Questions tagged [register]

Use this tag when asking *about* registers, their properties, existence, usage or limitations. Avoid using this tag just because registers are mentioned in the question.

Filter by
Sorted by
Tagged with
0
votes
1answer
34 views

Branching in arm assembly

This is an example assembly code: function0() 0x0.mov r0, #1 0x8.mov r1, #20 0x10.mov r2, #6 0x18.cmp r1, #16 0x20.b function1 function1() 0x28.cmp r0, #1 0x30.b functionX functionX(...
1
vote
1answer
49 views

How to insert arm instructions into a function in a native library?

I am new and am still learning assembly languuage. In a native android app library that has been disassembled i found this function which had 1 instruction. addres hex arm instruction ...
1
vote
3answers
103 views

TEST instruction and ZF flag

In the part 07 of lena151 RE tutorial, we arrive to these instructions: AL = 0 TEST AL,AL JNZ ... And notice: Because of the JNZ, AL must be different from zero when arriving here to be registered. ...
0
votes
0answers
30 views

Indirect calls using registers (IDA)

I need some help. Using IDA for disasembling an executable PE file. It has several indirect calls using registers like call eax. Trying to add breakpoints and get the content of the registers, but ...
1
vote
1answer
108 views

Read and write to register with Frida

I have an instruction that looks like this in Ghidra: 100168ff0 e9 13 00 32 orr w9,wzr,#0x1f Using lldb I can set a breakpoint on the instruction after this, read w9 to confirm what ...
1
vote
1answer
63 views

IDA Pro - How to remove multi-line bit definitions for register

I've just started reversing some microcontroller code and have the RAM, ROM, and SFR (Special Function Registers) segments set up. I've selected my processor architecture and it has named most of the ...
0
votes
0answers
38 views

getting the content of the Thread Envoirment Block in IDA Pro

i have started out reverse engineering with IDA Pro a few weeks ago. Currently i am reversing a heavily obfuscated file which uses many anti-reversing techniques and in particular relys heavily on ...
0
votes
1answer
59 views

usercalls in old Win32 game

I am currently analyzing an old Win32 game from 1999 that was probably compiled with Visual C++ 6 and was programmed in C. I noticed that there are almost no usercalls (i.e. calls that use registers ...
0
votes
0answers
39 views

Conditional breakpoint on register containing string catch everything

I am trying to setup a conditional breakpoint to catch a specific string ("Sessions") that will be on ESI register but it catches everything: I also tried with dereferenced register [ESI] ==...
0
votes
0answers
16 views

What is the syntax for setting a register in Delve?

Exactly as the question says: During debugging a Golang binary, I want to change the value of a register. help set in (dlv) returns: (dlv) help set Changes the value of a variable. [goroutine <n>...
0
votes
0answers
59 views

How to use aarch64 call convention to understand an unknown function?

I’m trying to reverse engineer an aarch64 Golang binary which happens to call a symbol, i.e., function named guess_me which is an import. To stop the binary from throwing errors, I write a Hello World!...
4
votes
1answer
670 views

How can I get the inferred register value for an instruction in Ghidra scripting?

I'd like to get the inferred value of a register at a particular point in the disassembly listing in a Ghidra script. In my case the target instruction is a rdmsr or wrmsr instruction, which reads or ...
1
vote
1answer
87 views

How to change local_184h to skip past jump commands with Radare2?

I am trying to solve a CTF challenge but I am very much out of my depth and nothing online is helping me very much. This is what I'm working with currently | 0x55b3fd508a41 4889e5 ...
1
vote
1answer
111 views

Why is the offset 16 bits?

I was told that segment:offset pairs were used to represent 20 bits. The segment is 4 bit shifted, and the value plus the offset becomes the physical address. I don't have to worry anymore at 32-bit ...
1
vote
0answers
32 views

xIP vs xSP vs xBP: How to choose the target?

We have 32bit & 64bit binaries, and in ROP (Return Oriented Programming), we sometimes target RSP/ESP, sometimes RIP/EIP, (maybe) sometimes RBP/EBP (I'm new to this, haven't seen RBP used yet). In ...
0
votes
3answers
221 views

How to find if a function is using registers as parameters?

The disassembly of the function Winload!CmpFindNlsData whose prototype I'm trying to construct 00893c10 8bff mov edi,edi 00893c12 55 push ebp 00893c13 8bec ...
1
vote
1answer
269 views

How can I move an integer number into a XMM register with Cheat Engine?

First off, I need to clear out that I'm a total noob on this, and I have tried reading and understanding documentation about this assembly stuff on the internet, but almost all I found, was meant for ...
2
votes
0answers
36 views

80188 relocation register mystery

I'm reverse engineering an embedded system using the 80C188 and the way the relocation register (RELREG) is used mystifies me. One of the first steps at initialization is to move the processor ...
0
votes
1answer
1k views

x64dbg: break when a register contains a value

Is there a way to break code execution when a register contains a particular value with x64dbg? I'm not talking about setting a conditional breakpoint at a specific location, but about watching the ...
1
vote
2answers
257 views

Call function by ebp

When I looking at exe file with Ida I see call dword ptr [ebp -70p] What is that? Why this function calling by ebp and not call sub_0xabcd How can I know which function is that to enter to this ...
1
vote
2answers
347 views

Ollydbg: How to set a conditinal breakpoint for a register gets special value

I read this question about "set conditional break point on a register value" ; but its about setting a bp on special address! I want to set a bp when for example ECX == 12345678 , i can do this on ...
2
votes
1answer
742 views

PowerPC TOC and SDA

I'm trying to understand the concepts of the TOC and SDA in PowerPC. From what I understand, they are basically pointers to tables of global values, when TOC is stored in r2, and SDA in r13. But ...
1
vote
1answer
34 views

Confused about address being referenced

lea ebp, dword_403638 lea ebx, [ebp-4] mov edi, ss:[ebx] I understand the first instruction setting ebp to the address of the byte sequence. What I don't understand is what ebx will then ...
1
vote
2answers
2k views

x64dbg (x32dbg) log registers every step like windbg

So I just switched to x64dbg (really using x32 atm) from windbg and so far I like it but the one thing I'm missing is windbg printing all the registers every step in the command window. Anyone know ...
0
votes
1answer
249 views

How to view registers values in string

Is it possible that radare2 will show registers values also in strings ? For example, when I run ar I am getting the liste of registers and I have: rax = 0x000000042 Is there a way to also show ...
2
votes
0answers
79 views

How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled?

How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled? Context is curiosity. I'm aware that Docker in the ...
0
votes
1answer
76 views

What is a good resource to learn about how the call stack works while programming in C?

Sorry if this is a duplicate and please point me in the right direction if so. I have a strong foundation in C programming and I know how memory is allocated on the stack for variables/arrays/...
4
votes
1answer
1k views

How do the PSHUFLW and PSHUFD instructions work?

I have been trying to figure out exactly what is happening with these instructions and can't make sense of them. I can see that the PSHUFLW instruction acts upon the first 16 bytes of the XMM register ...
10
votes
2answers
8k views

How many registers does an x86_64 CPU actually have?

I am currently learning reverse engineering and am studying the flags register. I had in my mind that rflags was just another name for one of the 16 general purpose registers, for example rax or rbx. ...
1
vote
1answer
931 views

Is the value of EBP before the main function important?

So before we come to the main function, it looks we are in a function with a name __libc_start_main and before we come to our main function we obviously push EBP value in the stack ( the value of EBP ...
5
votes
1answer
6k views

Moving integer to xmm register

I was looking at a game code, and I saw the following: 0x171 mov [rbp-30],r12w .... 0x210 movups xmm0,[rbp-30] I am pretty sure that r12 is an integer here (equals 5). So, is it moving an ...
18
votes
3answers
12k views

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

I don't know whether this is a silly question, but I couldn't find any answer. With the evolution of CPU architecture, register size was extended, from 8, to 16, 32, and eventually 64-bit. I was ...
2
votes
2answers
2k views

Confused about the value of edx and eax registers used at function entry

I am currently using IDA to disassemble a keygen. In the first few lines of a specific function before the eax and edx registers are given a value, their contents are moved to stack variables var_40 ...
1
vote
2answers
534 views

Intel PIN (TracerPIN): adding modification of registers

Basically I just would like to modify the following code: https://github.com/SideChannelMarvels/Tracer/tree/master/TracerPIN (based on Intel PIN) in order to be able to modify the content of some ...
2
votes
1answer
160 views

Can I step through a binary with IDA (eval version), reading registers step-wise?

I am new to disassembly, and I'm trying to understand how a 32 bit binary is operating. I have the evaluation (free) version, 32 bit (Version 7.0.170920 macOS x86_64 (32-bit address size)). I'm used ...
0
votes
1answer
240 views

Example of key fishing with OllyDbg logging? [closed]

I'm new to reverse engineering. Can you give an example of a crackme to do "non-hardcoded" key fishing and how to log the x86 registers to spot the generated key?
1
vote
1answer
124 views

How can an IA-32 program seemingly compiled with MSVC send its sole argument via EAX? [duplicate]

A C++ program I'm looking at appears to have been compiled with MSVC. It links to MSVCR100.dll, contains MSVC's security cookie code and uses the Microsoft mangling scheme. However, one of the ...
1
vote
2answers
370 views

Added instruction to shellcode

I have the following shellcode: xor eax, eax ; eax = 0 push eax ; 0 (end of the string) push 0x68732f2f ; //sh push 0x6e69622f ; /bin mov ebx, esp ; ebx = &(/bin//sh) xor ecx, ecx ...
0
votes
2answers
2k views

EBP + C what is that?

I have this assembly code: MOV DL,BYTE PTR DS:[ECX+EAX] --> Move the first byte of EAX to DL ADD BYTE PTR DS:[EAX+9],DL --> ADD the DL byte to the ninth byte at EAX INC ECX --> Increase ...
3
votes
2answers
2k views

How are addresses calculated from the values in x86 segment registers?

How are the 16-bit values in segment registers used to represent large memory addresses? ES 0023 32bit 0(FFFFFFFF) CS 001B 32bit 0(FFFFFFFF) SS 0023 32bit 0(FFFFFFFF) DS 0023 32bit 0(FFFFFFFF) FS ...
8
votes
2answers
1k views

Register Calling Convention: written in stone, or in mud?

When disassembling an old Delphi 3 executable, I find some routines that pass arguments in registers EAX, EDX, and on the stack – but not in ECX! For those routines, ECX never gets set to a '...
1
vote
1answer
2k views

Intel PIN: How to log the value of the fs and gs registers at every instruction?

I modified the pinatrace pintool example and managed to log all values of the "regular" registers: VOID Instruction(INS ins, VOID *v) { ... // Instrument REGISTER writes using a predicated ...
1
vote
2answers
2k views

Set register to specific value for use in autoanalysis in IDA Pro 6.9

I'm using IDA Pro 6.9 with some PowerPC disassembly. The code sets up r13 to a value, say 0x10000, then offsets that register to load and store memory in that region. r13 is never modified again in ...
11
votes
1answer
829 views

Randomly picking up a x86 register for an instruction

I came around a piece of malware which i am analyzing and have found that it uses some kind of math to randomly selecting a register for a specific instruction Which i don't understand how this ...
1
vote
1answer
417 views

Pydbg setting registers without breakpoint?

In pydbg, is it possible to set a register without having it hit a break point first? Consider the following example break point handler: def handler_breakpoint(mdbg): print "[+]Hit breakpoint" ...
1
vote
1answer
3k views

How to stop IDA debugger when a register is set to a particular value?

I use the following script to set IDA in trace mode and make it stop as soon as EAX register is set to a given value : #include <idc.idc> static main() { auto r_eip, code, eax; ...
1
vote
1answer
349 views

Can I get different thread registers with PyDBG?

I am writing a python debugger and disassembler using the PyDBG library I have the disassembler part working, but not all of the debugger. Is it possible to use it to return something similar to: [*] ...
1
vote
2answers
5k views

How can I step through instructions in IDA and know the current EIP?

import idaapi x=0 while x<10: idaapi.step_into() rv = idaapi.regval_t() idaapi.get_reg_val('EIP',rv) ea = rv.ival print hex(ea) x+=1 Hi. Here is a script to step-into 10 ...
0
votes
1answer
4k views

Strcpy BufferOverflow get shellcode location for EIP

I am trying to get a shellcode, exploiting a C program with a strcpy() function. I have found out that I need 68 bytes to start writing on the EIP. So, if I write 72's by EIP register is 0x41414141. ...
0
votes
2answers
436 views

GUI apps uses registry,how?

I have a GUI app that seems to use registry. So I wanna know if I can capture that function that access registry and check if it's activated because this app doesn't use windows directory, it's just a ...