Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [x86]

A family of instruction set architectures originally based on the Intel 8086 CPU that functions with a very wide array of operating systems, including Windows, MacOS X, Linux, BSD, and Solaris.

0
votes
1answer
23 views

x64dbg - Conditional breakpoint based on function argument

How can I set a conditional breakpoint based on the argument of a function? I am trying to break on the windows function LoadLibraryExW: https://docs.microsoft.com/en-us/windows/desktop/api/...
0
votes
0answers
16 views

Reverse Engineer the Galax RGB Lighting Utility

during the last week I tried to find a way to control the lighting on my Galax 1080Ti cause it's software sucks. I come up with this https://github.com/purpl3F0x/GalaxLightingControl . It needs the ...
0
votes
1answer
51 views

Radare2 Disassembler How Do You Organize Visual Panels (V!)?

I would like to use Radare2 to learn about how C is assembled into assembly but I am having trouble with the layout. I think the V! mode would be very handy as you can watch the registers update as ...
2
votes
1answer
59 views

How do the PSHUFLW and PSHUFD instructions work?

I have been trying to figure out exactly what is happening with these instructions and can't make sense of them. I can see that the PSHUFLW instruction acts upon the first 16 bytes of the XMM register ...
1
vote
1answer
28 views

How is the I/O address space on the PC arranged?

I'm disassembling a 16-bit DOS executable, and looking at the following three instructions: mov dx,0x3ce mov ax,0xff08 out dx,ax I know it writes the value 0xff08 to I/O port 0x3ce. I also know that ...
3
votes
1answer
66 views

Undocumented MSR Machine Specific register

I'm reversing the BIOS of my laptop, for fun and for learning something new. Inside it, I just stepped into this piece of code: mov ecx, 13Ah rdmsr and eax, 1 jnz SkipCacheAsRAM Looking ...
1
vote
1answer
54 views

IDA - large jump table, missing cases in analysis

I have come across the following jump table with a large amount of cases (160+). There seems to be cases missing from IDAs analysis though. For example it skips from cases 22 -> 38 -> 91, and I can ...
0
votes
1answer
67 views

IDA - Lots of mov instructions into ebp+offset - What is happening?

While learning RE I have come across this large segment of instructions that contains completely mov [ebp+offset], value instructions. I believe that ebp + offset are local variables? I think? Could ...
0
votes
1answer
56 views

IDA Interpreting mov instructions in a unusual way

When analysing mach-o binaries IDA seems to interpret const/literal part of x86 mov instruction(0x8B) as an offset. Hex rerpresentation: 8B 40 0A Correct assembly: mov eax,DWORD PTR [eax+0x0A] ; 8B ...
5
votes
1answer
243 views

Simplifying assembly

I'm analysing some binary trace, it's pretty much obfuscated. What I need to do is to understand work flow of its alghoritms. However I cannot find any reliable tool which would help me with that. I ...
1
vote
1answer
57 views

What purpose of MOVZX EAX,AX after MOVZX EAX, WORD PTR [RBP+ADDR.SA_DATA]?

I thought it was strange when I was looking at the code below. The first instruction clearly has completed the task of data transfer and expansion into 16 bits. Why is there a "mov Eax,ax" in the ...
-1
votes
1answer
154 views

How to convert assembly to pseudo code? [closed]

I have the following assembly. I don't know how to follow assembly. I was wondering if there is a way to convert assembly to a human readable pseudo code or better yet C code: init: mov eax, [ebp+...
2
votes
1answer
88 views

Call instruction changed while running

While debugging and reverse-engineering my exe, I have found a very weird thing. call ds:GetModuleFileNameA This call instruction is formed with below hex bytes in IDA. FF 15 24 C0 41 00 (I think ...
0
votes
1answer
106 views

How to locate an specific data structure in an executable?

I need to locate an specific "struct" variable in the data section from an assembly. This structure is used for an specific System Function (Windows) "SetCommState()". I'm wondering how to locate the ...
0
votes
0answers
31 views

How could a function stored into a static variable be used without an explict call at any point?

Disclaimer: I'm new to RE and I'm trying to hone my skills. I'm trying to reverse some C code and I noticed the following instructions (x86) that store a function into a static variable in the .bss ...
1
vote
1answer
142 views

What does fs and gs registers provide in Linux?

In a 64 bit ELF binary I found it mainly uses fs register to get some values. How can I know which value it wants to access? I'm familiar with that NT kernel uses fs and gs register for TEB structure ...
1
vote
1answer
65 views

While loop function disassembly x86

I am trying to convert this binary to C but I am having trouble with the while loop. What does sub esp, 8 mean? as well as push [ebp+_a] ? I am able to get the esp 8 sometimes while changing the ...
0
votes
1answer
67 views

Where to find address of registers populated in a binary

This question might sound very naive, however, I got stuck when one of my friends asked me where can I find the address of an initialized register in the stack. For e.g., info registers in gdb gives ...
1
vote
0answers
44 views

IDA 7 handling strings in debugger pseudocode

When running a remote debugger to a linux server, is there a way to get IDA (7.0) to properly handle strings? When I go to the pseudocode view, I get things like this; v7 = sub_804AD60((std::string *)...
2
votes
1answer
117 views

Finding the main function without symbols

for a C/C++ program compiled on windows using the x86 architecture, what is the best way to find the main function within disassembled code? I've found various answers to questions similar to this, ...
0
votes
1answer
70 views

Changing local variable in caller from callee in C?

I'm implementing a function which is going to perform some time-consuming task, and I'd like to hack the benchmarking part a bit by changing the variable indicating the CPU time my function has ...
3
votes
1answer
339 views

XCHG RAX, RAX: 0x09, what does this code do and how does it work?

Given the following short assembly snippet: shr rax, 3 adc rax, 0 I worked this out a bit: We know SHR sets the CF with the last bit shifted. We know ADC dest, 0 is just adding the CF. So ...
0
votes
1answer
87 views

XCHG RAX, RAX: 0x03, what does this code do and how does it work?

"XCHG RAX, RAX" is a kind of riddle book that provides assembly code for you to reverse and undercover the meaning. Some of the examples calculate the Fibonacci sequence others bit-twiddle to toggle ...
1
vote
0answers
39 views

getting %localappdata% in asm

I have an old windows x86 application that no longer works properly since windows 8. This app creates files within its own folders for things like app settings. Unfortunately, Microsoft no longer ...
1
vote
2answers
97 views

Why there are two different shellcodes for bin/sh with much different syntax and which one is better to use? (x86)

I have found two shellcodes for spawning /bin/sh which are much different from each other. The second one is hardly ever found on the net, and it mostly comes up in reverse engineering websites: 1. "\...
1
vote
1answer
71 views

Is the value of EBP before the main function important?

So before we come to the main function, it looks we are in a function with a name __libc_start_main and before we come to our main function we obviously push EBP value in the stack ( the value of EBP ...
0
votes
0answers
39 views

A question about stack frame

I have register ebp+0x8 : 0xb3fb1998 So ebp+0xa is 0x19 right ? Im newbie and I'm sorry for my bad English.
1
vote
2answers
112 views

Getting opcode Length , How to

I am apparently not very good with assembly as I am novice to somethings! Hence i wanted to make a question again. Now i got this from here to make something like a LDE (Length Disassembly Engine) ...
4
votes
4answers
693 views

Calculation of jmp address through subtraction

I don't get why the two addresses of the functions are subtracted in order to get the jump destination. mov eax, [ebp+func1] sub eax, [ebp+func2] sub eax, 5 mov [ebp+var_4], eax Which ...
0
votes
1answer
145 views

What is the password to this file? I can't figure it out with radare2 or gdb

Here is the binary file. https://drive.google.com/file/d/1ywN60yZYIhPPRyZMGbQudZRYoLYBhkeJ/view?usp=sharing I am able to figure out some of the assembly, but can't get the correct password. I know ...
8
votes
2answers
143 views

How did this 80286 detection code work?

I'm poking through a disassembled 16-bit DOS game circa 1992. The original system requirements state that the game needs an IBM AT-compatible machine or later, with the 286 processor, to run. And ...
7
votes
1answer
124 views

WHY and WHEN do we need SEH for buffer overflowing

In our course in university, we recently moved on from standard buffer-overflows to SEH based ones. My exploit is already ready and working thanks to some nice tutorials, although I am still not sure ...
3
votes
0answers
54 views

Recognizing instructions containing low-level control flows

There are some x86 instructions which containing a low-level** control flow in its semantics, for example div because its semantics is roughly as: if (source == 0) throw exception... else ...
3
votes
2answers
270 views

What are the difference syscall and int 0x2E instructions?

From this question: How does the Windows Native API communicate with the kernel? Here is an example of ZwClose(HANDLE Handle); system call in NTDLL.DLL in Windows 10 X86_64: NtClose proc ...
2
votes
1answer
168 views

XMM register instructions and their c equivalents

I'm trying to convert some x86 assembly back into C++, and I cannot figure out how this set of instructions was originally written. movd xmm0,eax ; byte read from device '0x04' cvtdq2pd xmm0,xmm0 ; ...
4
votes
2answers
147 views

How does the XADD instruction modify the Zero Flag?

I've come across a set of instructions using lock xadd which I'm guessing came from one of the C++ smart pointer templates. (It's been a very long time since I coded C++ so I'm not sure which). lea ...
3
votes
1answer
117 views

Using ECX after being modified by a function call

I have a peculiar snippet of code which I cannot wrap my head around: push 0xC ; arg1 for call mov ecx,edi ; set the this pointer for call call sdk.100039F0 ; make the call (...
4
votes
1answer
66 views

GS Cookie and exception handlers

I'm trying to understand how this GS cookie implementation is working. From what I've read on the topic, a cookie is set during the prologue then checked again in the epilogue. Well I can see the ...
1
vote
5answers
1k views

Older versions of IDA free?

I'm looking for an IDA free version previous to 7.0 so I can use it in x86 systems, the current one being only x64, but can't seem to find one and it doesn't look like I saved one neither. Does ...
2
votes
1answer
126 views

What does this magic number do? [duplicate]

I've opened a 64 bit DLL file in IDA. One function has this pseudocode: unsigned __int64 output; ULONG input; output = (unsigned __int64)(input * (unsigned __int128)0xE38E38E38E38E38Fui64 >> 64)...
1
vote
1answer
79 views

How to debug a crash in wow64.dll in 32bit process

I have a 32bit application and a few wrapper tools that I use one after another to inject code, hook system dll functions (using the patch-first-bytes-of-the-function-with-jump approach). Also I have ...
5
votes
1answer
58 views

Passing a (string) argument via the return address?

I'm debugging an old PC BIOS and it has most of its constant strings interspersed directly with the code, like this: As the comment notes, the function putsc will take the string as its argument, ...
2
votes
1answer
79 views

Why are these 0-byte jumps used as a delay?

I'm debugging an old PC BIOS and see a lot of what I assume are delay sequences, using 0-byte jump instructions (EB 00 = jmp short $+2). Why this particular instruction? I'm guessing it must have ...
2
votes
1answer
215 views

Trap Flag - Anti-debugging trick

I am trying to reverse a program which is employing some kind of anti-debugging trick based on the use of SEHs and the TF. The code stars with: So apparently it's generating an exception with XOR ...
1
vote
1answer
85 views

Data moved after program rebase

Consider the following piece of code: .text:00F74B42 call sub_12D1130 .text:00F74B47 mov eax, dword_15A0C80 Now, I want to add a sanity check but as I don't have enough space to do that I ...
5
votes
1answer
116 views

What's the meaning of dword_XXXX and offset dword_XXXX in IDA?

Consider the following code: In C++: SomeClass* globalPointer; // we don't know what it points to, but it's not null a pointer, it's initialized void someFunction() { globalPointer->...
0
votes
1answer
78 views

Keygenme - Key location

So I was messing with an interesting keygenme, written in C++, which derives the key based on the values of the OSINFO structure. Now, when checking for a valid key it uses the following instruction: ...
15
votes
3answers
5k views

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

I don't know whether this is a silly question, but I couldn't find any answer. With the evolution of CPU architecture, register size was extended, from 8, to 16, 32, and eventually 64-bit. I was ...
0
votes
1answer
143 views

ELF binary corrupted after adding instruction in non-executable section

I've been messing around a little with Radare2 trying to master binary exploitation and patching. I added a couple of assembly instructions to an x86 elf binary in a non-executable section of the file,...
3
votes
1answer
80 views

Shellcode issue

I'm currently trying to understand a peculiar behaviour with a shellcode. When reaching a MOV instruction just before an interrupt the shellcode get modified: As you can see on the radare2 output, my ...