Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [register]

Use this tag when asking *about* registers, their properties, existence, usage or limitations. Avoid using this tag just because registers are mentioned in the question.

5
votes
2answers
383 views

How many registers does an x86_64 CPU actually have?

I am currently learning reverse engineering and am studying the flags register. I had in my mind that rflags was just another name for one of the 16 general purpose registers, for example rax or rbx. ...
1
vote
1answer
58 views

Is the value of EBP before the main function important?

So before we come to the main function, it looks we are in a function with a name __libc_start_main and before we come to our main function we obviously push EBP value in the stack ( the value of EBP ...
0
votes
0answers
52 views

The value of edx register

Upon trying to reverse a keygen i came across some assembly in IDA that i didnt quite understand. mov dl, String In the above code, String if a buffer in memory used by GetDlgItemTextA function ...
3
votes
1answer
367 views

Moving integer to xmm register

I was looking at a game code, and I saw the following: 0x171 mov [rbp-30],r12w .... 0x210 movups xmm0,[rbp-30] I am pretty sure that r12 is an integer here (equals 5). So, is it moving an ...
14
votes
3answers
4k views

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

I don't know whether this is a silly question, but I couldn't find any answer. With the evolution of CPU architecture, register size was extended, from 8, to 16, 32, and eventually 64-bit. I was ...
2
votes
2answers
186 views

Confused about the value of edx and eax registers used at function entry

I am currently using IDA to disassemble a keygen. In the first few lines of a specific function before the eax and edx registers are given a value, their contents are moved to stack variables var_40 ...
1
vote
2answers
81 views

Intel PIN (TracerPIN): adding modification of registers

Basically I just would like to modify the following code: https://github.com/SideChannelMarvels/Tracer/tree/master/TracerPIN (based on Intel PIN) in order to be able to modify the content of some ...
2
votes
1answer
103 views

Can I step through a binary with IDA (eval version), reading registers step-wise?

I am new to disassembly, and I'm trying to understand how a 32 bit binary is operating. I have the evaluation (free) version, 32 bit (Version 7.0.170920 macOS x86_64 (32-bit address size)). I'm used ...
0
votes
1answer
151 views

Example of key fishing with OllyDbg logging? [closed]

I'm new to reverse engineering. Can you give an example of a crackme to do "non-hardcoded" key fishing and how to log the x86 registers to spot the generated key?
1
vote
1answer
85 views

How can an IA-32 program seemingly compiled with MSVC send its sole argument via EAX? [duplicate]

A C++ program I'm looking at appears to have been compiled with MSVC. It links to MSVCR100.dll, contains MSVC's security cookie code and uses the Microsoft mangling scheme. However, one of the ...
1
vote
2answers
202 views

Added instruction to shellcode

I have the following shellcode: xor eax, eax ; eax = 0 push eax ; 0 (end of the string) push 0x68732f2f ; //sh push 0x6e69622f ; /bin mov ebx, esp ; ebx = &(/bin//sh) xor ecx, ecx ...
0
votes
0answers
358 views

Is there an option in IDA to track function arguments?

I would like to know if there is any option in IDA to track function arguments at least within that function? Assume in the beginning of the function arguments are stored in memory, afterwards they ...
0
votes
2answers
818 views

EBP + C what is that?

I have this assembly code: MOV DL,BYTE PTR DS:[ECX+EAX] --> Move the first byte of EAX to DL ADD BYTE PTR DS:[EAX+9],DL --> ADD the DL byte to the ninth byte at EAX INC ECX --> Increase ...
3
votes
2answers
900 views

How are addresses calculated from the values in x86 segment registers?

How are the 16-bit values in segment registers used to represent large memory addresses? ES 0023 32bit 0(FFFFFFFF) CS 001B 32bit 0(FFFFFFFF) SS 0023 32bit 0(FFFFFFFF) DS 0023 32bit 0(FFFFFFFF) FS ...
6
votes
2answers
583 views

Register Calling Convention: written in stone, or in mud?

When disassembling an old Delphi 3 executable, I find some routines that pass arguments in registers EAX, EDX, and on the stack – but not in ECX! For those routines, ECX never gets set to a '...
1
vote
1answer
764 views

Intel PIN: How to log the value of the fs and gs registers at every instruction?

I modified the pinatrace pintool example and managed to log all values of the "regular" registers: VOID Instruction(INS ins, VOID *v) { ... // Instrument REGISTER writes using a predicated call, i....
1
vote
2answers
790 views

Set register to specific value for use in autoanalysis in IDA Pro 6.9

I'm using IDA Pro 6.9 with some PowerPC disassembly. The code sets up r13 to a value, say 0x10000, then offsets that register to load and store memory in that region. r13 is never modified again in ...
12
votes
1answer
657 views

Randomly picking up a x86 register for an instruction

I came around a piece of malware which i am analyzing and have found that it uses some kind of math to randomly selecting a register for a specific instruction Which i don't understand how this ...
1
vote
1answer
296 views

Pydbg setting registers without breakpoint?

In pydbg, is it possible to set a register without having it hit a break point first? Consider the following example break point handler: def handler_breakpoint(mdbg): print "[+]Hit breakpoint" ...
1
vote
1answer
1k views

How to stop IDA debugger when a register is set to a particular value?

I use the following script to set IDA in trace mode and make it stop as soon as EAX register is set to a given value : #include <idc.idc> static main() { auto r_eip, code, eax; ...
2
votes
1answer
238 views

Can I get different thread registers with PyDBG?

I am writing a python debugger and disassembler using the PyDBG library I have the disassembler part working, but not all of the debugger. Is it possible to use it to return something similar to: [*] ...
1
vote
1answer
3k views

How can I step through instructions in IDA and know the current EIP?

import idaapi x=0 while x<10: idaapi.step_into() rv = idaapi.regval_t() idaapi.get_reg_val('EIP',rv) ea = rv.ival print hex(ea) x+=1 Hi. Here is a script to step-into 10 ...
0
votes
1answer
2k views

Strcpy BufferOverflow get shellcode location for EIP

I am trying to get a shellcode, exploiting a C program with a strcpy() function. I have found out that I need 68 bytes to start writing on the EIP. So, if I write 72's by EIP register is 0x41414141. ...
0
votes
2answers
196 views

GUI apps uses registry,how?

I have a GUI app that seems to use registry. So I wanna know if I can capture that function that access registry and check if it's activated because this app doesn't use windows directory, it's just a ...
0
votes
0answers
113 views

How to access and modify data segment when doing hardware breakpoint crashes the application?

I want to modify the data segment in the x64_DBG, however, I don't know how to access it. lea r8,qword ptr ds:[7FEF0CA6AD8] In the above code, the address 7FEF0CA6AD8 is loaded in r8 register. I ...
1
vote
3answers
1k views

How to display debug register on the register panel of ollydbg

Can someone know how to or a plugin that allows to display extra information, the debug registers (DR0->DR7) on the register panel of Ollydbg ? Thank you in advance,
2
votes
1answer
3k views

Output of gdb `info registers`

Upon running info registers in gdb, we get an output similar to the following: rax 0x1c 28 rbx 0x0 0 rcx 0x400a60 4196960 rdx 0x7fffffffde88 ...
1
vote
1answer
1k views

Initial ESP and EBP values (Windows x86)

After PE loads into memory, sections are mapped depending on IMAGE_BASE value (assume there is no ASLR and it is always the same) and sections table. My question, how EBP value is determined (I ...
4
votes
2answers
4k views

Assembly- Using push and ESP-Register to store addresses

I have found the following assembly lines presented in a tutorial which I do not understand: xor eax, eax => clear, I know that, it makes eax = 0 push eax => push 0 on the stack ...