Questions tagged [x86-64]
The x86-64 tag has no usage guidance.
168
questions
0
votes
1
answer
25
views
What is 0xCC between each functions?
First, sorry for my bad english.
What I know about 0xCC instruction is a breakpoint instruction.
But, when I see x64 binary, each functions are seperate by multiple 0xCC instructions.
I think x64 uses ...
- 31
1
vote
0
answers
109
views
Analyse a statically linked binary and extract syscall from it using angr
How to extract all syscalls from analysing a statically linked binary.
I have a script written using angr(Latest - v9.2.78) but when I start my script I get few syscalls and the analysis is like hung ...
- 11
0
votes
1
answer
77
views
Mnemonic suffixes for x86-64 assembly for AT&T syntax
I'm trying to understand suffixes used for the AT&T syntax for the x64 assembly used for instruction mnemonics.
For regular cases:
'b', // 8_bit
'w', // 16_bit
'l', // 32_bit
'q', /...
- 1,639
0
votes
1
answer
89
views
ELF - Why does objdump provide a wrong byte value in the .got?
I seriously can't tell if I'm misunderstanding something grossly or if this is a bug in objdump. Newbie alert.
$ objdump -s --start-address=0x3fc0 --stop-address=0x3fc1 test
test: file format ...
0
votes
1
answer
96
views
Debugging of any x86(_64) executable producing strange results under Parallels + Windows on Arm
Recently, I have been experimenting with using an M1 (Arm64) Mac full-time for RE work, including Windows on Arm under Parallels with x86(_64) binaries. From several online sources discussing this use ...
1
vote
0
answers
119
views
Reversing Assembly to C
I've read the open letter addressing students asking for help with their homework and I agree with it, therefore I will try to be less of a pain in the *** ;)
I need to reverse the x86-64 (AT&T) ...
- 11
4
votes
1
answer
377
views
Change string value when string is in a RAM address x64 c++ program
I'm new to reverse engineering.
I'm simply trying to change the value of a string in x64dbg, of a program I make myself in VS
(It's a c++ program, and is VERY simple; it just prints a string, and two ...
- 41
1
vote
1
answer
208
views
Why this x64 shellcode doesn't work?(segmentation fault)
I found a simple shellcode on the internet.
Then, to test this shellcode, I make the simple ret overwrite code.
test.c
#include <stdio.h>
#include <string.h>
char buf[100];
int main(void)...
- 55
1
vote
0
answers
84
views
Program Analysis on a Wargame Binary
I've recently took it upon myself to research more about reverse engineering, I'm currently testing my intermediate skills on various CTF hosting sites. Interestingly enough I have come across a ...
- 11
2
votes
0
answers
72
views
How to deal with msvc runtime integrity?
After any type of patching image code the app cannot properly initialize the window specifically on the user32!CreateWindowExA call. PDB file shows it's vc2010\x64\Release.
I'm actually newbie in ...
3
votes
1
answer
176
views
What tricks can I use to manually decompile a set of instructions
ELF Binary takes user input and stores it in loc.buffer address 0x4020e8. Further, the registers going into the instruction set are
eax
ebx
ecx
edx
esi
length of user input (min length is 3)
0
...
- 141
2
votes
0
answers
212
views
Convert instructions to op code bytes in python script for IDA Pro
I need to convert into op code bytes the instructions that I have disassembled but I can't find a function that lets me do it, I've tried idc.get_bytes but it doesn't seem to work.
This is my python ...
- 121
2
votes
1
answer
661
views
What is a "far call" in an x86 or x86_64 cpu
I do not understand the usefulness of the "far call" instruction in a 86 CPU.
On a 32 bits CPU for example each process has an addressing space of 4Gb (0x00000000 to 0xFFFFFFFF).
There can ...
- 797
3
votes
0
answers
283
views
How would I crack a software that has Xor encryption
So, before you shout at me to go on google I would just like to say I am new to reverse Engineering. Like I have been doing it for a hour. So, I was doing a bunch of crackmes.one using the search all ...
- 31
3
votes
1
answer
67
views
x64 buffer overflow - tcp shell payload
ASLR: off
Canary: on
I have a binary that when run, it spawns zombie process on port 9191. I've been using ghidra and gdb to reverse engineer this and have found the buffer, canary, found the pop rdi ...
- 31
4
votes
0
answers
1k
views
IDA Free vs IDA Home (to have Lumina)
I use actually IDA Free and I want to know what do you think of IDA Home (particulary for the Lumina function).
I don't found in Google a tool to know for exemple the functions recognized by the ...
2
votes
0
answers
81
views
jump to invalid address when emulating
I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect ...
- 41
2
votes
0
answers
93
views
x64 Windows: Why is ExAllocatePool stepping on the caller's stack?
I am playing around with windbg on a 64-bit machine and noticed something interesting:
nt!ExAllocatePool:
...
sub rsp, 0xd0
...
mov qword ptr [rsp+0xf8], rbx
Windows only allocated ...
- 21
2
votes
1
answer
104
views
Getting "Flow analysis was incomplete, some code may be missing" on WinDbg
I wanted to perform static analysis on the Win32 function CreateFileW, so I loaded kernel32.dll using WinDbg and perform the command uf kernel32!CreateFileW.
But I am seeing the following output ...
- 205
0
votes
1
answer
63
views
Displacement size (disp_size) of x86 instructions
Given the opcode 80 3d 1d b0 09 00 00.
The corresponding capstone instruction is
<CsInsn 0x66a4 [803d1db0090000]: cmp byte ptr [rip + 0x9b01d], 0>
and has the following properties (c_i being ...
- 1,550
1
vote
1
answer
93
views
Capstone not disassembling vpunpcklqdq, vprold, and vshufi32x4
I am trying to disassemble a binary using Capstone. I noticed that there are some instructions that cannot be disassembled, e.g. the vshufi32x4 instruction:
from capstone import *
from capstone.x86 ...
- 1,550
3
votes
1
answer
112
views
What is the outcome of mov on non bracket memory locations?
I am having problems distinguishing whether the address is loaded or the content from the address. Please help me clarify.
1. mov [rsp+78h+arg_0], rsi
2. mov rsi, cs:qword_1F39B60
3. mov [...
- 35
0
votes
1
answer
99
views
ida jumping to address I can't see in driver
When I open this driver in IDA i can't seem to see the instructions that this jmp at 0x1400DC46D jumps to.
I've tried to undefine bytes and re-analyze the function but it then ends up will garbage. ...
- 41
1
vote
0
answers
87
views
Implementing syscalls under Miasm
I'd like to use Miasm's DSE on a binary. This binary makes use of 2 syscalls: exit and ptrace. Miasm provides an implementation of some syscalls, but unfortunately, not of those two.
So I tried to ...
- 11
1
vote
1
answer
123
views
IDA API: obtain operand size prefix (x64)
I am trying to tell apart the following two instructions:
8D 02 lea eax, [rdx] // auxfix = 0x1810
67 8D 02 lea eax, [edx] // auxfix = 0x810
The only difference is in the insn_t....
- 463
1
vote
0
answers
62
views
Philosophical and procedural question - Process for using x64 inline assembly in recovering source code
I am assuming this should place be appropriate for what I want to ask. I want to ask more of a philosophical and procedural question because I don't want to try things that have been tried and spend ...
- 773
1
vote
0
answers
154
views
silvio packer for shared libray leads to error: "ELF load command address/offset not properly aligned"
I'm trying to implement a packer based on silvio infection. The packer works fine for ET_EXEC. However, it failed with "ELF load command address/offset not properly aligned" error for the ...
- 81
2
votes
1
answer
2k
views
How to get offset of specific function in exe?
Suppose I have self-compiled exe-file (aka portable executable), its source (c/c++) and generated pdb-file. And what if I want to get offset of its function (non-winapi function) in debugger (x64dbg, ...
- 23
0
votes
0
answers
105
views
What kind of code creates this function call pattern?
While using WinDbg: u/uf to disassemble functions in ntoskrnl.exe there are functions that are used in system calls and exception handling that have these weird function call patterns and I can't ...
- 101
5
votes
2
answers
1k
views
Fixing/recompiling a heavily control flow obfuscated function
I've recently come across a binary that has been obfuscated with a very obscure protection.
Obfuscation
From what I understand, the obfuscator is effective in several ways.
Multiple JMPs via relative ...
user29468
0
votes
0
answers
112
views
Is it possible to extract the header files used by a Mach-O 64-bit SDK Binary?
I have a Mach-O 64 bit SDK that I've opened up with JEB (community edition) and I'd like to know if it's even possible to see things like the header files (.h) used/referenced by the binary.
The ...
- 101
3
votes
3
answers
4k
views
startup program exits with code 126 when executing program at entrypoint
I want to reverse engineer a program. I managed to find the entry point but every time I want to launch the application I get the same error `During startup program exited with code 126.
Here is what ...
2
votes
0
answers
278
views
Why PTRACE_POKEDATA returns I/O error?
I learning usage of ptrace.
I tried following simple example but raises a I/O Error.
I would like to overwrite "Hello, world" (printing string) from other process.
A target program prints &...
- 141
1
vote
0
answers
169
views
Trying to call the Exit Shellcode in a c program
#include<stdio.h>
#include<stdint.h>
char shellcode[] = "\xb8\x3c\x00\x00\x00"
"\xbf\x14\x00\x00\x00"
"\x0f\x05";
int ...
- 11
1
vote
1
answer
650
views
Disassembly call function offset from RIP
I am writing a program where I map an .exe PE file in memory and I "dissect" it.
I am disassembling the .text section of the target executable, using the distorm disassembler.
CALL ...
- 31
1
vote
1
answer
275
views
does mov DWORD PTR 32[rsp], 5 means mov DWORD PTR [rsp+32], 5?
I am learning about windows x64 calling convention, where the first four arguments are passed to registers and left arguments are passed through the stack. To see it, I checked the assembly of the ...
- 45
0
votes
0
answers
134
views
objdump says "64-bit address is disabled"
I've run into an issue with the MinGW build of objdump on Windows. Consider this very simple input file:
48 bf 88 77 66 55 44 33 22 11
I want to disassemble this as Intel x86-64 raw machine code. I ...
- 101
5
votes
1
answer
3k
views
How can I get the inferred register value for an instruction in Ghidra scripting?
I'd like to get the inferred value of a register at a particular point in the disassembly listing in a Ghidra script.
In my case the target instruction is a rdmsr or wrmsr instruction, which reads or ...
- 1,252
0
votes
1
answer
303
views
Calling MessageBoxW x64 confused about pointer
OK, I am very new to x64dbg. I used to use OllyDbg a lot and I'm having some problems with this.
I just made a customized version of MS-PAINT for practice by changing a few things like the default ...
- 101
2
votes
1
answer
856
views
x64dbg or alternative: Run to selection while storing all ran opcodes
I'm trying to trace a function, but unfortunately that function is huge and has lots and lots of jumps to other locations, making it almost impossible to trace for humans. I know the entry point and ...
- 123
1
vote
0
answers
98
views
Instruction-level hooking library for win32?
I am looking for instruction-level hooking library for win32 x86/x64.
I want to write hook insertion and hook implementation code in C/C++ (compiled into dll).
(Therefore instrumentation tools are ...
- 111
2
votes
1
answer
245
views
Garbage Assembly Code Generationat at random offsets
Recently I've been working on a project. The main purpose of the project is to generated statically undetectable PE samples. Where each time one generates a PE sample, each generated sample is going ...
- 395
2
votes
1
answer
56
views
Difference in binary behaviour (execution/under debugger)
I was trying out a simple heap overflow example (http://highaltitudehacks.com/2020/09/05/arm64-reversing-and-exploitation-part-1-arm-instruction-set-heap-overflow/) but replicated the relevant code in ...
- 193
1
vote
1
answer
278
views
Help understanding x64 TEST instruction
I have read that TEST does a bitwise and on the two arguments. I have also read that jz and je are both equivalent, and jump if the zero flag is set. So here's the problem I'm struggling with. ...
- 83
-1
votes
1
answer
201
views
What does xchg means when accessing array element?
I have ASM code of some Windows *.exe in IDA:
mov rax, [rbx+10h]
mov ecx, edx
xor edx, edx
xchg rdx, [rax+rcx*8]
Which is decompiled to pseudocode to
_RAX = this->m_someMemoryPool;
...
- 61
2
votes
2
answers
3k
views
how to does this instruction work: `mov qword ptr [rbp-0x30], 0x4020c5`
The following is the code snippet (shown partially) I have:
q = strrchr(resolved, '/'); /* given /home/misha/docs.txt, q now pts to the last slash */
if (q != NULL) {
p = q + 1; ...
- 1,797
0
votes
1
answer
70
views
Cant recognise where is my targeted function executed
Im trying to recognise where is my targeted function int64 __fastcall sub_1400CE4F0(__int64 a1, const char *a2)executed. When stepping through this function, after return it's redirecting me here:
if (...
- 33
0
votes
1
answer
163
views
How can I modify these?
So I'm onto something interesting, I asked the less direct way but failed to meet the requirements in terms of explanation
So here it is, how would I go about editing these the same way I would go ...
3
votes
1
answer
192
views
Radare2 - what does dot mean in disassembly
I've just started using radare2 and I've noticed a dot when I tried to disassamble one on my programs. The output is:
0x00000000 48b841000000. movabs rax, 0x41
I understand that 0x48 is the REX ...
- 133
0
votes
0
answers
133
views
Change value of memory in a debugger?
So I got this app loaded in x64, there is a function, let's say
"HeatGainedPerShot", which is basically the value which an object gains everytime it fires,
Such a value would normally exist ...