Questions tagged [x86-64]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
9 views

Elf x86_64 adding function

I'm trying to see if I can append function code in the .text section of an ELF while still maintaining the execution flow of the original ELF. Ideally, I want to call the new function but that's it's ...
0
votes
0answers
32 views

Bufferoverflow Stack

I want to do a buffer overflow exploit in the stack. For this i read in data via the "gets"-function. void ExploitMe() { char buffer[256]; gets(buffer); } I compile this file with gcc test.c -...
1
vote
1answer
56 views

How to pass param to execve to execute cat a file in x64 Asm? [closed]

I want execve("/bin/cat",["/bin/cat","/test/file"],NULL). Here is my asm xor %rdx, %rdx push %rdx sub $0x16, %rsp movb $0x2f, 7(%rsp) movl $0x2f6e6962, 8(%rsp) movl $0x746163, 12(%rsp) leaq 7(%rsp)...
1
vote
0answers
314 views

Receiving “Got EOF while reading in interactive” after properly executing system(“/bin/sh”) using pwntools

I've followed some tutorials on writing a pwntools-based exploit for the bitterman ELF binary, used in a CTF competition. However, all my attempts fail with the message below, i.e. Got EOF while ...
1
vote
1answer
138 views

Changing entry-point of and ELF file

I'm trying to conduct a little experiment which basically consists of changing the EP of an ELF file and executing an exit(9) syscall, without returning to the OEP. As shown in the image everything ...
0
votes
0answers
69 views

R13 off by 2 bytes. Any help?

in this challenge i have to overwrite RIP register to point to the function "print_flags" which calls "getenv" to get the "FLAGS" variable. I have overwritten RIP register with the address of "...
1
vote
3answers
117 views

Is the main function's name in the symbol table of C & C++ programs always 'main'? if not, how to find the name?

So I'm trying to write a reversing tool that parses symbol table to find the main function's address right now all the binaries I'm checking the name of main function is still main in symbol table ...
1
vote
1answer
122 views

why saved rip changed by push?

I am doing a reverse homework. see the following pictures: as can be seen from this picture, before call push touch3, "saved rip" is at 0x5561dca8, which is equal to the current rsp(0x5561dca8). ...
1
vote
1answer
56 views

Unknown parameters in custom signal handler on Linux

0x0000000008001946: mov 0xa8(%rdx),%rax 0x000000000800194d: lea 0x28(%rdx),%rsi 0x0000000008001951: lea 0x2(%rax),%rdi 0x0000000008001955: add $0xe,%rax 0x0000000008001959: ...
0
votes
1answer
63 views

Calculate LEA operand

I have those opcodes on 64 bits: 48 8D 35 45 CE FF FF >>> lea rsi, [rip - 0x31bb]. How can I get the 0x31bb value from those opcodes and how can I know if I have a + sign or a - sign ...
0
votes
1answer
104 views

How do I go about overriding a function internally defined in a binary on Linux?

To be specific, I cannot recompile this binary, nor do I have access to the sourcecode. The functions are not defined within a shared library. So, how can I go about changing a function, or ...
0
votes
1answer
126 views

How to locate an specific data structure in an executable?

I need to locate an specific "struct" variable in the data section from an assembly. This structure is used for an specific System Function (Windows) "SetCommState()". I'm wondering how to locate the ...
2
votes
1answer
118 views

Why do I get e8 00 00 00 00 for all libc function calls?

I just started learning reverse engineering. The near call instruction (e8) is very confusing to me. It took me a while to figure out how address calculation works for local functions. Now I'm ...
3
votes
1answer
233 views

IDA 7.0 - combine sequence of assembly instructions to a macro

I'm solving this CTF with IDA Pro 7.0. At some point there is an offset calculation by index, it simply multiply an index by 48 and write/read some data to it. The main problems are: the ...
3
votes
1answer
489 views

XCHG RAX, RAX: 0x09, what does this code do and how does it work?

Given the following short assembly snippet: shr rax, 3 adc rax, 0 I worked this out a bit: We know SHR sets the CF with the last bit shifted. We know ADC dest, 0 is just adding the CF. So ...
0
votes
1answer
112 views

XCHG RAX, RAX: 0x03, what does this code do and how does it work?

"XCHG RAX, RAX" is a kind of riddle book that provides assembly code for you to reverse and undercover the meaning. Some of the examples calculate the Fibonacci sequence others bit-twiddle to toggle ...
5
votes
2answers
1k views

How many registers does an x86_64 CPU actually have?

I am currently learning reverse engineering and am studying the flags register. I had in my mind that rflags was just another name for one of the 16 general purpose registers, for example rax or rbx. ...
1
vote
1answer
258 views

Payload in simple buffer overflow exploit redirecting %rip on x86-64 Ubuntu 16.04 LTS leads to early (meaning before %rip is overwritten) segfault

I am trying to do a simple buffer overflow exploitation by overwriting the instruction pointer %rip. Here's my code of vuln.c #include <stdio.h> #include <string.h> #include <stdlib.h&...
0
votes
2answers
232 views

.00cfg section in the PE file

What's that .00cfg section that is being added by Visual Studio 2017 to PE32+ binary files (for x64 builds)? I'm assuming it stands for "Control Flow Guard" section. It is relatively small and mostly ...
2
votes
1answer
371 views

Converting Assembly x64 code to C

I have the following code: 0000000000400526 <main>: 400526: 55 push rbp 400527: 48 89 e5 mov rbp,rsp 40052a: 48 83 ec 20 sub ...
3
votes
1answer
267 views

How can I convert this assembly code (x64) to C?

I have the following assembly (x64) function: 400700: sub rsp,0x18 400704: mov QWORD PTR [rsp+0x8],rdi 400709: cmp QWORD PTR [rsp+0x8],0x0 40070f: jne 400718 <bar+0x18> 400711: mov eax,0x0 ...
1
vote
1answer
70 views

How are __argc and __wargv globals exported from a 64-bit PE file compiled with Visual Studio?

I need to inject my code into a 64-bit process. I'm wondering, how can I access __argc and __wargv global variables once in the injected process? Are they always present at a static/preset address?
1
vote
2answers
330 views

Getting opcode Length , How to

I am apparently not very good with assembly as I am novice to somethings! Hence i wanted to make a question again. Now i got this from here to make something like a LDE (Length Disassembly Engine) ...
2
votes
1answer
49 views

Correct my understanding on a basic allocation memory

Here is the function If I understand correctly: There is a buffer of size 256 bytes created (malloc) in this buffer, the first 32 bits are set to 0 (because dword designates 32bits size) the next 32 ...
1
vote
1answer
64 views

Need Advice for the purposes of learning [closed]

I would really like to make a multiplayer mod for Fallout 4, I know how to program and i have a basic understanding of how to get opcodes and read/write to those. Now what i don't understand is how to ...
1
vote
1answer
244 views

Game's anti-cheat complains when driver test-signing mode is on

I use Windows 7 64 bit, thus in order to load a test-signed driver, I need to enable test-signing mode. My driver bypasses some of the game's anti-cheat features to allow me to run a debugger and ...
1
vote
1answer
123 views

How to debug a crash in wow64.dll in 32bit process

I have a 32bit application and a few wrapper tools that I use one after another to inject code, hook system dll functions (using the patch-first-bytes-of-the-function-with-jump approach). Also I have ...
1
vote
1answer
112 views

What are these LOAD segments in an assembly ELF64?

I wrote the following (fasm) assembly program: format ELF64 executable segment readable executable include 'io.inc' include 'unistd64.inc' entry main main: mov rdi, msg call print call ...
15
votes
3answers
7k views

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

I don't know whether this is a silly question, but I couldn't find any answer. With the evolution of CPU architecture, register size was extended, from 8, to 16, 32, and eventually 64-bit. I was ...
5
votes
1answer
1k views

Is IDA pulling my leg - or can REX.W sometimes not be determined in static analysis?

NB: I normally dabble with disassembly (i.e. mnemonics) and only ever look at the raw opcodes when I can't avoid it. I have the following line of disassembly of a Windows x64 kernel mode driver, ...
3
votes
1answer
307 views

Question about the limit and base address in x86-64 segmentation model?

I'm trying to understand how segmentation works under x86-64. From what I see, it's mostly disabled, but not entirely. It looks like GS and FS registers are still using it. So I was reviewing the ...
3
votes
1answer
163 views

Unable to use CreateRemoteThread in target process

I'm trying to get a debugger attached to a malware, but it seems to pick up whenever a new remote thread is created (which makes it so I can't use Scyllahide). Even if I suspend all threads, it does ...
1
vote
1answer
369 views

Windbg: How to directly view GS:[0x60]

Win10x64: In Windbg, how may I view a pointer to the PEB by directly using GS:[0x60] (and not by Windbg extensions)? To test, I assembled a program via masm64 that throws an interrupt, clears r8 then ...
0
votes
1answer
54 views

Reading params of a text engine function amd86_64

I'm starting to learn amd86_64 calling convention and how it calls params and clean the stack but the concept hasn't sunk in yet, so i would like to get a help reading the params as this might clear ...
4
votes
1answer
133 views

rasm2 giving different output each time for x64

Disassembling is great but when trying to re-assemble to opcode it gives different results each time. Example: C:\>rasm2 -a x86 -b 64 -d "48898D80FEFFFF" mov qword [rbp - 0x180], rcx C:\>...
1
vote
2answers
277 views

Printing bytecode in bytes given a string of assembly for Radare to disassemble?

Megabeets determined in this answer that depending on asm.bits Radare may show either lea edx, [0x80490c8] (asm.bits=32) lea edx, [rip + 0x80490c8] (asm.bits=64) If I want to see what the ...
0
votes
2answers
75 views

Magic number in resource loading routine

I'm practicing windows disassembly on x64 notepad.exe I've managed to find buffer allocation and string resources load. But after that follows code, which I can't fully understand: rbx = 0, rdx = 0 ...
0
votes
1answer
260 views

IDA Pro 64bit offset and opcode issue

I'm looking at a 64bit PE file in IDA. The instructions below access unknown data at offset 20030. Usually when I look at 32bit PE files, the offset is also listed next to the opcodes on the left. So ...
2
votes
1answer
111 views

Windows x86 compability on x64 operating system

I know some about wow64 system, in x64 windows version, and i looked up into this wow64* dlls, to see how the actual syscall transition happen, but something i can't find, and this is probably done by ...
3
votes
1answer
390 views

Deobfuscating overlapping x86 assembly instructions

I'm trying to solve a reverse engineering challenge (http://crackmes.cf/users/beatrix/beaba/) and am having trouble with the obfuscation. Below is a piece of code that gets executed almost immediately ...
2
votes
5answers
5k views

Run PE File - (Executable) From Memory

Would be grateful for your suggestion.Trying to run a 32/64bit on (Windows 10- 64 bit /Visual studio) program which tries to run an executable from memory.This is for my learning purpose. #include &...
0
votes
1answer
424 views

Linux x64 Disassembly: single movzwl operand question

A quick question regarding a movzwl instruction which do not behave as I expected. here is the disassembled code: movzwl (%rax),%eax Before the instruction, rax is 0x7fffffffe410 and point to 0x5 ...
0
votes
1answer
356 views

brute force remote nop sled memory address

I am in the middle of a binary crackme (ELF-64) on a remote server which communicates via simple socket server in C. I have the source code, locally. After overflowing the buffer (socket buffer is ...
0
votes
1answer
213 views

x64 Linux reverse-engineering - understanding asm code and inject eax

In a rootme exercise, i'm trying to bypass the control impleted to protect a "read" function. You'll find enclosed the code i'm refering to. As you may understand, i can inject data (with limitations) ...
8
votes
1answer
2k views

How to investigate Windows 32/64bit (WOW64) transition

There is surprisingly little information about Windows WOW64 mechanism. I'm trying to investigate it. So when we have system call in 32-land, it calls an address that is stored in FS, which leads us ...
1
vote
1answer
93 views

How to break on a window creation

in x32/x64 debugger, how can I break when a new window is opened? When inside my application, I click the "File" button in the menu bar then select "options" I want to break on that call to open the ...
0
votes
2answers
712 views

Trying to call a function in an unknown DLL

My goal is far from nefarious. After several polite attempts to try and get Lenovo to implement a proper keyboard backlight control, I've had no response. They do have a Windows Store app which adds ...
0
votes
1answer
121 views

Why is using a 32bit system over 64bit recommended for people that are new to reverse engineering? [closed]

I am new to the world of reverse engineering and have been recommended by a number of people that I should start with IA32 because it is easier to learn the concepts. Aside from differences in the ...
1
vote
1answer
93 views

Is it possible to restart over a program by calling an entry point function?

I was wondering if it was possible to restart a program (ignoring previously mapped files) with different argument by either calling main() or a glibc entry point function.
0
votes
1answer
958 views

Calling DLL exports in x64dbg

I am attempting to debug a x64bit dll with x64dbg. Is there an export caller similar to Ollydbg? I checked the documents and haven't seen anything.