Questions tagged [x86]
A family of instruction set architectures originally based on the Intel 8086 CPU that functions with a very wide array of operating systems, including Windows, MacOS X, Linux, BSD, and Solaris.
59
questions
32
votes
5
answers
11k
views
Why there are not any disassemblers that can generate re-assemblable asm code?
I am struggling on this problem for around three months:
How to use disassemblers (IDA Pro and others...) to generate re-assemblable asm code and assemble it back
My experience is that:
There is NO ...
- 2,475
32
votes
4
answers
12k
views
Why are machine code decompilers less capable than for example those for the CLR and JVM?
Java and .NET decompilers can (usually) produce an almost perfect source code, often very close to the original.
Why can't the same be done for the native code? I tried a few but they either don't ...
- 9,178
138
votes
2
answers
124k
views
What is PLT/GOT?
From time to time, when disassembling x86 binaries, I stumble on
reference to PLT and GOT, especially when calling procedures from a
dynamic library.
For example, when running a program in gdb:
(gdb)...
- 18.9k
86
votes
3
answers
131k
views
How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?
I try to understand the process of memory segmentation for the i386 and amd64 architectures on Linux. It seems that this is heavily related to the segment registers %fs, %gs, %cs, %ss, %ds, %es.
Can ...
- 18.9k
10
votes
2
answers
5k
views
What is the purpose of these instructions before the main preamble?
I wrote a small C program below:
#include <stdlib.h>
int sub(int x, int y){
return 2*x+y;
}
int main(int argc, char ** argv){
int a;
a = atoi(argv[1]);
return sub(argc,a);
}
Compiled ...
- 279
9
votes
2
answers
6k
views
What are the difference syscall and int 0x2E instructions?
From this question: How does the Windows Native API communicate with the kernel?
Here is an example of ZwClose(HANDLE Handle); system call in NTDLL.DLL in Windows 10 X86_64:
NtClose proc near
...
- 1,559
8
votes
2
answers
2k
views
basic reversing question about local variable
I do not understand the following:
in a very simple dummy C function:
void vulnerable_function(char* string) {
char buffer[100];
}
When I use gdb to disassemble it, I obtain:
0x08048464 <+...
- 103
9
votes
1
answer
4k
views
What x86 calling convention passes first parameter via ESI?
I am looking at some x86 code, which I believe was built using a Microsoft tool chain, and am trying to figure out the calling convention used during this call:
push esi ; save ESI (it gets ...
- 2,561
45
votes
4
answers
23k
views
convert this x86 ASM to C?
How could this 32-bit x86 assembly be written in C?
loc_536FB0:
mov cl, [eax]
cmp cl, ' '
jb short loc_536FBC
cmp cl, ','
jnz short loc_536FBF
loc_536FBC:
mov byte ptr [eax], ' '
loc_536FBF
mov cl, ...
- 563
7
votes
1
answer
4k
views
How to recover the exception info from .gcc_except_table and .eh_handle sections?
For C++ program with try catch defined, when using g++ to compile it into assembly code (test is on x86 32bit Linux, g++ 4.6.3)
g++ -S cppexcept.cc
A specified section called .gcc_except_table is ...
- 2,475
6
votes
2
answers
8k
views
Disassembly shows `LEA` with RIP?
When I disassemble this instruction using pad on Radare I get an LEA with rip
[0x00000000]> pad 8d 15 c8 90 04 08
lea edx, [rip + 0x80490c8]
I got this instruction from this post here I'm ...
- 1,769
6
votes
1
answer
710
views
Recompiling/optimizing redundant code to make analysis easier
I'm analyzing an application created with Borland Delphi but the poor quality of the object code makes analysis difficult and tedious. The code is so convoluted and inflated with superfluous ...
- 439
5
votes
2
answers
2k
views
How are addresses calculated from the values in x86 segment registers?
How are the 16-bit values in segment registers used to represent large memory addresses?
ES 0023 32bit 0(FFFFFFFF)
CS 001B 32bit 0(FFFFFFFF)
SS 0023 32bit 0(FFFFFFFF)
DS 0023 32bit 0(FFFFFFFF)
FS ...
- 83
4
votes
2
answers
2k
views
What could be the purpose of XORing esp with a global variable? (stack canary protection)
I am currently looking at a function inside a Win32 executable's main module. After allocating memory on the stack (sub esp) and saving some registers on the stack, the value of esp is XORed with a ...
3
votes
3
answers
6k
views
Determind length of instructions in bytes
Where is it possible to find a list of x86 instructions (and x64 instructions) with the (hex) opcode and the length/size in bytes of the instructions, such as:
0x90 = NOP = 1 byte
0xE9 = JMP = 5 ...
- 149
2
votes
1
answer
5k
views
Using GDB to modify an executable
I'm working on an assignment for a systems programming class, and for extra credit we are asked to modify an executable to allow it to accept the reverse of our PIN (finding the PIN was the original ...
32
votes
5
answers
43k
views
What is the meaning of movabs in gas/x86 AT&T syntax?
I just found a strange instruction by assembling (with gas) and disassembling (with objdump) on a amd64 architecture.
The original amd64 assembly code is:
mov 0x89abcdef, %al
And, after gas ...
- 18.9k
24
votes
1
answer
9k
views
How to use sysenter under Linux?
I would like to know what are the different ways to perform a system
call in x86 assembler under Linux. But, with no cheating, only
assembler must be used (i.e. compilation with gcc must be done with
-...
- 18.9k
24
votes
1
answer
13k
views
What's 'fs:[0]' doing and how can I execute it step by step?
In a 32 bits Windows binary, I see this code:
push next
push fs:[0]
mov fs:[0], esp
int3
...
next:
I see that something happens on the int3 (an error), but I don't understand why,...
- 6,684
18
votes
3
answers
12k
views
Are there any tools or scripts for identifying compression algorithms in executables?
I know there are tools for identifying common ciphers and hash algorithms in code, but are there any similar scripts / tools / plugins for common compression algorithms such as gzip, deflate, etc? ...
- 1,252
14
votes
1
answer
57k
views
What does the `TEST` instruction do
I'm having trouble understanding the TEST instruction and its use. I'm looking at the following code at the end of a loop
0040A3D1 A9 00010181 TEST EAX,81010100
0040A3D6 74 E8 ...
- 147
12
votes
3
answers
9k
views
Reverse engineer an old DOS QBasic executable
I recently decided to try my hand at reverse engineer an old DOS text based game that was coded in QBasic.
I found some info online about old DOS games disassembly but mostly for Wacom compiled C/C++ ...
- 121
11
votes
2
answers
14k
views
nop with argument in x86_64
A program I'm investigating has the following code (disassembled by IDA with some light censorship by me):
__text:....B9 call <redacted>
__text:....BE nop
...
- 293
10
votes
2
answers
2k
views
How to do static analysis to identify pointer from concrete value in assembly?
So basically I am writing some code to do analysis work on disassembled assembly code.
I am trapped in this issue for a while, here is an simple example of a disassembled asm code by objdump, ...
- 2,475
8
votes
1
answer
5k
views
Where ES/GS/FS are pointing to?
As far as I know those segments are extra or general. But at which part of program memory they are actually pointing? If I undestand it correctly DS is poining at entry point of Dump, SS stands for ...
- 263
8
votes
1
answer
5k
views
How to investigate Windows 32/64bit (WOW64) transition
There is surprisingly little information about Windows WOW64 mechanism.
I'm trying to investigate it.
So when we have system call in 32-land, it calls an address that is stored in FS, which leads us ...
- 263
8
votes
3
answers
7k
views
Is there any tool to visually see program stack in linux while debugging?
By stack I mean the location where local variable, return address etc are stored. Which is pointed to by the esp and ebp.
- 181
7
votes
2
answers
4k
views
How to recover information stored in .ctors section?
Test is on x86, 32-bit Linux. I am using g++ 4.6.3 and objdump 2.22
Here is a simple C++ code I am working on:
#include <iostream>
using namespace std;
main()
{
cout << "Hello ...
- 2,475
7
votes
1
answer
1k
views
How to get IDA Pro Free to automatically change segment on retf?
I have been unable to get IDA pro to do a simple disassembly of a flat 16-bit binary (bootloader) file. I'm just getting started, and it seems to be harder than it should be.
There's a simple set of ...
- 203
6
votes
2
answers
9k
views
When was the MOVABS instruction introduced?
When trying to write an instruction set analysis tool for disassembled code (https://superuser.com/a/832440/384221) I have found opcode MOVABS which was not included in my opcode source database (...
- 163
6
votes
1
answer
2k
views
Segmentation on x86 for stack canaries
I just compiled some C code that reads in input using gets and disassembled the code. The platform is Ubuntu 32-bit.
There are these 3 lines that check if the canary value has been tampered with.
...
user1743
6
votes
1
answer
1k
views
I need quick correction on this x86 opcode conundrum
I am trying to figure out how to encode the instruction MOV DS, AX, but I am confused from the opcode table as follows:
Is MOV DS all one byte, or is MOV one byte, DS the second, and the AX the third?...
- 61
5
votes
3
answers
8k
views
How can I view FS:[0] with windbg?
It seems that Windows 8 broke Ollydbg as several ntdll functions keep throwing exception 0xC0000008 and crashing my debugger.
I am now using Windbg. But, I am unable to view FS (specifically FS:[0])....
- 165
5
votes
1
answer
2k
views
What's the meaning of dword_XXXX and offset dword_XXXX in IDA?
Consider the following code:
In C++:
SomeClass* globalPointer; // we don't know what it points to, but it's not null a pointer, it's initialized
void someFunction()
{
globalPointer->...
- 175
4
votes
1
answer
7k
views
What does fs and gs registers provide in Linux?
In a 64 bit ELF binary I found it mainly uses fs register to get some values. How can I know which value it wants to access? I'm familiar with that NT kernel uses fs and gs register for TEB structure ...
- 1,559
4
votes
4
answers
7k
views
Calculation of jmp address through subtraction
I don't get why the two addresses of the functions are subtracted in order to get the jump destination.
mov eax, [ebp+func1]
sub eax, [ebp+func2]
sub eax, 5
mov [ebp+var_4], eax
Which ...
- 180
4
votes
3
answers
3k
views
IDA: add segments without losing data
I'm browsing an old 80186 BIOS ROM in IDA free. I have loaded the binary file at the correct address and created one big segment for the entire thing since I knew nothing about the internal structure.
...
- 55
4
votes
3
answers
5k
views
How to find the starting address of text section of a DLL inside a process? (64 bit)
There was a question about this a year ago, but the answer doesn't explain how to do it in C/C++:
How to find start of .text section?
I'm not talking about module start address, which we can get ...
- 232
4
votes
4
answers
1k
views
Why addresses of variable on stack are not consecutive?
The code below is generated by gcc from a simple scanf program.
My question is that
Why these 3 addresses of variables are not consecutive when allocated?
If not, when could I speculate the number ...
- 226
4
votes
1
answer
868
views
Getting list of opcodes from PANDA trace
As answer to the post "Using QEmu monitor interface to extract execution traces from a binary?", one of the PANDA authors outlined how QUEMU may be used to record execution traces.
I would like to do ...
- 1,550
3
votes
1
answer
1k
views
Good foundation for reverse engineering malware
I have been intrigued by reverse engineering recently and just finished Paul Carter's PC Assembly Language book (http://pacman128.github.io/static/pcasm-book.pdf) which was a great primer for x86. My ...
- 187
3
votes
1
answer
1k
views
IDA PRO and Dos Load Exec
I am trying to reverse some DOS game in IDA pro (5.0 demo). I get stuck when it tries to load the overlay file. Is it possible to load the 2nd executable into the original namespace?
It has already ...
- 31
3
votes
3
answers
4k
views
Does a JE must follow directly to an CMP?
I wanted to know if a jump instruction as JE must directly follow to a CMP instruction. Until now, I did always see that first a CMP comes and after that a JMP. But today I have discover the following:...
- 1,531
3
votes
1
answer
422
views
ELF x86 - Why is return address pushed twice?
I reverse an ELF x86, and I would like to understand why the return address is pushed again on the stack? It should be already present there.
main:
lea ecx, [esp+0x4 {argc}]
and esp, 0xfffffff0
...
- 193
3
votes
1
answer
4k
views
Can I use python3 with IDA 7.0?
Got IDA Pro 7.0 (I can't update at the moment),
I'm currently unable to use idapython.
I have python3.8 installed on my machine and nothing else (I dont want any collisions).
How can I use make ...
3
votes
0
answers
520
views
What does fs register value mean in x86 application? [duplicate]
I know that FS points to Thread Environment Block - which is seen by the address at the right part of what OllyDbg shows:
What does this value 0x53 mean? Does it have some connection with the address ...
- 218
2
votes
1
answer
1k
views
Is the value of EBP before the main function important?
So before we come to the main function, it looks we are in a function with a name __libc_start_main
and before we come to our main function we obviously push EBP value in the stack ( the value of EBP ...
- 207
2
votes
1
answer
315
views
Call instruction changed while running
While debugging and reverse-engineering my exe, I have found a very weird thing.
call ds:GetModuleFileNameA
This call instruction is formed with below hex bytes in IDA.
FF 15 24 C0 41 00
(I think ...
2
votes
1
answer
166
views
What is the mdisp field in RTTI for throw used for?
First of here is the article from which I'm looking up the fields.
I was trying out different combinations to see how they affect the RTTI for a C++ throw. It seems that having a virtual base class ...
- 455
2
votes
0
answers
245
views
Ollydbg Instructions Are Splitted
When I am trying to reverse ZeroAccess rootkit, ollydbg shows instructions as seperated like;
it should be e874010000 as a single instruction which is a call to some routine but it shows them like ...
- 21