Questions tagged [amd64]
A family of instruction set architectures originally designed by AMD to extend the Intel x86 instruction set to 64bits CPUs.
21
questions
96
votes
2answers
74k views
What is PLT/GOT?
From time to time, when disassembling x86 binaries, I stumble on
reference to PLT and GOT, especially when calling procedures from a
dynamic library.
For example, when running a program in gdb:
(gdb)...
69
votes
3answers
104k views
How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?
I try to understand the process of memory segmentation for the i386 and amd64 architectures on Linux. It seems that this is heavily related to the segment registers %fs, %gs, %cs, %ss, %ds, %es.
Can ...
27
votes
4answers
27k views
What is the meaning of movabs in gas/x86 AT&T syntax?
I just found a strange instruction by assembling (with gas) and disassembling (with objdump) on a amd64 architecture.
The original amd64 assembly code is:
mov 0x89abcdef, %al
And, after gas ...
8
votes
1answer
128 views
AMD64 compiler optimizations with register manipulations
AMD64 (aka x86-64 or x64) registers can be accessed 8, 16, 32 or 64 bits at a time. When reading a disassembly listing, what register operations are not straightforward?
For example, when an ...
4
votes
2answers
8k views
When was the MOVABS instruction introduced?
When trying to write an instruction set analysis tool for disassembled code (https://superuser.com/a/832440/384221) I have found opcode MOVABS which was not included in my opcode source database (...
4
votes
1answer
2k views
x86-64 bit Buffer Overflow, help with overwriting %rip
I am trying to get a buffer overflow exploit to work on Ubuntu 16.04 LTS 64bit.
To this end I use the following vulnerable program:
#include <stdio.h>
#include <string.h>
#include <...
4
votes
1answer
4k views
Moving integer to xmm register
I was looking at a game code, and I saw the following:
0x171 mov [rbp-30],r12w
....
0x210 movups xmm0,[rbp-30]
I am pretty sure that r12 is an integer here (equals 5). So, is it moving an ...
4
votes
1answer
653 views
Tools for RE OpenCL Kernel
I have an OpenCL 2.0 program with various .bin files that I would like to reverse. file shows:
$> file k.bin
k.bin: ELF 64-bit LSB executable, *unknown arch 0x40c* version 1 (SYSV),
corrupted ...
3
votes
1answer
3k views
Understanding Program Arguments on the Stack in Assembly
To self-teach myself reverse engineering, I am writing small C programs and reversing them in order to understands how the compiler sees my code. However, I am having quite tough time understanding ...
2
votes
2answers
494 views
Stuck in x87 FLD instruction
I've been working for my final project which is a disassembler for AMD64 instruction set, and i was trying to disassemble machine code by hand to understand it correctly. But i got stuck at a x87 ...
2
votes
1answer
136 views
EIP not in known module, under WOW64
I'm using WinDbg to debug a program under WOW64 (OS is x64, app is 32-bit).
I came across some indirect call inside the process module (module created by the app and not Windows), and started ...
2
votes
1answer
189 views
Is miasm working on 64bits architecture? [closed]
I am trying to use Miasm to reverse some binaries in i386 and amd64 instruction sets, but I encounter a few problem when using it.
First, the installation phase went nice. I managed to install tinycc ...
2
votes
1answer
334 views
Debugging Binary using Far Ret to switch Code Segment
It appears that GDB is unable to handle binaries which switch code segments.
Using pwntools*, it's trivial to generate a 32-bit intel binary which uses retf to switch to the 64-bit code segment. ...
1
vote
3answers
854 views
Without push instructions [duplicate]
If I pass an argument to a function, it should be translated in assembly language into push something. I coded the following in C:
#include <stdio.h>
int sum(int a, int b,int c)
{
int ...
1
vote
1answer
52 views
How to Insert Call to Already Imported Function in amd64 Windows DLL using IDA Pro?
I am trying to patch a function in 64-bit Windows DLL to load data I have inserted into the resource table of the DLL. I want to insert code something like this:
mov r8d, 0Ah ; lpType
mov ...
1
vote
1answer
98 views
Is it possible to restart over a program by calling an entry point function?
I was wondering if it was possible to restart a program (ignoring previously mapped files) with different argument by either calling main() or a glibc entry point function.
1
vote
1answer
1k views
Intel PIN: How to log the value of the fs and gs registers at every instruction?
I modified the pinatrace pintool example and managed to log all values of the "regular" registers:
VOID Instruction(INS ins, VOID *v)
{
...
// Instrument REGISTER writes using a predicated ...
1
vote
1answer
270 views
Is it possible to rebuild an nexe file if I can read at arbitrary untrusted memory addresses?
Ok, I’m in a remote situation where I don’t have access to the remote filesystem but where I can run arbitrary python code (except I can’t fork processes and I don’t have access to ulimit and uname).
...
1
vote
0answers
46 views
ASUS Strix Vega 56 or 64
I'm in the process of creating ASUS AURA drivers for Linux. I'm hoping somebody here has access to a Strix version of the Vega 56 or 64 on a windows machine? If you do, would you please dump the smbus....
0
votes
2answers
300 views
How to obtain memory address of string literal?
I am trying to find where a specific string literal is used in a compiled program. I have already found the location of this string literal within the executable; I want to somehow deduce what the ...
0
votes
1answer
431 views
How to debug Portable executable for AMD64 in IDA PRO?
How can I debug Portable executable for AMD64 in IDA PRO if I have Intel processor?
