Questions tagged [x86-64]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
7
votes
1answer
718 views

Why are values passed through useless copies?

So, say that I have the following code, which gives three examples of what I believe to be unnecessary copies of values. mov QWORD PTR [rbp-0x18],rdi mov rdx,QWORD PTR [rbp-0x18] lea rax,[...
2
votes
1answer
2k views

gdb setting fs register on Linux

I'm debugging an ELF 64-bit binary using gdb and I notice that the %fs register is set to 0x63. For some testing that I'd like to perform I'd like to set the %fs register to 0x00. I tried doing a set ...
2
votes
2answers
2k views

Windbg x64 setting breakpoint

My issue is all about setting the breakpoint on x64 Windbg. For x86 to combine IDA and Windbg analysis nothing is required. Just copy and paste the IDA address value and it works just fine. For ...
3
votes
1answer
531 views

What is the proper way to deal with an x86/64 instruction containing multiple prefixes from the same group?

Olly, specifically, will only accept the last prefix it finds if there are more than one from the same group. For example lock rep add dword ptr[eax],eax ; f0 f3 01 00 becomes ??? ...
6
votes
1answer
3k views

ROP exploitation in x86_64 linux

I am working on return oriented programming exploitation on a x86_64 Linux. However, my research leads to impossibility of ROP exploitation in 64-bit Linux machine because all of code segments are ...
4
votes
0answers
430 views

What does this multi mov instruction do? [closed]

I came across the following multi mov instruction: mov eax, 1, 2, 3 What does this instruction do? Where can I find the correct documentation for this instruction?
28
votes
2answers
8k views

Why are machine code decompilers less capable than for example those for the CLR and JVM?

Java and .NET decompilers can (usually) produce an almost perfect source code, often very close to the original. Why can't the same be done for the native code? I tried a few but they either don't ...
3
votes
2answers
4k views

What is an effective way to debug a 32 bits application within a 64 bits OS?

Currently I am on an x64-based system and have been doing some reverse engineering for a while. However I'm still a newbie, and the biggest issue I keep running into is the memory layout differences. ...
19
votes
3answers
1k views

What are the qualitative differences in reverse engineering x64/Win64 code versus x32/Win32 code?

Many professional reverse engineers spend their days looking at 32-bit code compiled for Windows, and familiarity breeds proficiency. What are the high-level differences between reverse engineering 64-...