Questions tagged [x86]
A family of instruction set architectures originally based on the Intel 8086 CPU that functions with a very wide array of operating systems, including Windows, MacOS X, Linux, BSD, and Solaris.
491
questions
0
votes
1
answer
116
views
Asking for Reverse Engineering Tool Ideas
I'm currently studying cybersecurity and IoT and I'm interested in working on a development project in the realm of reverse engineering. My level is somewhere between beginner and intermediate, and I'...
- 4,643
1
vote
1
answer
94
views
Attaching into an x86 process in windbg
How can I attach into an x86 process from windbg?
currently I am waiting for the process to load then I am breaking into wow64cpu!KiFastSystemCall to switch into x86 context and only then put bp to ...
- 408
3
votes
3
answers
8k
views
Disassembling an MS-DOS EXE
I've been disassembling an MS-DOS EXE and I've been using this link http://www.delorie.com/djgpp/doc/exe/ to make heads and tails of the binary.
The header seems to be an older version compared to ...
14
votes
1
answer
60k
views
What does the `TEST` instruction do
I'm having trouble understanding the TEST instruction and its use. I'm looking at the following code at the end of a loop
0040A3D1 A9 00010181 TEST EAX,81010100
0040A3D6 74 E8 ...
- 7,246
1
vote
1
answer
75
views
Static offsets Vs. Loaded Offsets
I am developing an application integrity concept tool that performs integrity checks based on a comparison of Windows syscalls in a static PE file on disk to those loaded. Can I match the offset of ...
CommunityBot
- 1
33
votes
5
answers
46k
views
What is the meaning of movabs in gas/x86 AT&T syntax?
I just found a strange instruction by assembling (with gas) and disassembling (with objdump) on a amd64 architecture.
The original amd64 assembly code is:
mov 0x89abcdef, %al
And, after gas ...
- 943
6
votes
2
answers
3k
views
Understanding subtle differences between addressing modes in X86
I'm trying to have a whole picture of all the possible addressing modes of X86 instructions. Starting from this I studied the Intel IA-32 reference and multiple secondary references found online.
I'd ...
- 111
1
vote
1
answer
139
views
Strange entry point for an old Mac OS X x86 32 bit binary
I wanted to reverse engineer an old game for Mac OS X, but I can't figure out how the entry point jumps to other code. The binary is an x86 Macho-O executable and, according to Detect it Easy, it was ...
CommunityBot
- 1
1
vote
2
answers
78
views
IDAPython: Getting all arguments passed to function
I am working on getting two specific arguments from a function that is called around 1000 times in an executable. Is there any way of looping through all XREFs that reference the function and print ...
0
votes
0
answers
63
views
x86 When we use fastcall, why does caller clean stack?
In fastcall functions, the callee cleans the stack and returns the value in eax. This completes the function call.And actually we put first two arguments in ecx and edx, still caller cleans stack 8 ...
- 1
0
votes
2
answers
92
views
reduce size of executable ELF program
I'm experimenting on patching my hello world program in order to make it smol.
I started by reducing the size of the program with the following commands:
as --32 ./hello_32.S -o ./hello_32.o
ld -...
- 36.9k
4
votes
1
answer
1k
views
Ghidra Decompiler Optimized Strings
Looking at a large x86 binary, I'm seeing lots of instances where strings are assembled on the stack as quadwords like so:
If I try to set the type of puStack40 to char[38], I get the following ...
CommunityBot
- 1
3
votes
1
answer
800
views
Locating function parameters in x32dbg
I'm a bit rusty and trying to analyze a piece of code in x32dbg. As follows:
0627BF49 | 8B0B | mov ecx,dword ptr ds:[ebx] |
0627BF4B | 8B85 CCF5FFFF ...
CommunityBot
- 1
0
votes
0
answers
63
views
GetProcAddress on NTDLL functions not working via ROP
This is somewhat convoluted, but I will try to focus on the heart of the issue. We are trying to do GetProcAddress on a few NTDLL functions, and it is not working. We are doing this via ROP and in a ...
- 1
37
votes
5
answers
8k
views
Why would a program contain a call instruction targetting the address immediately following that instruction?
While reversing a 32bit Mach-O binary with Hopper, I noticed this peculiar method. The instruction on 0x0000e506 seems to be calling an address right below the instruction.
What would be the reason ...
- 135
4
votes
2
answers
2k
views
How do you look for a a particular value at address in IDA
So, I was trying to load some binary and in the main function, I saw instructions such as
mov edi, [esi+1Ch]
...
lea eax, [esi+18h]
So, what are these values at [esi+1Ch] and [esi+18h]. How do ...
- 137
11
votes
3
answers
8k
views
Struggling between syscall or sysenter ( Windows )
As I understand, from windows XP, there is a sysenter instruction introduced, instead of int 2e interrupt.
But on win 10 there is syscall instruction used in ntdll. So is the sysenter used only for ...
- 260
0
votes
1
answer
739
views
How can I convert the following assembly code to pseudo code?
I got the following disassembly code in IDA pro. I really find it hard to convert it into pseudo code.
push ebp
mov ebp, esp
sub esp, 14h
mov dword ptr [ebp-14h], 1
mov dword ptr [ebp-10h], 2
mov ...
CommunityBot
- 1
4
votes
0
answers
1k
views
Finding older IDA files
I am following the Begin RE tutorial here but I am stuck towards the end, where I load a file into IDA. I am using IDA Free 8.2 on Windows 11 x64.
On the graph view it is only showing the main ...
- 1
1
vote
0
answers
81
views
Freeware x86 decompilers for Windows with debug? [closed]
I'm searching for a software that is capable of decompiling x86 code in C-like code and run a debug session within it with the possibility to see the content of the variables.
That above was a quick ...
- 111
0
votes
0
answers
63
views
Hexrays - Enhance decompilation of "pre-multiplied" array indices?
For this x86 (Watcom 1997) assembly that loops over an array, Hexrays yields the following pseudo code:
lea eax, ds:0[ecx*4]
add eax, ecx
shl eax, 3
mov [esp+310h+iMulSize], eax
mov ...
- 1,103
1
vote
0
answers
166
views
Analyse a statically linked binary and extract syscall from it using angr
How to extract all syscalls from analysing a statically linked binary.
I have a script written using angr(Latest - v9.2.78) but when I start my script I get few syscalls and the analysis is like hung ...
- 11
2
votes
1
answer
568
views
Nice documentation of the binary analysis tool "angr", to analyse system calls in statically linked binary and hence possibly draw a system call graph
I am a new master's student in CS. I am into the computer systems domain. I was just thinking of analyzing a statically linked binary to get a sort of database of system calls made in the binary and ...
- 11
4
votes
3
answers
6k
views
How to find the starting address of text section of a DLL inside a process? (64 bit)
There was a question about this a year ago, but the answer doesn't explain how to do it in C/C++:
How to find start of .text section?
I'm not talking about module start address, which we can get ...
3
votes
1
answer
973
views
What is the meaning of jmp dword ptr off_XXXXXXXX + 8 in IDA?
What is the meaning of this kind of jmp instruction in x86 assembly in IDA?
Does it mean that we should jump to the address [6CA2E9B0] + 8 or [6CA2E9B0+8]?
When I follow that off_XXX, I get to the ...
CommunityBot
- 1
0
votes
0
answers
42
views
Exe self-modifies strings searched in debugger
I'm studying a Windows binary file and while searching for some string I noticed the EXE modifies the searched string, e.g., if I search "This is a string", it's modified to "his is a ...
- 1
0
votes
0
answers
139
views
from executable to assembly source code?
let's say i have an ".exe program" and i want to disassemble it and get "disassembled code" .
my question is => can i maintain and organize that "disassembled code" ...
- 23
0
votes
0
answers
65
views
Is there a debugger for the entire x86 architecture?
When learning about the topic that includes processes, threads and image files it helped immensely to use x86dbg. However, it only shows things from the "view" of a single process.
I am ...
- 10.9k
32
votes
4
answers
12k
views
Why are machine code decompilers less capable than for example those for the CLR and JVM?
Java and .NET decompilers can (usually) produce an almost perfect source code, often very close to the original.
Why can't the same be done for the native code? I tried a few but they either don't ...
- 213
2
votes
1
answer
190
views
What triggers RIP_EVENT?
The documentation for the Windows Debugger API mentions a debug event called RIP_EVENT. It offers little explanation of what a RIP_EVENT is, only stating that the structure "contains the error ...
- 137
2
votes
1
answer
75
views
What is patched by LX 16:32 fixup record
In LX format description in section
3.13 Fixup Record Table, when describing SRC = DB Source type field there is such an option:
06h = 16:32 Pointer fixup (48-bits).
1. How many bytes does this fixup ...
- 36.9k
2
votes
1
answer
197
views
What is the meaning of 32 bit offset in x86 16 bit jump
Consider x86 16 bit mode instruction:
$ echo 66 EA 66 55 44 33 22 11 | xxd -p -r | ndisasm -b16 -
00000000 66EA665544332211 jmp dword 0x1122:0x33445566
I thought 16 bit code jumps work by combining ...
- 171
2
votes
0
answers
288
views
Ghidra Strings and Global Renaming Issue
I am currently reverse engineering a piece of 16-bit software (originally written in C/C++ from what I can gather).
I have identified a function that seems to print text to the console. The text to be ...
- 165
5
votes
2
answers
495
views
BIOS first jump leads to empty memory
I'm trying to reverse a BIOS of an industrial PC in order to repair it. The device is based on an ETX-formfactor mobo, obscure Italian SECO M671, very similar to an old Kontron PM-15(C), but with a ...
- 1
5
votes
1
answer
540
views
Disassembling a DOS game with dynamic code/overlays in IDA Pro
I'm working on a disassembly of an old DOS game. (Real old: 16-bit, real mode.) The bulk of the game is in a large resource file of mixed binary and data; the executable basically just loads a chunk ...
CommunityBot
- 1
0
votes
1
answer
336
views
Using x86dbg valid opcodes produce '??? invalid instruction' output
Using the most recent ( as of today ) version of x86dbg I have a problem that follow every executable I have tried.
The disassembler in the CPU window, look at the 5th line from the top:
Any ideas ...
CommunityBot
- 1
4
votes
0
answers
155
views
Reverse Engineering Technique "Step by Step"
Sometimes, I see how someone puts on the github, some reverse engineering project for some famous game.
By researching these projects - I come to the conclusion that:
people just took the code from ...
CommunityBot
- 1
4
votes
2
answers
2k
views
Disassemble bios code
I have a Gigabyte G41MT-S2PT motherboard with Intel core 2 Pentium processor installed on it for test.I decided to disassemble its bios code.Its bios produced by Award Software International and its ...
2
votes
1
answer
73
views
why some functions push data before the prologue
i am a newbie in the world of RE ,
i start to explorer a main entry of a classic game from 90's
and i start to see something confuse me as a newbie
this main entry function start with pushing stuff to ...
- 9,198
1
vote
1
answer
255
views
How works k command in windbg
I am studying a Windows x86 binary in windbg.
When i debug a function, in can see the call stack with « k » command.
My question is: how works windbg internaly to get this call stack ?
I was thinking ...
- 11
2
votes
1
answer
158
views
Ghidra Shows Structure Strange
I am new to assembly. When I was disassembling some code, I encounter some strange instruction here. The instruction shows that (RBP + -0x40) is equal to local_48, however at the beginning of the code,...
- 123
9
votes
1
answer
6k
views
Where ES/GS/FS are pointing to?
As far as I know those segments are extra or general. But at which part of program memory they are actually pointing? If I undestand it correctly DS is poining at entry point of Dump, SS stands for ...
- 11.8k
9
votes
2
answers
7k
views
What are the difference syscall and int 0x2E instructions?
From this question: How does the Windows Native API communicate with the kernel?
Here is an example of ZwClose(HANDLE Handle); system call in NTDLL.DLL in Windows 10 X86_64:
NtClose proc near
...
- 5
4
votes
1
answer
273
views
How to force IDA to show size of pointer dereference?
IDA's default x86 assembly syntax is not very clear about pointer dereferences. One of these is dereferencing the memory operand, and one is simply moving the address to the register:
mov ecx, ...
3
votes
3
answers
5k
views
startup program exits with code 126 when executing program at entrypoint
I want to reverse engineer a program. I managed to find the entry point but every time I want to launch the application I get the same error `During startup program exited with code 126.
Here is what ...
- 111
143
votes
2
answers
131k
views
What is PLT/GOT?
From time to time, when disassembling x86 binaries, I stumble on
reference to PLT and GOT, especially when calling procedures from a
dynamic library.
For example, when running a program in gdb:
(gdb)...
- 10.9k
2
votes
1
answer
52
views
Can ESP point to a global variable
This 3 lines of code are used by some encoders to get EIP into ECX register:
fldz
fnstenv [esp-C]
pop ecx
The 2 first instructions push some datas on stack and we get one of this into ECX on the last ...
- 96
3
votes
1
answer
139
views
Unable to determine what esp is pointing to
I'm going through the book Practical Malware Analysis (specifically, Lab07-03) and I've been stuck on a rather simple problem. I've divided the code section of main() into three parts to ease my ...
- 4,709
3
votes
1
answer
206
views
Simplifying and reversing an encryption/decryption algorithm in ASM X86 / Python
I'm trying to reverse a decoding function in order to produce the function for encoding (for the curious this is a save game for a legacy adventure game which use codes for saving).
So far I have ...
CommunityBot
- 1
1
vote
1
answer
147
views
Unable to understand x86 instruction(s)
Recently I have been given a set of assembly instructions which I must learn to understand. I know an extremely basic level of x86 assembly but I'm starting to come across more nuances that are very ...
- 16.5k