Questions tagged [x86]

A family of instruction set architectures originally based on the Intel 8086 CPU that functions with a very wide array of operating systems, including Windows, MacOS X, Linux, BSD, and Solaris.

35 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
167 views

What is the pictured x86 technique/area called?

I've been reverse-engineering Windows PE files and I've discovered this pattern used quite often, making it a little more difficult to follow API calls. First, I'll go to the file's imports and then I ...
3
votes
1answer
81 views

How to find the index of static ilbrary functions in the PLT of the binary?

So right now I'm trying to resolve function calls and their names in my reversing tool the problem I'm having is that library functions such as printf and fwrite and such do not have a corresponding ...
3
votes
0answers
62 views

Recognizing instructions containing low-level control flows

There are some x86 instructions which containing a low-level** control flow in its semantics, for example div because its semantics is roughly as: if (source == 0) throw exception... else ...
2
votes
0answers
104 views

IDA Hex-Rays Decompiler Generates ASM Code Issue

For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted. Some of the decompiled generated plain C code, show as ASM code :/ i.e: ...
2
votes
1answer
169 views

Changing parameters in an OS X executable

very new here so please bear with me. I'm an artist trying to realise an idea for a camera that takes photos every X interval during a month. Everything works, except that the app with which I ...
2
votes
0answers
145 views

Calling original function that uses unconventional calling convention

I'm using MinHook to hook a static function with the following signature: float __usercall RadarManager::Add_Blip@<xmm0>(int position@<ecx>, int shape@<edx>, int colorId, float ...
2
votes
0answers
121 views

Instruction and memory tracer for executing program on windows

Anyone know any popular x86 tracer which can capture the instruction and memory change by a running program on windows?
2
votes
0answers
100 views

Trace replayer won't load binary debug information

So I'm debugging a linux application with what I believe DWARF debug information on x86-64 host. Everything is working fine and as expected - the source files are loaded immediately on function ...
2
votes
0answers
454 views

Trying to run MIPS ELF with a cross toolchain but sigbus error

I finally successfuly installed a cross toolchain from this site in order to run and debug a mips elf on my x86-64 . I only have the elf file. I can disassemble it but when i try to run it with : ...
2
votes
0answers
179 views

Ollydbg Instructions Are Splitted

When I am trying to reverse ZeroAccess rootkit, ollydbg shows instructions as seperated like; it should be e874010000 as a single instruction which is a call to some routine but it shows them like ...
2
votes
0answers
225 views

How to include these exception handle symbols in x86 assembly code?

The test is on 32bit x86 Linux, with g++ 4.6.3. So basically I use a IDA pro script to recover the .gcc_excpt_table and .eh_frame sections from binary compiled from C++ language. Basically I want to ...
1
vote
0answers
59 views

Dump the value of register into file

I've reverse engineering little game on windows 32bit. I found a string in executable which was interesting for me (it is a board game and this string represents the fact that somebody made a move ...
1
vote
0answers
40 views

Reproduce compilation (ASM) output for library detection - identifying compiler, version & options used

I want to reverse a stripped x86 sample that uses a static library. So far I could identify the library itself and narrow the version of the library used. Now I want to use Ghidra's Function ID ...
1
vote
0answers
111 views

Mysterious chunk of code in IOLI crackme0x06 challenge

I've been struggling to understand a very strange piece of x86 assembly code from the IOLI crackme0x06 challenge. Context But first of all, here is the context : I've successfully cracked the ...
1
vote
0answers
61 views

Is there a way to generate a PE from a web assembly module?

I am in the process of analysing a large web assembly. I have the compiled .wasm file and using the tools available I can convert this to a .wat text representation. Currently, I am doing the ...
1
vote
0answers
64 views

How can a segfault happen during the libc exit call on Linux?

I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge. While testing, I have noticed ...
1
vote
0answers
152 views

IDA 7 handling strings in debugger pseudocode

When running a remote debugger to a linux server, is there a way to get IDA (7.0) to properly handle strings? When I go to the pseudocode view, I get things like this; v7 = sub_804AD60((std::string *)...
1
vote
0answers
48 views

getting %localappdata% in asm

I have an old windows x86 application that no longer works properly since windows 8. This app creates files within its own folders for things like app settings. Unfortunately, Microsoft no longer ...
1
vote
0answers
44 views

Threads blocking in kernel when I attach, can't control them

I'm attaching to a simple program and the new thread breaks at DbgBreakPoint as expected. I'm using x64dbg (32-bit). The problem is, when I go to the Threads window it shows all the threads' EIPs as ...
1
vote
0answers
235 views

loading memory dump into ida pro?

I'm looking for a good method to load custom memory dumps (of usermode processes under Windows) into IDA Pro. These memory dumps may be partial or complete - in terms of other DLLs, such as kernel32, ...
1
vote
0answers
143 views

Pointer disassembly

I'm using the Capstone engine to develop an ELF disassembler. I have implemented a linear sweep algorithm as the most basic version. My goal is to implement the recursive traversal now. Consider ...
1
vote
0answers
111 views

windbg stopped after I set up a breakpoint, keeping busing

I'm studying reverse engineering, I wrote the following code to see how it is to pass struct variables in the disassembly. struct s { int a; int b; int c; }; struct s get_some_values(int ...
1
vote
0answers
423 views

Why does clang use ebp relative offsets to put function arguments on the stack?

I've been looking at disassembly of x86 32-bit code generated by GCC vs Clang. Environment is Ubuntu Server 16.04.2 32bit running in VMware. Both are compiled with the same options. No optimizations ...
1
vote
0answers
101 views

Record-replay tools for Windows?

Are there any user-mode record-replay tools for Windows that can capture native execution of a program so that it can be replayed deterministically later? Instructions, memory accesses, syscalls and ...
1
vote
1answer
123 views

How to debug a crash in wow64.dll in 32bit process

I have a 32bit application and a few wrapper tools that I use one after another to inject code, hook system dll functions (using the patch-first-bytes-of-the-function-with-jump approach). Also I have ...
0
votes
1answer
54 views

Find the call function of a string

On a 16bit real mode x86 program I can locate a string that is displayed on screen. How do I go about finding all the places this string is called from to trace back the "print" function?
0
votes
1answer
109 views

Weird IDA/Decompiler floating point output

I stumbled upon this (reduced for readability) function. It does weird things that I have never encountered before. // a2 is always 60.0 void some_function(struct_123 *this, float a1, float a2) { ...
0
votes
0answers
46 views

Decode message in esoteric audio file

I'm having a reverse engineering lab at school and my last project is to beat a 10 level reverse engineering CTF-like challenge. It's got plenty of interesting things. What I need to do is find a ...
0
votes
1answer
54 views

ACCESS_VIOLATION when attaching a debugger

I'm debugging a software and it hits access violation on wcslen function under debugger but runs normally without it. First I thought It had some anti-debug trick, but I could not found any ...
0
votes
1answer
115 views

IDA Interpreting mov instructions in a unusual way

When analysing mach-o binaries IDA seems to interpret const/literal part of x86 mov instruction(0x8B) as an offset. Hex rerpresentation: 8B 40 0A Correct assembly: mov eax,DWORD PTR [eax+0x0A] ; 8B ...
0
votes
1answer
112 views

Changing local variable in caller from callee in C?

I'm implementing a function which is going to perform some time-consuming task, and I'd like to hack the benchmarking part a bit by changing the variable indicating the CPU time my function has ...
0
votes
0answers
334 views

Intercepting syscall in a shared object (dynamically linked)

Ditto. Any technique that allows to intercept sys calls issued from a shared object file? At runtime, the shared object is dlopen'ed by main(). One candidate is to use static binary rewriting (e.g. ...
0
votes
0answers
241 views

Weird self-modify instruction

Trying to finding the main caller of a series of nested function I ended in a switch table (or at least ollydbg says it's so) of address: DD address1 DD address2 DD myfunction DD adress4 .. AND SO ON ...
-1
votes
1answer
120 views

How can I convert the following assembly code to pseudo code?

I got the following disassembly code in IDA pro. I really find it hard to convert it into pseudo code. push ebp mov ebp, esp sub esp, 14h mov dword ptr [ebp-14h], 1 mov dword ptr [ebp-10h], 2 mov ...
-1
votes
1answer
216 views

Using x86dbg valid opcodes produce '??? invalid instruction' output

Using the most recent ( as of today ) version of x86dbg I have a problem that follow every executable I have tried. The disassembler in the CPU window, look at the 5th line from the top: Any ideas ...