Questions tagged [x86-64]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
1answer
130 views

Why does MSVC x64 Compiler load addresses like this?

Normally, in x86, to load a pointer to a null-terminated string you would use MOV EDX, OFFSET ds:mystring In x64, however, I noticed that the compiler does it like this lea rdx, OFFSET FLAT:$...
4
votes
2answers
1k views

Automating pattern-based de-obfuscation of x64 code using IDA plugins

Trying to deobfuscate x64 code. You can skim/skip most of this, since it mainly exists to prove I have tried and exhausted all avenues. Burning Purpose To massively automate the deobfuscation within ...
3
votes
1answer
218 views

How does GPROF hook to the program?

I compiled a simple helloworld and took a look at the disassembly using objdump. At the beginning there is the _init: 0000000000400600 <_init>: 400600: 48 83 ec 08 sub rsp,...
1
vote
2answers
179 views

Figure out whether a function has return value of not?

I am doing binary analysis on x86-64bit ELF binaries. All the binaries are compiled from C language. Basically, for a given function, I would like to figure out whether this function has a return ...
3
votes
3answers
5k views

Determind length of instructions in bytes

Where is it possible to find a list of x86 instructions (and x64 instructions) with the (hex) opcode and the length/size in bytes of the instructions, such as: 0x90 = NOP = 1 byte 0xE9 = JMP = 5 ...
7
votes
2answers
2k views

32-bit binary stack layout on a x64 Linux OS

Stack layout is well documented in many ways. Especially for x86 systems as there were numerous tutorials on how to exploit stack overflow on old 32-bit systems many years ago. So far we can know ...
3
votes
2answers
23k views

IDA cannot launch debugger for 64-bit exe files

I want to launch IDA debugger for one 64-bit exe file and it fails, have tried with more samples, but result always the same. Here is that I do. Launch IDA Pro (64-bit) Select Debugger -> Run -> ...
20
votes
1answer
31k views

What does mov qword ptr ds:[rax+18], r8 mean?

mov qword ptr ds:[rax+18], r8 In the above code, where are we copying the value of r8 register into? I know that ds means data segment which is a segment in memory, but what does exactly [rax+18] ...
2
votes
1answer
5k views

What does lea rdx,qword ptr ss:[rbp+50] mean?

What does the code below exactly mean? lea rdx,qword ptr ss:[rbp+50] I have difficulty in rbp+50. Is rbp the base pointer in the 64 bit CPU architecture? What is the base pointer refering to? how ...
1
vote
1answer
704 views

How do I bypass this comparison?

I am working on a crackme and I'm stuck on a particular comparison that I'd like your help in getting past(one of many). Here's what I know and the relevant code snippet will follow: Requires a 19 ...
1
vote
1answer
924 views

One shellcode works, one doesn't - an issue with exploiting a 64 bit linux binary

I'm working on exploiting a simple 64 bit linux binary. I got control of RIP by exploiting a buffer overflow and using a jmp rsp to get control of the progrm. However, I'm having trouble with the ...
1
vote
1answer
886 views

Code-Cave Assembly Patching Issue in x64_dbg

I'm trying a code-cave approach to this query that was asked about on this forum earlier. I'm using x64_dbg to perform this task. My issue here is that after I have written the extra lines of ...
0
votes
2answers
3k views

How can I use an x64 debugger to reroute a .NET application's logic?

I'd like to improve my reverse engineering skills, so I made this WPF application (targeting x64, of course): MainWindow.xaml: <Window x:Class="ApplicationTest.MainWindow" xmlns="http://...
5
votes
2answers
264 views

Returning a C function to its grandfather

This is a homework assignment, so I'd appreciate it if I would get a hint only, not a full answer. I wrote this program which is supposed to print the following: Executing function_a Executing ...
3
votes
1answer
8k views

64-bit integers on 32-bit machines

Let's say I create a program in C like this and compile it on a regular 64-bit desktop machine: #include <stdint.h> int main(void) { uint64_t a = 0x12345679abcdefULL; uint64_t b = ...
4
votes
2answers
1k views

Purpose of NOP immediately after CALL instruction

There are a lot of ... code ... call sub_... nop ... code ... patterns in an executable dump I am working on. They appear in the middle of subroutines and I believe don't serve alignment purposes. I ...
3
votes
2answers
400 views

How to find location of environment variables in 64 bit binaries at runtime?

In the main function, program authors can choose to receive the char * array as a parameter to main that points to the environment variables int main(int argc, char **argv, char **envp) { ... } The ...
3
votes
1answer
2k views

Does PeID signatures work with 64-Bit Portable Executable (EXE) files?

Can the signatures from PeID be used on 64-Bit Portable Executable (EXE) files? PeID does not support 64-Bit files but I can use the signatures in another application with 64-Bit support. My main ...
3
votes
2answers
833 views

x86_64 Calling convention

I am slightly confused by some x86_64 linux code here (generated by llvm): # BB#0: # %entry push RBP .Ltmp21: .cfi_def_cfa_offset 16 .Ltmp22: ....
5
votes
3answers
2k views

IDA Pro Renaming Imports

This PE file destroys its import address table. However, all the function addresses are in this _rdata segment here: Any straight forward way to rename these functions?
7
votes
1answer
5k views

Problem while debugging with gdbserver in IDA Pro

I'm new to debugging with IDA Pro and I ran into the problem that my breakpoint is not hit while attempting to debug with gdbserver. The program is written by myself and it is simple to debug with gdb....
8
votes
3answers
836 views

What methodology can be used to change code flow atomically during program execution?

I have been reading a lot about the different techniques for Windows API hooking (a technique I'm particularly fascinated by and fond of), and it seems a major problem in implementing a realiable ...
8
votes
1answer
789 views

Why are values passed through useless copies?

So, say that I have the following code, which gives three examples of what I believe to be unnecessary copies of values. mov QWORD PTR [rbp-0x18],rdi mov rdx,QWORD PTR [rbp-0x18] lea rax,[...
2
votes
1answer
2k views

gdb setting fs register on Linux

I'm debugging an ELF 64-bit binary using gdb and I notice that the %fs register is set to 0x63. For some testing that I'd like to perform I'd like to set the %fs register to 0x00. I tried doing a set ...
2
votes
2answers
2k views

Windbg x64 setting breakpoint

My issue is all about setting the breakpoint on x64 Windbg. For x86 to combine IDA and Windbg analysis nothing is required. Just copy and paste the IDA address value and it works just fine. For ...
3
votes
1answer
603 views

What is the proper way to deal with an x86/64 instruction containing multiple prefixes from the same group?

Olly, specifically, will only accept the last prefix it finds if there are more than one from the same group. For example lock rep add dword ptr[eax],eax ; f0 f3 01 00 becomes ??? ...
26
votes
1answer
76k views

Reversing ELF 64-bit LSB executable, x86-64 ,gdb

I'm a newbie and just got into RE. I got a ELF 64-bit LSB executable, x86-64. I'm trying to reverse it. First I tried to set a break point on line 1 using gdb ./filename break 1 The gdb says No ...
6
votes
1answer
3k views

ROP exploitation in x86_64 linux

I am working on return oriented programming exploitation on a x86_64 Linux. However, my research leads to impossibility of ROP exploitation in 64-bit Linux machine because all of code segments are ...
3
votes
2answers
18k views

64 bit Pseudocode decompiler

I have a 64 bit program im debugging. I found the function i need to learn more about to potentially "fix" the problem (there is no source code available for the program). To speed things up, i ...
4
votes
0answers
440 views

What does this multi mov instruction do? [closed]

I came across the following multi mov instruction: mov eax, 1, 2, 3 What does this instruction do? Where can I find the correct documentation for this instruction?
3
votes
2answers
4k views

What is an effective way to debug a 32 bits application within a 64 bits OS?

Currently I am on an x64-based system and have been doing some reverse engineering for a while. However I'm still a newbie, and the biggest issue I keep running into is the memory layout differences. ...
7
votes
3answers
79k views

How to obtain x86-64 pseudocode in IDA Pro?

Does anyone know about obtaining pseudocode for x86-64 in IDA Pro? I already tried the Hex-Rays plugin to obtain pseudocode, but when I try it, the following error pops up: "only 32bit code is ...
29
votes
2answers
9k views

Why are machine code decompilers less capable than for example those for the CLR and JVM?

Java and .NET decompilers can (usually) produce an almost perfect source code, often very close to the original. Why can't the same be done for the native code? I tried a few but they either don't ...
20
votes
3answers
1k views

What are the qualitative differences in reverse engineering x64/Win64 code versus x32/Win32 code?

Many professional reverse engineers spend their days looking at 32-bit code compiled for Windows, and familiarity breeds proficiency. What are the high-level differences between reverse engineering 64-...

1 2
3