Questions tagged [x86]
A family of instruction set architectures originally based on the Intel 8086 CPU that functions with a very wide array of operating systems, including Windows, MacOS X, Linux, BSD, and Solaris.
57
questions with no upvoted or accepted answers
4
votes
0
answers
139
views
Reverse Engineering Technique "Step by Step"
Sometimes, I see how someone puts on the github, some reverse engineering project for some famous game.
By researching these projects - I come to the conclusion that:
people just took the code from ...
user42316
3
votes
0
answers
561
views
Finding older IDA files
I am following the Begin RE tutorial here but I am stuck towards the end, where I load a file into IDA. I am using IDA Free 8.2 on Windows 11 x64.
On the graph view it is only showing the main ...
- 185
3
votes
1
answer
576
views
Locating function parameters in x32dbg
I'm a bit rusty and trying to analyze a piece of code in x32dbg. As follows:
0627BF49 | 8B0B | mov ecx,dword ptr ds:[ebx] |
0627BF4B | 8B85 CCF5FFFF ...
3
votes
1
answer
1k
views
Ghidra Decompiler Optimized Strings
Looking at a large x86 binary, I'm seeing lots of instances where strings are assembled on the stack as quadwords like so:
If I try to set the type of puStack40 to char[38], I get the following ...
- 368
3
votes
0
answers
76
views
Recognizing instructions containing low-level control flows
There are some x86 instructions which containing a low-level** control flow in its semantics, for example div because its semantics is roughly as:
if (source == 0)
throw exception...
else
...
- 1,410
3
votes
0
answers
1k
views
loading memory dump into ida pro?
I'm looking for a good method to load custom memory dumps (of usermode processes under Windows) into IDA Pro. These memory dumps may be partial or complete - in terms of other DLLs, such as kernel32, ...
- 101
2
votes
0
answers
166
views
Ghidra Strings and Global Renaming Issue
I am currently reverse engineering a piece of 16-bit software (originally written in C/C++ from what I can gather).
I have identified a function that seems to print text to the console. The text to be ...
- 165
2
votes
0
answers
52
views
Reversing internal function, can't call it with injected DLL
I'm currently learning RE. I've chosen to do so by trying to RE Skyrim for PC. I'm trying to call the ingame function for printing to the console, I'm doing this via an Injected DLL.
The function call ...
- 21
2
votes
0
answers
321
views
Finding the main function on Windows compiled executables
For a C/C++ program compiled on Windows using the x86 architecture, what is the best way to find the main function within disassembled code without relying on signatures such as FLIRT?
I've found ...
- 41
2
votes
0
answers
81
views
jump to invalid address when emulating
I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect ...
- 41
2
votes
0
answers
31
views
Why does OllyDbg label data segment as read only?
I'm working on this problem: Challenge 53
When compiling with cl c53.c /Fac53.asm /MD in VS2019 X86 Development Console and loading the .exe into OllyDbg, I found OllyDbg labels all segments of c53 as ...
2
votes
0
answers
2k
views
How to add symbols from open source lib to Ghidra?
I have a binary which I can tell is using rapidjson (open source C++ library) (header only/not dynamically linked). How can I load debug symbols from that? It would help to see the types, function ...
- 121
2
votes
0
answers
301
views
IDA Hex-Rays Decompiler Generates ASM Code Issue
For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted.
Some of the decompiled generated plain C code, show as ASM code :/
i.e:
...
2
votes
0
answers
452
views
Calling original function that uses unconventional calling convention
I'm using MinHook to hook a static function with the following signature:
float __usercall RadarManager::Add_Blip@<xmm0>(int position@<ecx>, int shape@<edx>, int colorId, float ...
- 133
2
votes
0
answers
155
views
Instruction and memory tracer for executing program on windows
Anyone know any popular x86 tracer which can capture the instruction and memory change by a running program on windows?
- 21
2
votes
0
answers
131
views
Trace replayer won't load binary debug information
So I'm debugging a linux application with what I believe DWARF debug information on x86-64 host. Everything is working fine and as expected - the source files are loaded immediately on function ...
- 455
2
votes
0
answers
598
views
Trying to run MIPS ELF with a cross toolchain but sigbus error
I finally successfuly installed a cross toolchain from this site in order to run and debug a mips elf on my x86-64 . I only have the elf file. I can disassemble it but when i try to run it with :
...
- 475
2
votes
0
answers
245
views
Ollydbg Instructions Are Splitted
When I am trying to reverse ZeroAccess rootkit, ollydbg shows instructions as seperated like;
it should be e874010000 as a single instruction which is a call to some routine but it shows them like ...
- 21
2
votes
0
answers
271
views
How to include these exception handle symbols in x86 assembly code?
The test is on 32bit x86 Linux, with g++ 4.6.3.
So basically I use a IDA pro script to recover the .gcc_excpt_table and .eh_frame sections from binary compiled from C++ language.
Basically I want to ...
- 2,475
1
vote
0
answers
109
views
Analyse a statically linked binary and extract syscall from it using angr
How to extract all syscalls from analysing a statically linked binary.
I have a script written using angr(Latest - v9.2.78) but when I start my script I get few syscalls and the analysis is like hung ...
- 11
1
vote
1
answer
84
views
Strange entry point for an old Mac OS X x86 32 bit binary
I wanted to reverse engineer an old game for Mac OS X, but I can't figure out how the entry point jumps to other code. The binary is an x86 Macho-O executable and, according to Detect it Easy, it was ...
- 11
1
vote
0
answers
63
views
Wrong access .data segment
Preface
I'm a PHP programmer, in my spare time I've been doing reverse work. Achieved good progress in the analysis game. But there was a big problem on my way. And now, more than ever, i need the ...
- 11
1
vote
0
answers
80
views
Normal artifact or something else?
I'm working on a Linux ELF challenge.
I have found this bit of code in the .text disassembly using objdump -d -M intel program
922: 83 c4 10 add esp,0x10
925: c7 45 f4 00 00 00 ...
- 141
1
vote
0
answers
631
views
What is happening with this *param_1?
I am a bit of a starter, so bear with me as I can't find the answer through Google (a common thing in Ghidra work I noticed so far).
I have a function that seems to read like it is a Constructor.
But ...
- 111
1
vote
0
answers
62
views
Is there a meaning to the test instruction if it isnt followed by a conditional jump?
Pasting a snippet of code I found inside a malware sample.
0040F695 push ecx
0040F696 lea ecx,dword ptr ss:[esp+8]
0040F69A sub ecx,1000
0040F6A0 sub ...
- 319
1
vote
0
answers
98
views
Instruction-level hooking library for win32?
I am looking for instruction-level hooking library for win32 x86/x64.
I want to write hook insertion and hook implementation code in C/C++ (compiled into dll).
(Therefore instrumentation tools are ...
- 111
1
vote
0
answers
1k
views
Instruction trace using frida in android emulator
i have a emulator named "Ldplayer" in my windows os and I'm trying to log all instructions executed by the app that uses ARM JNI libraries. basically, the app is running in an x86 emulator ...
- 73
1
vote
0
answers
281
views
IDA shows MEMORY or unknown references on C std library calls (memset, memcpy, etc.)
I'm currently reversing a Linux 32-bit executable (with a statically linked library included in it) but I'm having a little problem I can't find a solution for.
Basically whenever I stumble across a ...
1
vote
0
answers
69
views
How does this wannacry sample work?
I downloaded wannacry sample here: https://github.com/fadyosman/WannaCrySample/releases. Don't forget to enter password for archive.
I figured out how most of the binary works, except the very last ...
- 55
1
vote
0
answers
116
views
Memory modified at jump far
Observing a trace of Wow64 switching on Windows 7, the following situation makes me confused
...
0x77491dbe 64 ff 15 c0 00 00 00 call fs:[0xc0] ; syswow64\ntdll.dll
0x74632320 ea 1e 27 63 ...
- 1,410
1
vote
0
answers
89
views
Dump the value of register into file
I've reverse engineering little game on windows 32bit.
I found a string in executable which was interesting for me (it is a board game and this string represents the fact that somebody made a move ...
- 203
1
vote
0
answers
243
views
Reproduce compilation (ASM) output for library detection - identifying compiler, version & options used
I want to reverse a stripped x86 sample that uses a static library.
So far I could identify the library itself and narrow the version of the library used.
Now I want to use Ghidra's Function ID ...
- 11
1
vote
0
answers
263
views
Mysterious chunk of code in IOLI crackme0x06 challenge
I've been struggling to understand a very strange piece of x86 assembly code from the IOLI crackme0x06 challenge.
Context
But first of all, here is the context : I've successfully cracked the ...
- 51
1
vote
0
answers
294
views
Is there a way to generate a PE from a web assembly module?
I am in the process of analysing a large web assembly. I have the compiled .wasm file and using the tools available I can convert this to a .wat text representation. Currently, I am doing the ...
- 11
1
vote
0
answers
282
views
How can a segfault happen during the libc exit call on Linux?
I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge.
While testing, I have noticed ...
1
vote
0
answers
861
views
IDA 7 handling strings in debugger pseudocode
When running a remote debugger to a linux server, is there a way to get IDA (7.0) to properly handle strings? When I go to the pseudocode view, I get things like this;
v7 = sub_804AD60((std::string *)...
- 215
1
vote
0
answers
75
views
getting %localappdata% in asm
I have an old windows x86 application that no longer works properly since windows 8. This app creates files within its own folders for things like app settings. Unfortunately, Microsoft no longer ...
- 225
1
vote
0
answers
63
views
Threads blocking in kernel when I attach, can't control them
I'm attaching to a simple program and the new thread breaks at DbgBreakPoint as expected. I'm using x64dbg (32-bit). The problem is, when I go to the Threads window it shows all the threads' EIPs as ...
- 153
1
vote
0
answers
323
views
Pointer disassembly
I'm using the Capstone engine to develop an ELF disassembler. I have implemented a linear sweep algorithm as the most basic version.
My goal is to implement the recursive traversal now.
Consider ...
1
vote
0
answers
205
views
windbg stopped after I set up a breakpoint, keeping busing
I'm studying reverse engineering, I wrote the following code to see how it is to pass struct variables in the disassembly.
struct s {
int a;
int b;
int c;
};
struct s get_some_values(int ...
- 11
1
vote
0
answers
660
views
Why does clang use ebp relative offsets to put function arguments on the stack?
I've been looking at disassembly of x86 32-bit code generated by GCC vs Clang.
Environment is Ubuntu Server 16.04.2 32bit running in VMware.
Both are compiled with the same options. No optimizations ...
- 11
1
vote
0
answers
118
views
Record-replay tools for Windows?
Are there any user-mode record-replay tools for Windows that can capture native execution of a program so that it can be replayed deterministically later? Instructions, memory accesses, syscalls and ...
- 121
1
vote
1
answer
423
views
How to debug a crash in wow64.dll in 32bit process
I have a 32bit application and a few wrapper tools that I use one after another to inject code, hook system dll functions (using the patch-first-bytes-of-the-function-with-jump approach). Also I have ...
- 153
0
votes
0
answers
40
views
Hexrays - Enhance decompilation of "pre-multiplied" array indices?
For this x86 (Watcom 1997) assembly that loops over an array, Hexrays yields the following pseudo code:
lea eax, ds:0[ecx*4]
add eax, ecx
shl eax, 3
mov [esp+310h+iMulSize], eax
mov ...
- 1,083
0
votes
0
answers
34
views
Exe self-modifies strings searched in debugger
I'm studying a Windows binary file and while searching for some string I noticed the EXE modifies the searched string, e.g., if I search "This is a string", it's modified to "his is a ...
- 1
0
votes
0
answers
86
views
from executable to assembly source code?
let's say i have an ".exe program" and i want to disassemble it and get "disassembled code" .
my question is => can i maintain and organize that "disassembled code" ...
- 23
0
votes
0
answers
56
views
Is there a debugger for the entire x86 architecture?
When learning about the topic that includes processes, threads and image files it helped immensely to use x86dbg. However, it only shows things from the "view" of a single process.
I am ...
- 3
0
votes
0
answers
89
views
ADD right before CMP?
I am a beginner in RE. I compiled some code (x86 32bit), and opened it up in Ghidra. I come across the following instruction block:
CALL _strcmp
MOV dword ptr [EBP + local_1c], EAX
MOV EAX, dword ptr [...
- 41
0
votes
0
answers
227
views
PUSH x VS MOV [ESP], x?
I am a beginner in RE. I compiled some code (x86 32bit), and opened it up in Ghidra.
I come across the following instruction right before a call:
MOV dword ptr [ESP], 0x3c
Where 0x3c is the offset to ...
- 1
0
votes
0
answers
116
views
Emulator that emulates arm hardware
I want to hook arm instructions as they executes but most of the emulators are based on VirtualBox that uses houdini to translate arm instructions to x86, and i really can't hook a native JNI lib, ...
- 73