Questions tagged [x86]

A family of instruction set architectures originally based on the Intel 8086 CPU that functions with a very wide array of operating systems, including Windows, MacOS X, Linux, BSD, and Solaris.

Filter by
Sorted by
Tagged with
0 votes
0 answers
5 views

Hexrays - Enhance decompilation of "pre-multiplied" array indices?

For this x86 (Watcom 1997) assembly that loops over an array, Hexrays yields the following pseudo code: lea eax, ds:0[ecx*4] add eax, ecx shl eax, 3 mov [esp+310h+iMulSize], eax mov ...
Ray's user avatar
  • 1,083
1 vote
0 answers
105 views

Analyse a statically linked binary and extract syscall from it using angr

How to extract all syscalls from analysing a statically linked binary. I have a script written using angr(Latest - v9.2.78) but when I start my script I get few syscalls and the analysis is like hung ...
0x4E4F4F42's user avatar
1 vote
1 answer
83 views

Strange entry point for an old Mac OS X x86 32 bit binary

I wanted to reverse engineer an old game for Mac OS X, but I can't figure out how the entry point jumps to other code. The binary is an x86 Macho-O executable and, according to Detect it Easy, it was ...
Ajadaz's user avatar
  • 11
0 votes
0 answers
34 views

Exe self-modifies strings searched in debugger

I'm studying a Windows binary file and while searching for some string I noticed the EXE modifies the searched string, e.g., if I search "This is a string", it's modified to "his is a ...
lopan's user avatar
  • 1
0 votes
0 answers
86 views

from executable to assembly source code?

let's say i have an ".exe program" and i want to disassemble it and get "disassembled code" . my question is => can i maintain and organize that "disassembled code" ...
0x00001F's user avatar
0 votes
0 answers
56 views

Is there a debugger for the entire x86 architecture?

When learning about the topic that includes processes, threads and image files it helped immensely to use x86dbg. However, it only shows things from the "view" of a single process. I am ...
AirToTec's user avatar
2 votes
1 answer
86 views

What triggers RIP_EVENT?

The documentation for the Windows Debugger API mentions a debug event called RIP_EVENT. It offers little explanation of what a RIP_EVENT is, only stating that the structure "contains the error ...
tomysshadow's user avatar
2 votes
1 answer
71 views

What is patched by LX 16:32 fixup record

In LX format description in section 3.13 Fixup Record Table, when describing SRC = DB Source type field there is such an option: 06h = 16:32 Pointer fixup (48-bits). 1. How many bytes does this fixup ...
Uprooted's user avatar
  • 185
2 votes
1 answer
131 views

What is the meaning of 32 bit offset in x86 16 bit jump

Consider x86 16 bit mode instruction: $ echo 66 EA 66 55 44 33 22 11 | xxd -p -r | ndisasm -b16 - 00000000 66EA665544332211 jmp dword 0x1122:0x33445566 I thought 16 bit code jumps work by combining ...
Uprooted's user avatar
  • 185
2 votes
0 answers
165 views

Ghidra Strings and Global Renaming Issue

I am currently reverse engineering a piece of 16-bit software (originally written in C/C++ from what I can gather). I have identified a function that seems to print text to the console. The text to be ...
jttri777's user avatar
  • 165
4 votes
0 answers
139 views

Reverse Engineering Technique "Step by Step"

Sometimes, I see how someone puts on the github, some reverse engineering project for some famous game. By researching these projects - I come to the conclusion that: people just took the code from ...
user avatar
3 votes
0 answers
560 views

Finding older IDA files

I am following the Begin RE tutorial here but I am stuck towards the end, where I load a file into IDA. I am using IDA Free 8.2 on Windows 11 x64. On the graph view it is only showing the main ...
securityauditor's user avatar
2 votes
1 answer
70 views

why some functions push data before the prologue

i am a newbie in the world of RE , i start to explorer a main entry of a classic game from 90's and i start to see something confuse me as a newbie this main entry function start with pushing stuff to ...
0x00001F's user avatar
1 vote
1 answer
163 views

How works k command in windbg

I am studying a Windows x86 binary in windbg. When i debug a function, in can see the call stack with « k » command. My question is: how works windbg internaly to get this call stack ? I was thinking ...
Bob5421's user avatar
  • 797
2 votes
1 answer
133 views

Ghidra Shows Structure Strange

I am new to assembly. When I was disassembling some code, I encounter some strange instruction here. The instruction shows that (RBP + -0x40) is equal to local_48, however at the beginning of the code,...
Pytai's user avatar
  • 23
2 votes
1 answer
44 views

Can ESP point to a global variable

This 3 lines of code are used by some encoders to get EIP into ECX register: fldz fnstenv [esp-C] pop ecx The 2 first instructions push some datas on stack and we get one of this into ECX on the last ...
Bob5421's user avatar
  • 797
3 votes
1 answer
110 views

Unable to determine what esp is pointing to

I'm going through the book Practical Malware Analysis (specifically, Lab07-03) and I've been stuck on a rather simple problem. I've divided the code section of main() into three parts to ease my ...
smellyourbooks's user avatar
5 votes
1 answer
359 views

Disassembling a DOS game with dynamic code/overlays in IDA Pro

I'm working on a disassembly of an old DOS game. (Real old: 16-bit, real mode.) The bulk of the game is in a large resource file of mixed binary and data; the executable basically just loads a chunk ...
Peter Malamud Smith's user avatar
1 vote
1 answer
115 views

Unable to understand x86 instruction(s)

Recently I have been given a set of assembly instructions which I must learn to understand. I know an extremely basic level of x86 assembly but I'm starting to come across more nuances that are very ...
guest1's user avatar
  • 13
2 votes
2 answers
73 views

Why does this code use multiple shifts instead of one?

I came across the following piece of 16-bit x86 code for multiplying a value by 40, using just shifts and additions: ; BX holds the value we want to multiply. ; The result is stored in AX. MOV AX, BX ...
lethal-guitar's user avatar
4 votes
1 answer
189 views

How to force IDA to show size of pointer dereference?

IDA's default x86 assembly syntax is not very clear about pointer dereferences. One of these is dereferencing the memory operand, and one is simply moving the address to the register: mov ecx, ...
thejoelpatrol's user avatar
3 votes
1 answer
198 views

Simplifying and reversing an encryption/decryption algorithm in ASM X86 / Python

I'm trying to reverse a decoding function in order to produce the function for encoding (for the curious this is a save game for a legacy adventure game which use codes for saving). So far I have ...
Simon's user avatar
  • 31
2 votes
1 answer
652 views

What is a "far call" in an x86 or x86_64 cpu

I do not understand the usefulness of the "far call" instruction in a 86 CPU. On a 32 bits CPU for example each process has an addressing space of 4Gb (0x00000000 to 0xFFFFFFFF). There can ...
Bob5421's user avatar
  • 797
2 votes
0 answers
52 views

Reversing internal function, can't call it with injected DLL

I'm currently learning RE. I've chosen to do so by trying to RE Skyrim for PC. I'm trying to call the ingame function for printing to the console, I'm doing this via an Injected DLL. The function call ...
Tom James's user avatar
0 votes
1 answer
65 views

Trying to understand this interrupted (?) function prologue

Note: The uninterrupted disassembly is at the bottom Hey, I'm looking at the the assembly and I'm trying to reverse engineer the function Here, it seems like we are saving the previous rbp. Though, it ...
Happy Jerry's user avatar
2 votes
1 answer
419 views

Nice documentation of the binary analysis tool "angr", to analyse system calls in statically linked binary and hence possibly draw a system call graph

I am a new master's student in CS. I am into the computer systems domain. I was just thinking of analyzing a statically linked binary to get a sort of database of system calls made in the binary and ...
Abhishek Ghosh's user avatar
3 votes
1 answer
576 views

Locating function parameters in x32dbg

I'm a bit rusty and trying to analyze a piece of code in x32dbg. As follows: 0627BF49 | 8B0B | mov ecx,dword ptr ds:[ebx] | 0627BF4B | 8B85 CCF5FFFF ...
throwawayn000b9999's user avatar
2 votes
0 answers
321 views

Finding the main function on Windows compiled executables

For a C/C++ program compiled on Windows using the x86 architecture, what is the best way to find the main function within disassembled code without relying on signatures such as FLIRT? I've found ...
Soyboii's user avatar
  • 41
2 votes
0 answers
81 views

jump to invalid address when emulating

I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect ...
Ayyware's user avatar
  • 41
1 vote
1 answer
104 views

x86 weird register call

I am digging with disassembler inside old game (release year 2002) and something is bugging me, I noticed it has a bunch of... questionable instructions. One of the things it does is calling imported ...
Madghostek's user avatar
4 votes
2 answers
954 views

Disassemble bios code

I have a Gigabyte G41MT-S2PT motherboard with Intel core 2 Pentium processor installed on it for test.I decided to disassemble its bios code.Its bios produced by Award Software International and its ...
Farshid's user avatar
  • 41
0 votes
1 answer
154 views

Crackme assistance - unknown function [closed]

i have a problem about a crackme that my friend sent me for a bet. I solved most of it but i am stuck with this function. I can't even understand what the function is trying to do. Please help. images ...
dxAhax's user avatar
  • 1
6 votes
4 answers
3k views

Do I have to learn computer architecture for underestanding or doing reverse engineering?

I am completely noob in reverse engineering, and I've just started to learn it. Now I have this question in my mind, that does a reverse engineer use any computer architecture knowledge for doing his/...
Sirius Black's user avatar
1 vote
2 answers
1k views

What does MOV RAX,qword ptr FS:[0x28] mean?

I'm trying to understand what MOV RAX,qword ptr FS:[0x28] means. I get that FS:[0x28] is a stack canary. If my understanding is correct the data from RAX gets copied by MOV. Then there's a comma which ...
greg5678's user avatar
0 votes
1 answer
63 views

Displacement size (disp_size) of x86 instructions

Given the opcode 80 3d 1d b0 09 00 00. The corresponding capstone instruction is <CsInsn 0x66a4 [803d1db0090000]: cmp byte ptr [rip + 0x9b01d], 0> and has the following properties (c_i being ...
langlauf.io's user avatar
  • 1,550
1 vote
0 answers
63 views

Wrong access .data segment

Preface I'm a PHP programmer, in my spare time I've been doing reverse work. Achieved good progress in the analysis game. But there was a big problem on my way. And now, more than ever, i need the ...
 Blezigen 's user avatar
1 vote
1 answer
154 views

What does the code do?

Challenge #64 What does this code do? An array of array[x][y] form is accessed here. Try to determine the dimensions of the array, at least partially, by finding y. _array$ = 8 _x$ = 12 _y$ = 16 _f ...
Nicholas Humphrey's user avatar
3 votes
1 answer
4k views

How can I make Ghidra have access to external libraries?

I am trying to decompile a executable file, I have the source code of the external libraries that it is using, I wonder if there is a way that I can make Ghidra recognize these libraries, just like it ...
Rafael Ferreira's user avatar
2 votes
1 answer
424 views

x86 - How do I detect virtualized code by looking at the assembly?

How can I detected virtualized code by say, vmprotect, obsidium or themida just by looking at the assembly code? I know that just looking at the PE section name would help, but I wanted to detect ...
Alexey's user avatar
  • 69
1 vote
1 answer
124 views

C instruction causing an address shift

I am trying to recreate a segment of assembly back into the C code. Below is the progress I've made so far, but I'm getting stumped on a specific section. 00000000000010049 <mysteryFunc>: ...
enkrypted87's user avatar
0 votes
0 answers
89 views

ADD right before CMP?

I am a beginner in RE. I compiled some code (x86 32bit), and opened it up in Ghidra. I come across the following instruction block: CALL _strcmp MOV dword ptr [EBP + local_1c], EAX MOV EAX, dword ptr [...
Soyboii's user avatar
  • 41
0 votes
0 answers
226 views

PUSH x VS MOV [ESP], x?

I am a beginner in RE. I compiled some code (x86 32bit), and opened it up in Ghidra. I come across the following instruction right before a call: MOV dword ptr [ESP], 0x3c Where 0x3c is the offset to ...
Soyboii's user avatar
2 votes
0 answers
31 views

Why does OllyDbg label data segment as read only?

I'm working on this problem: Challenge 53 When compiling with cl c53.c /Fac53.asm /MD in VS2019 X86 Development Console and loading the .exe into OllyDbg, I found OllyDbg labels all segments of c53 as ...
Nicholas Humphrey's user avatar
1 vote
0 answers
80 views

Normal artifact or something else?

I'm working on a Linux ELF challenge. I have found this bit of code in the .text disassembly using objdump -d -M intel program 922: 83 c4 10 add esp,0x10 925: c7 45 f4 00 00 00 ...
Mr. Kelsey's user avatar
1 vote
2 answers
394 views

Relationship between compiled bytes of jmp instruction and target memory address

I'm very new to all this, so sorry if I mess up and/or am unclear. I'm working on reverse engineering assault cube, where a lot of people start, and I'm struggling to understand how this one AOB ...
owaowabeep's user avatar
1 vote
1 answer
393 views

How to locate memory address in register $esp

000011d9 <main>: 11d9: 8d 4c 24 04 lea 0x4(%esp),%ecx 11dd: 83 e4 f0 and $0xfffffff0,%esp 11e0: ff 71 fc push -0x4(%ecx) 11e3: ...
user40564's user avatar
3 votes
1 answer
830 views

What is the meaning of jmp dword ptr off_XXXXXXXX + 8 in IDA?

What is the meaning of this kind of jmp instruction in x86 assembly in IDA? Does it mean that we should jump to the address [6CA2E9B0] + 8 or [6CA2E9B0+8]? When I follow that off_XXX, I get to the ...
Moteke's user avatar
  • 31
0 votes
1 answer
103 views

Understanding the meaning of EBP + 0xffff98b4

I'm currently reverse-engineering an old game from 2003 to extend its functionality. I have now found what I am looking for and since it was written in C++ I'm trying to re-create the used classes. I ...
MansenC's user avatar
2 votes
1 answer
153 views

Why does this hooking function work and never cause a "backwards" jump?

//src = the place to write the hook, dst is the function you jump to, len is length //of stolen bytes (MUST fall on a boundray between instructions) BYTE* TrampHook32(BYTE* src, BYTE* dst, const ...
EatingTechnobladesRemainsAt3am's user avatar
1 vote
2 answers
240 views

IDA decompiler syntax: for function int __usercall sub_45BD46@ <eax>(char a1@<bl>, int a2@<esi>, int a3)

I have a function with the following header sub_45BD46@eax(char a1@bl, int a2@esi, int a3), my question is: I am right that sub_45BD46@eax means the result value is in eax?
Alexey's user avatar
  • 69

1
2 3 4 5
10