Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [x86-64]

The tag has no usage guidance.

2
votes
0answers
324 views

Using __kernel_vsyscall on x64 linux machine [closed]

I am trying to use __kernel_vsyscall instead of syscall/int 80 on linux x64. I have read that it can be done on Intel chips (I have one), but i can't find how can one do it. I have x32 version: int ...
1
vote
0answers
741 views

Error: the file can't be loaded by debugger plupin IDA PRO 64 bit

I use IDA PRO 64bits on windows 10 64 bit, I want use it remote debug a file 64bit by linux. When I run linux_serverx64 in linux and connect then i error: the file can't be loaded by debugger plupin ...
1
vote
0answers
535 views

Find memory mapped file with x64dbg

I have 64 bit process I want to debug with x64dbg. There is memory mapped file, I found with help of Process Explorer. Properties windows says: Type: Section Description: A memory mapped file or ...
1
vote
1answer
217 views

Is it possible to rebuild an nexe file if I can read at arbitrary untrusted memory addresses?

Ok, I’m in a remote situation where I don’t have access to the remote filesystem but where I can run arbitrary python code (except I can’t fork processes and I don’t have access to ulimit and uname). ...
1
vote
1answer
525 views

How would I find a color's memory address? (Beginner)

I'm an absolute beginner (just started learning about process memory a few hours ago). I'm trying to find the memory address for the color of Color 1 in mspaint using x64dbg. I know it's black, so I'...
1
vote
1answer
99 views

Why does MSVC x64 Compiler load addresses like this?

Normally, in x86, to load a pointer to a null-terminated string you would use MOV EDX, OFFSET ds:mystring In x64, however, I noticed that the compiler does it like this lea rdx, OFFSET FLAT:$...
4
votes
2answers
886 views

Automating pattern-based de-obfuscation of x64 code using IDA plugins

Trying to deobfuscate x64 code. You can skim/skip most of this, since it mainly exists to prove I have tried and exhausted all avenues. Burning Purpose To massively automate the deobfuscation within ...
3
votes
1answer
163 views

How does GPROF hook to the program?

I compiled a simple helloworld and took a look at the disassembly using objdump. At the beginning there is the _init: 0000000000400600 <_init>: 400600: 48 83 ec 08 sub rsp,...
1
vote
2answers
146 views

Figure out whether a function has return value of not?

I am doing binary analysis on x86-64bit ELF binaries. All the binaries are compiled from C language. Basically, for a given function, I would like to figure out whether this function has a return ...
4
votes
3answers
3k views

Determind length of instructions in bytes

Where is it possible to find a list of x86 instructions (and x64 instructions) with the (hex) opcode and the length/size in bytes of the instructions, such as: 0x90 = NOP = 1 byte 0xE9 = JMP = 5 ...
7
votes
2answers
1k views

32-bit binary stack layout on a x64 Linux OS

Stack layout is well documented in many ways. Especially for x86 systems as there were numerous tutorials on how to exploit stack overflow on old 32-bit systems many years ago. So far we can know ...
3
votes
2answers
18k views

IDA cannot launch debugger for 64-bit exe files

I want to launch IDA debugger for one 64-bit exe file and it fails, have tried with more samples, but result always the same. Here is that I do. Launch IDA Pro (64-bit) Select Debugger -> Run -> ...
4
votes
1answer
15k views

What does mov qword ptr ds:[rax+18], r8 mean?

mov qword ptr ds:[rax+18], r8 In the above code, where are we copying the value of r8 register into? I know that ds means data segment which is a segment in memory, but what does exactly [rax+18] ...
2
votes
1answer
3k views

What does lea rdx,qword ptr ss:[rbp+50] mean?

What does the code below exactly mean? lea rdx,qword ptr ss:[rbp+50] I have difficulty in rbp+50. Is rbp the base pointer in the 64 bit CPU architecture? What is the base pointer refering to? how ...
1
vote
1answer
584 views

How do I bypass this comparison?

I am working on a crackme and I'm stuck on a particular comparison that I'd like your help in getting past(one of many). Here's what I know and the relevant code snippet will follow: Requires a 19 ...
1
vote
1answer
812 views

One shellcode works, one doesn't - an issue with exploiting a 64 bit linux binary

I'm working on exploiting a simple 64 bit linux binary. I got control of RIP by exploiting a buffer overflow and using a jmp rsp to get control of the progrm. However, I'm having trouble with the ...
1
vote
1answer
640 views

Code-Cave Assembly Patching Issue in x64_dbg

I'm trying a code-cave approach to this query that was asked about on this forum earlier. I'm using x64_dbg to perform this task. My issue here is that after I have written the extra lines of ...
-1
votes
2answers
2k views

How can I use an x64 debugger to reroute a .NET application's logic?

I'd like to improve my reverse engineering skills, so I made this WPF application (targeting x64, of course): MainWindow.xaml: <Window x:Class="ApplicationTest.MainWindow" xmlns="http://...
5
votes
2answers
249 views

Returning a C function to its grandfather

This is a homework assignment, so I'd appreciate it if I would get a hint only, not a full answer. I wrote this program which is supposed to print the following: Executing function_a Executing ...
2
votes
1answer
6k views

64-bit integers on 32-bit machines

Let's say I create a program in C like this and compile it on a regular 64-bit desktop machine: #include <stdint.h> int main(void) { uint64_t a = 0x12345679abcdefULL; uint64_t b = ...
3
votes
2answers
887 views

Purpose of NOP immediately after CALL instruction

There are a lot of ... code ... call sub_... nop ... code ... patterns in an executable dump I am working on. They appear in the middle of subroutines and I believe don't serve alignment purposes. I ...
3
votes
2answers
303 views

How to find location of environment variables in 64 bit binaries at runtime?

In the main function, program authors can choose to receive the char * array as a parameter to main that points to the environment variables int main(int argc, char **argv, char **envp) { ... } The ...
1
vote
1answer
2k views

Does PeID signatures work with 64-Bit Portable Executable (EXE) files?

Can the signatures from PeID be used on 64-Bit Portable Executable (EXE) files? PeID does not support 64-Bit files but I can use the signatures in another application with 64-Bit support. My main ...
3
votes
2answers
709 views

x86_64 Calling convention

I am slightly confused by some x86_64 linux code here (generated by llvm): # BB#0: # %entry push RBP .Ltmp21: .cfi_def_cfa_offset 16 .Ltmp22: ....
5
votes
3answers
2k views

IDA Pro Renaming Imports

This PE file destroys its import address table. However, all the function addresses are in this _rdata segment here: Any straight forward way to rename these functions?
7
votes
1answer
4k views

Problem while debugging with gdbserver in IDA Pro

I'm new to debugging with IDA Pro and I ran into the problem that my breakpoint is not hit while attempting to debug with gdbserver. The program is written by myself and it is simple to debug with gdb....
8
votes
3answers
700 views

What methodology can be used to change code flow atomically during program execution?

I have been reading a lot about the different techniques for Windows API hooking (a technique I'm particularly fascinated by and fond of), and it seems a major problem in implementing a realiable ...
7
votes
1answer
692 views

Why are values passed through useless copies?

So, say that I have the following code, which gives three examples of what I believe to be unnecessary copies of values. mov QWORD PTR [rbp-0x18],rdi mov rdx,QWORD PTR [rbp-0x18] lea rax,[...
2
votes
1answer
2k views

gdb setting fs register on Linux

I'm debugging an ELF 64-bit binary using gdb and I notice that the %fs register is set to 0x63. For some testing that I'd like to perform I'd like to set the %fs register to 0x00. I tried doing a set ...
2
votes
2answers
2k views

Windbg x64 setting breakpoint

My issue is all about setting the breakpoint on x64 Windbg. For x86 to combine IDA and Windbg analysis nothing is required. Just copy and paste the IDA address value and it works just fine. For ...
3
votes
1answer
503 views

What is the proper way to deal with an x86/64 instruction containing multiple prefixes from the same group?

Olly, specifically, will only accept the last prefix it finds if there are more than one from the same group. For example lock rep add dword ptr[eax],eax ; f0 f3 01 00 becomes ??? ...
23
votes
1answer
51k views

Reversing ELF 64-bit LSB executable, x86-64 ,gdb

I'm a newbie and just got into RE. I got a ELF 64-bit LSB executable, x86-64. I'm trying to reverse it. First I tried to set a break point on line 1 using gdb ./filename break 1 The gdb says No ...
6
votes
1answer
3k views

ROP exploitation in x86_64 linux

I am working on return oriented programming exploitation on a x86_64 Linux. However, my research leads to impossibility of ROP exploitation in 64-bit Linux machine because all of code segments are ...
3
votes
2answers
16k views

64 bit Pseudocode decompiler

I have a 64 bit program im debugging. I found the function i need to learn more about to potentially "fix" the problem (there is no source code available for the program). To speed things up, i ...
4
votes
0answers
425 views

What does this multi mov instruction do? [closed]

I came across the following multi mov instruction: mov eax, 1, 2, 3 What does this instruction do? Where can I find the correct documentation for this instruction?
3
votes
2answers
3k views

What is an effective way to debug a 32 bits application within a 64 bits OS?

Currently I am on an x64-based system and have been doing some reverse engineering for a while. However I'm still a newbie, and the biggest issue I keep running into is the memory layout differences. ...
4
votes
3answers
52k views

How to obtain x86-64 pseudocode in IDA Pro?

Does anyone know about obtaining pseudocode for x86-64 in IDA Pro? I already tried the Hex-Rays plugin to obtain pseudocode, but when I try it, the following error pops up: "only 32bit code is ...
29
votes
2answers
8k views

Why are machine code decompilers less capable than for example those for the CLR and JVM?

Java and .NET decompilers can (usually) produce an almost perfect source code, often very close to the original. Why can't the same be done for the native code? I tried a few but they either don't ...
20
votes
3answers
1k views

What are the qualitative differences in reverse engineering x64/Win64 code versus x32/Win32 code?

Many professional reverse engineers spend their days looking at 32-bit code compiled for Windows, and familiarity breeds proficiency. What are the high-level differences between reverse engineering 64-...