4

Currently I am on an x64-based system and have been doing some reverse engineering for a while. However I'm still a newbie, and the biggest issue I keep running into is the memory layout differences. Obviously x64 uses different registers (rax => eax and so on), and allocates more memory for programs. I have used immunity debugger and it seems to run relatively well, but when I go on my Linux-box trying to debug/disassemble is a pain. Would my best bet be to use an x86-based VM or something like that?

Just general advice would be appreciated. Thanks!

Improve this question
3
  • Even if the memory layout is not exactly the same, x64 always has a "32-bits emulation mode", that can run 32-bits applications. So, what are more precisely the differences that you run into when executing a 32-bits application on a 64-bits OS ?
    – perror
    Aug 16, 2013 at 8:23
  • Use a 32bit VM if all you want is to work through a book or a series of blogposts. With any other option you will keep bumping into compatibility issues on all possible levels. It can be annoying.
    – Vitaly Osipov
    Aug 17, 2013 at 5:42
  • Assuming you use Debian/Ubuntu, apt-get install ia32-libs should be enough to run (and debug) most 32-bit executables on an x64 system.
    – Igor Skochinsky ♦
    Aug 17, 2013 at 19:08

2 Answers 2

Reset to default
1

Using a 32bit system would probably be the easiest solution, you can use gdbserver to debug from your main system. However you would probably benefit from learning x64 as 32bit systems are gradually going away. Apart from the different register names/size and the way arguments are passed to the functions due to the stack size being fixed there is not that much difference, you will get used to it after some time.

Improve this answer
1

Most x86_64 OSs provide some mechanism for running 32 bit code. As long as you have the necessary libraries installed, 99% of the time everything will still work from within your standard GDB - no changes necessary. I've never had any issues debugging 32 bit applications on 64 bit, and the workflow was transparent to me, provided I had multilib set up correctly.

That being said, it's always possible to use a 32 bit virtual machine if you feel so inclined. Or, as others have mentioned, you can debug over the network on a dedicated 32 bit test machine.

Also, I suggest editing your question to make it clear that you're talking about x86 vs amd64 - the answer could be different on other architectures that have both 32 bit and 64 bit versions (admittedly, I have no idea about these). EDIT: Disregard - I saw that you wrote x64. Guess my eyes just glazed over the x...

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.