Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [x86]

A family of instruction set architectures originally based on the Intel 8086 CPU that functions with a very wide array of operating systems, including Windows, MacOS X, Linux, BSD, and Solaris.

7
votes
2answers
91 views

How did this 80286 detection code work?

I'm poking through a disassembled 16-bit DOS game circa 1992. The original system requirements state that the game needs an IBM AT-compatible machine or later, with the 286 processor, to run. And ...
6
votes
1answer
77 views

WHY and WHEN do we need SEH for buffer overflowing

In our course in university, we recently moved on from standard buffer-overflows to SEH based ones. My exploit is already ready and working thanks to some nice tutorials, although I am still not sure ...
3
votes
0answers
47 views

Recognizing instructions containing low-level control flows

There are some x86 instructions which containing a low-level** control flow in its semantics, for example div because its semantics is roughly as: if (source == 0) throw exception... else ...
2
votes
2answers
70 views

What are the difference syscall and int 0x2E instructions?

From this question: How does the Windows Native API communicate with the kernel? Here is an example of ZwClose(HANDLE Handle); system call in NTDLL.DLL in Windows 10 X86_64: NtClose proc ...
2
votes
1answer
87 views

XMM register instructions and their c equivalents

I'm trying to convert some x86 assembly back into C++, and I cannot figure out how this set of instructions was originally written. movd xmm0,eax ; byte read from device '0x04' cvtdq2pd xmm0,xmm0 ; ...
4
votes
2answers
80 views

How does the XADD instruction modify the Zero Flag?

I've come across a set of instructions using lock xadd which I'm guessing came from one of the C++ smart pointer templates. (It's been a very long time since I coded C++ so I'm not sure which). lea ...
3
votes
1answer
88 views

Using ECX after being modified by a function call

I have a peculiar snippet of code which I cannot wrap my head around: push 0xC ; arg1 for call mov ecx,edi ; set the this pointer for call call sdk.100039F0 ; make the call (...
4
votes
1answer
42 views

GS Cookie and exception handlers

I'm trying to understand how this GS cookie implementation is working. From what I've read on the topic, a cookie is set during the prologue then checked again in the epilogue. Well I can see the ...
0
votes
4answers
144 views

Older versions of IDA free?

I'm looking for an IDA free version previous to 7.0 so I can use it in x86 systems, the current one being only x64, but can't seem to find one and it doesn't look like I saved one neither. Does ...
2
votes
1answer
69 views

What does this magic number do? [duplicate]

I've opened a 64 bit DLL file in IDA. One function has this pseudocode: unsigned __int64 output; ULONG input; output = (unsigned __int64)(input * (unsigned __int128)0xE38E38E38E38E38Fui64 >> 64)...
1
vote
1answer
40 views

How to debug a crash in wow64.dll in 32bit process

I have a 32bit application and a few wrapper tools that I use one after another to inject code, hook system dll functions (using the patch-first-bytes-of-the-function-with-jump approach). Also I have ...
5
votes
1answer
49 views

Passing a (string) argument via the return address?

I'm debugging an old PC BIOS and it has most of its constant strings interspersed directly with the code, like this: As the comment notes, the function putsc will take the string as its argument, ...
2
votes
1answer
69 views

Why are these 0-byte jumps used as a delay?

I'm debugging an old PC BIOS and see a lot of what I assume are delay sequences, using 0-byte jump instructions (EB 00 = jmp short $+2). Why this particular instruction? I'm guessing it must have ...
2
votes
1answer
97 views

Trap Flag - Anti-debugging trick

I am trying to reverse a program which is employing some kind of anti-debugging trick based on the use of SEHs and the TF. The code stars with: So apparently it's generating an exception with XOR ...
1
vote
1answer
75 views

Data moved after program rebase

Consider the following piece of code: .text:00F74B42 call sub_12D1130 .text:00F74B47 mov eax, dword_15A0C80 Now, I want to add a sanity check but as I don't have enough space to do that I ...
5
votes
1answer
84 views

What's the meaning of dword_XXXX and offset dword_XXXX in IDA?

Consider the following code: In C++: SomeClass* globalPointer; // we don't know what it points to, but it's not null a pointer, it's initialized void someFunction() { globalPointer->...
0
votes
1answer
74 views

Keygenme - Key location

So I was messing with an interesting keygenme, written in C++, which derives the key based on the values of the OSINFO structure. Now, when checking for a valid key it uses the following instruction: ...
14
votes
3answers
4k views

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

I don't know whether this is a silly question, but I couldn't find any answer. With the evolution of CPU architecture, register size was extended, from 8, to 16, 32, and eventually 64-bit. I was ...
0
votes
1answer
73 views

ELF binary corrupted after adding instruction in non-executable section

I've been messing around a little with Radare2 trying to master binary exploitation and patching. I added a couple of assembly instructions to an x86 elf binary in a non-executable section of the file,...
3
votes
1answer
65 views

Shellcode issue

I'm currently trying to understand a peculiar behaviour with a shellcode. When reaching a MOV instruction just before an interrupt the shellcode get modified: As you can see on the radare2 output, my ...
1
vote
1answer
60 views

How to move one step back in a debugger

When I debug a .exe file on Windows with IDA, I do it step by step. Can I move one step back and reset all the registers and stack to what they were one instruction ago? By the way, when I'm looking ...
2
votes
2answers
104 views

What is the difference between Windbg and local debugger in IDA

When I want to debug an .exe on Windows with IDA I can choose between Windbg or local debugger. What is the difference? By the way, is there any difference if I use Windbg tool (windows software) ...
2
votes
1answer
61 views

How to identify when a function is being called using IDA?

I'm debugging a .exe file on Windows with IDA's debugger. How can I identify when the code calls the random() function?
3
votes
2answers
46 views

Finding a particular call to an offset within a vtable using pattern matching

Let's say I have a very simple pattern I'm looking for. E.g. the following regex, mov.*(eax|edx|ecx|esi|edi), \[(eax|edx|ecx|esi|edi)\+30h\] Now, I'm also looking for references to this in which the ...
2
votes
0answers
73 views

Radare2 - Insert asm instructions without overwriting

In order to patch a x86 elf file on Linux, I'm struggling to insert a specific assembler instruction into the binary file without overwriting any of the preexisting instructions. I've been reading ...
3
votes
1answer
106 views

Question about the limit and base address in x86-64 segmentation model?

I'm trying to understand how segmentation works under x86-64. From what I see, it's mostly disabled, but not entirely. It looks like GS and FS registers are still using it. So I was reviewing the ...
-2
votes
1answer
83 views

x86 Assembly Data Types [closed]

For the code below can anyone help with these questions? xor eax, eax mov ecx, 5 lea edi, [edx] rep stosd mov al, 0xFF stosw stosb stosb How many times does the 'stosd' operation run? Why? If edx ...
1
vote
1answer
110 views

sidt, sldt, sgdt, str anti-vm techniques does not work anymore on VMWare 12?

They are all privileged(??) x86 instructions. sidt : Stores the Interrupt Descriptor Table Register (IDTR) content. (Red pill) sldt : Stores the segment selector from the Local Descriptor Table ...
3
votes
2answers
46 views

How do you look for a a particular value at address in IDA

So, I was trying to load some binary and in the main function, I saw instructions such as mov edi, [esi+1Ch] ... lea eax, [esi+18h] So, what are these values at [esi+1Ch] and [esi+18h]. How do ...
1
vote
1answer
67 views

Reverse engineering a VST to learn about signal processing and hopefully help me make my own.

I have been trying to simply open and view the source code for a VST I am researching as I hope to create my own VST sometime in the future. I have two .dat files which I presume contain the audio ...
2
votes
1answer
50 views

What does __return_ptr do in IDA?

Let's say I have this program: struct A { int x; }; struct A func1(int z) { struct A result; result.x = z+1; return result; } int main() { return func1(1).x; } When compiling ...
3
votes
3answers
197 views

IDA: add segments without losing data

I'm browsing an old 80186 BIOS ROM in IDA free. I have loaded the binary file at the correct address and created one big segment for the entire thing since I knew nothing about the internal structure. ...
1
vote
0answers
38 views

Threads blocking in kernel when I attach, can't control them

I'm attaching to a simple program and the new thread breaks at DbgBreakPoint as expected. I'm using x64dbg (32-bit). The problem is, when I go to the Threads window it shows all the threads' EIPs as ...
4
votes
1answer
115 views

How to specify stack-based return values in IDA Pro (GoLang)

tl;dr: I am reversing a GoLang 1.10 executable, compiled for Windows. I am trying to make IDA correctly recognize the calling convention. Details: I am looking at an x86 executable where the ...
0
votes
1answer
42 views

Identifying code that accesses encrypted overlay in PE

I’m reviewing a malware sample that stores an encrypted PE file in its overlay. I’m attempting to identify in IDA pieces of x86 that may be responsible for accessing the overlay and performing the ...
2
votes
1answer
83 views

Meaning of code used to find kernel32.dll in shellcode

I'm attempting to reverse some shellcode created by metasploit to increase my understanding of shellcode. I understand the overall point of the code is attempting to locate kernel32.dll in the list of ...
1
vote
1answer
92 views

Hex-Rays can't parse switch (bad target for case)

I need to add new case, so here is that I do. Copy the jump table for switch statement to 0048199C and add new ref to 4819C0. Add new instructions below Set new address 0048199C In the indirect ...
5
votes
1answer
352 views

Why do many imported functions jump to addresses that do not contain instructions?

I am learning to analyze binaries using radare2 and have been confused about what occurs within imported functions. In the binary below, titled Lab2B, I statically disassembled the binary and then ...
1
vote
2answers
57 views

How is the IV generated from a timestamp based on this function?

Background: I am currently looking to make some diagnostic software interoperable with other software, but all communication that occurs in this software is encrypted with AES-128-CBC. A sample ...
0
votes
1answer
94 views

IDA Pro Address doesn't correlate to Immunity Debugger address

I'm trying to use immunity debugger to step through a confusing binary. When I open it in IDA Pro, I see certain addresses next to the instructions: .text:01001392 inc eax When I ...
4
votes
2answers
162 views

General x86 to C tips?

I'm currently trying to finish an assignment for one of my classes that requires a sequence of ten Hexadecimal numbers for it not to blow up. The task is to find these numbers and input them in the ...
1
vote
3answers
220 views

Question relating to learning Assembly through CTF challenges

I've just started to dip into Assembly for CTF reversing challenges, and am having a great time. A loop structure in the current challenge I'm working on has me stumped, however - hoping someone can ...
1
vote
2answers
207 views

What does XREF mean?

I have been learning about the x86 assembly language by analyzing a binary using radare2 that is stored on a Intel 80386 machine. When I have been analyzing functions on the binary, I noticed that "...
1
vote
1answer
137 views

How is data transferred from the process’ memory to the console screen?

I am learning about how the call stack works by reverse engineering binaries using Radare2 (in a Linux environment). The ISA on the server (a P5 micro-architecture) I am analyzing binaries off of is ...
1
vote
2answers
89 views

Printing bytecode in bytes given a string of assembly?

Megabeets determined in this answer that depending on asm.bits Radare may show either lea edx, [0x80490c8] (asm.bits=32) lea edx, [rip + 0x80490c8] (asm.bits=64) If I want to see what the ...
3
votes
2answers
1k views

Disassembly shows `LEA` with RIP?

When I disassemble this instruction using pad on Radare I get an LEA with rip [0x00000000]> pad 8d 15 c8 90 04 08 lea edx, [rip + 0x80490c8] I got this instruction from this post here I'm ...
-1
votes
2answers
139 views

translate arm instructions to hex

I looking for simple tool(not site) to translate arm instruction to hex like http://armconverter.com/. Without linker , I want put 1 instruction , and want get the hex . Do you know one please?
2
votes
1answer
122 views

Changing parameters in an OS X executable

very new here so please bear with me. I'm an artist trying to realise an idea for a camera that takes photos every X interval during a month. Everything works, except that the app with which I ...
0
votes
1answer
52 views

Arm function save registers r0 and r1

I see arm 32 bits assembly code. Usually each function do push { r4-r9,lr} ( save 6 registers on stack ). And in the end of function pop them . I see function that save push {r0,r1,r4-r9,lr} but ...
1
vote
5answers
199 views

C representation of simple assembly

I have the following very simple X86 assembly: shr cx, 1 jae short <addr> So basically, the jump will be taken if the Carry flag is not set. In the case of shr, CF will be set to the value of ...