - BLOG

The client is an FDI enterprise, a branch of a global corporation that specializes in the assembling and manufacturing of motorcycles and automobiles. The branch holds a market share in the top motorbike and automobile trading enterprises in the Vietnam market.

Enterprises comply with the general regulations on information security of holding companies. This branch employs external threat monitoring services (data leaks, web phishing, etc.) and monitors the reputation of international suppliers at a high expense. They are building a team in charge of local information security, so they need great support from their partners.

Services for external threat monitoring (data leaks, web phishing, etc.) and reputation monitoring are provided. Coordination and consultation with customers are required to continuously optimize the monitoring process.

VSEC SOC detects and immediately notifies clients of fake website information and the leaked information of customers’ data that is published for sale on the dark web, and dark forum. Provide services with reasonable cost and quality equivalent to international suppliers. Provide services at a reasonable cost and of a similar standard to foreign suppliers. Assist the local team in the process of assuring information security for businesses.

SUPPLY CHAIN ATTACKS – THE DREAD OF BUSINESSES

Cyber world trending VSEC - BLOG

A supply chain attack is a cyber attack that targets an organization through its providers/vendors.

 

Current situation of supply chain attacks

A recent study shows that the supply chain attracts cyberattacks like a magnet. A whopping 97% of companies have been affected by supply chain attacks, with 93% of them admitting that they have been directly attacked due to vulnerabilities within the supply chain. According to an analysis by security provider Sonatype, these software supply chain attacks saw a staggering 650% increase in 2021, with Sonatype recording 12,000 incidents in the same year

“Supply chain attacks are terrifying because they are exceptionally challenging to deal with and because they demonstrate that you are placing your trust in the entire ecosystem,” said Nick Weaver, a security researcher at UC Berkeley’s International Computer Science Institute.

With a well-planned attack, they can disrupt a provider’s consumer network, resulting in hundreds or even thousands of victims. In addition, any firm that develops software or hardware for other organizations might be a potential target for these attackers.

 

Common supply chain attacks

  • SolarWinds SUNBURST backdoor: On December 13, 2020, the SUNBURST backdoor was first revealed. The attack leveraged the widely used SolarWinds Orion IT management and monitoring software to develop a malicious trojan update. Its targets included services running Orion software and the U.S. Department of Commerce. Fortune 500 companies, telecommunications firms, other government agencies, and universities are also likely to be affected. Of particular concern within the SUNBURST backdoor was the targeting of dedicated servers, which are typically less frequently monitored. Preventing attacks like the SUNBURST backdoor requires constant monitoring at all levels of the corporate network.
  • Exploiting vulnerabilities in Log4j: Another way of implementing a supply chain attack is by exploiting vulnerabilities in open source software. Notably, there was an attack where hackers exploited vulnerabilities in Log4j. This attack allows hackers to execute code remotely, including the ability to take full control of the server. Log4j is a zero-day vulnerability that was discovered by hackers before the software provider became aware of it. Since this vulnerability is associated with a part of the open-source library, it could potentially impact any of the 3 billion devices running Java.
  • Attacks on Kaseya VSA Software: The primary goal of a supply chain assault is to exploit the weaknesses of suppliers in order to launch attacks on customers. That’s the method the Revil hacking collective employed when they targeted Kaseya VSA, a customer-facing remote monitoring and management service platform for IT infrastructure. By exploiting a vulnerability in the Kaseya VSA, REvil was able to send ransomware to 1,500 companies that are customers of Kaseya VSA.

 

 

  • Capital One attack and cloud infrastructure security flaws: Not all cyberattacks originate from highly organized groups of hackers; in the case of Capital One (USA), a former Amazon employee used his insider knowledge of Amazon Web Services (AWS) to fraudulently charge $100 million to customer credit cards. The attack demonstrated the risks associated with cloud computing.
  • Vulnerabilities on Personal and Third-Party Devices: In March 2022, American cybersecurity firm Okta disclosed that one of its vendors, Sitel, had been infected by a virus. via an employee using a laptop to perform customer service. Fortunately, the extent of the breach was limited, only two of Okta’s authentication systems were compromised, and no client data or settings were altered. However, through this incident, there is a risk that hackers would target devices belonging to subcontractors or employees who carry their own devices to launch more extensive attacks.

 

How to reduce the risk of cyberattacks on supply chains?

Cyber attacks are a constant threat, and every company and organization in the supply chain needs to be prepared for them. That’s why it’s so important for businesses to strengthen their network security defenses. Listed below is a remedy that institutions can do to shield themselves from and reduce the impact of cyber threats.

Carefully select your suppliers: It is imperative for businesses to verify that their vendors use certified security policies and infrastructure. This should be expressed explicitly in any cooperation agreement between the two parties.

Keep a close eye on software vendors: This is especially important for software with access privileges to company assets.

Restrict access to your data from third parties such as vendors and partners: Having fewer people with access to the data will make it easier to manage and prevent security breaches.

Safeguard the devices used by developers: Set up an endpoint protection platform and endpoint detection and response technologies to see any unusual activity and troubleshoot appropriately if necessary.

Education of staff, vendors, and associates: Organize training seminars to instruct workers on how to properly implement all of the company’s security measures, from password protection to technical assaults. All important matters should not be overlooked.

Always have a backup plan in unexpected cases: While no strategy can guarantee that a crisis won’t occur, you can prepare for it by having an event response plan ready to implement.

To ensure your clients’ faith and patronage of your services, VSEC is present 24/7 to improve the security of the IT infrastructure.

Source: ictvietnam, computerweekly, helpnetsecurity, gep.com

5 subdomain scanners to assist the pentest process

For pentester VSEC - BLOG

In recent years, finding subdomains has become an important part of the pentest process. This mission usually takes time and effort. However, the development of digital technology platforms has provided us with effective tools. This article will outline 5 subdomain scanners to assist in the pentest process.

Outstanding methods for finding subdomains

The finding of subdomains helps in analyzing the domain infrastructure of any company. Let’s find out the most common uses of these tools.

DNS audit

DNS attacks are becoming more and more common, however, most companies are not aware of this threat. Very few companies perform DNS audit regularly although it brings more good things than bad ones. DNS audit can help find DNS vulnerabilities, and update and patch them. In addition, this process can find unused subdomains or potentially vulnerable ones.

 

Domain Intelligence

Red teams often use subdomain discovery took kit in their infosec investigations, which frequently include a number of OSINT techniques. These subdomain enumeration tools detect information exposed to the public such as information about users, apps, or technologies being used in the system.

 

Vulnerability scanning

An extensive list of domain names along with their subdomains can bring a lot of benefits to the process of vulnerability scanning

 

How subdomain scanners work  

Querying search engines

We can use Google to search for subdomains of any domain. Just use the simple command line below:

site:vsec.com.vn -www

This command line will return all the domains indexed by Google.

Most of today’s tools use Google or Bing as built-in modules to assist in searching.

Performing brute force discovery

Some discovery tools use this method for improving search results. While it isn’t the quickest way to find subdomains, it can be one of the most accurate

TLS/SSL information

SSl/TLS certificates are not only useful for encrypting data sent and received between browsers and servers, but it’s also helpful for pentester.

Subject Alternate name (SAN) of SSL/TLS certificate can be used to extract domain and subdomain names

 

Top 5 subdomain scanners (terminal-based)

  1. AMASS

Developed on the Go lang platform, it’s one of the most effective tools in discovering large numbers of subdomain

AMASS uses a variety of subdomain mapping techniques including scraping, recursive brute force, reverse DNS sweeping, and Machine Learning to get the best result. Installing AMASS is quite easy. Installation instructions and manual are available at:  https://github.com/OWASP/Amass

Or can install by using snap (on Kali Linux and other Linux distros), by a command line: snap install amass

After installing, you can use the simple command below to search subdomain: amass enum -d example.com

Result:

User manual: https://github.com/OWASP/Amass/blob/master/doc/user_guide.md

 

  1. SubBrute

This is one of the fastest subdomain discovery tools. One of its coolest features is the ability to conceal the origin of the subdomain scanning itself, by using open resolvers as proxy to DNS rate-limit. 

It can also work as a DNS spider that recursively crawls enumerated DNS records.

SubBrute supports filtering DNS records. For example, if you need to get only TXT records from any given domain name, you can use the –type option:

./subbrute.py -s google.names google.com –type TXT

Another great thing about SubBrute is the fact that it can be integrated into your own python scripts by using the subbrute.run() function. For example:

import subbrute

for d in subbrute.run (“yahoo.com”):

print(d)

For advanced usage, simply run: ./subbrute -h

 

  1. Sublist3r

Sublist3r is another Python-based tool that can be used as a massive subdomain scanner. It’s widely used by bug bounty hunters, as well as blue and red teams across the globe for subdomain data collection.

By querying search engines such as Bing, Yahoo, Google, Baidu, and other 3rd party sources like Netcraft or VirusTotal subdomain database, it can be one of the most effective and fastest tools around when you want to find subdomains.

Sublist3r minimum requirements are Python2 or Python3 versions.

Python 2 recommended version: 2.7.x

Python 3 recommended version: 3.4.x

To get started, you’ll need to clone the Git repo, and then run the installation for some of the dependencies with pip:

pip install -r requirements.txt

That’s it. Now you can perform subdomain scanning tasks:

./sublist3r.py -d securitytrails.com

Expected output:

Github: https://github.com/aboul3la/Sublist3r

 

4. DNSRecon

DNSRecon is one of the most well-known domain reconnaissance scripts. As with almost every other one on this list, it’s written in Python.

It works by checking all NS records for AXFR zone transfers and can be very useful in DNS enumeration for almost any type of record, including MX, SOA, NS, TXT, SPF, and SRV.

It also supports wildcard resolution checking and brute force-based discovery for A and AAAA type-records with wordlists. It can also query Google Dorks to fetch indexed subdomains by GoogleBot.

After downloading the DNSRecon package, you’ll need to install a few required packages with pip:

pip install -r requirements.txt

Then you are ready to test it: :

./dnsrecon.py -d securitytrails.com

Result

Github: https://github.com/darkoperator/dnsrecon

 

5. AltDNS

AltDNS is a subdomain discovery tool based on work with alterations and permutations.

By setting your own wordlist (or using the default wordlist at default altdns/words.tx), as well as using a list of confirmed subdomains, you can run the script to generate both altered or mutated results that may be present in the domain name.

It includes a dataset of 200+ subdomains that can be used to churn out valid subdomains.

After cloning the git project, install requested packages through pip:

pip install -r request.txt

Then you are ready to start using AltDNS:

./altdns.py -i subdomains.txt -o data_output -w words.txt -r -s results_output.txt

Note: subdomains.txt is the actual subdomain list you know already exists, and words.txt is AltDNS’s own wordlist.

You can expect the output to look like this:

MIPS Assembly Language (P2)

Security for Newbie VSEC - BLOG

Gone is the one… the autumn coat is folded

Still hiding a bit of golden sunlight in the flap

My sorrow growing on branches as leaves

Not fall off quickly but wait for another autumn

Hello everyone, it’s me again, an amateur entering the field. Lately, due to being swamped with company projects, I haven’t had the time to explore and write blog anymore ☹. But today, on the occasion of a leisurely day, just like my single status during the winter season – I take some time to continue this ongoing series, hoping you’ll continue reading?).

Arithmetic Computational Instructions.

Addition Instruction.

As far as I know, it includes:

Instruction Example Meaning
add add $1,$2,$3 $1=$2+$3
add immediate addi $1,$2,100 $1=$2+100 It means addition with constant numbers
add unsigned addu $1,$2,$3 $1=$2+$3 Unsigned integer addition,
add immediate unsigned addiu $1,$2,100 $1=$2+100 Unsigned integer addition,

 

Syntax:

For add, addu: <instruction name> <destination register>, <source register 1>, <source register 2>

For addi, addiu: <instruction name> <destination register>, <source register 1>, <constant number>

Specific example:

Compiling the above .c file with the MIPS architecture as follows:

mips-linux-gnu-gcc -O3 -S -mfp32 -march=mips32 Sum.c

Image when compiled to MIPS Assembly.

Why do I declare a signed int, but the assembly output uses addiu? From what I’ve briefly researched online, most compilers tend to use addu and addiu to avoid “overflow” traps. The add and addi instructions seem to be used only when manually coding or in ISAs like x86, ARM…

Subtraction Instruction.

Instruction Example Meaning
subtract sub $1,$2,$3 $1=$2-$3
subtract unsigned subu $1,$2,$3 $1=$2-$3 Unsigned integer subtraction

Syntax:

sub,subu: <instruction name > <destination register> , <register 1>, < register 2>

Specific example: 

Image when compiled to MIPS Assembly.

Multiplication Instruction.

Instruction Example Meaning
Multiply (withoutoverflow) mul $1,$2,$3 $1=$2*$3 Result fits in 32 bits.
Multiply mult $2,$3 $hi,$low=$2*$3 High 32-bit overflow multiplication saved in hi register

– Low 32 bits stored in low register.

Specific example:

Division Instruction

Lệnh Ví dụ Ý nghĩa
Divide div $2,$3 $hi,$low=$2/$3 Kết quả được lưu trong thanh ghi hi

Thươn số được lưu trong thanh ghi low

 

Alright, I’m too lazy to capture images for this part 😄. This is similar to the previous images anyway.

Logic Computational Instructions.

Instruction Example Meaning
and and $1,$2,$3 $1=$2&$3 Bitwise AND
or or $1,$2,$3 $1=$2|$3 Bitwise OR
xor xor $1,$2,$3 $1 = $2 ??$3 Bitwise XOR
nor nor $1,$2,$3 $1 = ~($2 | $3) not of OR Bitwise NOR
and immediate andi $1,$2,100 $1=$2&100 Bitwise AND register, constant number
or immediate or $1,$2,100 $1=$2|100 Bitwise OR register, constant number
xor immediate xori $1, $2,10 $1 = ~$2 &~10 Bitwise XOR register, constant number
shift left logical sll $1,$2,10 $1=$2<<10 Left shift
shift right logical srl $1,$2,10 $1=$2>>10 Right shift

Specific example.

Image when compiled to MIPS Assembly.

Ending Part 2 for the chilly winter here. See you in the next parts ^^.

Vu Van Tien ( aka n0_be3r )

MIPS Assembly Language (P1)

Security for Newbie VSEC - BLOG

First of all, I’d like to warmly welcome all of you who found out about my blog to read what I write here         (＾∀＾●）ﾉｼ. You might wonder why I’m writing about this MIPS assembly language, as it’s not exactly a new topic and I’m writing about it again 🙁. The reason here is that I’m currently interested in researching and exploring the intricacies of IoT devices (especially Wi-Fi routers). So, as you might already know, IoT devices often use the MIPS architecture for their RISC instruction set.

Speaking of instruction sets, there are two types: CISC and RISC.

  • CISC is mainly used in personal computers and servers because its instruction set is extensive and quite complex, leading to resource and power consumption. That’s why IoT devices aren’t so exciting?)
  • In contrast, RISC is less and simpler, consuming fewer resources and less power, making it suitable for IoT devices or mobile devices.

Enough of that babble, let’s dive into today’s main topic.

MIPS assembly language.

After several upgrades, MIPS now has two versions: 32-bit and 64-bit. However, this article and later I will concentrate solely on the 32-bit version because of the simplicity, and I’m also learning about it, so please understand ^^.

MIPS has a total of 32 registers for storing values, numbered from 0 to 31, along with a common convention when used. Among them, register 0 is always hard-assigned with the value 0.

Register Common Name Meaning
$0 $zero The registers always contain the value 0
$1 $at Reserved for assembler
$2 – $3 $v0,$v1 Saves the return values of a function
$4 – $7 $a0-$a3 Saves arguments passed to functions
$8 – $15 $t0 – $t7 Saves temporary variables
$16 – $23 $s0 – $s7 Saves register values
$24 – $25 $t8 – $t9 Similar to registers $8 – $15
$$26 -$27 $k0 – $k1 Reserved for kernel. Not for general use.
$28 $gp Points to the global area (Global Area Pointer)
$29 $sp Stack Pointer
$30 $fp Frame Pointer
$31 $rp Return Address

MIPS Instruction Format:

In some processors, particularly CISC processors, the size of an instruction varies based on the instruction itself and its operands.

However, MIPS, like most RISC processors, employs fixed-length instruction formats. All MIPS instructions are precisely 32 bits long. The fixed-length instructions provide the advantage of simpler instruction fetching, which translates to smaller and cheaper processors. Simpler and smaller leads to faster performance, lower power consumption, and reduced production costs.

Register Instructions:

Register instructions involve two source registers and one destination register.

Register Instruction Format.

Opcode Source 1 Source 2 Destination Shift Amount Function
000000 5 bits 5 bits 5 bits 5 bits 6 bits

 

Explanation:

Opcode (6 bits): This register contains 6 bits set to 0, indicating that this is a register instruction (RI).

Function (6 bits): This register uses 6 bits to differentiate between different instruction types.

Source 1, Source 2 (10 bits): These two registers, each consisting of 10 bits, represent the source registers used for performing computations.

Destination (5 bits): This field stores the computed result.

Shift Amount (5 bits): The number of bits to shift left or right when there’s a bit shift instruction

Example: add $t3, $t4, $t1

Where: $t3 = 11, $t4 = 12, $t1 = 9

000000 01100 01001 01011 00000 10000
RI $t4 $t1 $t3 unused add

 

Jump Instructions

Opcode Target Offset
0001xx 26 bits

 

In the case if the leftmost 6 bits are 00001x, then this is an unconditional jump instruction.

Example:

000010 xxxxxxxxxxxxxxxxxxxxxxxxxx ~ j label

000011 xxxxxxxxxxxxxxxxxxxxxxxxxx ~ jal label

 

Looking at this, you might wonder how, with 26 bits, it’s possible to jump to the 32-bit destination address. The target address expansion to 32 bits occurs dynamically at runtime when the jump instruction is executed. The destination address field converts to a 32-bit address, be occurs at runtime when the jump instruction is executed.

Coprocessor Instructions

If the leftmost 6 bits are 0100xx, the instruction is processed by the coprocessor (an extension for the basic MIPS CPU). The last two bits represent the coprocessor.

Opcode Source 1 Source 2 Destination Shift Amount Function
0100xx 5 bits 5 bits 5 bits 5 bits 6 bits

 

 

Immediate Instructions

If the leftmost 6 bits differ from all above, the instruction is used for the immediate format.

Immediate instructions use one source register, one destination register, and a 16-bit immediate operand.

The immediate operand is limited to 16 bits, allowing unsigned values from 0 to 65535 or signed values from -32768 to 32767 (MIPS processors use two’s complement for signed operands).

Opcode Source Destination Immediate Operand
0100xx 5 bits 5 bits 16 bits

 

For example: addi $t1, $t5, 7

Opcode Source Destination Immediate Operand
001000 sssss ttttt 0000000000000111
addi $t1 $t5 7

 

And that concludes the article. The main purpose of this piece was to provide a brief and general introduction to the MIPS assembly language. In the upcoming articles, I will explai the details of the instructions that I consider crucial within MIPS :D. This will be a long-term series, so if you find it informative, please giving me a like and subscribe ^^.

Reference link:

https://chortle.ccsu.edu/AssemblyTutorial/index.html

https://en.wikipedia.org/wiki/MIPS_architecture