Questions tagged [intel]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
2answers
45 views

What is the equivalent of the dollar sign from jmp $+1 in GAS syntax?

I have an asm program made with intel syntax. In this program, I am using this syntax jz $+1 from INTEL (+gcc), that means that I jump into the jz instruction (which is 2 bytes). I jump 1 byte further ...
1
vote
2answers
124 views

Intel ME partitions EFFS and FCRS?

What is the purpose of partitions EFFS and FCRS on systems with Intel ME 8.x? Is it currently possible to parse data in EFFS partition on a ME image? I hope anyone can help, there is so little ...
2
votes
1answer
54 views

Why base address of GDT(global descriptor table) differ in intel x64 processor?

I have created a simple linux kernel module to get the base address of GDT table: #include <linux/init.h> #include <linux/module.h> #include <linux/const.h> #include <linux/errno....
1
vote
0answers
36 views

Learning Intel Disassembler, What to learn for Intel XED [closed]

In order to learn about disassembly and code something like Capstone disassembler, HDE etc. for a function , calculate opcodes etc , Please advise on what I should know. I have some knowledge of ...
1
vote
0answers
81 views

How to interpret binary instruction using the intel manual

OK. So I am really trying to figure out how to use the "Intel 64 and IA-32 Architectures Software Developer's Manual" for myself, since it seems like the authoritative source for x86(_64) machine code....
1
vote
1answer
140 views

Loading 8051 binary to IDA with ROM+External RAM configuration

I have 8051 firmware file, in 8051 ROM addresses can overlap external RAM addresses(movc and movx solve this issue), however IDA doesn't allow overlapping addresses: In this example the ROM size is ...
1
vote
1answer
567 views

Understand the CPU cycles of x86 instruction bsr/bsf

I am on the hook to analysis some "timing channels" of some x86 binary code. I am posting one question to comprehend bsf/bsr opcode. So high-levelly, these two opcodes can be modeled as a "loop", ...
2
votes
1answer
514 views

How do the PSHUFLW and PSHUFD instructions work?

I have been trying to figure out exactly what is happening with these instructions and can't make sense of them. I can see that the PSHUFLW instruction acts upon the first 16 bytes of the XMM register ...
4
votes
1answer
236 views

Undocumented MSR Machine Specific register

I'm reversing the BIOS of my laptop, for fun and for learning something new. Inside it, I just stepped into this piece of code: mov ecx, 13Ah rdmsr and eax, 1 jnz SkipCacheAsRAM Looking ...
3
votes
1answer
164 views

Basic hello world stack manipulation troubles

I'm a beginner in reverse engineering, and as a beginner I started to read "Reverse Engineering for beginers". Here is the hello world program from the book (taken from chapter 3, page 12) : Now ...
1
vote
1answer
1k views

NASM, MASM, Intel, AT&T' syntax?

I see word NASM, MASM, Intel, AT&T. I am confused between them. Is it different types of assembly?
0
votes
1answer
363 views

IDA Pro Address doesn't correlate to Immunity Debugger address

I'm trying to use immunity debugger to step through a confusing binary. When I open it in IDA Pro, I see certain addresses next to the instructions: .text:01001392 inc eax When I ...
3
votes
2answers
3k views

What does XREF mean?

I have been learning about the x86 assembly language by analyzing a binary using radare2 that is stored on a Intel 80386 machine. When I have been analyzing functions on the binary, I noticed that "...
1
vote
2answers
367 views

Intel PIN (TracerPIN): adding modification of registers

Basically I just would like to modify the following code: https://github.com/SideChannelMarvels/Tracer/tree/master/TracerPIN (based on Intel PIN) in order to be able to modify the content of some ...
1
vote
0answers
907 views

Reverse Intel hex to programming code

I have a file in the Intel hex format, which was taken of from a pic16F1705 chip. I need to find a way to disassemble it into some form of human friendly programming language in order to make some ...
0
votes
1answer
424 views

How to debug Portable executable for AMD64 in IDA PRO?

How can I debug Portable executable for AMD64 in IDA PRO if I have Intel processor?
1
vote
1answer
642 views

Optimized vs Unoptimized code comparison

After reading a number of blog posts, forums, and watching tutorials I figured I would start learning to reverse software the old fashion way. Creating simple C files and looking at their disassembly....
1
vote
1answer
482 views

Basic assembly query [closed]

I wrote a program which will add two numbers in assembly. When I do a system call for scanf(), the instruction looks like this: mov rcx, num1 Note: I have defined num1 in the bss section as: num1 ...
0
votes
1answer
157 views

Detecting user<->kernel transitions with hypervisor

Is it possible to use a hypervisor to trap all ring0<->ring3 transitions (both 0->3 and 3->0)?
2
votes
1answer
352 views

igdlh64.inf modify custom resolution

I have some dead pixels in top couple of rows of my cheap Win 10 tablet. To alleviate that, I wanted to use the custom resolution option in Intel graphics management panel, however, I cannot choose ...
0
votes
1answer
115 views

Intel PIN and nm unable to capture binary symbols

I'm trying to generate a log of all identified symbols in a binary file. The application i'm trying to inspect is busybox. I've created a Pin Tool that successfully captures symbols (no demangling) ...
0
votes
2answers
2k views

Intel syntax - Meaning of jmp/call instruction with $+5 operand

I'm currently parsing a lot of assembly files and don't understand a specific jmp or call with $+5 as operand: call $+5 jmp $+5 To provide more context I grepped some of the occurrences: mov esp, [...