Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [x86-64]

The tag has no usage guidance.

0
votes
0answers
54 views

R13 off by 2 bytes. Any help?

in this challenge i have to overwrite RIP register to point to the function "print_flags" which calls "getenv" to get the "FLAGS" variable. I have overwritten RIP register with the address of "...
1
vote
3answers
105 views

Is the main function's name in the symbol table of C & C++ programs always 'main'? if not, how to find the name?

So I'm trying to write a reversing tool that parses symbol table to find the main function's address right now all the binaries I'm checking the name of main function is still main in symbol table ...
1
vote
1answer
85 views

why saved rip changed by push?

I am doing a reverse homework. see the following pictures: as can be seen from this picture, before call push touch3, "saved rip" is at 0x5561dca8, which is equal to the current rsp(0x5561dca8). ...
1
vote
1answer
52 views

Unknown parameters in custom signal handler on Linux

0x0000000008001946: mov 0xa8(%rdx),%rax 0x000000000800194d: lea 0x28(%rdx),%rsi 0x0000000008001951: lea 0x2(%rax),%rdi 0x0000000008001955: add $0xe,%rax 0x0000000008001959: ...
0
votes
1answer
48 views

Calculate LEA operand

I have those opcodes on 64 bits: 48 8D 35 45 CE FF FF >>> lea rsi, [rip - 0x31bb]. How can I get the 0x31bb value from those opcodes and how can I know if I have a + sign or a - sign ...
0
votes
1answer
95 views

How do I go about overriding a function internally defined in a binary on Linux?

To be specific, I cannot recompile this binary, nor do I have access to the sourcecode. The functions are not defined within a shared library. So, how can I go about changing a function, or ...
0
votes
1answer
121 views

How to locate an specific data structure in an executable?

I need to locate an specific "struct" variable in the data section from an assembly. This structure is used for an specific System Function (Windows) "SetCommState()". I'm wondering how to locate the ...
2
votes
1answer
98 views

Why do I get e8 00 00 00 00 for all libc function calls?

I just started learning reverse engineering. The near call instruction (e8) is very confusing to me. It took me a while to figure out how address calculation works for local functions. Now I'm ...
3
votes
1answer
176 views

IDA 7.0 - combine sequence of assembly instructions to a macro

I'm solving this CTF with IDA Pro 7.0. At some point there is an offset calculation by index, it simply multiply an index by 48 and write/read some data to it. The main problems are: the ...
3
votes
1answer
432 views

XCHG RAX, RAX: 0x09, what does this code do and how does it work?

Given the following short assembly snippet: shr rax, 3 adc rax, 0 I worked this out a bit: We know SHR sets the CF with the last bit shifted. We know ADC dest, 0 is just adding the CF. So ...
0
votes
1answer
102 views

XCHG RAX, RAX: 0x03, what does this code do and how does it work?

"XCHG RAX, RAX" is a kind of riddle book that provides assembly code for you to reverse and undercover the meaning. Some of the examples calculate the Fibonacci sequence others bit-twiddle to toggle ...
5
votes
2answers
1k views

How many registers does an x86_64 CPU actually have?

I am currently learning reverse engineering and am studying the flags register. I had in my mind that rflags was just another name for one of the 16 general purpose registers, for example rax or rbx. ...
1
vote
1answer
190 views

Payload in simple buffer overflow exploit redirecting %rip on x86-64 Ubuntu 16.04 LTS leads to early (meaning before %rip is overwritten) segfault

I am trying to do a simple buffer overflow exploitation by overwriting the instruction pointer %rip. Here's my code of vuln.c #include <stdio.h> #include <string.h> #include <stdlib.h&...
0
votes
2answers
166 views

.00cfg section in the PE file

What's that .00cfg section that is being added by Visual Studio 2017 to PE32+ binary files (for x64 builds)? I'm assuming it stands for "Control Flow Guard" section. It is relatively small and mostly ...
2
votes
1answer
323 views

Converting Assembly x64 code to C

I have the following code: 0000000000400526 <main>: 400526: 55 push rbp 400527: 48 89 e5 mov rbp,rsp 40052a: 48 83 ec 20 sub ...
3
votes
1answer
257 views

How can I convert this assembly code (x64) to C?

I have the following assembly (x64) function: 400700: sub rsp,0x18 400704: mov QWORD PTR [rsp+0x8],rdi 400709: cmp QWORD PTR [rsp+0x8],0x0 40070f: jne 400718 <bar+0x18> 400711: mov eax,0x0 ...
1
vote
1answer
62 views

How are __argc and __wargv globals exported from a 64-bit PE file compiled with Visual Studio?

I need to inject my code into a 64-bit process. I'm wondering, how can I access __argc and __wargv global variables once in the injected process? Are they always present at a static/preset address?
1
vote
2answers
254 views

Getting opcode Length , How to

I am apparently not very good with assembly as I am novice to somethings! Hence i wanted to make a question again. Now i got this from here to make something like a LDE (Length Disassembly Engine) ...
2
votes
1answer
49 views

Correct my understanding on a basic allocation memory

Here is the function If I understand correctly: There is a buffer of size 256 bytes created (malloc) in this buffer, the first 32 bits are set to 0 (because dword designates 32bits size) the next 32 ...
1
vote
1answer
61 views

Need Advice for the purposes of learning [closed]

I would really like to make a multiplayer mod for Fallout 4, I know how to program and i have a basic understanding of how to get opcodes and read/write to those. Now what i don't understand is how to ...
1
vote
1answer
205 views

Game's anti-cheat complains when driver test-signing mode is on

I use Windows 7 64 bit, thus in order to load a test-signed driver, I need to enable test-signing mode. My driver bypasses some of the game's anti-cheat features to allow me to run a debugger and ...
1
vote
1answer
107 views

How to debug a crash in wow64.dll in 32bit process

I have a 32bit application and a few wrapper tools that I use one after another to inject code, hook system dll functions (using the patch-first-bytes-of-the-function-with-jump approach). Also I have ...
1
vote
1answer
81 views

What are these LOAD segments in an assembly ELF64?

I wrote the following (fasm) assembly program: format ELF64 executable segment readable executable include 'io.inc' include 'unistd64.inc' entry main main: mov rdi, msg call print call ...
15
votes
3answers
6k views

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

I don't know whether this is a silly question, but I couldn't find any answer. With the evolution of CPU architecture, register size was extended, from 8, to 16, 32, and eventually 64-bit. I was ...
6
votes
1answer
1k views

Is IDA pulling my leg - or can REX.W sometimes not be determined in static analysis?

NB: I normally dabble with disassembly (i.e. mnemonics) and only ever look at the raw opcodes when I can't avoid it. I have the following line of disassembly of a Windows x64 kernel mode driver, ...
3
votes
1answer
265 views

Question about the limit and base address in x86-64 segmentation model?

I'm trying to understand how segmentation works under x86-64. From what I see, it's mostly disabled, but not entirely. It looks like GS and FS registers are still using it. So I was reviewing the ...
3
votes
1answer
150 views

Unable to use CreateRemoteThread in target process

I'm trying to get a debugger attached to a malware, but it seems to pick up whenever a new remote thread is created (which makes it so I can't use Scyllahide). Even if I suspend all threads, it does ...
1
vote
1answer
304 views

Windbg: How to directly view GS:[0x60]

Win10x64: In Windbg, how may I view a pointer to the PEB by directly using GS:[0x60] (and not by Windbg extensions)? To test, I assembled a program via masm64 that throws an interrupt, clears r8 then ...
0
votes
1answer
52 views

Reading params of a text engine function amd86_64

I'm starting to learn amd86_64 calling convention and how it calls params and clean the stack but the concept hasn't sunk in yet, so i would like to get a help reading the params as this might clear ...
4
votes
1answer
121 views

rasm2 giving different output each time for x64

Disassembling is great but when trying to re-assemble to opcode it gives different results each time. Example: C:\>rasm2 -a x86 -b 64 -d "48898D80FEFFFF" mov qword [rbp - 0x180], rcx C:\>...
1
vote
2answers
230 views

Printing bytecode in bytes given a string of assembly?

Megabeets determined in this answer that depending on asm.bits Radare may show either lea edx, [0x80490c8] (asm.bits=32) lea edx, [rip + 0x80490c8] (asm.bits=64) If I want to see what the ...
0
votes
2answers
74 views

Magic number in resource loading routine

I'm practicing windows disassembly on x64 notepad.exe I've managed to find buffer allocation and string resources load. But after that follows code, which I can't fully understand: rbx = 0, rdx = 0 ...
0
votes
1answer
230 views

IDA Pro 64bit offset and opcode issue

I'm looking at a 64bit PE file in IDA. The instructions below access unknown data at offset 20030. Usually when I look at 32bit PE files, the offset is also listed next to the opcodes on the left. So ...
2
votes
1answer
108 views

Windows x86 compability on x64 operating system

I know some about wow64 system, in x64 windows version, and i looked up into this wow64* dlls, to see how the actual syscall transition happen, but something i can't find, and this is probably done by ...
3
votes
1answer
333 views

Deobfuscating overlapping x86 assembly instructions

I'm trying to solve a reverse engineering challenge (http://crackmes.cf/users/beatrix/beaba/) and am having trouble with the obfuscation. Below is a piece of code that gets executed almost immediately ...
2
votes
5answers
4k views

Run PE File - (Executable) From Memory

Would be grateful for your suggestion.Trying to run a 32/64bit on (Windows 10- 64 bit /Visual studio) program which tries to run an executable from memory.This is for my learning purpose. #include &...
0
votes
1answer
324 views

Linux x64 Disassembly: single movzwl operand question

A quick question regarding a movzwl instruction which do not behave as I expected. here is the disassembled code: movzwl (%rax),%eax Before the instruction, rax is 0x7fffffffe410 and point to 0x5 ...
0
votes
1answer
318 views

brute force remote nop sled memory address

I am in the middle of a binary crackme (ELF-64) on a remote server which communicates via simple socket server in C. I have the source code, locally. After overflowing the buffer (socket buffer is ...
0
votes
1answer
208 views

x64 Linux reverse-engineering - understanding asm code and inject eax

In a rootme exercise, i'm trying to bypass the control impleted to protect a "read" function. You'll find enclosed the code i'm refering to. As you may understand, i can inject data (with limitations) ...
8
votes
1answer
2k views

How to investigate Windows 32/64bit (WOW64) transition

There is surprisingly little information about Windows WOW64 mechanism. I'm trying to investigate it. So when we have system call in 32-land, it calls an address that is stored in FS, which leads us ...
1
vote
1answer
89 views

How to break on a window creation

in x32/x64 debugger, how can I break when a new window is opened? When inside my application, I click the "File" button in the menu bar then select "options" I want to break on that call to open the ...
0
votes
2answers
688 views

Trying to call a function in an unknown DLL

My goal is far from nefarious. After several polite attempts to try and get Lenovo to implement a proper keyboard backlight control, I've had no response. They do have a Windows Store app which adds ...
0
votes
1answer
121 views

Why is using a 32bit system over 64bit recommended for people that are new to reverse engineering? [closed]

I am new to the world of reverse engineering and have been recommended by a number of people that I should start with IA32 because it is easier to learn the concepts. Aside from differences in the ...
1
vote
1answer
92 views

Is it possible to restart over a program by calling an entry point function?

I was wondering if it was possible to restart a program (ignoring previously mapped files) with different argument by either calling main() or a glibc entry point function.
0
votes
1answer
912 views

Calling DLL exports in x64dbg

I am attempting to debug a x64bit dll with x64dbg. Is there an export caller similar to Ollydbg? I checked the documents and haven't seen anything.
0
votes
1answer
86 views

MSVC Generates Weird Code for Volatile Local Variable

I want to know how MSVC 2010 generates code for volatile local variable and have done a test. This simple test function uses a volatile local variable: int proc1(int a, int b) { int volatile ...
4
votes
1answer
2k views

xor eax, eax in x64

I have following code: sub rsp, 40 ; 00000028H lea rcx, OFFSET FLAT:$SG4237 call printf xor eax, eax add rsp, 40 ; 00000028H ret 0 Why there is xor eax, eax , ...
1
vote
1answer
681 views

How do I denote and use JMP /5 in byte code

I'm on the OSX platform working with x86_64. I've worked out how to do near jumps with the E9 byte code directive where my relative addresses have 4 bytes (teamed up with RIP) Now I have an instance ...
3
votes
1answer
478 views

Writing own custome syscall/int 0x80 on x64 system

Is there a way to write my own syscall/int 0x80 without using them? So, normally it goes like setup registers ... syscall or int 0x80 and I am interested in doing this without syscall/int 0x80 ...
3
votes
0answers
315 views

Using __kernel_vsyscall on x64 linux machine [closed]

I am trying to use __kernel_vsyscall instead of syscall/int 80 on linux x64. I have read that it can be done on Intel chips (I have one), but i can't find how can one do it. I have x32 version: int ...