Questions tagged [x86-64]
The x86-64 tag has no usage guidance.
32
questions with no upvoted or accepted answers
4
votes
0
answers
2k
views
IDA Free vs IDA Home (to have Lumina)
I use actually IDA Free and I want to know what do you think of IDA Home (particulary for the Lumina function).
I don't found in Google a tool to know for exemple the functions recognized by the ...
3
votes
0
answers
311
views
How would I crack a software that has Xor encryption
So, before you shout at me to go on google I would just like to say I am new to reverse Engineering. Like I have been doing it for a hour. So, I was doing a bunch of crackmes.one using the search all ...
- 31
2
votes
0
answers
74
views
How to deal with msvc runtime integrity?
After any type of patching image code the app cannot properly initialize the window specifically on the user32!CreateWindowExA call. PDB file shows it's vc2010\x64\Release.
I'm actually newbie in ...
2
votes
0
answers
227
views
Convert instructions to op code bytes in python script for IDA Pro
I need to convert into op code bytes the instructions that I have disassembled but I can't find a function that lets me do it, I've tried idc.get_bytes but it doesn't seem to work.
This is my python ...
- 121
2
votes
0
answers
84
views
jump to invalid address when emulating
I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect ...
- 41
2
votes
0
answers
97
views
x64 Windows: Why is ExAllocatePool stepping on the caller's stack?
I am playing around with windbg on a 64-bit machine and noticed something interesting:
nt!ExAllocatePool:
...
sub rsp, 0xd0
...
mov qword ptr [rsp+0xf8], rbx
Windows only allocated ...
- 21
2
votes
0
answers
358
views
Why PTRACE_POKEDATA returns I/O error?
I learning usage of ptrace.
I tried following simple example but raises a I/O Error.
I would like to overwrite "Hello, world" (printing string) from other process.
A target program prints &...
- 141
2
votes
0
answers
2k
views
Error: the file can't be loaded by debugger plupin IDA PRO 64 bit
I use IDA PRO 64bits on windows 10 64 bit, I want use it remote debug a file 64bit by linux. When I run linux_serverx64 in linux and connect then i error: the file can't be loaded by debugger plupin ...
- 323
1
vote
0
answers
38
views
Potential vulnerabilities in a binary run as root
I am given a vulnerable 64-bit stripped application, it conducts basic password strength checks on linux(/etc/shadow). The application receives workers(which creates worker process for performing the ...
- 111
1
vote
0
answers
152
views
Analyse a statically linked binary and extract syscall from it using angr
How to extract all syscalls from analysing a statically linked binary.
I have a script written using angr(Latest - v9.2.78) but when I start my script I get few syscalls and the analysis is like hung ...
- 11
1
vote
0
answers
135
views
Reversing Assembly to C
I've read the open letter addressing students asking for help with their homework and I agree with it, therefore I will try to be less of a pain in the *** ;)
I need to reverse the x86-64 (AT&T) ...
- 11
1
vote
0
answers
92
views
Program Analysis on a Wargame Binary
I've recently took it upon myself to research more about reverse engineering, I'm currently testing my intermediate skills on various CTF hosting sites. Interestingly enough I have come across a ...
- 11
1
vote
0
answers
96
views
Implementing syscalls under Miasm
I'd like to use Miasm's DSE on a binary. This binary makes use of 2 syscalls: exit and ptrace. Miasm provides an implementation of some syscalls, but unfortunately, not of those two.
So I tried to ...
- 11
1
vote
0
answers
85
views
Philosophical and procedural question - Process for using x64 inline assembly in recovering source code
I am assuming this should place be appropriate for what I want to ask. I want to ask more of a philosophical and procedural question because I don't want to try things that have been tried and spend ...
- 783
1
vote
0
answers
169
views
silvio packer for shared libray leads to error: "ELF load command address/offset not properly aligned"
I'm trying to implement a packer based on silvio infection. The packer works fine for ET_EXEC. However, it failed with "ELF load command address/offset not properly aligned" error for the ...
- 81
1
vote
0
answers
190
views
Trying to call the Exit Shellcode in a c program
#include<stdio.h>
#include<stdint.h>
char shellcode[] = "\xb8\x3c\x00\x00\x00"
"\xbf\x14\x00\x00\x00"
"\x0f\x05";
int ...
- 11
1
vote
0
answers
108
views
Instruction-level hooking library for win32?
I am looking for instruction-level hooking library for win32 x86/x64.
I want to write hook insertion and hook implementation code in C/C++ (compiled into dll).
(Therefore instrumentation tools are ...
- 111
1
vote
0
answers
130
views
Memory modified at jump far
Observing a trace of Wow64 switching on Windows 7, the following situation makes me confused
...
0x77491dbe 64 ff 15 c0 00 00 00 call fs:[0xc0] ; syswow64\ntdll.dll
0x74632320 ea 1e 27 63 ...
- 1,410
1
vote
0
answers
91
views
Go back to the original entry point after executing the instructions in the newly added segment- PE32+, C++
I am learning PE32+ (64 bit) files. I have added a new section to the PE32+ file and made the new section as the entry point. Some simple instructions are added in the new segment. Now I want to go to ...
- 49
1
vote
0
answers
312
views
How to interpret binary instruction using the intel manual
OK. So I am really trying to figure out how to use the "Intel 64 and IA-32 Architectures Software Developer's Manual" for myself, since it seems like the authoritative source for x86(_64) machine code....
- 129
1
vote
0
answers
1k
views
Find memory mapped file with x64dbg
I have 64 bit process I want to debug with x64dbg. There is memory mapped file, I found with help of Process Explorer. Properties windows says:
Type: Section
Description: A memory mapped file or ...
- 111
1
vote
1
answer
443
views
How to debug a crash in wow64.dll in 32bit process
I have a 32bit application and a few wrapper tools that I use one after another to inject code, hook system dll functions (using the patch-first-bytes-of-the-function-with-jump approach). Also I have ...
- 153
0
votes
0
answers
45
views
Improving the output of pseudocode C++ code from IDA Pro
I have some specific questions and some general ones about reverse-engineering a dynamic shared library via IDA Pro 8.3:
If I know the compiler used and compiler flags used (via readelf --debug-dump),...
- 143
0
votes
0
answers
37
views
Dynamic analysis of cmd dependent software
There is a PE file, which can't run by itself, and can only be called from cmd.exe, it doesn't create independent processes, and can be launched independently only with .bat scripts, which without &...
0
votes
1
answer
178
views
Debugging of any x86(_64) executable producing strange results under Parallels + Windows on Arm
Recently, I have been experimenting with using an M1 (Arm64) Mac full-time for RE work, including Windows on Arm under Parallels with x86(_64) binaries. From several online sources discussing this use ...
0
votes
0
answers
107
views
What kind of code creates this function call pattern?
While using WinDbg: u/uf to disassemble functions in ntoskrnl.exe there are functions that are used in system calls and exception handling that have these weird function call patterns and I can't ...
- 101
0
votes
0
answers
133
views
Is it possible to extract the header files used by a Mach-O 64-bit SDK Binary?
I have a Mach-O 64 bit SDK that I've opened up with JEB (community edition) and I'd like to know if it's even possible to see things like the header files (.h) used/referenced by the binary.
The ...
- 101
0
votes
0
answers
151
views
objdump says "64-bit address is disabled"
I've run into an issue with the MinGW build of objdump on Windows. Consider this very simple input file:
48 bf 88 77 66 55 44 33 22 11
I want to disassemble this as Intel x86-64 raw machine code. I ...
- 101
0
votes
0
answers
150
views
Change value of memory in a debugger?
So I got this app loaded in x64, there is a function, let's say
"HeatGainedPerShot", which is basically the value which an object gains everytime it fires,
Such a value would normally exist ...
0
votes
0
answers
69
views
Windows pintool mismatch between call/ret instructions
So i've been trying to write a pintool that monitors call/ret instructions but i've noticed that threre was a significant inconsistency between the two. For example ret instructions without previous ...
- 53
0
votes
0
answers
125
views
Bufferoverflow Stack
I want to do a buffer overflow exploit in the stack. For this i read in data via the "gets"-function.
void ExploitMe()
{
char buffer[256];
gets(buffer);
}
I compile this file with
gcc test.c -...
- 49
0
votes
0
answers
263
views
R13 off by 2 bytes. Any help?
in this challenge i have to overwrite RIP register to point to the function "print_flags" which calls "getenv" to get the "FLAGS" variable.
I have overwritten RIP register with the address of "...
