Questions tagged [x86]

A family of instruction set architectures originally based on the Intel 8086 CPU that functions with a very wide array of operating systems, including Windows, MacOS X, Linux, BSD, and Solaris.

Filter by
Sorted by
Tagged with
0
votes
1answer
41 views

What is the best way to change the call-graph of a PE file without changing its real behavior and without packing it?

What i want to do is take a PE file, extract its call-graph, and then inject a junk function in it, so for example by injecting a junk function inside of it, and changing a call instruction's opcode ...
0
votes
0answers
63 views

CHBByteStream operator<<, get only one argument - value

Anyone heard about CHBByteStream? It's from Harman headunit (car radio). I don't know how it's passing arguments. SWID is 4 bytes, VIN is 17 bytes, it should be connected in some way, to pass thru ...
1
vote
1answer
83 views

Adding a static variable to Windows DLL

I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls. I ...
-1
votes
2answers
88 views

How to see assembly of main function?

How can I dump the assembly of main function of binary(not striped) in ubuntu? I want to see the assembly command and the hex value of this command There are 1 binary for arm and 1 binary for x86
0
votes
0answers
87 views

Disassembly - First steps

I decided that I need to understand this more thoroughly, so am working in parallel with two resources: one more modern and one original from @Aleph1. In the essay, there is a basic code snippet, ...
0
votes
0answers
25 views

Modify a binary and account for relative jumps [duplicate]

Most binaries have jump and control flow instructions that are relative to other locations in the binary. For example: if I modify an instruction around 0x12341232, and there is an instruction ...
1
vote
0answers
48 views

IDA shows MEMORY or unknown references on C std library calls (memset, memcpy, etc.)

I'm currently reversing a Linux 32-bit executable (with a statically linked library included in it) but I'm having a little problem I can't find a solution for. Basically whenever I stumble across a ...
2
votes
2answers
96 views

BIOS first jump leads to empty memory

I'm trying to reverse a BIOS of an industrial PC in order to repair it. The device is based on an ETX-formfactor mobo, obscure Italian SECO M671, very similar to an old Kontron PM-15(C), but with a ...
1
vote
1answer
146 views

ELF file crashing after executing shellcode

So after changing the entry point via the e_entry field I managed to execute my shellcode before returning control to the original entry point. Here's how I did it: // write string and jump to OEP, ...
1
vote
1answer
39 views

strtok called on char pointer at 0

I'm working on a larger reversing project and came across this segment. I don't really understand what's going on here. There is no other way to proceed along the flow of control besides bypassing ...
0
votes
1answer
45 views

I don't understand the use of mov eax,ds:0x404004 and the NOP slide in this code I made [closed]

Hi guys, I'm just practising the difference between global and local variables and how they are represented in x86 assembly. I just don't understand the use of the ds segment register and the NOP ...
1
vote
0answers
33 views

How does this wannacry sample work?

I downloaded wannacry sample here: https://github.com/fadyosman/WannaCrySample/releases. Don't forget to enter password for archive. I figured out how most of the binary works, except the very last ...
1
vote
0answers
35 views

Memory modified at jump far

Observing a trace of Wow64 switching on Windows 7, the following situation makes me confused ... 0x77491dbe 64 ff 15 c0 00 00 00 call fs:[0xc0] ; syswow64\ntdll.dll 0x74632320 ea 1e 27 63 ...
0
votes
0answers
50 views

Best way to find data in running executable (ollydbg/x32dbg/CheatEngine) that I found in Ghidra?

I have located a function that I would like to reverse engineer in a game. The function pulls character strings from a large array. I am trying to find this array's contents. The line in Ghidra is: ...
0
votes
0answers
64 views

unpacking Armadillo-packed exe on Windows 10

I was trying to unpack the Armadillo-protected target from this webpage Armadillo 4.30a with Debug Blocker - manually unpacking on Windows 10. However, I got another child process spawning again after ...
0
votes
0answers
121 views

Decompile a win32 application written using C++ with .exe and .pdb

I'm aware of IDA Pro, but it doesn't generate a compilable code. I don't want exact original source code or comments, I just want a recompilable code generation. The exe is not packed and does not ...
2
votes
1answer
88 views

What are some useful strategies for understanding undocumented assembly language?

What are some useful strategies for tackling a list of undocumented assembly language instructions? Even as someone who writes assembly code, I find it to be challenging at times to understand someone ...
1
vote
1answer
60 views

Cant see mnemonics on ollydbg 2.01

Im reverse engineering an exe, but i get locked on a specific location, i suppose this is a jump to the same location, when im on this "obfuscated" addresses i cant see any instruction, but the ...
1
vote
1answer
77 views

Why is IDA showing three arguments for the main function instead of two in some linux binaries?

So I am reversing an ELF‌ binary, now from my knowledge in C the main function has two argument, argc and argv but some linux binaries that i am reversing have 3 when i decompile them! one int and ...
1
vote
1answer
87 views

Finding a mathematical calculation which uses Pi within binary

Given a large (~14MB) binary compiled for a X86 64-bit system, what would be the basic steps to go through in order to find the usage of Pi (π) for calculation of a certain parameter (flag)? I'm ...
0
votes
0answers
28 views

Alternative APIs to hook instead of messagebox for message pop ups?

So i am reversing an app that pops up a message at some point, but its not doing this using messagebox i also tried to pause and then run to user code but didn't work, so what are some of the other ...
0
votes
2answers
112 views

IDA Pro, replace exit() with continue;

This is the function: loc_BA060: ; status xor edi, edi call _exit How can one replace exit with continue?
0
votes
2answers
45 views

Which APIs are responsible for terminating process icons in Taskbar?

I am trying to reverse and debug a program but it exists after certain point, tried setting breakpoint on any inter module call that starts with exit or terminate, now here's the weird part : it does ...
0
votes
2answers
178 views

Where is the ESP after call instruction?

I've started learning the Reverse Engineering and when I read the Stack Operations and function invocation, there are an issue that I'm confused. -What is the address of ESP after "pop ebp" and "retn" ...
0
votes
1answer
67 views

How to make a program to read Unicode control characters

I'm learning on how to cause a buffer overflow. My victim program has to read input from a file encoded with UTF-16, 2-bytes by 2-bytes, and I want to overrun the EBP with an address like 0x0012F468. ...
1
vote
1answer
96 views

I'm trying to understand the SEH mechanism

I'm trying to understand the mechanism of SEH (Structured Exception Handling). I understood how it was recorded and saved in FS: [0] on the previous three instructions. But why add interrupt 1 (step ...
1
vote
3answers
142 views

Injecting C++ code, while also maximizing compatibility with other injections

Using the New Vegas Script Extender C++ API for Fallout New Vegas, I am able to write to the process' memory directly at runtime through a .dll plugin that's loaded by the NVSE injector. But it is not ...
0
votes
2answers
94 views

How is subtraction performed on unsigned numbers within the CPU?

I am learning about various flag states for the cmp instruction. From reading, the cmp instruction is really just a sub instruction that sets the various flags (OF, CF, ZF) accordingly depending on ...
1
vote
3answers
362 views

How to find the starting address of text section of a DLL inside a process? (64 bit)

There was a question about this a year ago, but the answer doesn't explain how to do it in C/C++: How to find start of .text section? I'm not talking about module start address, which we can get ...
0
votes
1answer
55 views

x86 main preamble makes stack aligned on 32-bytes boundaries

For the record, I've read all stackexchange relevant answers on the topic (here and here) plus other articles to fully grasp the concepts of memory alignment and CPU natural boundaries. But for some ...
1
vote
2answers
160 views

Does the loader fill the IAT table of an .exe in load time by checking the corresponding export tables or during run time?

I came upon this question : Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking? and it got me wondering, lets say for some reason some function was not in the IAT of our ...
0
votes
1answer
259 views

Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking?

So i was trying to hook the ZwQuerySystemInformation or NtZwQuerySystemInformation using IAT, but i found out that these are not inside the IAT inside the memory nor in the PE file but maybe i am not ...
2
votes
1answer
100 views

How to hide a process from all the methods of getting the list of processes?

So it seems that there are a lot of ways of getting the process list, although I'm not sure whether in the low level do they acquire them from same place or not so these are the ways i know : ...
2
votes
0answers
323 views

How to add symbols from open source lib to Ghidra?

I have a binary which I can tell is using rapidjson (open source C++ library) (header only/not dynamically linked). How can I load debug symbols from that? It would help to see the types, function ...
0
votes
0answers
34 views

Generate pseudo code not available for some binaries in IDA Pro

I'm using IDA Pro to disassemble binaries. For some binaries, the Generate Pseudo Code option is available and works fine. However, on other binaries (using possibly a different compiler toolchain) ...
0
votes
0answers
60 views

What's the point of changing the CS register and can any process do this?

So i was reading this article : http://waleedassar.blogspot.com/2012/07/wow64-user-mode-system-calls-hooking.html which explains the wow64, the part that we do a far jmp and change the CS register ...
1
vote
1answer
152 views

Why address 7FFE0308 always gets compared in 64bit applications before making a syscall in Ntdll?

So there was a question asked before about this : What are the difference syscall and int 0x2E instructions? and it has two answer, one says that is just a way to check if we are in a 32 bit or 64 ...
1
vote
1answer
80 views

What is the ending bytes in the MOV instruction in 32 bit applications in windows? (B8 mov)

So i just compared NTterminateProcess between 32 and 64 bit version of a program, and the mov instruction which moves the syscall into eax is almost the same, both 5 byte, (both the B8 mov) but the ...
3
votes
2answers
344 views

What is the purpose of consecutive ADC instructions to a single register?

To clarify, I understand how ADC works. It's the same as a regular ADD but with an extra 1 if the Carry Flag was set. Its use in the snippet below makes perfect sense to me since an overflow is most ...
2
votes
1answer
311 views

Can Ghidra do backward symbolic execution?

I am searching for a tool which can do backwards symbolic execution on x86 binaries. More specifically, I would like to give the tool a program state(PC value + registers + memory content) and have it ...
-1
votes
1answer
80 views

Find the call function of a string

On a 16bit real mode x86 program I can locate a string that is displayed on screen. How do I go about finding all the places this string is called from to trace back the "print" function?
1
vote
1answer
80 views

Find Reference To Resource String In Windows 3.1 16-bit DLL with IDA Pro

Experimenting Visual Basic 4 in DosBox + Windows 3.1 running on Windows 10. While I have installed SHARE.exe from MS-DOS 6.22 and it seems to run OK, it still fails to detect it. The error I get is : ...
1
vote
2answers
155 views

Dealing With x86 Segmentation Overlaps

I load my project into IDA 7 and select 8086 as this rom is a 512kb in the high address space. I apply an offset of 0x80000 and it loads properly. I then go to 0xFFFF0 and find a far jump to 0xFDAF:...
1
vote
0answers
67 views

Dump the value of register into file

I've reverse engineering little game on windows 32bit. I found a string in executable which was interesting for me (it is a board game and this string represents the fact that somebody made a move ...
1
vote
1answer
47 views

Reversing AND / shift instructions used in succession

I'm working on reversing some assembly code, and have worked it up into some pseudo code to start off with a reverse attempt. The function performs a kind of encryption on the data passed in, and I'm ...
1
vote
1answer
151 views

Weird IDA/Decompiler floating point output

I stumbled upon this (reduced for readability) function. It does weird things that I have never encountered before. // a2 is always 60.0 void some_function(struct_123 *this, float a1, float a2) { ...
2
votes
1answer
367 views

Finding address in IDA from address found in Cheat Engine

I found a pointer's address, 0x485FE058, in Cheat Engine. However, when I load up the exe in IDA, the addresses are smaller and start from 0x00401000. I read up somewhere that this was called virtual ...
0
votes
0answers
76 views

Decode message in esoteric audio file

I'm having a reverse engineering lab at school and my last project is to beat a 10 level reverse engineering CTF-like challenge. It's got plenty of interesting things. What I need to do is find a ...
0
votes
1answer
127 views

ACCESS_VIOLATION when attaching a debugger

I'm debugging a software and it hits access violation on wcslen function under debugger but runs normally without it. First I thought It had some anti-debug trick, but I could not found any ...
1
vote
0answers
62 views

Reproduce compilation (ASM) output for library detection - identifying compiler, version & options used

I want to reverse a stripped x86 sample that uses a static library. So far I could identify the library itself and narrow the version of the library used. Now I want to use Ghidra's Function ID ...

1
2 3 4 5
8