Questions tagged [x86-64]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2 votes
0 answers
92 views

IDA Free vs IDA Home (to have Lumina)

I use actually IDA Free and I want to know what do you think of IDA Home (particulary for the Lumina function). I don't found in Google a tool to know for exemple the functions recognized by the ...
1 vote
0 answers
59 views

jump to invalid address when emulating

I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect ...
  • 21
1 vote
0 answers
62 views

x64 Windows: Why is ExAllocatePool stepping on the caller's stack?

I am playing around with windbg on a 64-bit machine and noticed something interesting: nt!ExAllocatePool: ... sub rsp, 0xd0 ... mov qword ptr [rsp+0xf8], rbx Windows only allocated ...
1 vote
1 answer
37 views

Getting "Flow analysis was incomplete, some code may be missing" on WinDbg

I wanted to perform static analysis on the Win32 function CreateFileW, so I loaded kernel32.dll using WinDbg and perform the command uf kernel32!CreateFileW. But I am seeing the following output ...
0 votes
1 answer
39 views

Displacement size (disp_size) of x86 instructions

Given the opcode 80 3d 1d b0 09 00 00. The corresponding capstone instruction is <CsInsn 0x66a4 [803d1db0090000]: cmp byte ptr [rip + 0x9b01d], 0> and has the following properties (c_i being ...
  • 1,456
1 vote
1 answer
41 views

Capstone not disassembling vpunpcklqdq, vprold, and vshufi32x4

I am trying to disassemble a binary using Capstone. I noticed that there are some instructions that cannot be disassembled, e.g. the vshufi32x4 instruction: from capstone import * from capstone.x86 ...
  • 1,456
3 votes
1 answer
70 views

What is the outcome of mov on non bracket memory locations?

I am having problems distinguishing whether the address is loaded or the content from the address. Please help me clarify. 1. mov [rsp+78h+arg_0], rsi 2. mov rsi, cs:qword_1F39B60 3. mov [...
  • 35
0 votes
1 answer
30 views

ida jumping to address I can't see in driver

When I open this driver in IDA i can't seem to see the instructions that this jmp at 0x1400DC46D jumps to. I've tried to undefine bytes and re-analyze the function but it then ends up will garbage. ...
  • 21
1 vote
0 answers
65 views

Implementing syscalls under Miasm

I'd like to use Miasm's DSE on a binary. This binary makes use of 2 syscalls: exit and ptrace. Miasm provides an implementation of some syscalls, but unfortunately, not of those two. So I tried to ...
1 vote
1 answer
81 views

IDA API: obtain operand size prefix (x64)

I am trying to tell apart the following two instructions: 8D 02 lea eax, [rdx] // auxfix = 0x1810 67 8D 02 lea eax, [edx] // auxfix = 0x810 The only difference is in the insn_t....
0 votes
0 answers
33 views

Philosophical and procedural question - Process for using x64 inline assembly in recovering source code

I am assuming this should place be appropriate for what I want to ask. I want to ask more of a philosophical and procedural question because I don't want to try things that have been tried and spend ...
  • 723
1 vote
0 answers
97 views

silvio packer for shared libray leads to error: "ELF load command address/offset not properly aligned"

I'm trying to implement a packer based on silvio infection. The packer works fine for ET_EXEC. However, it failed with "ELF load command address/offset not properly aligned" error for the ...
  • 71
0 votes
0 answers
28 views

How to keep track of Dynamic Variables

The thing I'm trying to reverse has a lot of variables on allocated memory so I can't comment and keep track of the addresses as every time I re-run the software they will be different.. I'm working ...
2 votes
1 answer
952 views

How to get offset of specific function in exe?

Suppose I have self-compiled exe-file (aka portable executable), its source (c/c++) and generated pdb-file. And what if I want to get offset of its function (non-winapi function) in debugger (x64dbg, ...
  • 23
0 votes
0 answers
97 views

What kind of code creates this function call pattern?

While using WinDbg: u/uf to disassemble functions in ntoskrnl.exe there are functions that are used in system calls and exception handling that have these weird function call patterns and I can't ...
4 votes
1 answer
415 views

Fixing/recompiling a heavily control flow obfuscated function

I've recently come across a binary that has been obfuscated with a very obscure protection. Obfuscation From what I understand, the obfuscator is effective in several ways. Multiple JMPs via relative ...
's user avatar
0 votes
0 answers
39 views

Is it possible to extract the header files used by a Mach-O 64-bit SDK Binary?

I have a Mach-O 64 bit SDK that I've opened up with JEB (community edition) and I'd like to know if it's even possible to see things like the header files (.h) used/referenced by the binary. The ...
  • 101
1 vote
1 answer
2k views

startup program exits with code 126 when executing program at entrypoint

I want to reverse engineer a program. I managed to find the entry point but every time I want to launch the application I get the same error `During startup program exited with code 126. Here is what ...
2 votes
0 answers
129 views

Why PTRACE_POKEDATA returns I/O error?

I learning usage of ptrace. I tried following simple example but raises a I/O Error. I would like to overwrite "Hello, world" (printing string) from other process. A target program prints &...
1 vote
0 answers
68 views

Trying to call the Exit Shellcode in a c program

#include<stdio.h> #include<stdint.h> char shellcode[] = "\xb8\x3c\x00\x00\x00" "\xbf\x14\x00\x00\x00" "\x0f\x05"; int ...
1 vote
1 answer
302 views

Disassembly call function offset from RIP

I am writing a program where I map an .exe PE file in memory and I "dissect" it. I am disassembling the .text section of the target executable, using the distorm disassembler. CALL ...
  • 31
1 vote
1 answer
172 views

does mov DWORD PTR 32[rsp], 5 means mov DWORD PTR [rsp+32], 5?

I am learning about windows x64 calling convention, where the first four arguments are passed to registers and left arguments are passed through the stack. To see it, I checked the assembly of the ...
  • 25
0 votes
0 answers
66 views

objdump says "64-bit address is disabled"

I've run into an issue with the MinGW build of objdump on Windows. Consider this very simple input file: 48 bf 88 77 66 55 44 33 22 11 I want to disassemble this as Intel x86-64 raw machine code. I ...
5 votes
1 answer
1k views

How can I get the inferred register value for an instruction in Ghidra scripting?

I'd like to get the inferred value of a register at a particular point in the disassembly listing in a Ghidra script. In my case the target instruction is a rdmsr or wrmsr instruction, which reads or ...
  • 1,212
0 votes
1 answer
172 views

Calling MessageBoxW x64 confused about pointer

OK, I am very new to x64dbg. I used to use OllyDbg a lot and I'm having some problems with this. I just made a customized version of MS-PAINT for practice by changing a few things like the default ...
  • 101
2 votes
1 answer
388 views

x64dbg or alternative: Run to selection while storing all ran opcodes

I'm trying to trace a function, but unfortunately that function is huge and has lots and lots of jumps to other locations, making it almost impossible to trace for humans. I know the entry point and ...
  • 123
1 vote
0 answers
63 views

Instruction-level hooking library for win32?

I am looking for instruction-level hooking library for win32 x86/x64. I want to write hook insertion and hook implementation code in C/C++ (compiled into dll). (Therefore instrumentation tools are ...
2 votes
1 answer
132 views

Garbage Assembly Code Generationat at random offsets

Recently I've been working on a project. The main purpose of the project is to generated statically undetectable PE samples. Where each time one generates a PE sample, each generated sample is going ...
2 votes
1 answer
52 views

Difference in binary behaviour (execution/under debugger)

I was trying out a simple heap overflow example (http://highaltitudehacks.com/2020/09/05/arm64-reversing-and-exploitation-part-1-arm-instruction-set-heap-overflow/) but replicated the relevant code in ...
  • 153
1 vote
1 answer
176 views

Help understanding x64 TEST instruction

I have read that TEST does a bitwise and on the two arguments. I have also read that jz and je are both equivalent, and jump if the zero flag is set. So here's the problem I'm struggling with. ...
  • 63
-1 votes
1 answer
138 views

What does xchg means when accessing array element?

I have ASM code of some Windows *.exe in IDA: mov rax, [rbx+10h] mov ecx, edx xor edx, edx xchg rdx, [rax+rcx*8] Which is decompiled to pseudocode to _RAX = this->m_someMemoryPool; ...
  • 61
2 votes
2 answers
1k views

how to does this instruction work: `mov qword ptr [rbp-0x30], 0x4020c5`

The following is the code snippet (shown partially) I have: q = strrchr(resolved, '/'); /* given /home/misha/docs.txt, q now pts to the last slash */ if (q != NULL) { p = q + 1; ...
  • 1,477
0 votes
1 answer
69 views

Cant recognise where is my targeted function executed

Im trying to recognise where is my targeted function int64 __fastcall sub_1400CE4F0(__int64 a1, const char *a2)executed. When stepping through this function, after return it's redirecting me here: if (...
0 votes
1 answer
117 views

How can I modify these?

So I'm onto something interesting, I asked the less direct way but failed to meet the requirements in terms of explanation So here it is, how would I go about editing these the same way I would go ...
3 votes
1 answer
162 views

Radare2 - what does dot mean in disassembly

I've just started using radare2 and I've noticed a dot when I tried to disassamble one on my programs. The output is: 0x00000000 48b841000000. movabs rax, 0x41 I understand that 0x48 is the REX ...
0 votes
0 answers
67 views

Change value of memory in a debugger?

So I got this app loaded in x64, there is a function, let's say "HeatGainedPerShot", which is basically the value which an object gains everytime it fires, Such a value would normally exist ...
0 votes
0 answers
51 views

Windows pintool mismatch between call/ret instructions

So i've been trying to write a pintool that monitors call/ret instructions but i've noticed that threre was a significant inconsistency between the two. For example ret instructions without previous ...
  • 13
0 votes
2 answers
217 views

Where do arguments 5 and 6 go in this Microsoft x64 function call?

I'm disassembling a working-as-expected compiled C program (MS/Windows x64, MinGW gcc 10.1.0). In the main function, I have the following call which passes 6 arguments to the function DotProduct: ... /...
  • 111
1 vote
1 answer
119 views

Displaying Operands as Position Independent in IDA

I'm writing an IDA python script, and i need to be able to detect position independent code. I have an instruction that IDA displays using the operand name 'format' lea rdi, format However, when ...
1 vote
1 answer
157 views

Is `movq rax, xmm0` buggy in Radare2?

Why doesn't rax get loaded from xmm0 here? radare2 bug? GitHub issue `movq rax, xmm0` doesn't work in native debugger filed. [0x0003b0e0]> drr role reg value ref ―――――――――――――――――――...
1 vote
2 answers
136 views

x64 processor module

I just downloaded Ghidra last evening on a Fedora Linux machine with 4 Intel Core i5-7200U CPUs. When querying the "installed processor modules" in "Help" I get a listing of 41 processors. x86 is on ...
  • 21
1 vote
1 answer
290 views

How can i check if i am running in ring 0 / ring 3 on x64 CPU

I have read it is possible to check ring level with bit 3 of CS register. Is there another register which really contains ring value (2 bits)
  • 613
8 votes
4 answers
5k views

What is the difference between MOV and LEA in example?

Looking at an assembly code snippet I see: lea rax, [rbp-0x50] Which tells me that the rax register now points to whatever value is in rbp-hex(50). Question. Would I achieve the same result doing ...
2 votes
1 answer
949 views

Help understanding MOVSXD

I've tried reading the documentation but the functionality of this instruction is still cloudy to me. For an example, I would like to know what is stored in RDX after these instructions: mov edx, ...
1 vote
0 answers
72 views

Memory modified at jump far

Observing a trace of Wow64 switching on Windows 7, the following situation makes me confused ... 0x77491dbe 64 ff 15 c0 00 00 00 call fs:[0xc0] ; syswow64\ntdll.dll 0x74632320 ea 1e 27 63 ...
1 vote
1 answer
68 views

How to determine what code created a string, in a live debugger session?

I'm using IDA 7 to debug a running application that must be a child of another application, which means I can't start it from IDA (using Debugger->Run). Instead, I have to run the application normally,...
  • 51
2 votes
1 answer
116 views

Finding "func main" in a stripped binary written in GO

I'm reversing a binary that was apart of a CTF I was involved in about a month ago. It was too large of a binary to do during the challenge so I am doing it now. I am having trouble finding the main ...
1 vote
1 answer
90 views

Isolate the call to a function

Is it possible to call a function of a binary and obtain its result (without calling other functions), to isolate; are there any tools to do this?
  • 193
1 vote
0 answers
53 views

Go back to the original entry point after executing the instructions in the newly added segment- PE32+, C++

I am learning PE32+ (64 bit) files. I have added a new section to the PE32+ file and made the new section as the entry point. Some simple instructions are added in the new segment. Now I want to go to ...
  • 39
2 votes
2 answers
635 views

PE32+ executable : .text segment encryption

I am working on PE segment encryption(in C++). I completed the PE32 .text segment encryption. I added stub segment to the PE that will decrypt .text segment at runtime. Used inline assembly in the ...
  • 39