Questions tagged [x86]

A family of instruction set architectures originally based on the Intel 8086 CPU that functions with a very wide array of operating systems, including Windows, MacOS X, Linux, BSD, and Solaris.

Filter by
Sorted by
Tagged with
1
vote
0answers
23 views

Instruction trace using frida in android emulator

i have a emulator named "Ldplayer" in my windows os and I'm trying to log all instructions executed by the app that uses ARM JNI libraries. basically, the app is running in an x86 emulator ...
3
votes
1answer
74 views

Figure out with fopen

Can anyone explain, why fopen takes as argument- not a file name- according to code takes some off_6A5D8C: .text:00537F9F push offset stru_6C4E40 ; FILE * .text:00537FA4 ...
0
votes
1answer
32 views

What is this line and how to remove it

I tried to unpack packed_dll, when the unpack stage done, i dumped unpacked_dll out and start to reverse. I pretty sure this is continuously function of that dll but this line show up. So what is this ...
0
votes
1answer
28 views

Getting function arguments in ida

I'm trying to extract the callee arguments in my intel x86 binary using IDA Pro 7.3. I tried the following line: ida_typeinf.get_arg_addrs(call_address) # call address points at `call some_func` ...
1
vote
0answers
24 views

What numeric properties are used in this Unsigned Integer (64bit) -> Floating Vector (128bit) conversion?

Recently I came across the following set of vector instructions: movq xmm0, rcx punpckldq xmm0, 0x4530000043300000 subpd xmm0, 0x4330000000000000 haddpd xmm0, xmm0 The only sensible ...
0
votes
1answer
31 views

Disassemble scanf storage register

I am trying to understand scanf function a have 3 question regarding it. this is c file: #include <stdio.h> #include <stdlib.h> int main(){ int x; printf("Enter X:\n"); scanf(...
1
vote
1answer
31 views

Displaying Operands as Position Independent in IDA

I'm writing an IDA python script, and i need to be able to detect position independent code. I have an instruction that IDA displays using the operand name 'format' lea rdi, format However, when ...
2
votes
1answer
48 views

Why would VGA port 03CC respond with bit 3 set and bit 2 not?

I'm reverse-engineering some code I wrote in the middle-90s for which the source is long-lost and I'm a bit baffled by some VGA code I've encountered. I think it's probably from library or 3rd party ...
0
votes
1answer
256 views

What does 'test al, al' mean?

I'm trying to reverse engineer a program and i found the following instruction: test al, al je label what does these two instruction do ? Can someone explain please ?
2
votes
2answers
39 views

X86 access to global strings pattern

While reversing some x86 executables, I came across a pattern of addressing globals, that I don't familiar with, but it looks like IDA is, and I would like to know more about it. .text:00002560 ...
0
votes
0answers
23 views

Some more questions related to C++ exceptions (catchHigh)

I've came up with the most convoluted example but still can't find the purpose of the catchHigh field. I find it that the right handler can be selected simply by looking at the tryblock map from start ...
0
votes
1answer
62 views

Ghidra Decompiler Optimized Strings

Looking at a large x86 binary, I'm seeing lots of instances where strings are assembled on the stack as quadwords like so: If I try to set the type of puStack40 to char[38], I get the following ...
1
vote
1answer
53 views

What code produces FuncInfoV1 with zero TryBlocks and zero UnwindMap?

Topic is C++ exceptions internal representation in WIndows x86 binaries compiled with msvc. I've found a code that straight up doesn't have nothing (all fields of FuncInfo zero) except the EHFlags ...
2
votes
1answer
79 views

What does state mean in unwinding?

I'm looking at UnwindMapEntry. Here is it's declaration: // // UnwindMapEntry - Description of each state transition for unwinding // the stack (i.e. calling destructors). // // The unwind map is an ...
1
vote
1answer
31 views

What is the mdisp field in RTTI for throw used for?

First of here is the article from which I'm looking up the fields. I was trying out different combinations to see how they affect the RTTI for a C++ throw. It seems that having a virtual base class ...
0
votes
1answer
132 views

x86 ELF - argc location on stack?

According to the System V ABI for x86, esp should be pointing at argc when entering main. However, I've seen many binaries where argc instead is retrieved from esp + 4, or esp + 8. Is this correct, or ...
0
votes
3answers
83 views

What is the best way to change the call-graph of a PE file without changing its real behavior and without packing it?

What i want to do is take a PE file, extract its call-graph, and then inject a junk function in it, so for example by injecting a junk function inside of it, and changing a call instruction's opcode ...
0
votes
0answers
72 views

CHBByteStream operator<<, get only one argument - value

Anyone heard about CHBByteStream? It's from Harman headunit (car radio). I don't know how it's passing arguments. SWID is 4 bytes, VIN is 17 bytes, it should be connected in some way, to pass thru ...
1
vote
1answer
100 views

Adding a static variable to Windows DLL

I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls. I ...
-1
votes
2answers
133 views

How to see assembly of main function?

How can I dump the assembly of main function of binary(not striped) in ubuntu? I want to see the assembly command and the hex value of this command There are 1 binary for arm and 1 binary for x86
0
votes
0answers
87 views

Disassembly - First steps

I decided that I need to understand this more thoroughly, so am working in parallel with two resources: one more modern and one original from @Aleph1. In the essay, there is a basic code snippet, ...
0
votes
0answers
26 views

Modify a binary and account for relative jumps [duplicate]

Most binaries have jump and control flow instructions that are relative to other locations in the binary. For example: if I modify an instruction around 0x12341232, and there is an instruction ...
1
vote
0answers
77 views

IDA shows MEMORY or unknown references on C std library calls (memset, memcpy, etc.)

I'm currently reversing a Linux 32-bit executable (with a statically linked library included in it) but I'm having a little problem I can't find a solution for. Basically whenever I stumble across a ...
2
votes
2answers
107 views

BIOS first jump leads to empty memory

I'm trying to reverse a BIOS of an industrial PC in order to repair it. The device is based on an ETX-formfactor mobo, obscure Italian SECO M671, very similar to an old Kontron PM-15(C), but with a ...
1
vote
1answer
151 views

ELF file crashing after executing shellcode

So after changing the entry point via the e_entry field I managed to execute my shellcode before returning control to the original entry point. Here's how I did it: // write string and jump to OEP, ...
1
vote
1answer
42 views

strtok called on char pointer at 0

I'm working on a larger reversing project and came across this segment. I don't really understand what's going on here. There is no other way to proceed along the flow of control besides bypassing ...
0
votes
1answer
48 views

I don't understand the use of mov eax,ds:0x404004 and the NOP slide in this code I made [closed]

Hi guys, I'm just practising the difference between global and local variables and how they are represented in x86 assembly. I just don't understand the use of the ds segment register and the NOP ...
1
vote
0answers
39 views

How does this wannacry sample work?

I downloaded wannacry sample here: https://github.com/fadyosman/WannaCrySample/releases. Don't forget to enter password for archive. I figured out how most of the binary works, except the very last ...
1
vote
0answers
36 views

Memory modified at jump far

Observing a trace of Wow64 switching on Windows 7, the following situation makes me confused ... 0x77491dbe 64 ff 15 c0 00 00 00 call fs:[0xc0] ; syswow64\ntdll.dll 0x74632320 ea 1e 27 63 ...
0
votes
0answers
106 views

Best way to find data in running executable (ollydbg/x32dbg/CheatEngine) that I found in Ghidra?

I have located a function that I would like to reverse engineer in a game. The function pulls character strings from a large array. I am trying to find this array's contents. The line in Ghidra is: ...
0
votes
0answers
205 views

unpacking Armadillo-packed exe on Windows 10

I was trying to unpack the Armadillo-protected target from this webpage Armadillo 4.30a with Debug Blocker - manually unpacking on Windows 10. However, I got another child process spawning again after ...
0
votes
0answers
281 views

Decompile a win32 application written using C++ with .exe and .pdb

I'm aware of IDA Pro, but it doesn't generate a compilable code. I don't want exact original source code or comments, I just want a recompilable code generation. The exe is not packed and does not ...
2
votes
1answer
91 views

What are some useful strategies for understanding undocumented assembly language?

What are some useful strategies for tackling a list of undocumented assembly language instructions? Even as someone who writes assembly code, I find it to be challenging at times to understand someone ...
1
vote
1answer
65 views

Cant see mnemonics on ollydbg 2.01

Im reverse engineering an exe, but i get locked on a specific location, i suppose this is a jump to the same location, when im on this "obfuscated" addresses i cant see any instruction, but the ...
1
vote
1answer
86 views

Why is IDA showing three arguments for the main function instead of two in some linux binaries?

So I am reversing an ELF‌ binary, now from my knowledge in C the main function has two argument, argc and argv but some linux binaries that i am reversing have 3 when i decompile them! one int and ...
1
vote
1answer
89 views

Finding a mathematical calculation which uses Pi within binary

Given a large (~14MB) binary compiled for a X86 64-bit system, what would be the basic steps to go through in order to find the usage of Pi (π) for calculation of a certain parameter (flag)? I'm ...
0
votes
0answers
31 views

Alternative APIs to hook instead of messagebox for message pop ups?

So i am reversing an app that pops up a message at some point, but its not doing this using messagebox i also tried to pause and then run to user code but didn't work, so what are some of the other ...
0
votes
2answers
121 views

IDA Pro, replace exit() with continue;

This is the function: loc_BA060: ; status xor edi, edi call _exit How can one replace exit with continue?
0
votes
2answers
51 views

Which APIs are responsible for terminating process icons in Taskbar?

I am trying to reverse and debug a program but it exists after certain point, tried setting breakpoint on any inter module call that starts with exit or terminate, now here's the weird part : it does ...
0
votes
2answers
251 views

Where is the ESP after call instruction?

I've started learning the Reverse Engineering and when I read the Stack Operations and function invocation, there are an issue that I'm confused. -What is the address of ESP after "pop ebp" ...
0
votes
1answer
69 views

How to make a program to read Unicode control characters

I'm learning on how to cause a buffer overflow. My victim program has to read input from a file encoded with UTF-16, 2-bytes by 2-bytes, and I want to overrun the EBP with an address like 0x0012F468. ...
1
vote
1answer
115 views

I'm trying to understand the SEH mechanism

I'm trying to understand the mechanism of SEH (Structured Exception Handling). I understood how it was recorded and saved in FS: [0] on the previous three instructions. But why add interrupt 1 (step ...
1
vote
3answers
146 views

Injecting C++ code, while also maximizing compatibility with other injections

Using the New Vegas Script Extender C++ API for Fallout New Vegas, I am able to write to the process' memory directly at runtime through a .dll plugin that's loaded by the NVSE injector. But it is not ...
0
votes
2answers
117 views

How is subtraction performed on unsigned numbers within the CPU?

I am learning about various flag states for the cmp instruction. From reading, the cmp instruction is really just a sub instruction that sets the various flags (OF, CF, ZF) accordingly depending on ...
1
vote
3answers
672 views

How to find the starting address of text section of a DLL inside a process? (64 bit)

There was a question about this a year ago, but the answer doesn't explain how to do it in C/C++: How to find start of .text section? I'm not talking about module start address, which we can get ...
0
votes
1answer
60 views

x86 main preamble makes stack aligned on 32-bytes boundaries

For the record, I've read all stackexchange relevant answers on the topic (here and here) plus other articles to fully grasp the concepts of memory alignment and CPU natural boundaries. But for some ...
1
vote
2answers
201 views

Does the loader fill the IAT table of an .exe in load time by checking the corresponding export tables or during run time?

I came upon this question : Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking? and it got me wondering, lets say for some reason some function was not in the IAT of our ...
0
votes
1answer
331 views

Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking?

So i was trying to hook the ZwQuerySystemInformation or NtZwQuerySystemInformation using IAT, but i found out that these are not inside the IAT inside the memory nor in the PE file but maybe i am not ...
2
votes
1answer
108 views

How to hide a process from all the methods of getting the list of processes?

So it seems that there are a lot of ways of getting the process list, although I'm not sure whether in the low level do they acquire them from same place or not so these are the ways i know : ...
2
votes
0answers
497 views

How to add symbols from open source lib to Ghidra?

I have a binary which I can tell is using rapidjson (open source C++ library) (header only/not dynamically linked). How can I load debug symbols from that? It would help to see the types, function ...

1
2 3 4 5
8