Questions tagged [x86]

A family of instruction set architectures originally based on the Intel 8086 CPU that functions with a very wide array of operating systems, including Windows, MacOS X, Linux, BSD, and Solaris.

Filter by
Sorted by
Tagged with
1
vote
1answer
400 views

IDA Interpreting mov instructions in a unusual way

When analysing mach-o binaries IDA seems to interpret const/literal part of x86 mov instruction(0x8B) as an offset. Hex rerpresentation: 8B 40 0A Correct assembly: mov eax,DWORD PTR [eax+0x0A] ; 8B ...
0
votes
1answer
71 views

Understanding the meaning of EBP + 0xffff98b4

I'm currently reverse-engineering an old game from 2003 to extend its functionality. I have now found what I am looking for and since it was written in C++ I'm trying to re-create the used classes. I ...
2
votes
1answer
32 views

Why does this hooking function work and never cause a "backwards" jump?

//src = the place to write the hook, dst is the function you jump to, len is length //of stolen bytes (MUST fall on a boundray between instructions) BYTE* TrampHook32(BYTE* src, BYTE* dst, const ...
1
vote
2answers
37 views

IDA decompiler syntax: for function int __usercall sub_45BD46@ <eax>(char a1@<bl>, int a2@<esi>, int a3)

I have a function with the following header sub_45BD46@eax(char a1@bl, int a2@esi, int a3), my question is: I am right that sub_45BD46@eax means the result value is in eax?
0
votes
0answers
17 views

Unable to redirect program because function address is not correctly written to the heap

I have a heap overflow example program (heap0.c)compiled as follows: gcc heap0.c -w -g -no-pie -z execstack -o heap0 In order to overwrite the instruction pointer with (BBBB = \x42\x42\x42\x42), I ...
0
votes
1answer
37 views

Constructors testing for strange in-stack value

This is something that I found in a lot of constructors that have to do with classes that inherit from other classes. I have a vague idea as to why it's done, but I'd rather have it confirmed before ...
1
vote
1answer
55 views

List instructions to fix wrong IDA analysis

I don't want to get too much into detail, but a disastrous chain of events that began with a boolean of incorrect size forced the IDA analyzer to discard a lot of instruction sections of many ...
5
votes
1answer
917 views

How can I get the inferred register value for an instruction in Ghidra scripting?

I'd like to get the inferred value of a register at a particular point in the disassembly listing in a Ghidra script. In my case the target instruction is a rdmsr or wrmsr instruction, which reads or ...
0
votes
1answer
37 views

One class with different sizes

After looking at some basic examples of how C++ classes are compiled by MSVC, I tried to apply the knowledge to a DLL I'm working on. While searching for a class to start with, I came across ...
1
vote
1answer
99 views

How to import x86asm into Ghidra?

I have some assembly code as a .txt file (i.e. a list of the instructions, stuff like this): 00000003 E8D001 call 0x1d6 00000006 A08000 mov al,[0x80] 00000009 0C00 ...
1
vote
1answer
297 views

Adding a static variable to Windows DLL

I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls. I ...
1
vote
1answer
59 views

IDA Pro - configure register clobbering

TL;DR: The __fastcall convention in IDA Pro assumes that all the registers which could be used for transferring parameters are clobbered after a call (tested on x86, clobbered regs are eax, edx, ebx, ...
0
votes
3answers
176 views

Order of arguments in __usercall

I have the following function with five arguments: ; int __cdecl trampolineRegister(void) a4= dword ptr 8 a5= dword ptr 0Ch push ebp mov ebp, esp add eax, ...
8
votes
3answers
6k views

Is there any tool to visually see program stack in linux while debugging?

By stack I mean the location where local variable, return address etc are stored. Which is pointed to by the esp and ebp.
0
votes
2answers
71 views

Why windbg skips syscall on kernel mode?

I have a VM running windows with notepad open, I did list the modules with lm: start end module name 00007ffc`60fb0000 00007ffc`60fe2000 vertdll (deferred) ...
1
vote
1answer
121 views

Binary diff + patching across versions

What are the current options for binary patching which works across different versions of the binary? E.g. we created a binary patch for a specific version of a binary and want to apply that patch to ...
1
vote
0answers
83 views

What is happening with this *param_1?

I am a bit of a starter, so bear with me as I can't find the answer through Google (a common thing in Ghidra work I noticed so far). I have a function that seems to read like it is a Constructor. But ...
4
votes
1answer
96 views

How to reverse engineer a setjmp/longjmp sequence?

I'm trying to reverse engineer the GNU libc x86 (32 bit) setjmp / longjmp (re a vuln which may allow arbitrary overwrite of the jmp_buf env. There's a great writeup of the musl setjmp but I can find ...
2
votes
3answers
294 views

Injecting C++ code, while also maximizing compatibility with other injections

Using the New Vegas Script Extender C++ API for Fallout New Vegas, I am able to write to the process' memory directly at runtime through a .dll plugin that's loaded by the NVSE injector. But it is not ...
0
votes
1answer
547 views

Getting function arguments in ida

I'm trying to extract the callee arguments in my intel x86 binary using IDA Pro 7.3. I tried the following line: ida_typeinf.get_arg_addrs(call_address) # call address points at `call some_func` ...
1
vote
1answer
94 views

What's purpose of mov ebx, [esp+0]?

I'm disassembling one SO library for fun and was wondering what's purpose of following procedure: sub_3699 proc near mov ebx, [esp+0] retn sub_3699 endp It's widely used across entire library ...
0
votes
0answers
42 views

Why would compiler emit a null pointer assignment

I have been reversing a popular Windows application and ended up in a very interesting place while debugging. What I can clearly see as valid x86 instructions that eventually lead to some sort of &...
5
votes
2answers
13k views

Import table vs Import Address Table

What's the difference between the Import Table and the Import Address Table?
0
votes
1answer
125 views

Translate ASM code x86 32 bits in C

I have a exercise which i can't resolve it, and i need help. If anyone can help me it would be great. I have the next ASM code in x86 32 bits which i need to translate in C language: Dump of assembler ...
-1
votes
2answers
3k views

XOR encryption - How to find the key?

I'm trying to solve a crackme which basically uses a XOR encryption scheme in which the password is used as the key to an encrypted buffer which is subsequently executed. The following is the ...
1
vote
2answers
99 views

Can't figure out a crash in IDA "The memory could not be read -> 00000710 (exc.code c0000005, tid 20612)"

I'm trying to debug out a game. Basically, the Steam version works perfectly but the GOG version (which is 8kb smaller) has an annoying problem where for some people (which happen to be me) the game ...
1
vote
1answer
262 views

Changing local variable in caller from callee in C? [closed]

I'm implementing a function which is going to perform some time-consuming task, and I'd like to hack the benchmarking part a bit by changing the variable indicating the CPU time my function has ...
0
votes
1answer
131 views

How do I interpret this double offset?

While looking at that old game I've found a class CStr that is used in an unusual (to me) manner. Most of the times a member of CStr is used, it's done as follows. In both cases, this is a CStr *. ...
1
vote
1answer
79 views

Finding API in ROM dump (DOS debug)

Have dumped the ROM from a HP 200LX using these instructions: debug #Enters the debug mode r bx #Reads the bx register and prompts you to enter a new value 30 #The new value for bx r cx #Reads the cx ...
0
votes
1answer
47 views

How does this function take the argument if its not pushed into the stack?

I dont understand how does the function take the argument without pushing push ebp mov ebp, esp and esp, 0FFFFFFF0h sub esp, 20h mov [esp+20h+var_20], offset aEnterX ; "Enter X:" call _puts
1
vote
1answer
204 views

I'm having trouble understanding this specific notation in Ghidra

I'm reversing a code construct I created to learn Ghidra, and it looks different to what it is in GDB. I was wondering if anyone could clarify what the highlighted LEA instruction means: [I don't know ...
0
votes
0answers
22 views

How to add include path in Cutter

Hi I have an program waiting for debug. But the executable is based on another so file, which need to be added into LD_LIBRARY_PATH variable. I have search over the internet but cannot find a way of ...
0
votes
2answers
80 views

What does the cs register do here?

I've come across this sequence of bytes: 2e 88 38. Hopper disassembles this as: mov byte [cs:rax], bh This online disassembler gives slightly different output: mov BYTE PTR cs:[rax],bh Either ...
1
vote
1answer
218 views

How to write these 4 example x86 assembly instructions in opcodes, according to the Intel docs?

Okay so I have been studying Chapter 2 of Volume 2 of the Intel Manuals. I have as best an understanding as I can get of the ModR/M byte, the REX byte, the SIB byte, and the general instruction ...
2
votes
1answer
99 views

What is the mdisp field in RTTI for throw used for?

First of here is the article from which I'm looking up the fields. I was trying out different combinations to see how they affect the RTTI for a C++ throw. It seems that having a virtual base class ...
1
vote
1answer
818 views

startup program exits with code 126 when executing program at entrypoint

I want to reverse engineer a program. I managed to find the entry point but every time I want to launch the application I get the same error `During startup program exited with code 126. Here is what ...
0
votes
1answer
95 views

A question about moving data with LEA and MOV

Given the above code, i am struggling to understand what happens in line 5 and 6 As i understand it, in line 5 the Adress of the ESP is loaded into the EAX register. While there may be the value 4 ...
1
vote
1answer
93 views

How to change local_184h to skip past jump commands with Radare2?

I am trying to solve a CTF challenge but I am very much out of my depth and nothing online is helping me very much. This is what I'm working with currently | 0x55b3fd508a41 4889e5 ...
3
votes
1answer
69 views

Confused about the use of the shl instruction in this disassembly

I created a code construct in C to see how it looks in x86. I'm confused about the use of the shl instructions. I'm confused about what is happening in between the lines <+39> and <+51> I ...
1
vote
1answer
2k views

Intel PIN: How to log the value of the fs and gs registers at every instruction?

I modified the pinatrace pintool example and managed to log all values of the "regular" registers: VOID Instruction(INS ins, VOID *v) { ... // Instrument REGISTER writes using a predicated ...
24
votes
8answers
4k views

How are x86 CPU instructions encoded?

I'm writing a small utility library for hooking functions at run time. I need to find out the length of the first few instructions because I don't want to assume anything or require the developer to ...
0
votes
0answers
26 views

Tools for tracing down a Windows-specific UUID generation?

I'm have a kind of "Crackme" program that generates a 4-byte Windows system-specific UUID. It doesn't seem to be hardware-dependent - I have created 2 identical Windows 7 virtualboxes - same ...
1
vote
2answers
111 views

Why eax is assigned to 'variable looked' like addresses

#include <stdio.h> int main() { int number1, number2, sum; printf("Enter two integers: "); scanf("%d %d", &number1, &number2); sum = number1 + ...
2
votes
2answers
128 views

How to test and debug x86 Assembly exceptions in NASM?

I have seen all the exception "IDs" in the Intel Manuals, and just came across sandpile's exception guide, which actually shows some hexcodes. For example, "divide by zero error": ...
1
vote
1answer
95 views

How do you build a virtual machine to interpret machine code?

How does the parser parse the machine code? Does it go byte by byte? How does it know how many bytes to read when parsing an instruction? Does it have some sorts of tables of bytes to translate the ...
11
votes
4answers
7k views

How can I generate a call graph from an unstripped x86 Linux ELF?

There's a piece of software, for which I only have the binary, not the source code. It's: unobfuscated (so, not polymorphic or anything. It is optimized a bit, though) unstripped x86 32 bit ...
8
votes
3answers
90k views

How to obtain x86-64 pseudocode in IDA Pro?

Does anyone know about obtaining pseudocode for x86-64 in IDA Pro? I already tried the Hex-Rays plugin to obtain pseudocode, but when I try it, the following error pops up: "only 32bit code is ...
1
vote
1answer
63 views

How to split bytes into instructions in binary ELF file for x86

I'm working on a static code injector for ELF files. I need to "steal" some bytes in order to write jump to my code on their place and then execute stolen instructions somewhere in the ...
3
votes
1answer
1k views

Correct way to understand local_ in ghidra disassembly

Attached is the part of a disassembled main from a x86 binary file, generated by ghidra. ************************************************************** ...
1
vote
0answers
42 views

Weird x86 function calling convention [duplicate]

I have come across some weird function. It's in an x86 LE Windows executable compiled with Visual Studio and linking to v100 runtime. The function seems to be an __stdcall as it ends with a move into ...

1
2 3 4 5
9