Skip to main content

Questions tagged [x86]

A family of instruction set architectures originally based on the Intel 8086 CPU that functions with a very wide array of operating systems, including Windows, MacOS X, Linux, BSD, and Solaris.

Filter by
Sorted by
Tagged with
1 vote
0 answers
28 views

IDAPython: Getting all arguments passed to function

I am working on getting two specific arguments from a function that is called around 1000 times in an executable. Is there any way of looping through all XREFs that reference the function and print ...
Surasia's user avatar
  • 11
0 votes
0 answers
53 views

x86 When we use fastcall, why does caller clean stack?

In fastcall functions, the callee cleans the stack and returns the value in eax. This completes the function call.And actually we put first two arguments in ecx and edx, still caller cleans stack 8 ...
benoyum's user avatar
0 votes
2 answers
79 views

reduce size of executable ELF program

I'm experimenting on patching my hello world program in order to make it smol. I started by reducing the size of the program with the following commands: as --32 ./hello_32.S -o ./hello_32.o ld -...
Yuki San's user avatar
1 vote
1 answer
66 views

Static offsets Vs. Loaded Offsets

I am developing an application integrity concept tool that performs integrity checks based on a comparison of Windows syscalls in a static PE file on disk to those loaded. Can I match the offset of ...
Shockmeister's user avatar
0 votes
0 answers
61 views

GetProcAddress on NTDLL functions not working via ROP

This is somewhat convoluted, but I will try to focus on the heart of the issue. We are trying to do GetProcAddress on a few NTDLL functions, and it is not working. We are doing this via ROP and in a ...
vg1925's user avatar
  • 1
1 vote
0 answers
80 views

Freeware x86 decompilers for Windows with debug? [closed]

I'm searching for a software that is capable of decompiling x86 code in C-like code and run a debug session within it with the possibility to see the content of the variables. That above was a quick ...
Alby87's user avatar
  • 111
0 votes
0 answers
63 views

Hexrays - Enhance decompilation of "pre-multiplied" array indices?

For this x86 (Watcom 1997) assembly that loops over an array, Hexrays yields the following pseudo code: lea eax, ds:0[ecx*4] add eax, ecx shl eax, 3 mov [esp+310h+iMulSize], eax mov ...
Ray's user avatar
  • 1,103
1 vote
0 answers
162 views

Analyse a statically linked binary and extract syscall from it using angr

How to extract all syscalls from analysing a statically linked binary. I have a script written using angr(Latest - v9.2.78) but when I start my script I get few syscalls and the analysis is like hung ...
0x4E4F4F42's user avatar
1 vote
1 answer
120 views

Strange entry point for an old Mac OS X x86 32 bit binary

I wanted to reverse engineer an old game for Mac OS X, but I can't figure out how the entry point jumps to other code. The binary is an x86 Macho-O executable and, according to Detect it Easy, it was ...
Ajadaz's user avatar
  • 11
0 votes
0 answers
42 views

Exe self-modifies strings searched in debugger

I'm studying a Windows binary file and while searching for some string I noticed the EXE modifies the searched string, e.g., if I search "This is a string", it's modified to "his is a ...
lopan's user avatar
  • 1
0 votes
0 answers
138 views

from executable to assembly source code?

let's say i have an ".exe program" and i want to disassemble it and get "disassembled code" . my question is => can i maintain and organize that "disassembled code" ...
0x00001F's user avatar
0 votes
0 answers
64 views

Is there a debugger for the entire x86 architecture?

When learning about the topic that includes processes, threads and image files it helped immensely to use x86dbg. However, it only shows things from the "view" of a single process. I am ...
AirToTec's user avatar
2 votes
1 answer
175 views

What triggers RIP_EVENT?

The documentation for the Windows Debugger API mentions a debug event called RIP_EVENT. It offers little explanation of what a RIP_EVENT is, only stating that the structure "contains the error ...
tomysshadow's user avatar
2 votes
1 answer
75 views

What is patched by LX 16:32 fixup record

In LX format description in section 3.13 Fixup Record Table, when describing SRC = DB Source type field there is such an option: 06h = 16:32 Pointer fixup (48-bits). 1. How many bytes does this fixup ...
Uprooted's user avatar
  • 185
2 votes
1 answer
194 views

What is the meaning of 32 bit offset in x86 16 bit jump

Consider x86 16 bit mode instruction: $ echo 66 EA 66 55 44 33 22 11 | xxd -p -r | ndisasm -b16 - 00000000 66EA665544332211 jmp dword 0x1122:0x33445566 I thought 16 bit code jumps work by combining ...
Uprooted's user avatar
  • 185
2 votes
0 answers
280 views

Ghidra Strings and Global Renaming Issue

I am currently reverse engineering a piece of 16-bit software (originally written in C/C++ from what I can gather). I have identified a function that seems to print text to the console. The text to be ...
jttri777's user avatar
  • 165
4 votes
0 answers
155 views

Reverse Engineering Technique "Step by Step"

Sometimes, I see how someone puts on the github, some reverse engineering project for some famous game. By researching these projects - I come to the conclusion that: people just took the code from ...
user avatar
4 votes
0 answers
1k views

Finding older IDA files

I am following the Begin RE tutorial here but I am stuck towards the end, where I load a file into IDA. I am using IDA Free 8.2 on Windows 11 x64. On the graph view it is only showing the main ...
securityauditor's user avatar
2 votes
1 answer
73 views

why some functions push data before the prologue

i am a newbie in the world of RE , i start to explorer a main entry of a classic game from 90's and i start to see something confuse me as a newbie this main entry function start with pushing stuff to ...
0x00001F's user avatar
1 vote
1 answer
253 views

How works k command in windbg

I am studying a Windows x86 binary in windbg. When i debug a function, in can see the call stack with « k » command. My question is: how works windbg internaly to get this call stack ? I was thinking ...
Bob5421's user avatar
  • 797
2 votes
1 answer
156 views

Ghidra Shows Structure Strange

I am new to assembly. When I was disassembling some code, I encounter some strange instruction here. The instruction shows that (RBP + -0x40) is equal to local_48, however at the beginning of the code,...
Pytai's user avatar
  • 23
2 votes
1 answer
50 views

Can ESP point to a global variable

This 3 lines of code are used by some encoders to get EIP into ECX register: fldz fnstenv [esp-C] pop ecx The 2 first instructions push some datas on stack and we get one of this into ECX on the last ...
Bob5421's user avatar
  • 797
3 votes
1 answer
139 views

Unable to determine what esp is pointing to

I'm going through the book Practical Malware Analysis (specifically, Lab07-03) and I've been stuck on a rather simple problem. I've divided the code section of main() into three parts to ease my ...
smellyourbooks's user avatar
5 votes
1 answer
527 views

Disassembling a DOS game with dynamic code/overlays in IDA Pro

I'm working on a disassembly of an old DOS game. (Real old: 16-bit, real mode.) The bulk of the game is in a large resource file of mixed binary and data; the executable basically just loads a chunk ...
Peter Malamud Smith's user avatar
1 vote
1 answer
144 views

Unable to understand x86 instruction(s)

Recently I have been given a set of assembly instructions which I must learn to understand. I know an extremely basic level of x86 assembly but I'm starting to come across more nuances that are very ...
guest1's user avatar
  • 13
2 votes
2 answers
77 views

Why does this code use multiple shifts instead of one?

I came across the following piece of 16-bit x86 code for multiplying a value by 40, using just shifts and additions: ; BX holds the value we want to multiply. ; The result is stored in AX. MOV AX, BX ...
lethal-guitar's user avatar
4 votes
1 answer
266 views

How to force IDA to show size of pointer dereference?

IDA's default x86 assembly syntax is not very clear about pointer dereferences. One of these is dereferencing the memory operand, and one is simply moving the address to the register: mov ecx, ...
thejoelpatrol's user avatar
3 votes
1 answer
205 views

Simplifying and reversing an encryption/decryption algorithm in ASM X86 / Python

I'm trying to reverse a decoding function in order to produce the function for encoding (for the curious this is a save game for a legacy adventure game which use codes for saving). So far I have ...
Simon's user avatar
  • 31
2 votes
1 answer
967 views

What is a "far call" in an x86 or x86_64 cpu

I do not understand the usefulness of the "far call" instruction in a 86 CPU. On a 32 bits CPU for example each process has an addressing space of 4Gb (0x00000000 to 0xFFFFFFFF). There can ...
Bob5421's user avatar
  • 797
2 votes
0 answers
67 views

Reversing internal function, can't call it with injected DLL

I'm currently learning RE. I've chosen to do so by trying to RE Skyrim for PC. I'm trying to call the ingame function for printing to the console, I'm doing this via an Injected DLL. The function call ...
Tom James's user avatar
0 votes
1 answer
77 views

Trying to understand this interrupted (?) function prologue

Note: The uninterrupted disassembly is at the bottom Hey, I'm looking at the the assembly and I'm trying to reverse engineer the function Here, it seems like we are saving the previous rbp. Though, it ...
Happy Jerry's user avatar
2 votes
1 answer
559 views

Nice documentation of the binary analysis tool "angr", to analyse system calls in statically linked binary and hence possibly draw a system call graph

I am a new master's student in CS. I am into the computer systems domain. I was just thinking of analyzing a statically linked binary to get a sort of database of system calls made in the binary and ...
Abhishek Ghosh's user avatar
3 votes
1 answer
784 views

Locating function parameters in x32dbg

I'm a bit rusty and trying to analyze a piece of code in x32dbg. As follows: 0627BF49 | 8B0B | mov ecx,dword ptr ds:[ebx] | 0627BF4B | 8B85 CCF5FFFF ...
throwawayn000b9999's user avatar
2 votes
0 answers
495 views

Finding the main function on Windows compiled executables

For a C/C++ program compiled on Windows using the x86 architecture, what is the best way to find the main function within disassembled code without relying on signatures such as FLIRT? I've found ...
Soyboii's user avatar
  • 41
2 votes
0 answers
85 views

jump to invalid address when emulating

I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect ...
Ayyware's user avatar
  • 41
1 vote
1 answer
112 views

x86 weird register call

I am digging with disassembler inside old game (release year 2002) and something is bugging me, I noticed it has a bunch of... questionable instructions. One of the things it does is calling imported ...
Madghostek's user avatar
4 votes
2 answers
1k views

Disassemble bios code

I have a Gigabyte G41MT-S2PT motherboard with Intel core 2 Pentium processor installed on it for test.I decided to disassemble its bios code.Its bios produced by Award Software International and its ...
Farshid's user avatar
  • 41
0 votes
1 answer
156 views

Crackme assistance - unknown function [closed]

i have a problem about a crackme that my friend sent me for a bet. I solved most of it but i am stuck with this function. I can't even understand what the function is trying to do. Please help. images ...
dxAhax's user avatar
  • 1
6 votes
4 answers
3k views

Do I have to learn computer architecture for underestanding or doing reverse engineering?

I am completely noob in reverse engineering, and I've just started to learn it. Now I have this question in my mind, that does a reverse engineer use any computer architecture knowledge for doing his/...
Sirius Black's user avatar
1 vote
2 answers
1k views

What does MOV RAX,qword ptr FS:[0x28] mean?

I'm trying to understand what MOV RAX,qword ptr FS:[0x28] means. I get that FS:[0x28] is a stack canary. If my understanding is correct the data from RAX gets copied by MOV. Then there's a comma which ...
greg5678's user avatar
0 votes
1 answer
79 views

Displacement size (disp_size) of x86 instructions

Given the opcode 80 3d 1d b0 09 00 00. The corresponding capstone instruction is <CsInsn 0x66a4 [803d1db0090000]: cmp byte ptr [rip + 0x9b01d], 0> and has the following properties (c_i being ...
langlauf.io's user avatar
  • 1,560
1 vote
0 answers
65 views

Wrong access .data segment

Preface I'm a PHP programmer, in my spare time I've been doing reverse work. Achieved good progress in the analysis game. But there was a big problem on my way. And now, more than ever, i need the ...
 Blezigen 's user avatar
1 vote
1 answer
164 views

What does the code do?

Challenge #64 What does this code do? An array of array[x][y] form is accessed here. Try to determine the dimensions of the array, at least partially, by finding y. _array$ = 8 _x$ = 12 _y$ = 16 _f ...
Nicholas Humphrey's user avatar
5 votes
1 answer
5k views

How can I make Ghidra have access to external libraries?

I am trying to decompile a executable file, I have the source code of the external libraries that it is using, I wonder if there is a way that I can make Ghidra recognize these libraries, just like it ...
Rafael Ferreira's user avatar
2 votes
1 answer
567 views

x86 - How do I detect virtualized code by looking at the assembly?

How can I detected virtualized code by say, vmprotect, obsidium or themida just by looking at the assembly code? I know that just looking at the PE section name would help, but I wanted to detect ...
Alexey's user avatar
  • 69
1 vote
1 answer
140 views

C instruction causing an address shift

I am trying to recreate a segment of assembly back into the C code. Below is the progress I've made so far, but I'm getting stumped on a specific section. 00000000000010049 <mysteryFunc>: ...
enkrypted87's user avatar
0 votes
0 answers
102 views

ADD right before CMP?

I am a beginner in RE. I compiled some code (x86 32bit), and opened it up in Ghidra. I come across the following instruction block: CALL _strcmp MOV dword ptr [EBP + local_1c], EAX MOV EAX, dword ptr [...
Soyboii's user avatar
  • 41
0 votes
0 answers
250 views

PUSH x VS MOV [ESP], x?

I am a beginner in RE. I compiled some code (x86 32bit), and opened it up in Ghidra. I come across the following instruction right before a call: MOV dword ptr [ESP], 0x3c Where 0x3c is the offset to ...
Soyboii's user avatar
2 votes
0 answers
34 views

Why does OllyDbg label data segment as read only?

I'm working on this problem: Challenge 53 When compiling with cl c53.c /Fac53.asm /MD in VS2019 X86 Development Console and loading the .exe into OllyDbg, I found OllyDbg labels all segments of c53 as ...
Nicholas Humphrey's user avatar
1 vote
0 answers
83 views

Normal artifact or something else?

I'm working on a Linux ELF challenge. I have found this bit of code in the .text disassembly using objdump -d -M intel program 922: 83 c4 10 add esp,0x10 925: c7 45 f4 00 00 00 ...
Mr. Kelsey's user avatar

1
2 3 4 5
10