Questions tagged [intel]
The intel tag has no usage guidance.
36 questions
0
votes
1
answer
146
views
Mnemonic suffixes for x86-64 assembly for AT&T syntax
I'm trying to understand suffixes used for the AT&T syntax for the x64 assembly used for instruction mnemonics.
For regular cases:
'b', // 8_bit
'w', // 16_bit
'l', // 32_bit
'q', /...
- 1,761
11
votes
2
answers
4k
views
Why did Intel chose 90h machine code for their NOP instruction instead of a 0?
Probably just a historical question, if anyone knows.
- 1,761
2
votes
0
answers
98
views
Intel Pintools: How to count the number of static and basic blocks?
I am using Intel Pintool BBLs to count the total number of static and dynamic basic blocks.
The below is the distinguish between static vs dynamic basic blocks (bbls):
A dynamic basic block is ...
- 41
2
votes
2
answers
674
views
If i disable a few CPU cores on my laptop how exactly does it work?
I have a 1280P Intel processor and I am running Ubuntu, i notice that i have a little to much power for my everyday task and have been debating on disabling a few CPU cores/threads to see if it will ...
1
vote
0
answers
59
views
Is there any available source code which is Windows 64 bit compatible that can disassemble binary code?
I'm writing a program that takes as input a single byte of binary (machine code from code segment) and converts it into assembly. I've done some searching online but have yet to find anything helpful. ...
- 11
3
votes
1
answer
123
views
What is the outcome of mov on non bracket memory locations?
I am having problems distinguishing whether the address is loaded or the content from the address. Please help me clarify.
1. mov [rsp+78h+arg_0], rsi
2. mov rsi, cs:qword_1F39B60
3. mov [...
- 35
1
vote
0
answers
84
views
Normal artifact or something else?
I'm working on a Linux ELF challenge.
I have found this bit of code in the .text disassembly using objdump -d -M intel program
922: 83 c4 10 add esp,0x10
925: c7 45 f4 00 00 00 ...
- 141
0
votes
1
answer
58
views
How does this function take the argument if its not pushed into the stack?
I dont understand how does the function take the argument without pushing
push ebp
mov ebp, esp
and esp, 0FFFFFFF0h
sub esp, 20h
mov [esp+20h+var_20], offset aEnterX ; "Enter X:"
call _puts
1
vote
0
answers
33
views
Unable to find the pci device mentioned in the processor datasheet
I have following intel processor 4th Generation Core Processor (Haswell U/Y).
I want to check the value of PMBASE register in the processor. For that I have downloaded the processor datasheet, where I ...
- 51
1
vote
1
answer
326
views
jmp $+5, why the jump
I am looking at some code that has jmp $+5 instruction at the beginning of the entry code in a library, right after pushing registers to the stack. I understand that jmp $+5 puts IP at the next ...
- 11
2
votes
1
answer
327
views
Where is the legacy BIOS stored on a UEFI system?
Where is the legacy BIOS (the 16 bit reset code that jumps to the POST entry point at F000:E05B and indeed POST itself and all the BIOS routines) originally stored on a UEFI system before it's ...
- 305
0
votes
0
answers
122
views
Pin DBI tool - Create executable
I'm starting to learn Intel's Pin framework and I can't figure out if it's possible to create an executable.
I mean, rather than creating a module and forcing people to download Pin + the module, is ...
- 1
4
votes
2
answers
679
views
How can I find out what type of processor an Intel Hex file belongs to?
I have a text file and I know that it is a firmware of a device. This file have Intel Hex Format as below:
:03:8000:00:028100FA
:02:8003:00:XXXXXX
:02:800B:00:XXXXXX
:02:8013:00:XXXXXX
:01:801B:00:...
- 207
0
votes
1
answer
135
views
Where are the intel manual x86-16?
I was studying the code for x86-16 operating systems(como DOS),with a desassembler, but I can't find the intel manual on the intel website:
Searching on google, only unofficial sources.
Perhaps the ...
2
votes
2
answers
632
views
What is the equivalent of the dollar sign from jmp $+1 in GAS syntax?
I have an asm program made with intel syntax. In this program, I am using this syntax jz $+1 from INTEL (+gcc), that means that I jump into the jz instruction (which is 2 bytes). I jump 1 byte further ...
- 283
1
vote
2
answers
409
views
Intel ME partitions EFFS and FCRS?
What is the purpose of partitions EFFS and FCRS on systems with Intel ME 8.x?
Is it currently possible to parse data in EFFS partition on a ME image?
I hope anyone can help, there is so little ...
user31201
2
votes
1
answer
263
views
Why base address of GDT(global descriptor table) differ in intel x64 processor?
I have created a simple linux kernel module to get the base address of GDT table:
#include <linux/init.h>
#include <linux/module.h>
#include <linux/const.h>
#include <linux/errno....
- 51
1
vote
0
answers
103
views
Learning Intel Disassembler, What to learn for Intel XED [closed]
In order to learn about disassembly and code something like Capstone disassembler, HDE etc. for a function , calculate opcodes etc , Please advise on what I should know. I have some knowledge of ...
- 11
1
vote
0
answers
318
views
How to interpret binary instruction using the intel manual
OK. So I am really trying to figure out how to use the "Intel 64 and IA-32 Architectures Software Developer's Manual" for myself, since it seems like the authoritative source for x86(_64) machine code....
- 129
1
vote
1
answer
1k
views
Loading 8051 binary to IDA with ROM+External RAM configuration
I have 8051 firmware file, in 8051 ROM addresses can overlap external RAM addresses(movc and movx solve this issue), however IDA doesn't allow overlapping addresses:
In this example the ROM size is ...
- 41
1
vote
1
answer
2k
views
Understand the CPU cycles of x86 instruction bsr/bsf
I am on the hook to analysis some "timing channels" of some x86 binary code. I am posting one question to comprehend bsf/bsr opcode.
So high-levelly, these two opcodes can be modeled as a "loop", ...
- 2,485
4
votes
1
answer
3k
views
How do the PSHUFLW and PSHUFD instructions work?
I have been trying to figure out exactly what is happening with these instructions and can't make sense of them. I can see that the PSHUFLW instruction acts upon the first 16 bytes of the XMM register ...
- 43
4
votes
1
answer
698
views
Undocumented MSR Machine Specific register
I'm reversing the BIOS of my laptop, for fun and for learning something new.
Inside it, I just stepped into this piece of code:
mov ecx, 13Ah
rdmsr
and eax, 1
jnz SkipCacheAsRAM
Looking ...
- 335
3
votes
1
answer
337
views
Basic hello world stack manipulation troubles
I'm a beginner in reverse engineering, and as a beginner I started to read "Reverse Engineering for beginers".
Here is the hello world program from the book (taken from chapter 3, page 12) :
Now ...
- 283
3
votes
1
answer
3k
views
NASM, MASM, Intel, AT&T' syntax?
I see word NASM, MASM, Intel, AT&T. I am confused between them. Is it different types of assembly?
- 333
0
votes
1
answer
563
views
IDA Pro Address doesn't correlate to Immunity Debugger address
I'm trying to use immunity debugger to step through a confusing binary.
When I open it in IDA Pro, I see certain addresses next to the instructions:
.text:01001392 inc eax
When I ...
- 1
5
votes
2
answers
10k
views
What does XREF mean?
I have been learning about the x86 assembly language by analyzing a binary using radare2 that is stored on a Intel 80386 machine. When I have been analyzing functions on the binary, I noticed that "...
- 225
1
vote
2
answers
761
views
Intel PIN (TracerPIN): adding modification of registers
Basically I just would like to modify the following code: https://github.com/SideChannelMarvels/Tracer/tree/master/TracerPIN
(based on Intel PIN) in order to be able to modify the content of some ...
- 13
1
vote
0
answers
3k
views
Reverse Intel hex to programming code
I have a file in the Intel hex format, which was taken of from a pic16F1705 chip. I need to find a way to disassemble it into some form of human friendly programming language in order to make some ...
- 11
0
votes
1
answer
827
views
How to debug Portable executable for AMD64 in IDA PRO?
How can I debug Portable executable for AMD64 in IDA PRO if I have Intel processor?
- 3
1
vote
1
answer
2k
views
Optimized vs Unoptimized code comparison
After reading a number of blog posts, forums, and watching tutorials I figured I would start learning to reverse software the old fashion way. Creating simple C files and looking at their disassembly....
- 175
1
vote
1
answer
602
views
Basic assembly query [closed]
I wrote a program which will add two numbers in assembly.
When I do a system call for scanf(), the instruction looks like this:
mov rcx, num1
Note: I have defined num1 in the bss section as:
num1 ...
- 21
0
votes
1
answer
194
views
Detecting user<->kernel transitions with hypervisor
Is it possible to use a hypervisor to trap all ring0<->ring3 transitions (both 0->3 and 3->0)?
2
votes
1
answer
533
views
igdlh64.inf modify custom resolution
I have some dead pixels in top couple of rows of my cheap Win 10 tablet. To alleviate that, I wanted to use the custom resolution option in Intel graphics management panel, however, I cannot choose ...
- 131
0
votes
1
answer
160
views
Intel PIN and nm unable to capture binary symbols
I'm trying to generate a log of all identified symbols in a binary file. The application i'm trying to inspect is busybox. I've created a Pin Tool that successfully captures symbols (no demangling) ...
0
votes
2
answers
3k
views
Intel syntax - Meaning of jmp/call instruction with $+5 operand
I'm currently parsing a lot of assembly files and don't understand a specific jmp or call with $+5 as operand:
call $+5
jmp $+5
To provide more context I grepped some of the occurrences:
mov esp, [...
- 1,257