Questions tagged [x86-64]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
2answers
401 views

.00cfg section in the PE file

What's that .00cfg section that is being added by Visual Studio 2017 to PE32+ binary files (for x64 builds)? I'm assuming it stands for "Control Flow Guard" section. It is relatively small and mostly ...
15
votes
3answers
8k views

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

I don't know whether this is a silly question, but I couldn't find any answer. With the evolution of CPU architecture, register size was extended, from 8, to 16, 32, and eventually 64-bit. I was ...
1
vote
2answers
523 views

Getting opcode Length , How to

I am apparently not very good with assembly as I am novice to somethings! Hence i wanted to make a question again. Now i got this from here to make something like a LDE (Length Disassembly Engine) ...
2
votes
1answer
52 views

Correct my understanding on a basic allocation memory

Here is the function If I understand correctly: There is a buffer of size 256 bytes created (malloc) in this buffer, the first 32 bits are set to 0 (because dword designates 32bits size) the next 32 ...
1
vote
1answer
64 views

Need Advice for the purposes of learning [closed]

I would really like to make a multiplayer mod for Fallout 4, I know how to program and i have a basic understanding of how to get opcodes and read/write to those. Now what i don't understand is how to ...
1
vote
1answer
382 views

Game's anti-cheat complains when driver test-signing mode is on

I use Windows 7 64 bit, thus in order to load a test-signed driver, I need to enable test-signing mode. My driver bypasses some of the game's anti-cheat features to allow me to run a debugger and ...
1
vote
1answer
169 views

What are these LOAD segments in an assembly ELF64?

I wrote the following (fasm) assembly program: format ELF64 executable segment readable executable include 'io.inc' include 'unistd64.inc' entry main main: mov rdi, msg call print call ...
1
vote
1answer
112 views

Why does MSVC x64 Compiler load addresses like this?

Normally, in x86, to load a pointer to a null-terminated string you would use MOV EDX, OFFSET ds:mystring In x64, however, I noticed that the compiler does it like this lea rdx, OFFSET FLAT:$...
4
votes
1answer
152 views

rasm2 giving different output each time for x64

Disassembling is great but when trying to re-assemble to opcode it gives different results each time. Example: C:\>rasm2 -a x86 -b 64 -d "48898D80FEFFFF" mov qword [rbp - 0x180], rcx C:\>...
5
votes
1answer
1k views

Is IDA pulling my leg - or can REX.W sometimes not be determined in static analysis?

NB: I normally dabble with disassembly (i.e. mnemonics) and only ever look at the raw opcodes when I can't avoid it. I have the following line of disassembly of a Windows x64 kernel mode driver, ...
3
votes
1answer
190 views

Unable to use CreateRemoteThread in target process

I'm trying to get a debugger attached to a malware, but it seems to pick up whenever a new remote thread is created (which makes it so I can't use Scyllahide). Even if I suspend all threads, it does ...
3
votes
1answer
454 views

Question about the limit and base address in x86-64 segmentation model?

I'm trying to understand how segmentation works under x86-64. From what I see, it's mostly disabled, but not entirely. It looks like GS and FS registers are still using it. So I was reviewing the ...
24
votes
1answer
62k views

Reversing ELF 64-bit LSB executable, x86-64 ,gdb

I'm a newbie and just got into RE. I got a ELF 64-bit LSB executable, x86-64. I'm trying to reverse it. First I tried to set a break point on line 1 using gdb ./filename break 1 The gdb says No ...
8
votes
3answers
750 views

What methodology can be used to change code flow atomically during program execution?

I have been reading a lot about the different techniques for Windows API hooking (a technique I'm particularly fascinated by and fond of), and it seems a major problem in implementing a realiable ...
8
votes
1answer
3k views

How to investigate Windows 32/64bit (WOW64) transition

There is surprisingly little information about Windows WOW64 mechanism. I'm trying to investigate it. So when we have system call in 32-land, it calls an address that is stored in FS, which leads us ...
3
votes
2answers
1k views

Purpose of NOP immediately after CALL instruction

There are a lot of ... code ... call sub_... nop ... code ... patterns in an executable dump I am working on. They appear in the middle of subroutines and I believe don't serve alignment purposes. I ...
0
votes
1answer
60 views

Reading params of a text engine function amd86_64

I'm starting to learn amd86_64 calling convention and how it calls params and clean the stack but the concept hasn't sunk in yet, so i would like to get a help reading the params as this might clear ...
0
votes
2answers
76 views

Magic number in resource loading routine

I'm practicing windows disassembly on x64 notepad.exe I've managed to find buffer allocation and string resources load. But after that follows code, which I can't fully understand: rbx = 0, rdx = 0 ...
0
votes
1answer
314 views

IDA Pro 64bit offset and opcode issue

I'm looking at a 64bit PE file in IDA. The instructions below access unknown data at offset 20030. Usually when I look at 32bit PE files, the offset is also listed next to the opcodes on the left. So ...
2
votes
1answer
116 views

Windows x86 compability on x64 operating system

I know some about wow64 system, in x64 windows version, and i looked up into this wow64* dlls, to see how the actual syscall transition happen, but something i can't find, and this is probably done by ...
2
votes
1answer
7k views

64-bit integers on 32-bit machines

Let's say I create a program in C like this and compile it on a regular 64-bit desktop machine: #include <stdint.h> int main(void) { uint64_t a = 0x12345679abcdefULL; uint64_t b = ...
3
votes
1answer
502 views

Deobfuscating overlapping x86 assembly instructions

I'm trying to solve a reverse engineering challenge (http://crackmes.cf/users/beatrix/beaba/) and am having trouble with the obfuscation. Below is a piece of code that gets executed almost immediately ...
0
votes
1answer
596 views

Linux x64 Disassembly: single movzwl operand question

A quick question regarding a movzwl instruction which do not behave as I expected. here is the disassembled code: movzwl (%rax),%eax Before the instruction, rax is 0x7fffffffe410 and point to 0x5 ...
0
votes
1answer
461 views

brute force remote nop sled memory address

I am in the middle of a binary crackme (ELF-64) on a remote server which communicates via simple socket server in C. I have the source code, locally. After overflowing the buffer (socket buffer is ...
0
votes
1answer
248 views

x64 Linux reverse-engineering - understanding asm code and inject eax

In a rootme exercise, i'm trying to bypass the control impleted to protect a "read" function. You'll find enclosed the code i'm refering to. As you may understand, i can inject data (with limitations) ...
5
votes
3answers
62k views

How to obtain x86-64 pseudocode in IDA Pro?

Does anyone know about obtaining pseudocode for x86-64 in IDA Pro? I already tried the Hex-Rays plugin to obtain pseudocode, but when I try it, the following error pops up: "only 32bit code is ...
2
votes
1answer
98 views

How to break on a window creation

in x32/x64 debugger, how can I break when a new window is opened? When inside my application, I click the "File" button in the menu bar then select "options" I want to break on that call to open the ...
1
vote
0answers
611 views

Find memory mapped file with x64dbg

I have 64 bit process I want to debug with x64dbg. There is memory mapped file, I found with help of Process Explorer. Properties windows says: Type: Section Description: A memory mapped file or ...
0
votes
1answer
1k views

Calling DLL exports in x64dbg

I am attempting to debug a x64bit dll with x64dbg. Is there an export caller similar to Ollydbg? I checked the documents and haven't seen anything.
0
votes
2answers
791 views

Trying to call a function in an unknown DLL

My goal is far from nefarious. After several polite attempts to try and get Lenovo to implement a proper keyboard backlight control, I've had no response. They do have a Windows Store app which adds ...
3
votes
2answers
21k views

IDA cannot launch debugger for 64-bit exe files

I want to launch IDA debugger for one 64-bit exe file and it fails, have tried with more samples, but result always the same. Here is that I do. Launch IDA Pro (64-bit) Select Debugger -> Run -> ...
0
votes
1answer
123 views

Why is using a 32bit system over 64bit recommended for people that are new to reverse engineering? [closed]

I am new to the world of reverse engineering and have been recommended by a number of people that I should start with IA32 because it is easier to learn the concepts. Aside from differences in the ...
1
vote
1answer
96 views

Is it possible to restart over a program by calling an entry point function?

I was wondering if it was possible to restart a program (ignoring previously mapped files) with different argument by either calling main() or a glibc entry point function.
1
vote
0answers
826 views

Error: the file can't be loaded by debugger plupin IDA PRO 64 bit

I use IDA PRO 64bits on windows 10 64 bit, I want use it remote debug a file 64bit by linux. When I run linux_serverx64 in linux and connect then i error: the file can't be loaded by debugger plupin ...
1
vote
1answer
2k views

Does PeID signatures work with 64-Bit Portable Executable (EXE) files?

Can the signatures from PeID be used on 64-Bit Portable Executable (EXE) files? PeID does not support 64-Bit files but I can use the signatures in another application with 64-Bit support. My main ...
4
votes
2answers
1k views

Automating pattern-based de-obfuscation of x64 code using IDA plugins

Trying to deobfuscate x64 code. You can skim/skip most of this, since it mainly exists to prove I have tried and exhausted all avenues. Burning Purpose To massively automate the deobfuscation within ...
5
votes
3answers
2k views

IDA Pro Renaming Imports

This PE file destroys its import address table. However, all the function addresses are in this _rdata segment here: Any straight forward way to rename these functions?
0
votes
1answer
98 views

MSVC Generates Weird Code for Volatile Local Variable

I want to know how MSVC 2010 generates code for volatile local variable and have done a test. This simple test function uses a volatile local variable: int proc1(int a, int b) { int volatile ...
4
votes
1answer
2k views

xor eax, eax in x64

I have following code: sub rsp, 40 ; 00000028H lea rcx, OFFSET FLAT:$SG4237 call printf xor eax, eax add rsp, 40 ; 00000028H ret 0 Why there is xor eax, eax , ...
2
votes
1answer
837 views

How do I denote and use JMP /5 in byte code

I'm on the OSX platform working with x86_64. I've worked out how to do near jumps with the E9 byte code directive where my relative addresses have 4 bytes (teamed up with RIP) Now I have an instance ...
2
votes
1answer
548 views

Writing own custome syscall/int 0x80 on x64 system

Is there a way to write my own syscall/int 0x80 without using them? So, normally it goes like setup registers ... syscall or int 0x80 and I am interested in doing this without syscall/int 0x80 ...
2
votes
0answers
348 views

Using __kernel_vsyscall on x64 linux machine [closed]

I am trying to use __kernel_vsyscall instead of syscall/int 80 on linux x64. I have read that it can be done on Intel chips (I have one), but i can't find how can one do it. I have x32 version: int ...
3
votes
2answers
17k views

64 bit Pseudocode decompiler

I have a 64 bit program im debugging. I found the function i need to learn more about to potentially "fix" the problem (there is no source code available for the program). To speed things up, i ...
1
vote
1answer
246 views

Is it possible to rebuild an nexe file if I can read at arbitrary untrusted memory addresses?

Ok, I’m in a remote situation where I don’t have access to the remote filesystem but where I can run arbitrary python code (except I can’t fork processes and I don’t have access to ulimit and uname). ...
1
vote
1answer
692 views

How would I find a color's memory address? (Beginner)

I'm an absolute beginner (just started learning about process memory a few hours ago). I'm trying to find the memory address for the color of Color 1 in mspaint using x64dbg. I know it's black, so I'...
1
vote
2answers
157 views

Figure out whether a function has return value of not?

I am doing binary analysis on x86-64bit ELF binaries. All the binaries are compiled from C language. Basically, for a given function, I would like to figure out whether this function has a return ...
3
votes
1answer
192 views

How does GPROF hook to the program?

I compiled a simple helloworld and took a look at the disassembly using objdump. At the beginning there is the _init: 0000000000400600 <_init>: 400600: 48 83 ec 08 sub rsp,...
4
votes
3answers
4k views

Determind length of instructions in bytes

Where is it possible to find a list of x86 instructions (and x64 instructions) with the (hex) opcode and the length/size in bytes of the instructions, such as: 0x90 = NOP = 1 byte 0xE9 = JMP = 5 ...
7
votes
2answers
2k views

32-bit binary stack layout on a x64 Linux OS

Stack layout is well documented in many ways. Especially for x86 systems as there were numerous tutorials on how to exploit stack overflow on old 32-bit systems many years ago. So far we can know ...
7
votes
1answer
5k views

Problem while debugging with gdbserver in IDA Pro

I'm new to debugging with IDA Pro and I ran into the problem that my breakpoint is not hit while attempting to debug with gdbserver. The program is written by myself and it is simple to debug with gdb....