We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [amd64]

A family of instruction set architectures originally designed by AMD to extend the Intel x86 instruction set to 64bits CPUs.

Filter by
Sorted by
Tagged with
4
votes
1answer
977 views

x86-64 bit Buffer Overflow, help with overwriting %rip

I am trying to get a buffer overflow exploit to work on Ubuntu 16.04 LTS 64bit. To this end I use the following vulnerable program: #include <stdio.h> #include <string.h> #include <...
3
votes
1answer
2k views

Understanding Program Arguments on the Stack in Assembly

To self-teach myself reverse engineering, I am writing small C programs and reversing them in order to understands how the compiler sees my code. However, I am having quite tough time understanding ...
3
votes
1answer
2k views

Moving integer to xmm register

I was looking at a game code, and I saw the following: 0x171 mov [rbp-30],r12w .... 0x210 movups xmm0,[rbp-30] I am pretty sure that r12 is an integer here (equals 5). So, is it moving an ...
0
votes
2answers
207 views

How to obtain memory address of string literal?

I am trying to find where a specific string literal is used in a compiled program. I have already found the location of this string literal within the executable; I want to somehow deduce what the ...
2
votes
1answer
262 views

Debugging Binary using Far Ret to switch Code Segment

It appears that GDB is unable to handle binaries which switch code segments. Using pwntools*, it's trivial to generate a 32-bit intel binary which uses retf to switch to the 64-bit code segment. ...
0
votes
1answer
353 views

How to debug Portable executable for AMD64 in IDA PRO?

How can I debug Portable executable for AMD64 in IDA PRO if I have Intel processor?
1
vote
1answer
93 views

Is it possible to restart over a program by calling an entry point function?

I was wondering if it was possible to restart a program (ignoring previously mapped files) with different argument by either calling main() or a glibc entry point function.
4
votes
1answer
447 views

Tools for RE OpenCL Kernel

I have an OpenCL 2.0 program with various .bin files that I would like to reverse. file shows: $> file k.bin k.bin: ELF 64-bit LSB executable, *unknown arch 0x40c* version 1 (SYSV), corrupted ...
2
votes
2answers
424 views

Stuck in x87 FLD instruction

I've been working for my final project which is a disassembler for AMD64 instruction set, and i was trying to disassemble machine code by hand to understand it correctly. But i got stuck at a x87 ...
1
vote
1answer
1k views

Intel PIN: How to log the value of the fs and gs registers at every instruction?

I modified the pinatrace pintool example and managed to log all values of the "regular" registers: VOID Instruction(INS ins, VOID *v) { ... // Instrument REGISTER writes using a predicated call, i....
1
vote
1answer
236 views

Is it possible to rebuild an nexe file if I can read at arbitrary untrusted memory addresses?

Ok, I’m in a remote situation where I don’t have access to the remote filesystem but where I can run arbitrary python code (except I can’t fork processes and I don’t have access to ulimit and uname). ...
2
votes
1answer
124 views

EIP not in known module, under WOW64

I'm using WinDbg to debug a program under WOW64 (OS is x64, app is 32-bit). I came across some indirect call inside the process module (module created by the app and not Windows), and started ...
1
vote
3answers
785 views

Without push instructions [duplicate]

If I pass an argument to a function, it should be translated in assembly language into push something. I coded the following in C: #include <stdio.h> int sum(int a, int b,int c) { int ...
3
votes
2answers
7k views

When was the MOVABS instruction introduced?

When trying to write an instruction set analysis tool for disassembled code (https://superuser.com/a/832440/384221) I have found opcode MOVABS which was not included in my opcode source database (...
24
votes
4answers
23k views

What is the meaning of movabs in gas/x86 AT&T syntax?

I just found a strange instruction by assembling (with gas) and disassembling (with objdump) on a amd64 architecture. The original amd64 assembly code is: mov 0x89abcdef, %al And, after gas ...
2
votes
1answer
186 views

Is miasm working on 64bits architecture? [closed]

I am trying to use Miasm to reverse some binaries in i386 and amd64 instruction sets, but I encounter a few problem when using it. First, the installation phase went nice. I managed to install tinycc ...
62
votes
3answers
95k views

How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?

I try to understand the process of memory segmentation for the i386 and amd64 architectures on Linux. It seems that this is heavily related to the segment registers %fs, %gs, %cs, %ss, %ds, %es. Can ...
81
votes
2answers
62k views

What is PLT/GOT?

From time to time, when disassembling x86 binaries, I stumble on reference to PLT and GOT, especially when calling procedures from a dynamic library. For example, when running a program in gdb: (gdb)...
8
votes
1answer
125 views

AMD64 compiler optimizations with register manipulations

AMD64 (aka x86-64 or x64) registers can be accessed 8, 16, 32 or 64 bits at a time. When reading a disassembly listing, what register operations are not straightforward? For example, when an ...