Questions tagged [intel]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
108 views

Mnemonic suffixes for x86-64 assembly for AT&T syntax

I'm trying to understand suffixes used for the AT&T syntax for the x64 assembly used for instruction mnemonics. For regular cases: 'b', // 8_bit 'w', // 16_bit 'l', // 32_bit 'q', /...
c00000fd's user avatar
  • 1,649
11 votes
2 answers
4k views

Why did Intel chose 90h machine code for their NOP instruction instead of a 0?

Probably just a historical question, if anyone knows.
c00000fd's user avatar
  • 1,649
2 votes
0 answers
88 views

Intel Pintools: How to count the number of static and basic blocks?

I am using Intel Pintool BBLs to count the total number of static and dynamic basic blocks. The below is the distinguish between static vs dynamic basic blocks (bbls): A dynamic basic block is ...
Tony Nguyen's user avatar
2 votes
2 answers
516 views

If i disable a few CPU cores on my laptop how exactly does it work?

I have a 1280P Intel processor and I am running Ubuntu, i notice that i have a little to much power for my everyday task and have been debating on disabling a few CPU cores/threads to see if it will ...
StacyVlanglydu's user avatar
1 vote
0 answers
58 views

Is there any available source code which is Windows 64 bit compatible that can disassemble binary code?

I'm writing a program that takes as input a single byte of binary (machine code from code segment) and converts it into assembly. I've done some searching online but have yet to find anything helpful. ...
vSm's user avatar
  • 11
3 votes
1 answer
118 views

What is the outcome of mov on non bracket memory locations?

I am having problems distinguishing whether the address is loaded or the content from the address. Please help me clarify. 1. mov [rsp+78h+arg_0], rsi 2. mov rsi, cs:qword_1F39B60 3. mov [...
Sawb's user avatar
  • 35
1 vote
0 answers
82 views

Normal artifact or something else?

I'm working on a Linux ELF challenge. I have found this bit of code in the .text disassembly using objdump -d -M intel program 922: 83 c4 10 add esp,0x10 925: c7 45 f4 00 00 00 ...
Mr. Kelsey's user avatar
0 votes
1 answer
56 views

How does this function take the argument if its not pushed into the stack?

I dont understand how does the function take the argument without pushing push ebp mov ebp, esp and esp, 0FFFFFFF0h sub esp, 20h mov [esp+20h+var_20], offset aEnterX ; "Enter X:" call _puts
jackthejones's user avatar
1 vote
0 answers
32 views

Unable to find the pci device mentioned in the processor datasheet

I have following intel processor 4th Generation Core Processor (Haswell U/Y). I want to check the value of PMBASE register in the processor. For that I have downloaded the processor datasheet, where I ...
shubham0d's user avatar
1 vote
1 answer
293 views

jmp $+5, why the jump

I am looking at some code that has jmp $+5 instruction at the beginning of the entry code in a library, right after pushing registers to the stack. I understand that jmp $+5 puts IP at the next ...
Igor's user avatar
  • 11
2 votes
1 answer
304 views

Where is the legacy BIOS stored on a UEFI system?

Where is the legacy BIOS (the 16 bit reset code that jumps to the POST entry point at F000:E05B and indeed POST itself and all the BIOS routines) originally stored on a UEFI system before it's ...
Lewis Kelsey's user avatar
0 votes
0 answers
120 views

Pin DBI tool - Create executable

I'm starting to learn Intel's Pin framework and I can't figure out if it's possible to create an executable. I mean, rather than creating a module and forcing people to download Pin + the module, is ...
Reginas's user avatar
4 votes
2 answers
631 views

How can I find out what type of processor an Intel Hex file belongs to?

I have a text file and I know that it is a firmware of a device. This file have Intel Hex Format as below: :03:8000:00:028100FA :02:8003:00:XXXXXX :02:800B:00:XXXXXX :02:8013:00:XXXXXX :01:801B:00:...
Ebrahim Ghasemi's user avatar
0 votes
1 answer
130 views

Where are the intel manual x86-16?

I was studying the code for x86-16 operating systems(como DOS),with a desassembler, but I can't find the intel manual on the intel website: Searching on google, only unofficial sources. Perhaps the ...
Loliconaoquadrado's user avatar
2 votes
2 answers
580 views

What is the equivalent of the dollar sign from jmp $+1 in GAS syntax?

I have an asm program made with intel syntax. In this program, I am using this syntax jz $+1 from INTEL (+gcc), that means that I jump into the jz instruction (which is 2 bytes). I jump 1 byte further ...
Nark's user avatar
  • 283
1 vote
2 answers
371 views

Intel ME partitions EFFS and FCRS?

What is the purpose of partitions EFFS and FCRS on systems with Intel ME 8.x? Is it currently possible to parse data in EFFS partition on a ME image? I hope anyone can help, there is so little ...
user avatar
2 votes
1 answer
256 views

Why base address of GDT(global descriptor table) differ in intel x64 processor?

I have created a simple linux kernel module to get the base address of GDT table: #include <linux/init.h> #include <linux/module.h> #include <linux/const.h> #include <linux/errno....
shubham0d's user avatar
1 vote
0 answers
101 views

Learning Intel Disassembler, What to learn for Intel XED [closed]

In order to learn about disassembly and code something like Capstone disassembler, HDE etc. for a function , calculate opcodes etc , Please advise on what I should know. I have some knowledge of ...
Heisan's user avatar
  • 11
1 vote
0 answers
306 views

How to interpret binary instruction using the intel manual

OK. So I am really trying to figure out how to use the "Intel 64 and IA-32 Architectures Software Developer's Manual" for myself, since it seems like the authoritative source for x86(_64) machine code....
pooley1994's user avatar
1 vote
1 answer
1k views

Loading 8051 binary to IDA with ROM+External RAM configuration

I have 8051 firmware file, in 8051 ROM addresses can overlap external RAM addresses(movc and movx solve this issue), however IDA doesn't allow overlapping addresses: In this example the ROM size is ...
Kinetics332's user avatar
1 vote
1 answer
2k views

Understand the CPU cycles of x86 instruction bsr/bsf

I am on the hook to analysis some "timing channels" of some x86 binary code. I am posting one question to comprehend bsf/bsr opcode. So high-levelly, these two opcodes can be modeled as a "loop", ...
lllllllllllll's user avatar
4 votes
1 answer
2k views

How do the PSHUFLW and PSHUFD instructions work?

I have been trying to figure out exactly what is happening with these instructions and can't make sense of them. I can see that the PSHUFLW instruction acts upon the first 16 bytes of the XMM register ...
Ando's user avatar
  • 43
4 votes
1 answer
641 views

Undocumented MSR Machine Specific register

I'm reversing the BIOS of my laptop, for fun and for learning something new. Inside it, I just stepped into this piece of code: mov ecx, 13Ah rdmsr and eax, 1 jnz SkipCacheAsRAM Looking ...
Alessandro's user avatar
3 votes
1 answer
323 views

Basic hello world stack manipulation troubles

I'm a beginner in reverse engineering, and as a beginner I started to read "Reverse Engineering for beginers". Here is the hello world program from the book (taken from chapter 3, page 12) : Now ...
Nark's user avatar
  • 283
2 votes
1 answer
3k views

NASM, MASM, Intel, AT&T' syntax?

I see word NASM, MASM, Intel, AT&T. I am confused between them. Is it different types of assembly?
QChí Nguyễn's user avatar
0 votes
1 answer
557 views

IDA Pro Address doesn't correlate to Immunity Debugger address

I'm trying to use immunity debugger to step through a confusing binary. When I open it in IDA Pro, I see certain addresses next to the instructions: .text:01001392 inc eax When I ...
Nick's user avatar
  • 1
5 votes
2 answers
9k views

What does XREF mean?

I have been learning about the x86 assembly language by analyzing a binary using radare2 that is stored on a Intel 80386 machine. When I have been analyzing functions on the binary, I noticed that "...
Darien Springer's user avatar
1 vote
2 answers
739 views

Intel PIN (TracerPIN): adding modification of registers

Basically I just would like to modify the following code: https://github.com/SideChannelMarvels/Tracer/tree/master/TracerPIN (based on Intel PIN) in order to be able to modify the content of some ...
john_antman's user avatar
1 vote
0 answers
3k views

Reverse Intel hex to programming code

I have a file in the Intel hex format, which was taken of from a pic16F1705 chip. I need to find a way to disassemble it into some form of human friendly programming language in order to make some ...
Radi's user avatar
  • 11
0 votes
1 answer
801 views

How to debug Portable executable for AMD64 in IDA PRO?

How can I debug Portable executable for AMD64 in IDA PRO if I have Intel processor?
LOGA's user avatar
  • 3
1 vote
1 answer
2k views

Optimized vs Unoptimized code comparison

After reading a number of blog posts, forums, and watching tutorials I figured I would start learning to reverse software the old fashion way. Creating simple C files and looking at their disassembly....
ButtahNBred's user avatar
1 vote
1 answer
592 views

Basic assembly query [closed]

I wrote a program which will add two numbers in assembly. When I do a system call for scanf(), the instruction looks like this: mov rcx, num1 Note: I have defined num1 in the bss section as: num1 ...
Atply's user avatar
  • 21
0 votes
1 answer
192 views

Detecting user<->kernel transitions with hypervisor

Is it possible to use a hypervisor to trap all ring0<->ring3 transitions (both 0->3 and 3->0)?
user20825's user avatar
2 votes
1 answer
525 views

igdlh64.inf modify custom resolution

I have some dead pixels in top couple of rows of my cheap Win 10 tablet. To alleviate that, I wanted to use the custom resolution option in Intel graphics management panel, however, I cannot choose ...
keoxkeox's user avatar
  • 131
0 votes
1 answer
155 views

Intel PIN and nm unable to capture binary symbols

I'm trying to generate a log of all identified symbols in a binary file. The application i'm trying to inspect is busybox. I've created a Pin Tool that successfully captures symbols (no demangling) ...
Gabriel Vasconcelos's user avatar
0 votes
2 answers
2k views

Intel syntax - Meaning of jmp/call instruction with $+5 operand

I'm currently parsing a lot of assembly files and don't understand a specific jmp or call with $+5 as operand: call $+5 jmp $+5 To provide more context I grepped some of the occurrences: mov esp, [...
knx's user avatar
  • 1,257