Questions tagged [register]
Use this tag when asking *about* registers, their properties, existence, usage or limitations. Avoid using this tag just because registers are mentioned in the question.
59
questions
0
votes
1
answer
186
views
How can I tell ghidra what structure an address register points to?
I am reversing a raw bare-metal binary firmware for a tricore processor (TC1762/TC1766).
In many functions i'm currently reversing there is access to offsets of the address stored in the a0 register. ...
3
votes
0
answers
51
views
Contents of EAX in IDA Free?
I am doing Level 2 of TryHackMe's REloaded reverse engineering challenges.
In the screen shot below, you can see I have found the string I want by hovering my mouse over EAX, however a good chunk is ...
- 185
2
votes
0
answers
52
views
Access to CPU registers in GMM space
AMD's BIOS and Kernel Developer’s Guide (BKDG) documents GMM registers and access to them:
GMMxXXXXX: GPU memory mapped registers; XXXXX specifies the hexadecimal byte address offset (this may be 2 ...
- 121
0
votes
0
answers
169
views
Can't get Visual C++ to generate the same code give by Ghidra
I'm using visual c++ to create a mock dll that I'm trying to reverse using Ghidra and I'm doing good progress so far, however I'm stuck in a function that ghidra gives me the following:
...
- 101
1
vote
1
answer
110
views
Why aren't compilers using registers for their intended purpose?
It seem to be well known that x86 registers names have a purpose and indicate on how the register should be use (see this website for example).
According to this, ecx should be the register holding my ...
- 72
1
vote
1
answer
845
views
Ghidra: Reading all registers contents at chosen instruction
Remembering all register contents may be exhausting so I would like to find a solution to be able to see all register contents at a chosen instruction in the Listing. I know debuggers got this ...
- 11
0
votes
1
answer
222
views
ADDS(operations with S suffix) -Arm
This question was asked before here but in the answers I did get what i was looking for.
Consider this:
ADDS R0 RO R1
As far as I know to update the cpsr flags a subtraction has to be made. So after ...
- 164
1
vote
1
answer
590
views
IDA Pro - configure register clobbering
TL;DR:
The __fastcall convention in IDA Pro assumes that all the registers which could be used for transferring parameters are clobbered after a call (tested on x86, clobbered regs are eax, edx, ebx, ...
- 13
0
votes
1
answer
98
views
Branching in arm assembly
This is an example assembly code:
function0()
0x0.mov r0, #1
0x8.mov r1, #20
0x10.mov r2, #6
0x18.cmp r1, #16
0x20.b function1
function1()
0x28.cmp r0, #1
0x30.b functionX
functionX(...
- 164
1
vote
1
answer
118
views
How to insert arm instructions into a function in a native library?
I am new and am still learning assembly languuage. In a native android app library that has been disassembled i found this function which had 1 instruction.
addres hex arm instruction ...
- 164
2
votes
3
answers
2k
views
TEST instruction and ZF flag
In the part 07 of lena151 RE tutorial, we arrive to these instructions:
AL = 0
TEST AL,AL
JNZ ...
And notice:
Because of the JNZ, AL must be different from zero when arriving here to be registered.
...
- 89
2
votes
1
answer
2k
views
Read and write to register with Frida
I have an instruction that looks like this in Ghidra:
100168ff0 e9 13 00 32 orr w9,wzr,#0x1f
Using lldb I can set a breakpoint on the instruction after this, read w9 to confirm what ...
- 167
1
vote
1
answer
200
views
IDA Pro - How to remove multi-line bit definitions for register
I've just started reversing some microcontroller code and have the RAM, ROM, and SFR (Special Function Registers) segments set up. I've selected my processor architecture and it has named most of the ...
- 13
0
votes
1
answer
65
views
usercalls in old Win32 game
I am currently analyzing an old Win32 game from 1999 that was probably compiled with Visual C++ 6 and was programmed in C.
I noticed that there are almost no usercalls (i.e. calls that use registers ...
- 133
2
votes
0
answers
602
views
Conditional breakpoint on register containing string catch everything
I am trying to setup a conditional breakpoint to catch a specific string ("Sessions") that will be on ESI register but it catches everything:
I also tried with dereferenced register [ESI] ==...
- 573
5
votes
1
answer
3k
views
How can I get the inferred register value for an instruction in Ghidra scripting?
I'd like to get the inferred value of a register at a particular point in the disassembly listing in a Ghidra script.
In my case the target instruction is a rdmsr or wrmsr instruction, which reads or ...
- 1,252
1
vote
1
answer
187
views
How to change local_184h to skip past jump commands with Radare2?
I am trying to solve a CTF challenge but I am very much out of my depth and nothing online is helping me very much. This is what I'm working with currently
| 0x55b3fd508a41 4889e5 ...
- 11
1
vote
1
answer
370
views
Why is the offset 16 bits?
I was told that segment:offset pairs were used to represent 20 bits. The segment is 4 bit shifted, and the value plus the offset becomes the physical address. I don't have to worry anymore at 32-bit ...
- 113
1
vote
0
answers
47
views
xIP vs xSP vs xBP: How to choose the target?
We have 32bit & 64bit binaries, and in ROP (Return Oriented Programming), we sometimes target RSP/ESP, sometimes RIP/EIP, (maybe) sometimes RBP/EBP (I'm new to this, haven't seen RBP used yet). In ...
0
votes
3
answers
250
views
How to find if a function is using registers as parameters?
The disassembly of the function Winload!CmpFindNlsData whose prototype I'm trying to construct
00893c10 8bff mov edi,edi
00893c12 55 push ebp
00893c13 8bec ...
- 17
1
vote
1
answer
744
views
How can I move an integer number into a XMM register with Cheat Engine?
First off, I need to clear out that I'm a total noob on this, and I have tried reading and understanding documentation about this assembly stuff on the internet, but almost all I found, was meant for ...
- 11
2
votes
0
answers
70
views
80188 relocation register mystery
I'm reverse engineering an embedded system using the 80C188 and the way the relocation register (RELREG) is used mystifies me.
One of the first steps at initialization is to move the processor ...
2
votes
1
answer
3k
views
x64dbg: break when a register contains a value
Is there a way to break code execution when a register contains a particular value with x64dbg? I'm not talking about setting a conditional breakpoint at a specific location, but about watching the ...
2
votes
2
answers
671
views
Call function by ebp
When I looking at exe file with Ida I see
call dword ptr [ebp -70p]
What is that? Why this function calling by ebp and not call sub_0xabcd
How can I know which function is that to enter to this ...
1
vote
2
answers
900
views
Ollydbg: How to set a conditinal breakpoint for a register gets special value
I read this question about "set conditional break point on a register value" ; but its about setting a bp on special address!
I want to set a bp when for example ECX == 12345678 , i can do this on ...
- 11
4
votes
1
answer
2k
views
PowerPC TOC and SDA
I'm trying to understand the concepts of the TOC and SDA in PowerPC.
From what I understand, they are basically pointers to tables of global values, when TOC is stored in r2, and SDA in r13.
But ...
- 1,848
1
vote
1
answer
37
views
Confused about address being referenced
lea ebp, dword_403638
lea ebx, [ebp-4]
mov edi, ss:[ebx]
I understand the first instruction setting ebp to the address of the byte sequence. What I don't understand is what ebx will then ...
- 13
1
vote
2
answers
4k
views
x64dbg (x32dbg) log registers every step like windbg
So I just switched to x64dbg (really using x32 atm) from windbg and so far I like it but the one thing I'm missing is windbg printing all the registers every step in the command window. Anyone know ...
- 11
0
votes
1
answer
520
views
How to view registers values in string
Is it possible that radare2 will show registers values also in strings ?
For example, when I run ar I am getting the liste of registers and I have:
rax = 0x000000042
Is there a way to also show ...
- 573
2
votes
0
answers
127
views
How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled?
How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled?
Context is curiosity.
I'm aware that Docker in the ...
- 121
0
votes
1
answer
93
views
What is a good resource to learn about how the call stack works while programming in C?
Sorry if this is a duplicate and please point me in the right direction if so. I have a strong foundation in C programming and I know how memory is allocated on the stack for variables/arrays/...
user4466
4
votes
1
answer
2k
views
How do the PSHUFLW and PSHUFD instructions work?
I have been trying to figure out exactly what is happening with these instructions and can't make sense of them. I can see that the PSHUFLW instruction acts upon the first 16 bytes of the XMM register ...
- 43
12
votes
2
answers
15k
views
How many registers does an x86_64 CPU actually have?
I am currently learning reverse engineering and am studying the flags register.
I had in my mind that rflags was just another name for one of the 16 general purpose registers, for example rax or rbx.
...
- 123
2
votes
1
answer
1k
views
Is the value of EBP before the main function important?
So before we come to the main function, it looks we are in a function with a name __libc_start_main
and before we come to our main function we obviously push EBP value in the stack ( the value of EBP ...
- 207
5
votes
1
answer
9k
views
Moving integer to xmm register
I was looking at a game code, and I saw the following:
0x171 mov [rbp-30],r12w
....
0x210 movups xmm0,[rbp-30]
I am pretty sure that r12 is an integer here (equals 5). So, is it moving an ...
- 163
18
votes
3
answers
15k
views
Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?
I don't know whether this is a silly question, but I couldn't find any answer.
With the evolution of CPU architecture, register size was extended, from 8, to 16, 32, and eventually 64-bit. I was ...
- 285
2
votes
2
answers
2k
views
Confused about the value of edx and eax registers used at function entry
I am currently using IDA to disassemble a keygen. In the first few lines of a specific function before the eax and edx registers are given a value, their contents are moved to stack variables var_40 ...
- 23
1
vote
2
answers
723
views
Intel PIN (TracerPIN): adding modification of registers
Basically I just would like to modify the following code: https://github.com/SideChannelMarvels/Tracer/tree/master/TracerPIN
(based on Intel PIN) in order to be able to modify the content of some ...
- 13
2
votes
1
answer
244
views
Can I step through a binary with IDA (eval version), reading registers step-wise?
I am new to disassembly, and I'm trying to understand how a 32 bit binary is operating. I have the evaluation (free) version, 32 bit (Version 7.0.170920 macOS x86_64 (32-bit address size)).
I'm used ...
- 121
0
votes
1
answer
277
views
Example of key fishing with OllyDbg logging? [closed]
I'm new to reverse engineering. Can you give an example of a crackme to do "non-hardcoded" key fishing and how to log the x86 registers to spot the generated key?
- 3
1
vote
1
answer
174
views
How can an IA-32 program seemingly compiled with MSVC send its sole argument via EAX? [duplicate]
A C++ program I'm looking at appears to have been compiled with MSVC. It links to MSVCR100.dll, contains MSVC's security cookie code and uses the Microsoft mangling scheme. However, one of the ...
1
vote
2
answers
459
views
Added instruction to shellcode
I have the following shellcode:
xor eax, eax ; eax = 0
push eax ; 0 (end of the string)
push 0x68732f2f ; //sh
push 0x6e69622f ; /bin
mov ebx, esp ; ebx = &(/bin//sh)
xor ecx, ecx ...
- 199
0
votes
2
answers
2k
views
EBP + C what is that?
I have this assembly code:
MOV DL,BYTE PTR DS:[ECX+EAX] --> Move the first byte of EAX to DL
ADD BYTE PTR DS:[EAX+9],DL --> ADD the DL byte to the ninth byte at EAX
INC ECX --> Increase ...
- 45
5
votes
2
answers
2k
views
How are addresses calculated from the values in x86 segment registers?
How are the 16-bit values in segment registers used to represent large memory addresses?
ES 0023 32bit 0(FFFFFFFF)
CS 001B 32bit 0(FFFFFFFF)
SS 0023 32bit 0(FFFFFFFF)
DS 0023 32bit 0(FFFFFFFF)
FS ...
- 83
8
votes
2
answers
1k
views
Register Calling Convention: written in stone, or in mud?
When disassembling an old Delphi 3 executable, I find some routines that pass arguments in registers EAX, EDX, and on the stack – but not in ECX!
For those routines, ECX never gets set to a '...
- 2,354
1
vote
1
answer
2k
views
Intel PIN: How to log the value of the fs and gs registers at every instruction?
I modified the pinatrace pintool example and managed to log all values of the "regular" registers:
VOID Instruction(INS ins, VOID *v)
{
...
// Instrument REGISTER writes using a predicated ...
- 1,550
1
vote
2
answers
3k
views
Set register to specific value for use in autoanalysis in IDA Pro 6.9
I'm using IDA Pro 6.9 with some PowerPC disassembly. The code sets up r13 to a value, say 0x10000, then offsets that register to load and store memory in that region. r13 is never modified again in ...
- 13
11
votes
1
answer
874
views
Randomly picking up a x86 register for an instruction
I came around a piece of malware which i am analyzing and have found that it uses some kind of math to randomly selecting a register for a specific instruction
Which i don't understand how this ...
- 314
1
vote
1
answer
453
views
Pydbg setting registers without breakpoint?
In pydbg, is it possible to set a register without having it hit a break point first? Consider the following example break point handler:
def handler_breakpoint(mdbg):
print "[+]Hit breakpoint"
...
- 345
1
vote
1
answer
3k
views
How to stop IDA debugger when a register is set to a particular value?
I use the following script to set IDA in trace mode and make it stop as soon as EAX register is set to a given value :
#include <idc.idc>
static main()
{
auto r_eip, code, eax;
...
- 371