Questions tagged [x86]
A family of instruction set architectures originally based on the Intel 8086 CPU that functions with a very wide array of operating systems, including Windows, MacOS X, Linux, BSD, and Solaris.
482
questions
0
votes
0
answers
5
views
Hexrays - Enhance decompilation of "pre-multiplied" array indices?
For this x86 (Watcom 1997) assembly that loops over an array, Hexrays yields the following pseudo code:
lea eax, ds:0[ecx*4]
add eax, ecx
shl eax, 3
mov [esp+310h+iMulSize], eax
mov ...
- 1,083
1
vote
0
answers
105
views
Analyse a statically linked binary and extract syscall from it using angr
How to extract all syscalls from analysing a statically linked binary.
I have a script written using angr(Latest - v9.2.78) but when I start my script I get few syscalls and the analysis is like hung ...
- 11
1
vote
1
answer
83
views
Strange entry point for an old Mac OS X x86 32 bit binary
I wanted to reverse engineer an old game for Mac OS X, but I can't figure out how the entry point jumps to other code. The binary is an x86 Macho-O executable and, according to Detect it Easy, it was ...
- 11
0
votes
0
answers
34
views
Exe self-modifies strings searched in debugger
I'm studying a Windows binary file and while searching for some string I noticed the EXE modifies the searched string, e.g., if I search "This is a string", it's modified to "his is a ...
- 1
0
votes
0
answers
86
views
from executable to assembly source code?
let's say i have an ".exe program" and i want to disassemble it and get "disassembled code" .
my question is => can i maintain and organize that "disassembled code" ...
- 23
0
votes
0
answers
56
views
Is there a debugger for the entire x86 architecture?
When learning about the topic that includes processes, threads and image files it helped immensely to use x86dbg. However, it only shows things from the "view" of a single process.
I am ...
- 3
2
votes
1
answer
86
views
What triggers RIP_EVENT?
The documentation for the Windows Debugger API mentions a debug event called RIP_EVENT. It offers little explanation of what a RIP_EVENT is, only stating that the structure "contains the error ...
- 137
2
votes
1
answer
71
views
What is patched by LX 16:32 fixup record
In LX format description in section
3.13 Fixup Record Table, when describing SRC = DB Source type field there is such an option:
06h = 16:32 Pointer fixup (48-bits).
1. How many bytes does this fixup ...
- 185
2
votes
1
answer
131
views
What is the meaning of 32 bit offset in x86 16 bit jump
Consider x86 16 bit mode instruction:
$ echo 66 EA 66 55 44 33 22 11 | xxd -p -r | ndisasm -b16 -
00000000 66EA665544332211 jmp dword 0x1122:0x33445566
I thought 16 bit code jumps work by combining ...
- 185
2
votes
0
answers
165
views
Ghidra Strings and Global Renaming Issue
I am currently reverse engineering a piece of 16-bit software (originally written in C/C++ from what I can gather).
I have identified a function that seems to print text to the console. The text to be ...
- 165
4
votes
0
answers
139
views
Reverse Engineering Technique "Step by Step"
Sometimes, I see how someone puts on the github, some reverse engineering project for some famous game.
By researching these projects - I come to the conclusion that:
people just took the code from ...
user42316
3
votes
0
answers
560
views
Finding older IDA files
I am following the Begin RE tutorial here but I am stuck towards the end, where I load a file into IDA. I am using IDA Free 8.2 on Windows 11 x64.
On the graph view it is only showing the main ...
- 185
2
votes
1
answer
70
views
why some functions push data before the prologue
i am a newbie in the world of RE ,
i start to explorer a main entry of a classic game from 90's
and i start to see something confuse me as a newbie
this main entry function start with pushing stuff to ...
- 23
1
vote
1
answer
163
views
How works k command in windbg
I am studying a Windows x86 binary in windbg.
When i debug a function, in can see the call stack with « k » command.
My question is: how works windbg internaly to get this call stack ?
I was thinking ...
- 797
2
votes
1
answer
133
views
Ghidra Shows Structure Strange
I am new to assembly. When I was disassembling some code, I encounter some strange instruction here. The instruction shows that (RBP + -0x40) is equal to local_48, however at the beginning of the code,...
- 23
2
votes
1
answer
44
views
Can ESP point to a global variable
This 3 lines of code are used by some encoders to get EIP into ECX register:
fldz
fnstenv [esp-C]
pop ecx
The 2 first instructions push some datas on stack and we get one of this into ECX on the last ...
- 797
3
votes
1
answer
110
views
Unable to determine what esp is pointing to
I'm going through the book Practical Malware Analysis (specifically, Lab07-03) and I've been stuck on a rather simple problem. I've divided the code section of main() into three parts to ease my ...
5
votes
1
answer
359
views
Disassembling a DOS game with dynamic code/overlays in IDA Pro
I'm working on a disassembly of an old DOS game. (Real old: 16-bit, real mode.) The bulk of the game is in a large resource file of mixed binary and data; the executable basically just loads a chunk ...
1
vote
1
answer
115
views
Unable to understand x86 instruction(s)
Recently I have been given a set of assembly instructions which I must learn to understand. I know an extremely basic level of x86 assembly but I'm starting to come across more nuances that are very ...
- 13
2
votes
2
answers
73
views
Why does this code use multiple shifts instead of one?
I came across the following piece of 16-bit x86 code for multiplying a value by 40, using just shifts and additions:
; BX holds the value we want to multiply.
; The result is stored in AX.
MOV AX, BX
...
- 153
4
votes
1
answer
189
views
How to force IDA to show size of pointer dereference?
IDA's default x86 assembly syntax is not very clear about pointer dereferences. One of these is dereferencing the memory operand, and one is simply moving the address to the register:
mov ecx, ...
3
votes
1
answer
198
views
Simplifying and reversing an encryption/decryption algorithm in ASM X86 / Python
I'm trying to reverse a decoding function in order to produce the function for encoding (for the curious this is a save game for a legacy adventure game which use codes for saving).
So far I have ...
- 31
2
votes
1
answer
652
views
What is a "far call" in an x86 or x86_64 cpu
I do not understand the usefulness of the "far call" instruction in a 86 CPU.
On a 32 bits CPU for example each process has an addressing space of 4Gb (0x00000000 to 0xFFFFFFFF).
There can ...
- 797
2
votes
0
answers
52
views
Reversing internal function, can't call it with injected DLL
I'm currently learning RE. I've chosen to do so by trying to RE Skyrim for PC. I'm trying to call the ingame function for printing to the console, I'm doing this via an Injected DLL.
The function call ...
- 21
0
votes
1
answer
65
views
Trying to understand this interrupted (?) function prologue
Note: The uninterrupted disassembly is at the bottom
Hey, I'm looking at the the assembly and I'm trying to reverse engineer the function
Here, it seems like we are saving the previous rbp. Though, it ...
2
votes
1
answer
419
views
Nice documentation of the binary analysis tool "angr", to analyse system calls in statically linked binary and hence possibly draw a system call graph
I am a new master's student in CS. I am into the computer systems domain. I was just thinking of analyzing a statically linked binary to get a sort of database of system calls made in the binary and ...
- 121
3
votes
1
answer
576
views
Locating function parameters in x32dbg
I'm a bit rusty and trying to analyze a piece of code in x32dbg. As follows:
0627BF49 | 8B0B | mov ecx,dword ptr ds:[ebx] |
0627BF4B | 8B85 CCF5FFFF ...
2
votes
0
answers
321
views
Finding the main function on Windows compiled executables
For a C/C++ program compiled on Windows using the x86 architecture, what is the best way to find the main function within disassembled code without relying on signatures such as FLIRT?
I've found ...
- 41
2
votes
0
answers
81
views
jump to invalid address when emulating
I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect ...
- 41
1
vote
1
answer
104
views
x86 weird register call
I am digging with disassembler inside old game (release year 2002) and something is bugging me, I noticed it has a bunch of... questionable instructions. One of the things it does is calling imported ...
- 11
4
votes
2
answers
954
views
Disassemble bios code
I have a Gigabyte G41MT-S2PT motherboard with Intel core 2 Pentium processor installed on it for test.I decided to disassemble its bios code.Its bios produced by Award Software International and its ...
- 41
0
votes
1
answer
154
views
Crackme assistance - unknown function [closed]
i have a problem about a crackme that my friend sent me for a bet. I solved most of it but i am stuck with this function. I can't even understand what the function is trying to do. Please help.
images ...
- 1
6
votes
4
answers
3k
views
Do I have to learn computer architecture for underestanding or doing reverse engineering?
I am completely noob in reverse engineering, and I've just started to learn it.
Now I have this question in my mind, that does a reverse engineer use any computer architecture knowledge for doing his/...
- 63
1
vote
2
answers
1k
views
What does MOV RAX,qword ptr FS:[0x28] mean?
I'm trying to understand what MOV RAX,qword ptr FS:[0x28] means. I get that FS:[0x28] is a stack canary. If my understanding is correct the data from RAX gets copied by MOV. Then there's a comma which ...
- 11
0
votes
1
answer
63
views
Displacement size (disp_size) of x86 instructions
Given the opcode 80 3d 1d b0 09 00 00.
The corresponding capstone instruction is
<CsInsn 0x66a4 [803d1db0090000]: cmp byte ptr [rip + 0x9b01d], 0>
and has the following properties (c_i being ...
- 1,550
1
vote
0
answers
63
views
Wrong access .data segment
Preface
I'm a PHP programmer, in my spare time I've been doing reverse work. Achieved good progress in the analysis game. But there was a big problem on my way. And now, more than ever, i need the ...
- 11
1
vote
1
answer
154
views
What does the code do?
Challenge #64
What does this code do?
An array of array[x][y] form is accessed here. Try to determine the dimensions of the array, at least partially, by finding y.
_array$ = 8
_x$ = 12
_y$ = 16
_f ...
3
votes
1
answer
4k
views
How can I make Ghidra have access to external libraries?
I am trying to decompile a executable file, I have the source code of the external libraries that it is using, I wonder if there is a way that I can make Ghidra recognize these libraries, just like it ...
2
votes
1
answer
424
views
x86 - How do I detect virtualized code by looking at the assembly?
How can I detected virtualized code by say, vmprotect, obsidium or themida just by looking at the assembly code? I know that just looking at the PE section name would help, but I wanted to detect ...
- 69
1
vote
1
answer
124
views
C instruction causing an address shift
I am trying to recreate a segment of assembly back into the C code. Below is the progress I've made so far, but I'm getting stumped on a specific section.
00000000000010049 <mysteryFunc>:
...
- 13
0
votes
0
answers
89
views
ADD right before CMP?
I am a beginner in RE. I compiled some code (x86 32bit), and opened it up in Ghidra. I come across the following instruction block:
CALL _strcmp
MOV dword ptr [EBP + local_1c], EAX
MOV EAX, dword ptr [...
- 41
0
votes
0
answers
226
views
PUSH x VS MOV [ESP], x?
I am a beginner in RE. I compiled some code (x86 32bit), and opened it up in Ghidra.
I come across the following instruction right before a call:
MOV dword ptr [ESP], 0x3c
Where 0x3c is the offset to ...
- 1
2
votes
0
answers
31
views
Why does OllyDbg label data segment as read only?
I'm working on this problem: Challenge 53
When compiling with cl c53.c /Fac53.asm /MD in VS2019 X86 Development Console and loading the .exe into OllyDbg, I found OllyDbg labels all segments of c53 as ...
1
vote
0
answers
80
views
Normal artifact or something else?
I'm working on a Linux ELF challenge.
I have found this bit of code in the .text disassembly using objdump -d -M intel program
922: 83 c4 10 add esp,0x10
925: c7 45 f4 00 00 00 ...
- 141
1
vote
2
answers
394
views
Relationship between compiled bytes of jmp instruction and target memory address
I'm very new to all this, so sorry if I mess up and/or am unclear. I'm working on reverse engineering assault cube, where a lot of people start, and I'm struggling to understand how this one AOB ...
- 13
1
vote
1
answer
393
views
How to locate memory address in register $esp
000011d9 <main>:
11d9: 8d 4c 24 04 lea 0x4(%esp),%ecx
11dd: 83 e4 f0 and $0xfffffff0,%esp
11e0: ff 71 fc push -0x4(%ecx)
11e3: ...
- 11
3
votes
1
answer
830
views
What is the meaning of jmp dword ptr off_XXXXXXXX + 8 in IDA?
What is the meaning of this kind of jmp instruction in x86 assembly in IDA?
Does it mean that we should jump to the address [6CA2E9B0] + 8 or [6CA2E9B0+8]?
When I follow that off_XXX, I get to the ...
- 31
0
votes
1
answer
103
views
Understanding the meaning of EBP + 0xffff98b4
I'm currently reverse-engineering an old game from 2003 to extend its functionality. I have now found what I am looking for and since it was written in C++ I'm trying to re-create the used classes. I ...
- 3
2
votes
1
answer
153
views
Why does this hooking function work and never cause a "backwards" jump?
//src = the place to write the hook, dst is the function you jump to, len is length
//of stolen bytes (MUST fall on a boundray between instructions)
BYTE* TrampHook32(BYTE* src, BYTE* dst, const ...
1
vote
2
answers
240
views
IDA decompiler syntax: for function int __usercall sub_45BD46@ <eax>(char a1@<bl>, int a2@<esi>, int a3)
I have a function with the following header sub_45BD46@eax(char a1@bl, int a2@esi, int a3), my question is: I am right that sub_45BD46@eax means the result value is in eax?
- 69