We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [x86]

A family of instruction set architectures originally based on the Intel 8086 CPU that functions with a very wide array of operating systems, including Windows, MacOS X, Linux, BSD, and Solaris.

Filter by
Sorted by
Tagged with
1
vote
1answer
47 views

Why is IDA showing three arguments for the main function instead of two in some linux binaries?

So I am reversing an ELF‌ binary, now from my knowledge in C the main function has two argument, argc and argv but some linux binaries that i am reversing have 3 when i decompile them! one int and ...
1
vote
1answer
55 views

Finding a mathematical calculation which uses Pi within binary

Given a large (~14MB) binary compiled for a X86 64-bit system, what would be the basic steps to go through in order to find the usage of Pi (π) for calculation of a certain parameter (flag)? I'm ...
0
votes
0answers
23 views

Alternative APIs to hook instead of messagebox for message pop ups?

So i am reversing an app that pops up a message at some point, but its not doing this using messagebox i also tried to pause and then run to user code but didn't work, so what are some of the other ...
0
votes
2answers
41 views

Which APIs are responsible for terminating process icons in Taskbar?

I am trying to reverse and debug a program but it exists after certain point, tried setting breakpoint on any inter module call that starts with exit or terminate, now here's the weird part : it does ...
0
votes
2answers
122 views

Where is the ESP after call instruction?

I've started learning the Reverse Engineering and when I read the Stack Operations and function invocation, there are an issue that I'm confused. -What is the address of ESP after "pop ebp" and "retn" ...
0
votes
1answer
63 views

How to make a program to read Unicode control characters

I'm learning on how to cause a buffer overflow. My victim program has to read input from a file encoded with UTF-16, 2-bytes by 2-bytes, and I want to overrun the EBP with an address like 0x0012F468. ...
0
votes
1answer
69 views

I'm trying to understand the SEH mechanism

I'm trying to understand the mechanism of SEH (Structured Exception Handling). I understood how it was recorded and saved in FS: [0] on the previous three instructions. But why add interrupt 1 (step ...
0
votes
3answers
101 views

Injecting C++ code, while also maximizing compatibility with other injections

Using the New Vegas Script Extender C++ API for Fallout New Vegas, I am able to write to the process' memory directly at runtime through a .dll plugin that's loaded by the NVSE injector. But it is not ...
0
votes
2answers
81 views

How is subtraction performed on unsigned numbers within the CPU?

I am learning about various flag states for the cmp instruction. From reading, the cmp instruction is really just a sub instruction that sets the various flags (OF, CF, ZF) accordingly depending on ...
1
vote
3answers
113 views

How to find the starting address of text section of a DLL inside a process? (64 bit)

There was a question about this a year ago, but the answer doesn't explain how to do it in C/C++: How to find start of .text section? I'm not talking about module start address, which we can get ...
0
votes
1answer
41 views

x86 main preamble makes stack aligned on 32-bytes boundaries

For the record, I've read all stackexchange relevant answers on the topic (here and here) plus other articles to fully grasp the concepts of memory alignment and CPU natural boundaries. But for some ...
1
vote
2answers
79 views

Does the loader fill the IAT table of an .exe in load time by checking the corresponding export tables or during run time?

I came upon this question : Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking? and it got me wondering, lets say for some reason some function was not in the IAT of our ...
0
votes
1answer
134 views

Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking?

So i was trying to hook the ZwQuerySystemInformation or NtZwQuerySystemInformation using IAT, but i found out that these are not inside the IAT inside the memory nor in the PE file but maybe i am not ...
2
votes
1answer
87 views

How to hide a process from all the methods of getting the list of processes?

So it seems that there are a lot of ways of getting the process list, although I'm not sure whether in the low level do they acquire them from same place or not so these are the ways i know : ...
2
votes
0answers
107 views

How to add symbols from open source lib to Ghidra?

I have a binary which I can tell is using rapidjson (open source C++ library) (header only/not dynamically linked). How can I load debug symbols from that? It would help to see the types, function ...
0
votes
0answers
26 views

Generate pseudo code not available for some binaries in IDA Pro

I'm using IDA Pro to disassemble binaries. For some binaries, the Generate Pseudo Code option is available and works fine. However, on other binaries (using possibly a different compiler toolchain) ...
0
votes
0answers
55 views

What's the point of changing the CS register and can any process do this?

So i was reading this article : http://waleedassar.blogspot.com/2012/07/wow64-user-mode-system-calls-hooking.html which explains the wow64, the part that we do a far jmp and change the CS register ...
0
votes
1answer
100 views

Why address 7FFE0308 always gets compared in 64bit applications before making a syscall in Ntdll?

So there was a question asked before about this : What are the difference syscall and int 0x2E instructions? and it has two answer, one says that is just a way to check if we are in a 32 bit or 64 ...
1
vote
1answer
60 views

What is the ending bytes in the MOV instruction in 32 bit applications in windows? (B8 mov)

So i just compared NTterminateProcess between 32 and 64 bit version of a program, and the mov instruction which moves the syscall into eax is almost the same, both 5 byte, (both the B8 mov) but the ...
3
votes
2answers
310 views

What is the purpose of consecutive ADC instructions to a single register?

To clarify, I understand how ADC works. It's the same as a regular ADD but with an extra 1 if the Carry Flag was set. Its use in the snippet below makes perfect sense to me since an overflow is most ...
2
votes
1answer
191 views

Can Ghidra do backward symbolic execution?

I am searching for a tool which can do backwards symbolic execution on x86 binaries. More specifically, I would like to give the tool a program state(PC value + registers + memory content) and have it ...
0
votes
1answer
55 views

Find the call function of a string

On a 16bit real mode x86 program I can locate a string that is displayed on screen. How do I go about finding all the places this string is called from to trace back the "print" function?
1
vote
1answer
53 views

Find Reference To Resource String In Windows 3.1 16-bit DLL with IDA Pro

Experimenting Visual Basic 4 in DosBox + Windows 3.1 running on Windows 10. While I have installed SHARE.exe from MS-DOS 6.22 and it seems to run OK, it still fails to detect it. The error I get is : ...
1
vote
2answers
110 views

Dealing With x86 Segmentation Overlaps

I load my project into IDA 7 and select 8086 as this rom is a 512kb in the high address space. I apply an offset of 0x80000 and it loads properly. I then go to 0xFFFF0 and find a far jump to 0xFDAF:...
1
vote
0answers
64 views

Dump the value of register into file

I've reverse engineering little game on windows 32bit. I found a string in executable which was interesting for me (it is a board game and this string represents the fact that somebody made a move ...
1
vote
1answer
44 views

Reversing AND / shift instructions used in succession

I'm working on reversing some assembly code, and have worked it up into some pseudo code to start off with a reverse attempt. The function performs a kind of encryption on the data passed in, and I'm ...
0
votes
1answer
122 views

Weird IDA/Decompiler floating point output

I stumbled upon this (reduced for readability) function. It does weird things that I have never encountered before. // a2 is always 60.0 void some_function(struct_123 *this, float a1, float a2) { ...
2
votes
1answer
167 views

Finding address in IDA from address found in Cheat Engine

I found a pointer's address, 0x485FE058, in Cheat Engine. However, when I load up the exe in IDA, the addresses are smaller and start from 0x00401000. I read up somewhere that this was called virtual ...
0
votes
0answers
62 views

Decode message in esoteric audio file

I'm having a reverse engineering lab at school and my last project is to beat a 10 level reverse engineering CTF-like challenge. It's got plenty of interesting things. What I need to do is find a ...
0
votes
1answer
77 views

ACCESS_VIOLATION when attaching a debugger

I'm debugging a software and it hits access violation on wcslen function under debugger but runs normally without it. First I thought It had some anti-debug trick, but I could not found any ...
1
vote
0answers
48 views

Reproduce compilation (ASM) output for library detection - identifying compiler, version & options used

I want to reverse a stripped x86 sample that uses a static library. So far I could identify the library itself and narrow the version of the library used. Now I want to use Ghidra's Function ID ...
3
votes
1answer
180 views

ELF x86 - Why is return address pushed twice?

I reverse an ELF x86, and I would like to understand why the return address is pushed again on the stack? It should be already present there. main: lea ecx, [esp+0x4 {argc}] and esp, 0xfffffff0 ...
1
vote
0answers
132 views

Mysterious chunk of code in IOLI crackme0x06 challenge

I've been struggling to understand a very strange piece of x86 assembly code from the IOLI crackme0x06 challenge. Context But first of all, here is the context : I've successfully cracked the ...
2
votes
0answers
131 views

IDA Hex-Rays Decompiler Generates ASM Code Issue

For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted. Some of the decompiled generated plain C code, show as ASM code :/ i.e: ...
0
votes
1answer
151 views

How to find the starting address of main function when the binary is stripped and _start doesn't push the absolute address value of main?

So let's say the ELF binary is stripped - meaning no symbol table - and the _start function doesn't push the address of main before calling __libc_start_main. This happened in a binary when compiled ...
3
votes
1answer
90 views

How to find the index of static ilbrary functions in the PLT of the binary?

So right now I'm trying to resolve function calls and their names in my reversing tool the problem I'm having is that library functions such as printf and fwrite and such do not have a corresponding ...
1
vote
3answers
132 views

Is the main function's name in the symbol table of C & C++ programs always 'main'? if not, how to find the name?

So I'm trying to write a reversing tool that parses symbol table to find the main function's address right now all the binaries I'm checking the name of main function is still main in symbol table ...
0
votes
1answer
65 views

What type of function gets called using a register instead of address in the binary? how to find the address statically?

So I'm trying to write a reversing tool right now and trying to make a CALL graph the problem I'm having is some calls are like Call *eax instead Call 'address' I can easily generate the call-graph ...
2
votes
1answer
89 views

What's the effect of adding a REP(N(E)) prefix to a JMP instruction?

I'm attempting to reverse engineer an executable packer, and I'm a little stumped on this x86 instruction: F2 EB F5 repne jmp short near ptr unk_88801B According to the Intel manual a repeat ...
1
vote
4answers
162 views

Modify formula by adding a subtraction

I have the following Assembler Code in a x86 Program and I need to modify it as it is buggy: fld ds:(flt_203B8 - 29C48h)[ebx] fdivr dword ptr [esi+44h] fmul ds:(flt_203BC - 29C48h)[ebx] ...
-1
votes
1answer
137 views

How can I convert the following assembly code to pseudo code?

I got the following disassembly code in IDA pro. I really find it hard to convert it into pseudo code. push ebp mov ebp, esp sub esp, 14h mov dword ptr [ebp-14h], 1 mov dword ptr [ebp-10h], 2 mov ...
-1
votes
1answer
124 views

How can I convert the following disassembly code to pseudo code or C code?

I used IDA pro to get the following disassembly code. I am having difficulty converting it into the equivalent c code. mov dword ptr [ebp-8], 1 mov dword ptr [ebp-4], 0 loc_401014: cmp dword ptr [...
1
vote
0answers
76 views

Is there a way to generate a PE from a web assembly module?

I am in the process of analysing a large web assembly. I have the compiled .wasm file and using the tools available I can convert this to a .wat text representation. Currently, I am doing the ...
0
votes
2answers
371 views

What's happening in the assembly main function?

I'm currently inspecting a 32-bit malware executable in a WinXP VM using IDA Pro (free version). I don't understand what's happening in the main function here. Where should I set the breakpoints (...
2
votes
2answers
1k views

How the CMP instruction uses condition flags?

I am trying to figure out the behavior of conditional jumps (JE/JNE, JZ/JNZ) in the x86 instruction set familly. Which condition flags CMP instruction sets and how, if the result is equal and if it ...
0
votes
1answer
431 views

How does the x86 instruction, call 135b<__x86.get_pc_thunk.ax> work?

I think the below instruction is used for position independent code. Could anyone please help me understand how it works? call 135b<__x86.get_pc_thunk.ax> What are the use of the below ...
1
vote
1answer
87 views

debugging with radare2

I am using radare2 for disassemble an x86 binary: $ r2 ./mynbinary [0x00001000]> aaa ... [0x00001000]> pdf ;-- section..text: ;-- section.LOAD1: ;-- rip: / (...
0
votes
1answer
83 views

Why Ida pseudo-code translate test as AND?

In IDA when disassembling a x86 EXE file there is a line test byte ptr [ebp+XXX], cl Before this line cl has a value of 0x11 The Hex-Rays decompiler plugin translates it as if (v10 &0x11). Why ...
1
vote
2answers
150 views

Assembly that just seems to be a jumble

I've disassembled an old DOS program into assembly and I'm trying to figure out a function call. Here is the ASM: seg000:373C ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦...
7
votes
2answers
1k views

What's this assembly doing?

I have been trying to figure out the assembly for part of a DOS game and there is an operation that keeps getting called that uses all 4 registers. I can see what each line does but I can't for the ...