Questions tagged [x86-64]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
45 views

Improving the output of pseudocode C++ code from IDA Pro

I have some specific questions and some general ones about reverse-engineering a dynamic shared library via IDA Pro 8.3: If I know the compiler used and compiler flags used (via readelf --debug-dump),...
HCSF's user avatar
  • 143
0 votes
0 answers
37 views

Dynamic analysis of cmd dependent software

There is a PE file, which can't run by itself, and can only be called from cmd.exe, it doesn't create independent processes, and can be launched independently only with .bat scripts, which without &...
flying_meatball's user avatar
1 vote
0 answers
38 views

Potential vulnerabilities in a binary run as root

I am given a vulnerable 64-bit stripped application, it conducts basic password strength checks on linux(/etc/shadow). The application receives workers(which creates worker process for performing the ...
emotional_piper's user avatar
2 votes
1 answer
168 views

What is 0xCC between each functions?

First, sorry for my bad english. What I know about 0xCC instruction is a breakpoint instruction. But, when I see x64 binary, each functions are seperate by multiple 0xCC instructions. I think x64 uses ...
schnabel's user avatar
1 vote
0 answers
149 views

Analyse a statically linked binary and extract syscall from it using angr

How to extract all syscalls from analysing a statically linked binary. I have a script written using angr(Latest - v9.2.78) but when I start my script I get few syscalls and the analysis is like hung ...
0x4E4F4F42's user avatar
0 votes
1 answer
119 views

Mnemonic suffixes for x86-64 assembly for AT&T syntax

I'm trying to understand suffixes used for the AT&T syntax for the x64 assembly used for instruction mnemonics. For regular cases: 'b', // 8_bit 'w', // 16_bit 'l', // 32_bit 'q', /...
c00000fd's user avatar
  • 1,659
0 votes
1 answer
96 views

ELF - Why does objdump provide a wrong byte value in the .got?

I seriously can't tell if I'm misunderstanding something grossly or if this is a bug in objdump. Newbie alert. $ objdump -s --start-address=0x3fc0 --stop-address=0x3fc1 test test: file format ...
chilliefiber's user avatar
0 votes
1 answer
173 views

Debugging of any x86(_64) executable producing strange results under Parallels + Windows on Arm

Recently, I have been experimenting with using an M1 (Arm64) Mac full-time for RE work, including Windows on Arm under Parallels with x86(_64) binaries. From several online sources discussing this use ...
Benjamin Crawford Ctrl-Alt-Tut's user avatar
1 vote
0 answers
134 views

Reversing Assembly to C

I've read the open letter addressing students asking for help with their homework and I agree with it, therefore I will try to be less of a pain in the *** ;) I need to reverse the x86-64 (AT&T) ...
mikealexx's user avatar
4 votes
1 answer
785 views

Change string value when string is in a RAM address x64 c++ program

I'm new to reverse engineering. I'm simply trying to change the value of a string in x64dbg, of a program I make myself in VS (It's a c++ program, and is VERY simple; it just prints a string, and two ...
clouded.'s user avatar
1 vote
1 answer
288 views

Why this x64 shellcode doesn't work?(segmentation fault)

I found a simple shellcode on the internet. Then, to test this shellcode, I make the simple ret overwrite code. test.c #include <stdio.h> #include <string.h> char buf[100]; int main(void)...
doldom's user avatar
  • 55
1 vote
0 answers
92 views

Program Analysis on a Wargame Binary

I've recently took it upon myself to research more about reverse engineering, I'm currently testing my intermediate skills on various CTF hosting sites. Interestingly enough I have come across a ...
Gregory's user avatar
  • 11
2 votes
0 answers
74 views

How to deal with msvc runtime integrity?

After any type of patching image code the app cannot properly initialize the window specifically on the user32!CreateWindowExA call. PDB file shows it's vc2010\x64\Release. I'm actually newbie in ...
Andrei Nevsky's user avatar
3 votes
1 answer
193 views

What tricks can I use to manually decompile a set of instructions

ELF Binary takes user input and stores it in loc.buffer address 0x4020e8. Further, the registers going into the instruction set are eax ebx ecx edx esi length of user input (min length is 3) 0 ...
Mr. Kelsey's user avatar
2 votes
0 answers
225 views

Convert instructions to op code bytes in python script for IDA Pro

I need to convert into op code bytes the instructions that I have disassembled but I can't find a function that lets me do it, I've tried idc.get_bytes but it doesn't seem to work. This is my python ...
Luca's user avatar
  • 121
2 votes
1 answer
884 views

What is a "far call" in an x86 or x86_64 cpu

I do not understand the usefulness of the "far call" instruction in a 86 CPU. On a 32 bits CPU for example each process has an addressing space of 4Gb (0x00000000 to 0xFFFFFFFF). There can ...
Bob5421's user avatar
  • 797
3 votes
0 answers
310 views

How would I crack a software that has Xor encryption

So, before you shout at me to go on google I would just like to say I am new to reverse Engineering. Like I have been doing it for a hour. So, I was doing a bunch of crackmes.one using the search all ...
user42257's user avatar
3 votes
1 answer
91 views

x64 buffer overflow - tcp shell payload

ASLR: off Canary: on I have a binary that when run, it spawns zombie process on port 9191. I've been using ghidra and gdb to reverse engineer this and have found the buffer, canary, found the pop rdi ...
Coop's user avatar
  • 31
4 votes
0 answers
2k views

IDA Free vs IDA Home (to have Lumina)

I use actually IDA Free and I want to know what do you think of IDA Home (particulary for the Lumina function). I don't found in Google a tool to know for exemple the functions recognized by the ...
Benoit POTIER's user avatar
2 votes
0 answers
84 views

jump to invalid address when emulating

I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect ...
Ayyware's user avatar
  • 41
2 votes
0 answers
97 views

x64 Windows: Why is ExAllocatePool stepping on the caller's stack?

I am playing around with windbg on a 64-bit machine and noticed something interesting: nt!ExAllocatePool: ... sub rsp, 0xd0 ... mov qword ptr [rsp+0xf8], rbx Windows only allocated ...
Yolo41251263's user avatar
2 votes
1 answer
133 views

Getting "Flow analysis was incomplete, some code may be missing" on WinDbg

I wanted to perform static analysis on the Win32 function CreateFileW, so I loaded kernel32.dll using WinDbg and perform the command uf kernel32!CreateFileW. But I am seeing the following output ...
caramel1995's user avatar
0 votes
1 answer
78 views

Displacement size (disp_size) of x86 instructions

Given the opcode 80 3d 1d b0 09 00 00. The corresponding capstone instruction is <CsInsn 0x66a4 [803d1db0090000]: cmp byte ptr [rip + 0x9b01d], 0> and has the following properties (c_i being ...
langlauf.io's user avatar
  • 1,560
1 vote
1 answer
96 views

Capstone not disassembling vpunpcklqdq, vprold, and vshufi32x4

I am trying to disassemble a binary using Capstone. I noticed that there are some instructions that cannot be disassembled, e.g. the vshufi32x4 instruction: from capstone import * from capstone.x86 ...
langlauf.io's user avatar
  • 1,560
3 votes
1 answer
121 views

What is the outcome of mov on non bracket memory locations?

I am having problems distinguishing whether the address is loaded or the content from the address. Please help me clarify. 1. mov [rsp+78h+arg_0], rsi 2. mov rsi, cs:qword_1F39B60 3. mov [...
Sawb's user avatar
  • 35
0 votes
1 answer
120 views

ida jumping to address I can't see in driver

When I open this driver in IDA i can't seem to see the instructions that this jmp at 0x1400DC46D jumps to. I've tried to undefine bytes and re-analyze the function but it then ends up will garbage. ...
Ayyware's user avatar
  • 41
1 vote
0 answers
96 views

Implementing syscalls under Miasm

I'd like to use Miasm's DSE on a binary. This binary makes use of 2 syscalls: exit and ptrace. Miasm provides an implementation of some syscalls, but unfortunately, not of those two. So I tried to ...
Katoptriss's user avatar
1 vote
1 answer
133 views

IDA API: obtain operand size prefix (x64)

I am trying to tell apart the following two instructions: 8D 02 lea eax, [rdx] // auxfix = 0x1810 67 8D 02 lea eax, [edx] // auxfix = 0x810 The only difference is in the insn_t....
bernd feinman's user avatar
1 vote
0 answers
84 views

Philosophical and procedural question - Process for using x64 inline assembly in recovering source code

I am assuming this should place be appropriate for what I want to ask. I want to ask more of a philosophical and procedural question because I don't want to try things that have been tried and spend ...
LUser's user avatar
  • 783
1 vote
0 answers
169 views

silvio packer for shared libray leads to error: "ELF load command address/offset not properly aligned"

I'm trying to implement a packer based on silvio infection. The packer works fine for ET_EXEC. However, it failed with "ELF load command address/offset not properly aligned" error for the ...
prgbenz's user avatar
  • 81
2 votes
1 answer
3k views

How to get offset of specific function in exe?

Suppose I have self-compiled exe-file (aka portable executable), its source (c/c++) and generated pdb-file. And what if I want to get offset of its function (non-winapi function) in debugger (x64dbg, ...
ruakh's user avatar
  • 23
0 votes
0 answers
107 views

What kind of code creates this function call pattern?

While using WinDbg: u/uf to disassemble functions in ntoskrnl.exe there are functions that are used in system calls and exception handling that have these weird function call patterns and I can't ...
Arush Agarampur's user avatar
5 votes
2 answers
1k views

Fixing/recompiling a heavily control flow obfuscated function

I've recently come across a binary that has been obfuscated with a very obscure protection. Obfuscation From what I understand, the obfuscator is effective in several ways. Multiple JMPs via relative ...
user avatar
0 votes
0 answers
131 views

Is it possible to extract the header files used by a Mach-O 64-bit SDK Binary?

I have a Mach-O 64 bit SDK that I've opened up with JEB (community edition) and I'd like to know if it's even possible to see things like the header files (.h) used/referenced by the binary. The ...
Tikiyetti's user avatar
  • 101
3 votes
3 answers
5k views

startup program exits with code 126 when executing program at entrypoint

I want to reverse engineer a program. I managed to find the entry point but every time I want to launch the application I get the same error `During startup program exited with code 126. Here is what ...
Revolucion for Monica's user avatar
2 votes
0 answers
350 views

Why PTRACE_POKEDATA returns I/O error?

I learning usage of ptrace. I tried following simple example but raises a I/O Error. I would like to overwrite "Hello, world" (printing string) from other process. A target program prints &...
KiYugadgeter's user avatar
1 vote
0 answers
189 views

Trying to call the Exit Shellcode in a c program

#include<stdio.h> #include<stdint.h> char shellcode[] = "\xb8\x3c\x00\x00\x00" "\xbf\x14\x00\x00\x00" "\x0f\x05"; int ...
user8166560's user avatar
1 vote
1 answer
774 views

Disassembly call function offset from RIP

I am writing a program where I map an .exe PE file in memory and I "dissect" it. I am disassembling the .text section of the target executable, using the distorm disassembler. CALL ...
servo's user avatar
  • 31
1 vote
1 answer
298 views

does mov DWORD PTR 32[rsp], 5 means mov DWORD PTR [rsp+32], 5?

I am learning about windows x64 calling convention, where the first four arguments are passed to registers and left arguments are passed through the stack. To see it, I checked the assembly of the ...
Mr. rc's user avatar
  • 45
0 votes
0 answers
150 views

objdump says "64-bit address is disabled"

I've run into an issue with the MinGW build of objdump on Windows. Consider this very simple input file: 48 bf 88 77 66 55 44 33 22 11 I want to disassemble this as Intel x86-64 raw machine code. I ...
Roman Starkov's user avatar
5 votes
1 answer
3k views

How can I get the inferred register value for an instruction in Ghidra scripting?

I'd like to get the inferred value of a register at a particular point in the disassembly listing in a Ghidra script. In my case the target instruction is a rdmsr or wrmsr instruction, which reads or ...
Polynomial's user avatar
  • 1,272
0 votes
1 answer
353 views

Calling MessageBoxW x64 confused about pointer

OK, I am very new to x64dbg. I used to use OllyDbg a lot and I'm having some problems with this. I just made a customized version of MS-PAINT for practice by changing a few things like the default ...
Synaps3's user avatar
  • 101
2 votes
1 answer
997 views

x64dbg or alternative: Run to selection while storing all ran opcodes

I'm trying to trace a function, but unfortunately that function is huge and has lots and lots of jumps to other locations, making it almost impossible to trace for humans. I know the entry point and ...
thethiny's user avatar
  • 123
1 vote
0 answers
108 views

Instruction-level hooking library for win32?

I am looking for instruction-level hooking library for win32 x86/x64. I want to write hook insertion and hook implementation code in C/C++ (compiled into dll). (Therefore instrumentation tools are ...
user2771324's user avatar
2 votes
1 answer
263 views

Garbage Assembly Code Generationat at random offsets

Recently I've been working on a project. The main purpose of the project is to generated statically undetectable PE samples. Where each time one generates a PE sample, each generated sample is going ...
rustam Shirinov's user avatar
2 votes
1 answer
60 views

Difference in binary behaviour (execution/under debugger)

I was trying out a simple heap overflow example (http://highaltitudehacks.com/2020/09/05/arm64-reversing-and-exploitation-part-1-arm-instruction-set-heap-overflow/) but replicated the relevant code in ...
localacct's user avatar
  • 193
1 vote
1 answer
312 views

Help understanding x64 TEST instruction

I have read that TEST does a bitwise and on the two arguments. I have also read that jz and je are both equivalent, and jump if the zero flag is set. So here's the problem I'm struggling with. ...
T. Reed's user avatar
  • 183
-1 votes
1 answer
213 views

What does xchg means when accessing array element?

I have ASM code of some Windows *.exe in IDA: mov rax, [rbx+10h] mov ecx, edx xor edx, edx xchg rdx, [rax+rcx*8] Which is decompiled to pseudocode to _RAX = this->m_someMemoryPool; ...
yudjin's user avatar
  • 61
2 votes
2 answers
3k views

how to does this instruction work: `mov qword ptr [rbp-0x30], 0x4020c5`

The following is the code snippet (shown partially) I have: q = strrchr(resolved, '/'); /* given /home/misha/docs.txt, q now pts to the last slash */ if (q != NULL) { p = q + 1; ...
R4444's user avatar
  • 1,807
0 votes
1 answer
70 views

Cant recognise where is my targeted function executed

Im trying to recognise where is my targeted function int64 __fastcall sub_1400CE4F0(__int64 a1, const char *a2)executed. When stepping through this function, after return it's redirecting me here: if (...
CospriMalice's user avatar