Questions tagged [x86-64]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2
votes
1answer
301 views

Why do I get e8 00 00 00 00 for all libc function calls?

I just started learning reverse engineering. The near call instruction (e8) is very confusing to me. It took me a while to figure out how address calculation works for local functions. Now I'm ...
2
votes
1answer
135 views

How are __argc and __wargv globals exported from a 64-bit PE file compiled with Visual Studio?

I need to inject my code into a 64-bit process. I'm wondering, how can I access __argc and __wargv global variables once in the injected process? Are they always present at a static/preset address?
2
votes
1answer
107 views

How to break on a window creation

in x32/x64 debugger, how can I break when a new window is opened? When inside my application, I click the "File" button in the menu bar then select "options" I want to break on that call to open the ...
2
votes
1answer
1k views

How do I denote and use JMP /5 in byte code

I'm on the OSX platform working with x86_64. I've worked out how to do near jumps with the E9 byte code directive where my relative addresses have 4 bytes (teamed up with RIP) Now I have an instance ...
2
votes
1answer
86 views

Garbage Assembly Code Generationat at random offsets

Recently I've been working on a project. The main purpose of the project is to generated statically undetectable PE samples. Where each time one generates a PE sample, each generated sample is going ...
2
votes
1answer
44 views

Difference in binary behaviour (execution/under debugger)

I was trying out a simple heap overflow example (http://highaltitudehacks.com/2020/09/05/arm64-reversing-and-exploitation-part-1-arm-instruction-set-heap-overflow/) but replicated the relevant code in ...
2
votes
1answer
477 views

Help understanding MOVSXD

I've tried reading the documentation but the functionality of this instruction is still cloudy to me. For an example, I would like to know what is stored in RDX after these instructions: mov edx, ...
2
votes
1answer
153 views

Undocumented Model-Specific Register on Broadwell Microarchitecture

I'm trying to reverse the BIOS of a machine to learn something. The bigger problem I'm facing is that during early initialization, the code is making heavy usage of MSRs, and most of the time, I found ...
2
votes
1answer
126 views

Understanding operand forms

9(%rax, %rdx): What happens here? Is 9 the offset? and do you add the two registers together? I'm reading Randal E. Bryant and David R. O'Hallaran's "Computer Systems - A programmer's Persepctive" ...
2
votes
1answer
163 views

How to hide a process from all the methods of getting the list of processes?

So it seems that there are a lot of ways of getting the process list, although I'm not sure whether in the low level do they acquire them from same place or not so these are the ways i know : ...
2
votes
1answer
2k views

Does PeID signatures work with 64-Bit Portable Executable (EXE) files?

Can the signatures from PeID be used on 64-Bit Portable Executable (EXE) files? PeID does not support 64-Bit files but I can use the signatures in another application with 64-Bit support. My main ...
2
votes
1answer
2k views

gdb setting fs register on Linux

I'm debugging an ELF 64-bit binary using gdb and I notice that the %fs register is set to 0x63. For some testing that I'd like to perform I'd like to set the %fs register to 0x00. I tried doing a set ...
2
votes
1answer
92 views

Finding “func main” in a stripped binary written in GO

I'm reversing a binary that was apart of a CTF I was involved in about a month ago. It was too large of a binary to do during the challenge so I am doing it now. I am having trouble finding the main ...
2
votes
1answer
6k views

Receiving “Got EOF while reading in interactive” after properly executing system(“/bin/sh”) using pwntools

I've followed some tutorials on writing a pwntools-based exploit for the bitterman ELF binary, used in a CTF competition. However, all my attempts fail with the message below, i.e. Got EOF while ...
2
votes
1answer
915 views

Windbg: How to directly view GS:[0x60]

Win10x64: In Windbg, how may I view a pointer to the PEB by directly using GS:[0x60] (and not by Windbg extensions)? To test, I assembled a program via masm64 that throws an interrupt, clears r8 then ...
2
votes
1answer
627 views

Writing own custome syscall/int 0x80 on x64 system

Is there a way to write my own syscall/int 0x80 without using them? So, normally it goes like setup registers ... syscall or int 0x80 and I am interested in doing this without syscall/int 0x80 ...
2
votes
0answers
25 views

Why PTRACE_POKEDATA returns I/O error?

I learning usage of ptrace. I tried following simple example but raises a I/O Error. I would like to overwrite "Hello, world" (printing string) from other process. A target program prints &...
2
votes
0answers
377 views

Using __kernel_vsyscall on x64 linux machine [closed]

I am trying to use __kernel_vsyscall instead of syscall/int 80 on linux x64. I have read that it can be done on Intel chips (I have one), but i can't find how can one do it. I have x32 version: int ...
2
votes
0answers
1k views

Error: the file can't be loaded by debugger plupin IDA PRO 64 bit

I use IDA PRO 64bits on windows 10 64 bit, I want use it remote debug a file 64bit by linux. When I run linux_serverx64 in linux and connect then i error: the file can't be loaded by debugger plupin ...
1
vote
1answer
106 views

startup program exits with code 126 when executing program at entrypoint

I want to reverse engineer a program. I managed to find the entry point but every time I want to launch the application I get the same error `During startup program exited with code 126. Here is what ...
1
vote
1answer
101 views

Help understanding x64 TEST instruction

I have read that TEST does a bitwise and on the two arguments. I have also read that jz and je are both equivalent, and jump if the zero flag is set. So here's the problem I'm struggling with. ...
1
vote
2answers
92 views

x64 processor module

I just downloaded Ghidra last evening on a Fedora Linux machine with 4 Intel Core i5-7200U CPUs. When querying the "installed processor modules" in "Help" I get a listing of 41 processors. x86 is on ...
1
vote
1answer
69 views

Isolate the call to a function

Is it possible to call a function of a binary and obtain its result (without calling other functions), to isolate; are there any tools to do this?
1
vote
2answers
459 views

Does the loader fill the IAT table of an .exe in load time by checking the corresponding export tables or during run time?

I came upon this question : Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking? and it got me wondering, lets say for some reason some function was not in the IAT of our ...
1
vote
2answers
194 views

Figure out whether a function has return value of not?

I am doing binary analysis on x86-64bit ELF binaries. All the binaries are compiled from C language. Basically, for a given function, I would like to figure out whether this function has a return ...
1
vote
1answer
55 views

does mov DWORD PTR 32[rsp], 5 means mov DWORD PTR [rsp+32], 5?

I am learning about windows x64 calling convention, where the first four arguments are passed to registers and left arguments are passed through the stack. To see it, I checked the assembly of the ...
1
vote
3answers
2k views

How to find the starting address of text section of a DLL inside a process? (64 bit)

There was a question about this a year ago, but the answer doesn't explain how to do it in C/C++: How to find start of .text section? I'm not talking about module start address, which we can get ...
1
vote
1answer
748 views

why saved rip changed by push?

I am doing a reverse homework. see the following pictures: as can be seen from this picture, before call push touch3, "saved rip" is at 0x5561dca8, which is equal to the current rsp(0x5561dca8). ...
1
vote
1answer
87 views

Unknown parameters in custom signal handler on Linux

0x0000000008001946: mov 0xa8(%rdx),%rax 0x000000000800194d: lea 0x28(%rdx),%rsi 0x0000000008001951: lea 0x2(%rax),%rdi 0x0000000008001955: add $0xe,%rax 0x0000000008001959: ...
1
vote
2answers
926 views

Getting opcode Length , How to

I am apparently not very good with assembly as I am novice to somethings! Hence i wanted to make a question again. Now i got this from here to make something like a LDE (Length Disassembly Engine) ...
1
vote
2answers
417 views

Printing bytecode in bytes given a string of assembly for Radare to disassemble?

Megabeets determined in this answer that depending on asm.bits Radare may show either lea edx, [0x80490c8] (asm.bits=32) lea edx, [rip + 0x80490c8] (asm.bits=64) If I want to see what the ...
1
vote
1answer
316 views

Is it possible to rebuild an nexe file if I can read at arbitrary untrusted memory addresses?

Ok, I’m in a remote situation where I don’t have access to the remote filesystem but where I can run arbitrary python code (except I can’t fork processes and I don’t have access to ulimit and uname). ...
1
vote
1answer
1k views

How would I find a color's memory address? (Beginner)

I'm an absolute beginner (just started learning about process memory a few hours ago). I'm trying to find the memory address for the color of Color 1 in mspaint using x64dbg. I know it's black, so I'...
1
vote
1answer
742 views

How do I bypass this comparison?

I am working on a crackme and I'm stuck on a particular comparison that I'd like your help in getting past(one of many). Here's what I know and the relevant code snippet will follow: Requires a 19 ...
1
vote
1answer
931 views

Code-Cave Assembly Patching Issue in x64_dbg

I'm trying a code-cave approach to this query that was asked about on this forum earlier. I'm using x64_dbg to perform this task. My issue here is that after I have written the extra lines of ...
1
vote
1answer
57 views

Disassembly call function offset from RIP

I am writing a program where I map an .exe PE file in memory and I "dissect" it. I am disassembling the .text section of the target executable, using the distorm disassembler. CALL ...
1
vote
1answer
62 views

Displaying Operands as Position Independent in IDA

I'm writing an IDA python script, and i need to be able to detect position independent code. I have an instruction that IDA displays using the operand name 'format' lea rdi, format However, when ...
1
vote
1answer
107 views

Is `movq rax, xmm0` buggy in Radare2?

Why doesn't rax get loaded from xmm0 here? radare2 bug? GitHub issue `movq rax, xmm0` doesn't work in native debugger filed. [0x0003b0e0]> drr role reg value ref ―――――――――――――――――――...
1
vote
1answer
196 views

How can i check if i am running in ring 0 / ring 3 on x64 CPU

I have read it is possible to check ring level with bit 3 of CS register. Is there another register which really contains ring value (2 bits)
1
vote
1answer
47 views

How to determine what code created a string, in a live debugger session?

I'm using IDA 7 to debug a running application that must be a child of another application, which means I can't start it from IDA (using Debugger->Run). Instead, I have to run the application normally,...
1
vote
1answer
617 views

cannot find a string in x64dbg even when using search all strings

I am trying to debug a program for testing but for some reason i can NOT find any strings related to registeration like Registered, Unregistered,Blocked in x64dbg, i can see all these strings in the ...
1
vote
1answer
120 views

What is the ending bytes in the MOV instruction in 32 bit applications in windows? (B8 mov)

So i just compared NTterminateProcess between 32 and 64 bit version of a program, and the mov instruction which moves the syscall into eax is almost the same, both 5 byte, (both the B8 mov) but the ...
1
vote
1answer
1k views

How to pass param to execve to execute cat a file in x64 Asm? [closed]

I want execve("/bin/cat",["/bin/cat","/test/file"],NULL). Here is my asm xor %rdx, %rdx push %rdx sub $0x16, %rsp movb $0x2f, 7(%rsp) movl $0x2f6e6962, 8(%rsp) movl $0x746163, 12(%rsp) leaq 7(%rsp)...
1
vote
1answer
899 views

Changing entry-point of and ELF file

I'm trying to conduct a little experiment which basically consists of changing the EP of an ELF file and executing an exit(9) syscall, without returning to the OEP. As shown in the image everything ...
1
vote
1answer
604 views

Payload in simple buffer overflow exploit redirecting %rip on x86-64 Ubuntu 16.04 LTS leads to early (meaning before %rip is overwritten) segfault

I am trying to do a simple buffer overflow exploitation by overwriting the instruction pointer %rip. Here's my code of vuln.c #include <stdio.h> #include <string.h> #include <stdlib.h&...
1
vote
1answer
687 views

Game's anti-cheat complains when driver test-signing mode is on

I use Windows 7 64 bit, thus in order to load a test-signed driver, I need to enable test-signing mode. My driver bypasses some of the game's anti-cheat features to allow me to run a debugger and ...
1
vote
1answer
274 views

What are these LOAD segments in an assembly ELF64?

I wrote the following (fasm) assembly program: format ELF64 executable segment readable executable include 'io.inc' include 'unistd64.inc' entry main main: mov rdi, msg call print call ...
1
vote
1answer
123 views

Is it possible to restart over a program by calling an entry point function?

I was wondering if it was possible to restart a program (ignoring previously mapped files) with different argument by either calling main() or a glibc entry point function.
1
vote
1answer
141 views

Why does MSVC x64 Compiler load addresses like this?

Normally, in x86, to load a pointer to a null-terminated string you would use MOV EDX, OFFSET ds:mystring In x64, however, I noticed that the compiler does it like this lea rdx, OFFSET FLAT:$...
1
vote
1answer
946 views

One shellcode works, one doesn't - an issue with exploiting a 64 bit linux binary

I'm working on exploiting a simple 64 bit linux binary. I got control of RIP by exploiting a buffer overflow and using a jmp rsp to get control of the progrm. However, I'm having trouble with the ...