Questions tagged [x86-64]
The x86-64 tag has no usage guidance.
172
questions
3
votes
1
answer
193
views
What tricks can I use to manually decompile a set of instructions
ELF Binary takes user input and stores it in loc.buffer address 0x4020e8. Further, the registers going into the instruction set are
eax
ebx
ecx
edx
esi
length of user input (min length is 3)
0
...
- 141
3
votes
1
answer
740
views
IDA 7.0 - combine sequence of assembly instructions to a macro
I'm solving this CTF with IDA Pro 7.0.
At some point there is an offset calculation by index, it simply multiply an index by 48 and write/read some data to it.
The main problems are:
the ...
- 31
3
votes
1
answer
478
views
Unable to use CreateRemoteThread in target process
I'm trying to get a debugger attached to a malware, but it seems to pick up whenever a new remote thread is created (which makes it so I can't use Scyllahide).
Even if I suspend all threads, it does ...
- 33
3
votes
2
answers
632
views
How to find location of environment variables in 64 bit binaries at runtime?
In the main function, program authors can choose to receive the char * array as a parameter to main that points to the environment variables
int main(int argc, char **argv, char **envp) {
...
}
The ...
- 163
3
votes
2
answers
983
views
x86_64 Calling convention
I am slightly confused by some x86_64 linux code here (generated by llvm):
# BB#0: # %entry
push RBP
.Ltmp21:
.cfi_def_cfa_offset 16
.Ltmp22:
....
- 71
3
votes
0
answers
311
views
How would I crack a software that has Xor encryption
So, before you shout at me to go on google I would just like to say I am new to reverse Engineering. Like I have been doing it for a hour. So, I was doing a bunch of crackmes.one using the search all ...
- 31
3
votes
1
answer
121
views
What is the outcome of mov on non bracket memory locations?
I am having problems distinguishing whether the address is loaded or the content from the address. Please help me clarify.
1. mov [rsp+78h+arg_0], rsi
2. mov rsi, cs:qword_1F39B60
3. mov [...
- 35
3
votes
2
answers
877
views
PE32+ executable : .text segment encryption
I am working on PE segment encryption(in C++). I completed the PE32 .text segment encryption. I added stub segment to the PE that will decrypt .text segment at runtime. Used inline assembly in the ...
- 49
2
votes
2
answers
2k
views
.00cfg section in the PE file
What's that .00cfg section that is being added by Visual Studio 2017
to PE32+ binary files (for x64 builds)? I'm assuming it stands for
"Control Flow Guard" section. It is relatively small and mostly ...
- 1,659
2
votes
1
answer
2k
views
Converting Assembly x64 code to C
I have the following code:
0000000000400526 <main>:
400526: 55 push rbp
400527: 48 89 e5 mov rbp,rsp
40052a: 48 83 ec 20 sub ...
- 165
2
votes
2
answers
1k
views
Does the loader fill the IAT table of an .exe in load time by checking the corresponding export tables or during run time?
I came upon this question :
Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking?
and it got me wondering, lets say for some reason some function was not in the IAT of our ...
- 99
2
votes
3
answers
970
views
Is the main function's name in the symbol table of C & C++ programs always 'main'? if not, how to find the name?
So I'm trying to write a reversing tool that parses symbol table to find the main function's address
right now all the binaries I'm checking the name of main function is still main in symbol table
...
- 99
2
votes
1
answer
1k
views
x64dbg or alternative: Run to selection while storing all ran opcodes
I'm trying to trace a function, but unfortunately that function is huge and has lots and lots of jumps to other locations, making it almost impossible to trace for humans. I know the entry point and ...
- 123
2
votes
2
answers
3k
views
how to does this instruction work: `mov qword ptr [rbp-0x30], 0x4020c5`
The following is the code snippet (shown partially) I have:
q = strrchr(resolved, '/'); /* given /home/misha/docs.txt, q now pts to the last slash */
if (q != NULL) {
p = q + 1; ...
- 1,807
2
votes
1
answer
199
views
Windows x86 compability on x64 operating system
I know some about wow64 system, in x64 windows version, and i looked up into this wow64* dlls, to see how the actual syscall transition happen, but something i can't find, and this is probably done by ...
2
votes
5
answers
13k
views
Run PE File - (Executable) From Memory
Would be grateful for your suggestion.Trying to run a 32/64bit on (Windows 10- 64 bit /Visual studio) program which tries to run an executable from memory.This is for my learning purpose.
#include &...
- 21
2
votes
1
answer
3k
views
How to get offset of specific function in exe?
Suppose I have self-compiled exe-file (aka portable executable), its source (c/c++) and generated pdb-file. And what if I want to get offset of its function (non-winapi function) in debugger (x64dbg, ...
- 23
2
votes
1
answer
67
views
Correct my understanding on a basic allocation memory
Here is the function
If I understand correctly:
There is a buffer of size 256 bytes created (malloc)
in this buffer, the first 32 bits are set to 0 (because dword designates 32bits size)
the next 32 ...
- 103
2
votes
2
answers
3k
views
Windbg x64 setting breakpoint
My issue is all about setting the breakpoint on x64 Windbg.
For x86 to combine IDA and Windbg analysis nothing is required. Just copy and paste the IDA address value and it works just fine.
For ...
- 23
2
votes
1
answer
174
views
What is 0xCC between each functions?
First, sorry for my bad english.
What I know about 0xCC instruction is a breakpoint instruction.
But, when I see x64 binary, each functions are seperate by multiple 0xCC instructions.
I think x64 uses ...
- 53
2
votes
1
answer
219
views
How are __argc and __wargv globals exported from a 64-bit PE file compiled with Visual Studio?
I need to inject my code into a 64-bit process. I'm wondering, how can I access __argc and __wargv global variables once in the injected process?
Are they always present at a static/preset address?
- 1,659
2
votes
2
answers
2k
views
How do I denote and use JMP /5 in byte code
I'm on the OSX platform working with x86_64. I've worked out how to do near jumps with the E9 byte code directive where my relative addresses have 4 bytes (teamed up with RIP)
Now I have an instance ...
- 93
2
votes
1
answer
888
views
What is a "far call" in an x86 or x86_64 cpu
I do not understand the usefulness of the "far call" instruction in a 86 CPU.
On a 32 bits CPU for example each process has an addressing space of 4Gb (0x00000000 to 0xFFFFFFFF).
There can ...
- 797
2
votes
1
answer
263
views
Garbage Assembly Code Generationat at random offsets
Recently I've been working on a project. The main purpose of the project is to generated statically undetectable PE samples. Where each time one generates a PE sample, each generated sample is going ...
- 395
2
votes
1
answer
60
views
Difference in binary behaviour (execution/under debugger)
I was trying out a simple heap overflow example (http://highaltitudehacks.com/2020/09/05/arm64-reversing-and-exploitation-part-1-arm-instruction-set-heap-overflow/) but replicated the relevant code in ...
- 193
2
votes
1
answer
1k
views
Help understanding MOVSXD
I've tried reading the documentation but the functionality of this instruction is still cloudy to me. For an example, I would like to know what is stored in RDX after these instructions:
mov edx, ...
- 105
2
votes
1
answer
414
views
How to hide a process from all the methods of getting the list of processes?
So it seems that there are a lot of ways of getting the process list, although I'm not sure whether in the low level do they acquire them from same place or not
so these are the ways i know :
...
- 518
2
votes
1
answer
3k
views
Does PeID signatures work with 64-Bit Portable Executable (EXE) files?
Can the signatures from PeID be used on 64-Bit Portable Executable (EXE) files?
PeID does not support 64-Bit files but I can use the signatures in another application with 64-Bit support.
My main ...
- 51
2
votes
1
answer
133
views
Getting "Flow analysis was incomplete, some code may be missing" on WinDbg
I wanted to perform static analysis on the Win32 function CreateFileW, so I loaded kernel32.dll using WinDbg and perform the command uf kernel32!CreateFileW.
But I am seeing the following output ...
- 205
2
votes
1
answer
415
views
Finding "func main" in a stripped binary written in GO
I'm reversing a binary that was apart of a CTF I was involved in about a month ago. It was too large of a binary to do during the challenge so I am doing it now.
I am having trouble finding the main ...
- 105
2
votes
1
answer
3k
views
Windbg: How to directly view GS:[0x60]
Win10x64: In Windbg, how may I view a pointer to the PEB by directly using GS:[0x60] (and not by Windbg extensions)?
To test, I assembled a program via masm64 that throws an interrupt, clears r8 then ...
- 368
2
votes
1
answer
985
views
Writing own custome syscall/int 0x80 on x64 system
Is there a way to write my own syscall/int 0x80 without using them?
So, normally it goes like
setup registers
...
syscall or int 0x80
and I am interested in doing this without syscall/int 0x80
...
- 43
2
votes
0
answers
74
views
How to deal with msvc runtime integrity?
After any type of patching image code the app cannot properly initialize the window specifically on the user32!CreateWindowExA call. PDB file shows it's vc2010\x64\Release.
I'm actually newbie in ...
2
votes
0
answers
227
views
Convert instructions to op code bytes in python script for IDA Pro
I need to convert into op code bytes the instructions that I have disassembled but I can't find a function that lets me do it, I've tried idc.get_bytes but it doesn't seem to work.
This is my python ...
- 121
2
votes
0
answers
84
views
jump to invalid address when emulating
I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect ...
- 41
2
votes
0
answers
97
views
x64 Windows: Why is ExAllocatePool stepping on the caller's stack?
I am playing around with windbg on a 64-bit machine and noticed something interesting:
nt!ExAllocatePool:
...
sub rsp, 0xd0
...
mov qword ptr [rsp+0xf8], rbx
Windows only allocated ...
- 21
2
votes
0
answers
357
views
Why PTRACE_POKEDATA returns I/O error?
I learning usage of ptrace.
I tried following simple example but raises a I/O Error.
I would like to overwrite "Hello, world" (printing string) from other process.
A target program prints &...
- 141
2
votes
0
answers
463
views
Using __kernel_vsyscall on x64 linux machine [closed]
I am trying to use __kernel_vsyscall instead of syscall/int 80 on linux x64.
I have read that it can be done on Intel chips (I have one), but i can't find how can one do it. I have x32 version:
int ...
- 43
2
votes
0
answers
2k
views
Error: the file can't be loaded by debugger plupin IDA PRO 64 bit
I use IDA PRO 64bits on windows 10 64 bit, I want use it remote debug a file 64bit by linux. When I run linux_serverx64 in linux and connect then i error: the file can't be loaded by debugger plupin ...
- 323
1
vote
1
answer
133
views
IDA API: obtain operand size prefix (x64)
I am trying to tell apart the following two instructions:
8D 02 lea eax, [rdx] // auxfix = 0x1810
67 8D 02 lea eax, [edx] // auxfix = 0x810
The only difference is in the insn_t....
- 463
1
vote
1
answer
313
views
Help understanding x64 TEST instruction
I have read that TEST does a bitwise and on the two arguments. I have also read that jz and je are both equivalent, and jump if the zero flag is set. So here's the problem I'm struggling with. ...
- 183
1
vote
2
answers
222
views
x64 processor module
I just downloaded Ghidra last evening on a Fedora Linux machine with 4 Intel Core i5-7200U CPUs.
When querying the "installed processor modules" in "Help" I get a listing of 41 processors.
x86 is on ...
- 21
1
vote
1
answer
106
views
Isolate the call to a function
Is it possible to call a function of a binary and obtain its result (without calling other functions), to isolate; are there any tools to do this?
- 193
1
vote
1
answer
2k
views
How would I find a color's memory address? (Beginner)
I'm an absolute beginner (just started learning about process memory a few hours ago).
I'm trying to find the memory address for the color of Color 1 in mspaint using x64dbg.
I know it's black, so I'...
- 13
1
vote
2
answers
542
views
Figure out whether a function has return value of not?
I am doing binary analysis on x86-64bit ELF binaries. All the binaries are compiled from C language. Basically, for a given function, I would like to figure out whether this function has a return ...
- 2,485
1
vote
1
answer
298
views
does mov DWORD PTR 32[rsp], 5 means mov DWORD PTR [rsp+32], 5?
I am learning about windows x64 calling convention, where the first four arguments are passed to registers and left arguments are passed through the stack. To see it, I checked the assembly of the ...
- 45
1
vote
1
answer
2k
views
why saved rip changed by push？
I am doing a reverse homework. see the following pictures:
as can be seen from this picture, before call push touch3, "saved rip" is at 0x5561dca8, which is equal to the current rsp(0x5561dca8).
...
- 19
1
vote
1
answer
141
views
Unknown parameters in custom signal handler on Linux
0x0000000008001946: mov 0xa8(%rdx),%rax
0x000000000800194d: lea 0x28(%rdx),%rsi
0x0000000008001951: lea 0x2(%rax),%rdi
0x0000000008001955: add $0xe,%rax
0x0000000008001959: ...
1
vote
1
answer
555
views
How to locate an specific data structure in an executable?
I need to locate an specific "struct" variable in the data section from an assembly. This structure is used for an specific System Function (Windows) "SetCommState()". I'm wondering how to locate the ...
- 115
1
vote
1
answer
590
views
Why do I get e8 00 00 00 00 for all libc function calls?
I just started learning reverse engineering. The near call instruction (e8) is very confusing to me. It took me a while to figure out how address calculation works for local functions.
Now I'm ...
- 111