Questions tagged [x86-64]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
14 views

Disassembly call function offset from RIP

I am writing a program where I map an .exe PE file in memory and I "dissect" it. I am disassembling the .text section of the target executable, using the distorm disassembler. CALL ...
1
vote
1answer
51 views

does mov DWORD PTR 32[rsp], 5 means mov DWORD PTR [rsp+32], 5?

I am learning about windows x64 calling convention, where the first four arguments are passed to registers and left arguments are passed through the stack. To see it, I checked the assembly of the ...
0
votes
0answers
23 views

objdump says “64-bit address is disabled”

I've run into an issue with the MinGW build of objdump on Windows. Consider this very simple input file: 48 bf 88 77 66 55 44 33 22 11 I want to disassemble this as Intel x86-64 raw machine code. I ...
4
votes
1answer
237 views

How can I get the inferred register value for an instruction in Ghidra scripting?

I'd like to get the inferred value of a register at a particular point in the disassembly listing in a Ghidra script. In my case the target instruction is a rdmsr or wrmsr instruction, which reads or ...
0
votes
1answer
70 views

Calling MessageBoxW x64 confused about pointer

OK, I am very new to x64dbg. I used to use OllyDbg a lot and I'm having some problems with this. I just made a customized version of MS-PAINT for practice by changing a few things like the default ...
1
vote
1answer
105 views

x64dbg or alternative: Run to selection while storing all ran opcodes

I'm trying to trace a function, but unfortunately that function is huge and has lots and lots of jumps to other locations, making it almost impossible to trace for humans. I know the entry point and ...
0
votes
0answers
37 views

Remapping Branch Instructions After Obfuscation

Recently I've been working on a project. I've already got a hint for a problem that I had here: (Garbage Assembly Code Generationat at random offsets) however, the accepted answer's solution doesn't ...
1
vote
0answers
29 views

Instruction-level hooking library for win32?

I am looking for instruction-level hooking library for win32 x86/x64. I want to write hook insertion and hook implementation code in C/C++ (compiled into dll). (Therefore instrumentation tools are ...
2
votes
1answer
81 views

Garbage Assembly Code Generationat at random offsets

Recently I've been working on a project. The main purpose of the project is to generated statically undetectable PE samples. Where each time one generates a PE sample, each generated sample is going ...
2
votes
1answer
44 views

Difference in binary behaviour (execution/under debugger)

I was trying out a simple heap overflow example (http://highaltitudehacks.com/2020/09/05/arm64-reversing-and-exploitation-part-1-arm-instruction-set-heap-overflow/) but replicated the relevant code in ...
1
vote
1answer
94 views

Help understanding x64 TEST instruction

I have read that TEST does a bitwise and on the two arguments. I have also read that jz and je are both equivalent, and jump if the zero flag is set. So here's the problem I'm struggling with. ...
-1
votes
1answer
70 views

What does xchg means when accessing array element?

I have ASM code of some Windows *.exe in IDA: mov rax, [rbx+10h] mov ecx, edx xor edx, edx xchg rdx, [rax+rcx*8] Which is decompiled to pseudocode to _RAX = this->m_someMemoryPool; ...
2
votes
2answers
276 views

how to does this instruction work: `mov qword ptr [rbp-0x30], 0x4020c5`

The following is the code snippet (shown partially) I have: q = strrchr(resolved, '/'); /* given /home/misha/docs.txt, q now pts to the last slash */ if (q != NULL) { p = q + 1; ...
0
votes
1answer
58 views

Cant recognise where is my targeted function executed

Im trying to recognise where is my targeted function int64 __fastcall sub_1400CE4F0(__int64 a1, const char *a2)executed. When stepping through this function, after return it's redirecting me here: if (...
0
votes
1answer
93 views

How can I modify these?

So I'm onto something interesting, I asked the less direct way but failed to meet the requirements in terms of explanation So here it is, how would I go about editing these the same way I would go ...
3
votes
1answer
126 views

Radare2 - what does dot mean in disassembly

I've just started using radare2 and I've noticed a dot when I tried to disassamble one on my programs. The output is: 0x00000000 48b841000000. movabs rax, 0x41 I understand that 0x48 is the REX ...
0
votes
0answers
46 views

Change value of memory in a debugger?

So I got this app loaded in x64, there is a function, let's say "HeatGainedPerShot", which is basically the value which an object gains everytime it fires, Such a value would normally exist ...
0
votes
0answers
36 views

Windows pintool mismatch between call/ret instructions

So i've been trying to write a pintool that monitors call/ret instructions but i've noticed that threre was a significant inconsistency between the two. For example ret instructions without previous ...
0
votes
2answers
78 views

Where do arguments 5 and 6 go in this Microsoft x64 function call?

I'm disassembling a working-as-expected compiled C program (MS/Windows x64, MinGW gcc 10.1.0). In the main function, I have the following call which passes 6 arguments to the function DotProduct: ... /...
1
vote
1answer
53 views

Displaying Operands as Position Independent in IDA

I'm writing an IDA python script, and i need to be able to detect position independent code. I have an instruction that IDA displays using the operand name 'format' lea rdi, format However, when ...
1
vote
1answer
101 views

Is `movq rax, xmm0` buggy in Radare2?

Why doesn't rax get loaded from xmm0 here? radare2 bug? GitHub issue `movq rax, xmm0` doesn't work in native debugger filed. [0x0003b0e0]> drr role reg value ref ―――――――――――――――――――...
1
vote
2answers
81 views

x64 processor module

I just downloaded Ghidra last evening on a Fedora Linux machine with 4 Intel Core i5-7200U CPUs. When querying the "installed processor modules" in "Help" I get a listing of 41 processors. x86 is on ...
2
votes
1answer
149 views

How can i check if i am running in ring 0 / ring 3 on x64 CPU

I have read it is possible to check ring level with bit 3 of CS register. Is there another register which really contains ring value (2 bits) Thanks
7
votes
4answers
2k views

What is the difference between MOV and LEA in example?

Looking at an assembly code snippet I see: lea rax, [rbp-0x50] Which tells me that the rax register now points to whatever value is in rbp-hex(50). Question. Would I achieve the same result doing ...
2
votes
1answer
400 views

Help understanding MOVSXD

I've tried reading the documentation but the functionality of this instruction is still cloudy to me. For an example, I would like to know what is stored in RDX after these instructions: mov edx, ...
1
vote
0answers
40 views

Memory modified at jump far

Observing a trace of Wow64 switching on Windows 7, the following situation makes me confused ... 0x77491dbe 64 ff 15 c0 00 00 00 call fs:[0xc0] ; syswow64\ntdll.dll 0x74632320 ea 1e 27 63 ...
1
vote
1answer
41 views

How to determine what code created a string, in a live debugger session?

I'm using IDA 7 to debug a running application that must be a child of another application, which means I can't start it from IDA (using Debugger->Run). Instead, I have to run the application normally,...
2
votes
1answer
89 views

Finding “func main” in a stripped binary written in GO

I'm reversing a binary that was apart of a CTF I was involved in about a month ago. It was too large of a binary to do during the challenge so I am doing it now. I am having trouble finding the main ...
1
vote
1answer
65 views

Isolate the call to a function

Is it possible to call a function of a binary and obtain its result (without calling other functions), to isolate; are there any tools to do this?
1
vote
0answers
30 views

Go back to the original entry point after executing the instructions in the newly added segment- PE32+, C++

I am learning PE32+ (64 bit) files. I have added a new section to the PE32+ file and made the new section as the entry point. Some simple instructions are added in the new segment. Now I want to go to ...
3
votes
2answers
363 views

PE32+ executable : .text segment encryption

I am working on PE segment encryption(in C++). I completed the PE32 .text segment encryption. I added stub segment to the PE that will decrypt .text segment at runtime. Used inline assembly in the ...
0
votes
1answer
130 views

How to determine when/where pointers in .ctors get mapped?

So I am learning about ELF, and am looking through a binary in Ghidra as I do. I've made sense of the ELF header, and now I am looking through the program header table. My binary has a bunch of ...
1
vote
0answers
131 views

How to interpret binary instruction using the intel manual

OK. So I am really trying to figure out how to use the "Intel 64 and IA-32 Architectures Software Developer's Manual" for myself, since it seems like the authoritative source for x86(_64) machine code....
1
vote
1answer
498 views

cannot find a string in x64dbg even when using search all strings

I am trying to debug a program for testing but for some reason i can NOT find any strings related to registeration like Registered, Unregistered,Blocked in x64dbg, i can see all these strings in the ...
2
votes
1answer
135 views

Undocumented Model-Specific Register on Broadwell Microarchitecture

I'm trying to reverse the BIOS of a machine to learn something. The bigger problem I'm facing is that during early initialization, the code is making heavy usage of MSRs, and most of the time, I found ...
0
votes
1answer
282 views

What do square brackets do in IDA's pseudocode representation?

I've been a bit stumped recently on my decomp work. I've not dealt with C in depth nor have I dealt with IDA's pseudocode system very much at all. I understand asm, but because of how IDA merges ...
1
vote
3answers
2k views

How to find the starting address of text section of a DLL inside a process? (64 bit)

There was a question about this a year ago, but the answer doesn't explain how to do it in C/C++: How to find start of .text section? I'm not talking about module start address, which we can get ...
2
votes
1answer
114 views

Understanding operand forms

9(%rax, %rdx): What happens here? Is 9 the offset? and do you add the two registers together? I'm reading Randal E. Bryant and David R. O'Hallaran's "Computer Systems - A programmer's Persepctive" ...
1
vote
2answers
402 views

Does the loader fill the IAT table of an .exe in load time by checking the corresponding export tables or during run time?

I came upon this question : Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking? and it got me wondering, lets say for some reason some function was not in the IAT of our ...
2
votes
1answer
154 views

How to hide a process from all the methods of getting the list of processes?

So it seems that there are a lot of ways of getting the process list, although I'm not sure whether in the low level do they acquire them from same place or not so these are the ways i know : ...
1
vote
1answer
299 views

Why address 7FFE0308 always gets compared in 64bit applications before making a syscall in Ntdll?

So there was a question asked before about this : What are the difference syscall and int 0x2E instructions? and it has two answer, one says that is just a way to check if we are in a 32 bit or 64 ...
1
vote
1answer
116 views

What is the ending bytes in the MOV instruction in 32 bit applications in windows? (B8 mov)

So i just compared NTterminateProcess between 32 and 64 bit version of a program, and the mov instruction which moves the syscall into eax is almost the same, both 5 byte, (both the B8 mov) but the ...
3
votes
3answers
954 views

Elf x86_64 adding function

I'm trying to see if I can append function code in the .text section of an ELF while still maintaining the execution flow of the original ELF. Ideally, I want to call the new function but that's it's ...
0
votes
0answers
90 views

Bufferoverflow Stack

I want to do a buffer overflow exploit in the stack. For this i read in data via the "gets"-function. void ExploitMe() { char buffer[256]; gets(buffer); } I compile this file with gcc test.c -...
1
vote
1answer
981 views

How to pass param to execve to execute cat a file in x64 Asm? [closed]

I want execve("/bin/cat",["/bin/cat","/test/file"],NULL). Here is my asm xor %rdx, %rdx push %rdx sub $0x16, %rsp movb $0x2f, 7(%rsp) movl $0x2f6e6962, 8(%rsp) movl $0x746163, 12(%rsp) leaq 7(%rsp)...
2
votes
1answer
5k views

Receiving “Got EOF while reading in interactive” after properly executing system(“/bin/sh”) using pwntools

I've followed some tutorials on writing a pwntools-based exploit for the bitterman ELF binary, used in a CTF competition. However, all my attempts fail with the message below, i.e. Got EOF while ...
1
vote
1answer
790 views

Changing entry-point of and ELF file

I'm trying to conduct a little experiment which basically consists of changing the EP of an ELF file and executing an exit(9) syscall, without returning to the OEP. As shown in the image everything ...
0
votes
0answers
171 views

R13 off by 2 bytes. Any help?

in this challenge i have to overwrite RIP register to point to the function "print_flags" which calls "getenv" to get the "FLAGS" variable. I have overwritten RIP register with the address of "...
2
votes
3answers
398 views

Is the main function's name in the symbol table of C & C++ programs always 'main'? if not, how to find the name?

So I'm trying to write a reversing tool that parses symbol table to find the main function's address right now all the binaries I'm checking the name of main function is still main in symbol table ...
1
vote
1answer
689 views

why saved rip changed by push?

I am doing a reverse homework. see the following pictures: as can be seen from this picture, before call push touch3, "saved rip" is at 0x5561dca8, which is equal to the current rsp(0x5561dca8). ...