Questions tagged [amd64]

A family of instruction set architectures originally designed by AMD to extend the Intel x86 instruction set to 64bits CPUs.

Filter by
Sorted by
Tagged with
83
votes
2answers
64k views

What is PLT/GOT?

From time to time, when disassembling x86 binaries, I stumble on reference to PLT and GOT, especially when calling procedures from a dynamic library. For example, when running a program in gdb: (gdb)...
62
votes
3answers
96k views

How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?

I try to understand the process of memory segmentation for the i386 and amd64 architectures on Linux. It seems that this is heavily related to the segment registers %fs, %gs, %cs, %ss, %ds, %es. Can ...
24
votes
4answers
24k views

What is the meaning of movabs in gas/x86 AT&T syntax?

I just found a strange instruction by assembling (with gas) and disassembling (with objdump) on a amd64 architecture. The original amd64 assembly code is: mov 0x89abcdef, %al And, after gas ...
8
votes
1answer
125 views

AMD64 compiler optimizations with register manipulations

AMD64 (aka x86-64 or x64) registers can be accessed 8, 16, 32 or 64 bits at a time. When reading a disassembly listing, what register operations are not straightforward? For example, when an ...
4
votes
1answer
1k views

x86-64 bit Buffer Overflow, help with overwriting %rip

I am trying to get a buffer overflow exploit to work on Ubuntu 16.04 LTS 64bit. To this end I use the following vulnerable program: #include <stdio.h> #include <string.h> #include <...
4
votes
1answer
451 views

Tools for RE OpenCL Kernel

I have an OpenCL 2.0 program with various .bin files that I would like to reverse. file shows: $> file k.bin k.bin: ELF 64-bit LSB executable, *unknown arch 0x40c* version 1 (SYSV), corrupted ...
3
votes
1answer
2k views

Understanding Program Arguments on the Stack in Assembly

To self-teach myself reverse engineering, I am writing small C programs and reversing them in order to understands how the compiler sees my code. However, I am having quite tough time understanding ...
3
votes
2answers
7k views

When was the MOVABS instruction introduced?

When trying to write an instruction set analysis tool for disassembled code (https://superuser.com/a/832440/384221) I have found opcode MOVABS which was not included in my opcode source database (...
3
votes
1answer
2k views

Moving integer to xmm register

I was looking at a game code, and I saw the following: 0x171 mov [rbp-30],r12w .... 0x210 movups xmm0,[rbp-30] I am pretty sure that r12 is an integer here (equals 5). So, is it moving an ...
2
votes
2answers
430 views

Stuck in x87 FLD instruction

I've been working for my final project which is a disassembler for AMD64 instruction set, and i was trying to disassemble machine code by hand to understand it correctly. But i got stuck at a x87 ...
2
votes
1answer
128 views

EIP not in known module, under WOW64

I'm using WinDbg to debug a program under WOW64 (OS is x64, app is 32-bit). I came across some indirect call inside the process module (module created by the app and not Windows), and started ...
2
votes
1answer
186 views

Is miasm working on 64bits architecture? [closed]

I am trying to use Miasm to reverse some binaries in i386 and amd64 instruction sets, but I encounter a few problem when using it. First, the installation phase went nice. I managed to install tinycc ...
2
votes
1answer
270 views

Debugging Binary using Far Ret to switch Code Segment

It appears that GDB is unable to handle binaries which switch code segments. Using pwntools*, it's trivial to generate a 32-bit intel binary which uses retf to switch to the 64-bit code segment. ...
1
vote
3answers
798 views

Without push instructions [duplicate]

If I pass an argument to a function, it should be translated in assembly language into push something. I coded the following in C: #include <stdio.h> int sum(int a, int b,int c) { int ...
1
vote
1answer
94 views

Is it possible to restart over a program by calling an entry point function?

I was wondering if it was possible to restart a program (ignoring previously mapped files) with different argument by either calling main() or a glibc entry point function.
1
vote
1answer
1k views

Intel PIN: How to log the value of the fs and gs registers at every instruction?

I modified the pinatrace pintool example and managed to log all values of the "regular" registers: VOID Instruction(INS ins, VOID *v) { ... // Instrument REGISTER writes using a predicated call, i....
1
vote
1answer
237 views

Is it possible to rebuild an nexe file if I can read at arbitrary untrusted memory addresses?

Ok, I’m in a remote situation where I don’t have access to the remote filesystem but where I can run arbitrary python code (except I can’t fork processes and I don’t have access to ulimit and uname). ...
1
vote
0answers
44 views

ASUS Strix Vega 56 or 64

I'm in the process of creating ASUS AURA drivers for Linux. I'm hoping somebody here has access to a Strix version of the Vega 56 or 64 on a windows machine? If you do, would you please dump the smbus....
0
votes
2answers
208 views

How to obtain memory address of string literal?

I am trying to find where a specific string literal is used in a compiled program. I have already found the location of this string literal within the executable; I want to somehow deduce what the ...
0
votes
1answer
364 views

How to debug Portable executable for AMD64 in IDA PRO?

How can I debug Portable executable for AMD64 in IDA PRO if I have Intel processor?