Questions tagged [intel]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
104 views

Mnemonic suffixes for x86-64 assembly for AT&T syntax

I'm trying to understand suffixes used for the AT&T syntax for the x64 assembly used for instruction mnemonics. For regular cases: 'b', // 8_bit 'w', // 16_bit 'l', // 32_bit 'q', /...
11 votes
2 answers
4k views

Why did Intel chose 90h machine code for their NOP instruction instead of a 0?

Probably just a historical question, if anyone knows.
2 votes
2 answers
490 views

If i disable a few CPU cores on my laptop how exactly does it work?

I have a 1280P Intel processor and I am running Ubuntu, i notice that i have a little to much power for my everyday task and have been debating on disabling a few CPU cores/threads to see if it will ...
2 votes
0 answers
83 views

Intel Pintools: How to count the number of static and basic blocks?

I am using Intel Pintool BBLs to count the total number of static and dynamic basic blocks. The below is the distinguish between static vs dynamic basic blocks (bbls): A dynamic basic block is ...
1 vote
0 answers
58 views

Is there any available source code which is Windows 64 bit compatible that can disassemble binary code?

I'm writing a program that takes as input a single byte of binary (machine code from code segment) and converts it into assembly. I've done some searching online but have yet to find anything helpful. ...
3 votes
1 answer
116 views

What is the outcome of mov on non bracket memory locations?

I am having problems distinguishing whether the address is loaded or the content from the address. Please help me clarify. 1. mov [rsp+78h+arg_0], rsi 2. mov rsi, cs:qword_1F39B60 3. mov [...
1 vote
1 answer
293 views

jmp $+5, why the jump

I am looking at some code that has jmp $+5 instruction at the beginning of the entry code in a library, right after pushing registers to the stack. I understand that jmp $+5 puts IP at the next ...
1 vote
0 answers
81 views

Normal artifact or something else?

I'm working on a Linux ELF challenge. I have found this bit of code in the .text disassembly using objdump -d -M intel program 922: 83 c4 10 add esp,0x10 925: c7 45 f4 00 00 00 ...
2 votes
1 answer
3k views

NASM, MASM, Intel, AT&T' syntax?

I see word NASM, MASM, Intel, AT&T. I am confused between them. Is it different types of assembly?
0 votes
1 answer
56 views

How does this function take the argument if its not pushed into the stack?

I dont understand how does the function take the argument without pushing push ebp mov ebp, esp and esp, 0FFFFFFF0h sub esp, 20h mov [esp+20h+var_20], offset aEnterX ; "Enter X:" call _puts
1 vote
0 answers
31 views

Unable to find the pci device mentioned in the processor datasheet

I have following intel processor 4th Generation Core Processor (Haswell U/Y). I want to check the value of PMBASE register in the processor. For that I have downloaded the processor datasheet, where I ...
2 votes
1 answer
303 views

Where is the legacy BIOS stored on a UEFI system?

Where is the legacy BIOS (the 16 bit reset code that jumps to the POST entry point at F000:E05B and indeed POST itself and all the BIOS routines) originally stored on a UEFI system before it's ...
0 votes
0 answers
120 views

Pin DBI tool - Create executable

I'm starting to learn Intel's Pin framework and I can't figure out if it's possible to create an executable. I mean, rather than creating a module and forcing people to download Pin + the module, is ...
4 votes
2 answers
627 views

How can I find out what type of processor an Intel Hex file belongs to?

I have a text file and I know that it is a firmware of a device. This file have Intel Hex Format as below: :03:8000:00:028100FA :02:8003:00:XXXXXX :02:800B:00:XXXXXX :02:8013:00:XXXXXX :01:801B:00:...
0 votes
1 answer
128 views

Where are the intel manual x86-16?

I was studying the code for x86-16 operating systems(como DOS),with a desassembler, but I can't find the intel manual on the intel website: Searching on google, only unofficial sources. Perhaps the ...
2 votes
2 answers
577 views

What is the equivalent of the dollar sign from jmp $+1 in GAS syntax?

I have an asm program made with intel syntax. In this program, I am using this syntax jz $+1 from INTEL (+gcc), that means that I jump into the jz instruction (which is 2 bytes). I jump 1 byte further ...
1 vote
2 answers
366 views

Intel ME partitions EFFS and FCRS?

What is the purpose of partitions EFFS and FCRS on systems with Intel ME 8.x? Is it currently possible to parse data in EFFS partition on a ME image? I hope anyone can help, there is so little ...
2 votes
1 answer
256 views

Why base address of GDT(global descriptor table) differ in intel x64 processor?

I have created a simple linux kernel module to get the base address of GDT table: #include <linux/init.h> #include <linux/module.h> #include <linux/const.h> #include <linux/errno....
1 vote
1 answer
1k views

Loading 8051 binary to IDA with ROM+External RAM configuration

I have 8051 firmware file, in 8051 ROM addresses can overlap external RAM addresses(movc and movx solve this issue), however IDA doesn't allow overlapping addresses: In this example the ROM size is ...
1 vote
0 answers
100 views

Learning Intel Disassembler, What to learn for Intel XED [closed]

In order to learn about disassembly and code something like Capstone disassembler, HDE etc. for a function , calculate opcodes etc , Please advise on what I should know. I have some knowledge of ...
1 vote
0 answers
305 views

How to interpret binary instruction using the intel manual

OK. So I am really trying to figure out how to use the "Intel 64 and IA-32 Architectures Software Developer's Manual" for myself, since it seems like the authoritative source for x86(_64) machine code....
1 vote
1 answer
2k views

Understand the CPU cycles of x86 instruction bsr/bsf

I am on the hook to analysis some "timing channels" of some x86 binary code. I am posting one question to comprehend bsf/bsr opcode. So high-levelly, these two opcodes can be modeled as a "loop", ...
4 votes
1 answer
2k views

How do the PSHUFLW and PSHUFD instructions work?

I have been trying to figure out exactly what is happening with these instructions and can't make sense of them. I can see that the PSHUFLW instruction acts upon the first 16 bytes of the XMM register ...
4 votes
1 answer
640 views

Undocumented MSR Machine Specific register

I'm reversing the BIOS of my laptop, for fun and for learning something new. Inside it, I just stepped into this piece of code: mov ecx, 13Ah rdmsr and eax, 1 jnz SkipCacheAsRAM Looking ...
3 votes
1 answer
322 views

Basic hello world stack manipulation troubles

I'm a beginner in reverse engineering, and as a beginner I started to read "Reverse Engineering for beginers". Here is the hello world program from the book (taken from chapter 3, page 12) : Now ...
0 votes
1 answer
557 views

IDA Pro Address doesn't correlate to Immunity Debugger address

I'm trying to use immunity debugger to step through a confusing binary. When I open it in IDA Pro, I see certain addresses next to the instructions: .text:01001392 inc eax When I ...
5 votes
2 answers
9k views

What does XREF mean?

I have been learning about the x86 assembly language by analyzing a binary using radare2 that is stored on a Intel 80386 machine. When I have been analyzing functions on the binary, I noticed that "...
1 vote
2 answers
738 views

Intel PIN (TracerPIN): adding modification of registers

Basically I just would like to modify the following code: https://github.com/SideChannelMarvels/Tracer/tree/master/TracerPIN (based on Intel PIN) in order to be able to modify the content of some ...
1 vote
0 answers
3k views

Reverse Intel hex to programming code

I have a file in the Intel hex format, which was taken of from a pic16F1705 chip. I need to find a way to disassemble it into some form of human friendly programming language in order to make some ...
0 votes
1 answer
800 views

How to debug Portable executable for AMD64 in IDA PRO?

How can I debug Portable executable for AMD64 in IDA PRO if I have Intel processor?
1 vote
1 answer
2k views

Optimized vs Unoptimized code comparison

After reading a number of blog posts, forums, and watching tutorials I figured I would start learning to reverse software the old fashion way. Creating simple C files and looking at their disassembly....
2 votes
1 answer
525 views

igdlh64.inf modify custom resolution

I have some dead pixels in top couple of rows of my cheap Win 10 tablet. To alleviate that, I wanted to use the custom resolution option in Intel graphics management panel, however, I cannot choose ...
1 vote
1 answer
589 views

Basic assembly query [closed]

I wrote a program which will add two numbers in assembly. When I do a system call for scanf(), the instruction looks like this: mov rcx, num1 Note: I have defined num1 in the bss section as: num1 ...
0 votes
1 answer
192 views

Detecting user<->kernel transitions with hypervisor

Is it possible to use a hypervisor to trap all ring0<->ring3 transitions (both 0->3 and 3->0)?
0 votes
1 answer
155 views

Intel PIN and nm unable to capture binary symbols

I'm trying to generate a log of all identified symbols in a binary file. The application i'm trying to inspect is busybox. I've created a Pin Tool that successfully captures symbols (no demangling) ...
0 votes
2 answers
2k views

Intel syntax - Meaning of jmp/call instruction with $+5 operand

I'm currently parsing a lot of assembly files and don't understand a specific jmp or call with $+5 as operand: call $+5 jmp $+5 To provide more context I grepped some of the occurrences: mov esp, [...