Questions tagged [x86-64]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
1answer
31 views

Displaying Operands as Position Independent in IDA

I'm writing an IDA python script, and i need to be able to detect position independent code. I have an instruction that IDA displays using the operand name 'format' lea rdi, format However, when ...
2
votes
1answer
93 views

How can i check if i am running in ring 0 / ring 3 on x64 CPU

I have read it is possible to check ring level with bit 3 of CS register. Is there another register which really contains ring value (2 bits) Thanks
1
vote
1answer
82 views

Is `movq rax, xmm0` buggy in Radare2?

Why doesn't rax get loaded from xmm0 here? radare2 bug? GitHub issue `movq rax, xmm0` doesn't work in native debugger filed. [0x0003b0e0]> drr role reg value ref ―――――――――――――――――――...
2
votes
3answers
410 views

Elf x86_64 adding function

I'm trying to see if I can append function code in the .text section of an ELF while still maintaining the execution flow of the original ELF. Ideally, I want to call the new function but that's it's ...
1
vote
2answers
56 views

x64 processor module

I just downloaded Ghidra last evening on a Fedora Linux machine with 4 Intel Core i5-7200U CPUs. When querying the "installed processor modules" in "Help" I get a listing of 41 processors. x86 is on ...
2
votes
1answer
232 views

PE32+ executable : .text segment encryption

I am working on PE segment encryption(in C++). I completed the PE32 .text segment encryption. I added stub segment to the PE that will decrypt .text segment at runtime. Used inline assembly in the ...
1
vote
0answers
3k views

Receiving “Got EOF while reading in interactive” after properly executing system(“/bin/sh”) using pwntools

I've followed some tutorials on writing a pwntools-based exploit for the bitterman ELF binary, used in a CTF competition. However, all my attempts fail with the message below, i.e. Got EOF while ...
0
votes
0answers
46 views

What does the file pointer of fgets actually point to in linux?

So i was reversing a 64 bit ELF binary, and it did a call to fgets, and based on documentation the third argument of fgets is a file pointer. now the weird part was that the third argument in this ...
0
votes
0answers
37 views

Extra Allocated Space in Stack and Wrong placement of Local Variable

I was recently reading reverse engineering for beginners by Yurichev where I happened to come across an example x64 MSVC and x64 GCC code. In this I'm unable to understand why there is a shadow space ...
4
votes
3answers
584 views

What is the difference between MOV and LEA in example?

Looking at an assembly code snippet I see: lea rax, [rbp-0x50] Which tells me that the rax register now points to whatever value is in rbp-hex(50). Question. Would I achieve the same result doing ...
2
votes
1answer
146 views

Help understanding MOVSXD

I've tried reading the documentation but the functionality of this instruction is still cloudy to me. For an example, I would like to know what is stored in RDX after these instructions: mov edx, ...
1
vote
0answers
36 views

Memory modified at jump far

Observing a trace of Wow64 switching on Windows 7, the following situation makes me confused ... 0x77491dbe 64 ff 15 c0 00 00 00 call fs:[0xc0] ; syswow64\ntdll.dll 0x74632320 ea 1e 27 63 ...
0
votes
0answers
67 views

Why does this execve shellcode work with this argv?

I wrote the following program in fasm, and am using Evan's Debugger on Ubuntu to debug it: format ELF64 executable 3 segment readable executable entry $ mov rbp, rsp sub rsp, 32 mov rax, 'this a t' ...
1
vote
1answer
36 views

How to determine what code created a string, in a live debugger session?

I'm using IDA 7 to debug a running application that must be a child of another application, which means I can't start it from IDA (using Debugger->Run). Instead, I have to run the application normally,...
14
votes
1answer
26k views

What does mov qword ptr ds:[rax+18], r8 mean?

mov qword ptr ds:[rax+18], r8 In the above code, where are we copying the value of r8 register into? I know that ds means data segment which is a segment in memory, but what does exactly [rax+18] ...
2
votes
1answer
86 views

Finding “func main” in a stripped binary written in GO

I'm reversing a binary that was apart of a CTF I was involved in about a month ago. It was too large of a binary to do during the challenge so I am doing it now. I am having trouble finding the main ...
2
votes
1answer
624 views

Windbg: How to directly view GS:[0x60]

Win10x64: In Windbg, how may I view a pointer to the PEB by directly using GS:[0x60] (and not by Windbg extensions)? To test, I assembled a program via masm64 that throws an interrupt, clears r8 then ...
1
vote
1answer
57 views

Isolate the call to a function

Is it possible to call a function of a binary and obtain its result (without calling other functions), to isolate; are there any tools to do this?
1
vote
1answer
147 views

cannot find a string in x64dbg even when using search all strings

I am trying to debug a program for testing but for some reason i can NOT find any strings related to registeration like Registered, Unregistered,Blocked in x64dbg, i can see all these strings in the ...
1
vote
0answers
26 views

Go back to the original entry point after executing the instructions in the newly added segment- PE32+, C++

I am learning PE32+ (64 bit) files. I have added a new section to the PE32+ file and made the new section as the entry point. Some simple instructions are added in the new segment. Now I want to go to ...
0
votes
1answer
93 views

How to determine when/where pointers in .ctors get mapped?

So I am learning about ELF, and am looking through a binary in Ghidra as I do. I've made sense of the ELF header, and now I am looking through the program header table. My binary has a bunch of ...
1
vote
0answers
87 views

How to interpret binary instruction using the intel manual

OK. So I am really trying to figure out how to use the "Intel 64 and IA-32 Architectures Software Developer's Manual" for myself, since it seems like the authoritative source for x86(_64) machine code....
0
votes
0answers
20 views

CPU integrated PCI device functions

I'm trying to reverse an Xeon based hardware bios. During the early initialization in the UEFI SEC phase, I stepped into some CPU embedded PCI devices initialization. After few hours researches, I've ...
1
vote
1answer
183 views

Why address 7FFE0308 always gets compared in 64bit applications before making a syscall in Ntdll?

So there was a question asked before about this : What are the difference syscall and int 0x2E instructions? and it has two answer, one says that is just a way to check if we are in a 32 bit or 64 ...
2
votes
1answer
82 views

Undocumented Model-Specific Register on Broadwell Microarchitecture

I'm trying to reverse the BIOS of a machine to learn something. The bigger problem I'm facing is that during early initialization, the code is making heavy usage of MSRs, and most of the time, I found ...
0
votes
1answer
139 views

What do square brackets do in IDA's pseudocode representation?

I've been a bit stumped recently on my decomp work. I've not dealt with C in depth nor have I dealt with IDA's pseudocode system very much at all. I understand asm, but because of how IDA merges ...
2
votes
1answer
108 views

How to hide a process from all the methods of getting the list of processes?

So it seems that there are a lot of ways of getting the process list, although I'm not sure whether in the low level do they acquire them from same place or not so these are the ways i know : ...
1
vote
3answers
672 views

How to find the starting address of text section of a DLL inside a process? (64 bit)

There was a question about this a year ago, but the answer doesn't explain how to do it in C/C++: How to find start of .text section? I'm not talking about module start address, which we can get ...
0
votes
0answers
64 views

What's the point of changing the CS register and can any process do this?

So i was reading this article : http://waleedassar.blogspot.com/2012/07/wow64-user-mode-system-calls-hooking.html which explains the wow64, the part that we do a far jmp and change the CS register ...
1
vote
1answer
75 views

Understanding operand forms

9(%rax, %rdx): What happens here? Is 9 the offset? and do you add the two registers together? I'm reading Randal E. Bryant and David R. O'Hallaran's "Computer Systems - A programmer's Persepctive" ...
1
vote
1answer
798 views

Code-Cave Assembly Patching Issue in x64_dbg

I'm trying a code-cave approach to this query that was asked about on this forum earlier. I'm using x64_dbg to perform this task. My issue here is that after I have written the extra lines of ...
1
vote
2answers
201 views

Does the loader fill the IAT table of an .exe in load time by checking the corresponding export tables or during run time?

I came upon this question : Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking? and it got me wondering, lets say for some reason some function was not in the IAT of our ...
1
vote
1answer
90 views

What is the ending bytes in the MOV instruction in 32 bit applications in windows? (B8 mov)

So i just compared NTterminateProcess between 32 and 64 bit version of a program, and the mov instruction which moves the syscall into eax is almost the same, both 5 byte, (both the B8 mov) but the ...
1
vote
2answers
398 views

Printing bytecode in bytes given a string of assembly for Radare to disassemble?

Megabeets determined in this answer that depending on asm.bits Radare may show either lea edx, [0x80490c8] (asm.bits=32) lea edx, [rip + 0x80490c8] (asm.bits=64) If I want to see what the ...
0
votes
0answers
60 views

Bufferoverflow Stack

I want to do a buffer overflow exploit in the stack. For this i read in data via the "gets"-function. void ExploitMe() { char buffer[256]; gets(buffer); } I compile this file with gcc test.c -...
1
vote
1answer
544 views

How to pass param to execve to execute cat a file in x64 Asm? [closed]

I want execve("/bin/cat",["/bin/cat","/test/file"],NULL). Here is my asm xor %rdx, %rdx push %rdx sub $0x16, %rsp movb $0x2f, 7(%rsp) movl $0x2f6e6962, 8(%rsp) movl $0x746163, 12(%rsp) leaq 7(%rsp)...
1
vote
1answer
551 views

Changing entry-point of and ELF file

I'm trying to conduct a little experiment which basically consists of changing the EP of an ELF file and executing an exit(9) syscall, without returning to the OEP. As shown in the image everything ...
0
votes
0answers
128 views

R13 off by 2 bytes. Any help?

in this challenge i have to overwrite RIP register to point to the function "print_flags" which calls "getenv" to get the "FLAGS" variable. I have overwritten RIP register with the address of "...
2
votes
3answers
259 views

Is the main function's name in the symbol table of C & C++ programs always 'main'? if not, how to find the name?

So I'm trying to write a reversing tool that parses symbol table to find the main function's address right now all the binaries I'm checking the name of main function is still main in symbol table ...
2
votes
5answers
8k views

Run PE File - (Executable) From Memory

Would be grateful for your suggestion.Trying to run a 32/64bit on (Windows 10- 64 bit /Visual studio) program which tries to run an executable from memory.This is for my learning purpose. #include &...
1
vote
1answer
445 views

why saved rip changed by push?

I am doing a reverse homework. see the following pictures: as can be seen from this picture, before call push touch3, "saved rip" is at 0x5561dca8, which is equal to the current rsp(0x5561dca8). ...
1
vote
1answer
71 views

Unknown parameters in custom signal handler on Linux

0x0000000008001946: mov 0xa8(%rdx),%rax 0x000000000800194d: lea 0x28(%rdx),%rsi 0x0000000008001951: lea 0x2(%rax),%rdi 0x0000000008001955: add $0xe,%rax 0x0000000008001959: ...
0
votes
1answer
176 views

How do I go about overriding a function internally defined in a binary on Linux?

To be specific, I cannot recompile this binary, nor do I have access to the sourcecode. The functions are not defined within a shared library. So, how can I go about changing a function, or ...
0
votes
1answer
133 views

Calculate LEA operand

I have those opcodes on 64 bits: 48 8D 35 45 CE FF FF >>> lea rsi, [rip - 0x31bb]. How can I get the 0x31bb value from those opcodes and how can I know if I have a + sign or a - sign ...
0
votes
1answer
170 views

How to locate an specific data structure in an executable?

I need to locate an specific "struct" variable in the data section from an assembly. This structure is used for an specific System Function (Windows) "SetCommState()". I'm wondering how to locate the ...
2
votes
1answer
211 views

Why do I get e8 00 00 00 00 for all libc function calls?

I just started learning reverse engineering. The near call instruction (e8) is very confusing to me. It took me a while to figure out how address calculation works for local functions. Now I'm ...
3
votes
1answer
371 views

IDA 7.0 - combine sequence of assembly instructions to a macro

I'm solving this CTF with IDA Pro 7.0. At some point there is an offset calculation by index, it simply multiply an index by 48 and write/read some data to it. The main problems are: the ...
3
votes
1answer
631 views

XCHG RAX, RAX: 0x09, what does this code do and how does it work?

Given the following short assembly snippet: shr rax, 3 adc rax, 0 I worked this out a bit: We know SHR sets the CF with the last bit shifted. We know ADC dest, 0 is just adding the CF. So ...
0
votes
1answer
159 views

XCHG RAX, RAX: 0x03, what does this code do and how does it work?

"XCHG RAX, RAX" is a kind of riddle book that provides assembly code for you to reverse and undercover the meaning. Some of the examples calculate the Fibonacci sequence others bit-twiddle to toggle ...
5
votes
2answers
3k views

How many registers does an x86_64 CPU actually have?

I am currently learning reverse engineering and am studying the flags register. I had in my mind that rflags was just another name for one of the 16 general purpose registers, for example rax or rbx. ...