Questions tagged [x86]
A family of instruction set architectures originally based on the Intel 8086 CPU that functions with a very wide array of operating systems, including Windows, MacOS X, Linux, BSD, and Solaris.
491
questions
143
votes
2
answers
131k
views
What is PLT/GOT?
From time to time, when disassembling x86 binaries, I stumble on
reference to PLT and GOT, especially when calling procedures from a
dynamic library.
For example, when running a program in gdb:
(gdb)...
- 19.2k
88
votes
3
answers
134k
views
How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?
I try to understand the process of memory segmentation for the i386 and amd64 architectures on Linux. It seems that this is heavily related to the segment registers %fs, %gs, %cs, %ss, %ds, %es.
Can ...
- 19.2k
45
votes
4
answers
23k
views
convert this x86 ASM to C?
How could this 32-bit x86 assembly be written in C?
loc_536FB0:
mov cl, [eax]
cmp cl, ' '
jb short loc_536FBC
cmp cl, ','
jnz short loc_536FBF
loc_536FBC:
mov byte ptr [eax], ' '
loc_536FBF
mov cl, ...
- 563
37
votes
5
answers
8k
views
Why would a program contain a call instruction targetting the address immediately following that instruction?
While reversing a 32bit Mach-O binary with Hopper, I noticed this peculiar method. The instruction on 0x0000e506 seems to be calling an address right below the instruction.
What would be the reason ...
- 497
33
votes
5
answers
46k
views
What is the meaning of movabs in gas/x86 AT&T syntax?
I just found a strange instruction by assembling (with gas) and disassembling (with objdump) on a amd64 architecture.
The original amd64 assembly code is:
mov 0x89abcdef, %al
And, after gas ...
- 19.2k
32
votes
5
answers
12k
views
Why there are not any disassemblers that can generate re-assemblable asm code?
I am struggling on this problem for around three months:
How to use disassemblers (IDA Pro and others...) to generate re-assemblable asm code and assemble it back
My experience is that:
There is NO ...
- 2,485
32
votes
4
answers
12k
views
Why are machine code decompilers less capable than for example those for the CLR and JVM?
Java and .NET decompilers can (usually) produce an almost perfect source code, often very close to the original.
Why can't the same be done for the native code? I tried a few but they either don't ...
- 9,198
30
votes
1
answer
58k
views
What does mov qword ptr ds:[rax+18], r8 mean?
mov qword ptr ds:[rax+18], r8
In the above code, where are we copying the value of r8 register into?
I know that ds means data segment which is a segment in memory, but what does exactly [rax+18] ...
- 639
28
votes
8
answers
5k
views
How are x86 CPU instructions encoded?
I'm writing a small utility library for hooking functions at run time. I need to find out the length of the first few instructions because I don't want to assume anything or require the developer to ...
- 471
24
votes
1
answer
13k
views
What's 'fs:[0]' doing and how can I execute it step by step?
In a 32 bits Windows binary, I see this code:
push next
push fs:[0]
mov fs:[0], esp
int3
...
next:
I see that something happens on the int3 (an error), but I don't understand why,...
- 6,694
24
votes
1
answer
10k
views
How to use sysenter under Linux?
I would like to know what are the different ways to perform a system
call in x86 assembler under Linux. But, with no cheating, only
assembler must be used (i.e. compilation with gcc must be done with
-...
- 19.2k
19
votes
3
answers
16k
views
Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?
I don't know whether this is a silly question, but I couldn't find any answer.
With the evolution of CPU architecture, register size was extended, from 8, to 16, 32, and eventually 64-bit. I was ...
- 295
19
votes
3
answers
13k
views
Are there any tools or scripts for identifying compression algorithms in executables?
I know there are tools for identifying common ciphers and hash algorithms in code, but are there any similar scripts / tools / plugins for common compression algorithms such as gzip, deflate, etc? ...
- 1,272
19
votes
1
answer
3k
views
What is the protocol for x87 floating point emulation in MS-DOS?
I'm trying to get useful results using the Reko decompiler on a dusty old MS-DOS binary compiled with Borland C++ that appears to be performing a lot of floating point arithmetic. I'm seeing code ...
- 1,080
16
votes
4
answers
4k
views
Open-Source library for Complete Binary Disassembly
One of the major hurdles of x86 disassembly is separating code from data. All available open-source disassembly library only perform a straight line disassembly (starts from the top and skips errors ...
- 506
14
votes
1
answer
60k
views
What does the `TEST` instruction do
I'm having trouble understanding the TEST instruction and its use. I'm looking at the following code at the end of a loop
0040A3D1 A9 00010181 TEST EAX,81010100
0040A3D6 74 E8 ...
- 147
13
votes
2
answers
14k
views
Better explanation of different x86 CALL variations
Hoping to get a better explanation of x86 call instruction. I sort of understand the call near and call far. But I don't fully understand the segment part. A little insight into my main problem, I am ...
- 501
12
votes
2
answers
3k
views
Replacing common x86 instructions with less known ones
Is there any kind of software or research or paper which discusses replacement of frequent x86 instructions with ones which are less common and thus less understandable to the attacker (floating point/...
- 223
12
votes
3
answers
9k
views
Reverse engineer an old DOS QBasic executable
I recently decided to try my hand at reverse engineer an old DOS text based game that was coded in QBasic.
I found some info online about old DOS games disassembly but mostly for Wacom compiled C/C++ ...
- 121
11
votes
3
answers
113k
views
How to obtain x86-64 pseudocode in IDA Pro?
Does anyone know about obtaining pseudocode for x86-64 in IDA Pro? I already tried the Hex-Rays plugin to obtain pseudocode, but when I try it, the following error pops up: "only 32bit code is ...
- 119
11
votes
4
answers
8k
views
How can I generate a call graph from an unstripped x86 Linux ELF?
There's a piece of software, for which I only have the binary, not the source code. It's:
unobfuscated (so, not polymorphic or anything. It is optimized a bit, though)
unstripped
x86 32 bit
...
- 281
11
votes
3
answers
8k
views
Struggling between syscall or sysenter ( Windows )
As I understand, from windows XP, there is a sysenter instruction introduced, instead of int 2e interrupt.
But on win 10 there is syscall instruction used in ntdll. So is the sysenter used only for ...
11
votes
1
answer
887
views
Randomly picking up a x86 register for an instruction
I came around a piece of malware which i am analyzing and have found that it uses some kind of math to randomly selecting a register for a specific instruction
Which i don't understand how this ...
- 314
11
votes
2
answers
15k
views
nop with argument in x86_64
A program I'm investigating has the following code (disassembled by IDA with some light censorship by me):
__text:....B9 call <redacted>
__text:....BE nop
...
- 303
11
votes
3
answers
1k
views
What methodology can be used to change code flow atomically during program execution?
I have been reading a lot about the different techniques for Windows API hooking (a technique I'm particularly fascinated by and fond of), and it seems a major problem in implementing a realiable ...
- 398
10
votes
2
answers
6k
views
What is the purpose of these instructions before the main preamble?
I wrote a small C program below:
#include <stdlib.h>
int sub(int x, int y){
return 2*x+y;
}
int main(int argc, char ** argv){
int a;
a = atoi(argv[1]);
return sub(argc,a);
}
Compiled ...
- 279
10
votes
3
answers
5k
views
Why does the function pointer get overwritten even though is declared before the vulnerable buffer?
I am working on io-wargames for fun right now, level3:
I do understand why there is a stack-overflow in this code (strlen(argv[1])), but what I don't understand is why it overflows the function ...
- 677
10
votes
2
answers
6k
views
Why does IDA add "db" statements between disassembled code
I'm trying to analyze a MS-DOS COM file that I wrote a few years ago with IDA Free 5.0, I've since renamed the segment to code_and_data and named constants and set data types correctly. However, when ...
- 203
10
votes
2
answers
9k
views
Mixed 16/32-bit code reversing using IDA
I am trying to reverse engineer a binary blob I expect to transition from 16-bit real mode into 32-bit protected mode (it is boot time code), so I expect the code to contain code of both sorts.
When ...
user1797
10
votes
2
answers
979
views
How did this 80286 detection code work?
I'm poking through a disassembled 16-bit DOS game circa 1992. The original system requirements state that the game needs an IBM AT-compatible machine or later, with the 286 processor, to run. And ...
- 258
10
votes
2
answers
2k
views
How to do static analysis to identify pointer from concrete value in assembly?
So basically I am writing some code to do analysis work on disassembled assembly code.
I am trapped in this issue for a while, here is an simple example of a disassembled asm code by objdump, ...
- 2,485
9
votes
2
answers
7k
views
What are the difference syscall and int 0x2E instructions?
From this question: How does the Windows Native API communicate with the kernel?
Here is an example of ZwClose(HANDLE Handle); system call in NTDLL.DLL in Windows 10 X86_64:
NtClose proc near
...
- 1,579
9
votes
1
answer
4k
views
What x86 calling convention passes first parameter via ESI?
I am looking at some x86 code, which I believe was built using a Microsoft tool chain, and am trying to figure out the calling convention used during this call:
push esi ; save ESI (it gets ...
- 2,581
9
votes
1
answer
17k
views
Difference between INT 0X80 and SYSCALL
The SYSCALL instruction is said to be the 64-bit version of INT 0X80, however it's still possible to use the latter in 64-bit code (although strace decodes it wrong because of the 64-bit ABI I guess) ...
- 437
9
votes
1
answer
6k
views
Where ES/GS/FS are pointing to?
As far as I know those segments are extra or general. But at which part of program memory they are actually pointing? If I undestand it correctly DS is poining at entry point of Dump, SS stands for ...
- 273
8
votes
3
answers
7k
views
Is there any tool to visually see program stack in linux while debugging?
By stack I mean the location where local variable, return address etc are stored. Which is pointed to by the esp and ebp.
- 181
8
votes
1
answer
5k
views
How to investigate Windows 32/64bit (WOW64) transition
There is surprisingly little information about Windows WOW64 mechanism.
I'm trying to investigate it.
So when we have system call in 32-land, it calls an address that is stored in FS, which leads us ...
- 273
8
votes
2
answers
2k
views
basic reversing question about local variable
I do not understand the following:
in a very simple dummy C function:
void vulnerable_function(char* string) {
char buffer[100];
}
When I use gdb to disassemble it, I obtain:
0x08048464 <+...
- 103
8
votes
1
answer
1k
views
Can I set entry point at code in PE headers?
If I set something like 0x00000040 (my code is located at this address), then the program crashes with this error:
The application was unable to start correctly (0xc000007b)
But if I jmp from the ...
- 81
8
votes
2
answers
5k
views
NOP instruction
I have recently learned that nop instruction is actually xchg eax, eax... what it does is basically exchanges eax with itself.
As far as CPU goes, does the exchange actually happen?
- 145
8
votes
1
answer
944
views
GAS/x86 disassembled a bare gs register as an instruction, is it a bug?
I encountered a strange x86-32 instruction (opcode 0x65) decoded by objdump as gs (not %gs but gs). I found it while a full linear sweep of a binary (objdump -D), so the decoding was surely incorrect. ...
- 19.2k
7
votes
2
answers
18k
views
Import table vs Import Address Table
What's the difference between the Import Table and the Import Address Table?
- 437
7
votes
3
answers
4k
views
Reverse engineering a VC++ video game
So I know x86 machine language and C++/C language. In the last weeks I've dedicated to learn Windows internals and especially PE format. My target is retrieving the Tomb Raider The Angel of Darkness ...
- 421
7
votes
2
answers
2k
views
What's this assembly doing?
I have been trying to figure out the assembly for part of a DOS game and there is an operation that keeps getting called that uses all 4 registers. I can see what each line does but I can't for the ...
- 185
7
votes
2
answers
4k
views
How to recover information stored in .ctors section?
Test is on x86, 32-bit Linux. I am using g++ 4.6.3 and objdump 2.22
Here is a simple C++ code I am working on:
#include <iostream>
using namespace std;
main()
{
cout << "Hello ...
- 2,485
7
votes
1
answer
1k
views
understanding the stack
I have de-assembled a x86 application use ida, it generates
the following code
.text:1084FF10 push ebp
.text:1084FF11 mov ebp, esp
.text:1084FF13 ...
- 226
7
votes
1
answer
4k
views
How to recover the exception info from .gcc_except_table and .eh_handle sections?
For C++ program with try catch defined, when using g++ to compile it into assembly code (test is on x86 32bit Linux, g++ 4.6.3)
g++ -S cppexcept.cc
A specified section called .gcc_except_table is ...
- 2,485
7
votes
1
answer
436
views
How can I check I've moved outside the stack without triggering a protection fault?
I'm adding a feature to my Linux debugger (I'm using Ptrace to manipulate the traced process as well as libbfd/libopcodes) to unwind the stack and determine if discrepancies exist between each CALL's ...
- 1,213
7
votes
1
answer
821
views
Unusual x86 switch statement?
I have come across the following x86 (Built with some version of Visual Studio AFAIK) switch statement:
0x1009E476 cmp edx, 0x3B
0x1009E479 jnz switch_statement
switch_statement:
0x1009E591 movzx ...
- 2,581
7
votes
1
answer
1k
views
WHY and WHEN do we need SEH for buffer overflowing
In our course in university, we recently moved on from standard buffer-overflows to SEH based ones.
My exploit is already ready and working thanks to some nice tutorials, although I am still not sure ...
- 173