Questions tagged [x86]

A family of instruction set architectures originally based on the Intel 8086 CPU that functions with a very wide array of operating systems, including Windows, MacOS X, Linux, BSD, and Solaris.

49 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
1answer
689 views

How can I get the inferred register value for an instruction in Ghidra scripting?

I'd like to get the inferred value of a register at a particular point in the disassembly listing in a Ghidra script. In my case the target instruction is a rdmsr or wrmsr instruction, which reads or ...
3
votes
0answers
69 views

Recognizing instructions containing low-level control flows

There are some x86 instructions which containing a low-level** control flow in its semantics, for example div because its semantics is roughly as: if (source == 0) throw exception... else ...
2
votes
3answers
266 views

Injecting C++ code, while also maximizing compatibility with other injections

Using the New Vegas Script Extender C++ API for Fallout New Vegas, I am able to write to the process' memory directly at runtime through a .dll plugin that's loaded by the NVSE injector. But it is not ...
2
votes
0answers
1k views

How to add symbols from open source lib to Ghidra?

I have a binary which I can tell is using rapidjson (open source C++ library) (header only/not dynamically linked). How can I load debug symbols from that? It would help to see the types, function ...
2
votes
0answers
211 views

IDA Hex-Rays Decompiler Generates ASM Code Issue

For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted. Some of the decompiled generated plain C code, show as ASM code :/ i.e: ...
2
votes
0answers
819 views

loading memory dump into ida pro?

I'm looking for a good method to load custom memory dumps (of usermode processes under Windows) into IDA Pro. These memory dumps may be partial or complete - in terms of other DLLs, such as kernel32, ...
2
votes
0answers
295 views

Calling original function that uses unconventional calling convention

I'm using MinHook to hook a static function with the following signature: float __usercall RadarManager::Add_Blip@<xmm0>(int position@<ecx>, int shape@<edx>, int colorId, float ...
2
votes
0answers
141 views

Instruction and memory tracer for executing program on windows

Anyone know any popular x86 tracer which can capture the instruction and memory change by a running program on windows?
2
votes
0answers
121 views

Trace replayer won't load binary debug information

So I'm debugging a linux application with what I believe DWARF debug information on x86-64 host. Everything is working fine and as expected - the source files are loaded immediately on function ...
2
votes
0answers
535 views

Trying to run MIPS ELF with a cross toolchain but sigbus error

I finally successfuly installed a cross toolchain from this site in order to run and debug a mips elf on my x86-64 . I only have the elf file. I can disassemble it but when i try to run it with : ...
2
votes
0answers
224 views

Ollydbg Instructions Are Splitted

When I am trying to reverse ZeroAccess rootkit, ollydbg shows instructions as seperated like; it should be e874010000 as a single instruction which is a call to some routine but it shows them like ...
2
votes
0answers
246 views

How to include these exception handle symbols in x86 assembly code?

The test is on 32bit x86 Linux, with g++ 4.6.3. So basically I use a IDA pro script to recover the .gcc_excpt_table and .eh_frame sections from binary compiled from C++ language. Basically I want to ...
1
vote
0answers
56 views

Is there a meaning to the test instruction if it isnt followed by a conditional jump?

Pasting a snippet of code I found inside a malware sample. 0040F695 push ecx 0040F696 lea ecx,dword ptr ss:[esp+8] 0040F69A sub ecx,1000 0040F6A0 sub ...
1
vote
0answers
36 views

Instruction-level hooking library for win32?

I am looking for instruction-level hooking library for win32 x86/x64. I want to write hook insertion and hook implementation code in C/C++ (compiled into dll). (Therefore instrumentation tools are ...
1
vote
0answers
374 views

Instruction trace using frida in android emulator

i have a emulator named "Ldplayer" in my windows os and I'm trying to log all instructions executed by the app that uses ARM JNI libraries. basically, the app is running in an x86 emulator ...
1
vote
1answer
270 views

Adding a static variable to Windows DLL

I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls. I ...
1
vote
0answers
157 views

IDA shows MEMORY or unknown references on C std library calls (memset, memcpy, etc.)

I'm currently reversing a Linux 32-bit executable (with a statically linked library included in it) but I'm having a little problem I can't find a solution for. Basically whenever I stumble across a ...
1
vote
0answers
53 views

How does this wannacry sample work?

I downloaded wannacry sample here: https://github.com/fadyosman/WannaCrySample/releases. Don't forget to enter password for archive. I figured out how most of the binary works, except the very last ...
1
vote
0answers
43 views

Memory modified at jump far

Observing a trace of Wow64 switching on Windows 7, the following situation makes me confused ... 0x77491dbe 64 ff 15 c0 00 00 00 call fs:[0xc0] ; syswow64\ntdll.dll 0x74632320 ea 1e 27 63 ...
1
vote
0answers
78 views

Dump the value of register into file

I've reverse engineering little game on windows 32bit. I found a string in executable which was interesting for me (it is a board game and this string represents the fact that somebody made a move ...
1
vote
0answers
107 views

Reproduce compilation (ASM) output for library detection - identifying compiler, version & options used

I want to reverse a stripped x86 sample that uses a static library. So far I could identify the library itself and narrow the version of the library used. Now I want to use Ghidra's Function ID ...
1
vote
0answers
219 views

Mysterious chunk of code in IOLI crackme0x06 challenge

I've been struggling to understand a very strange piece of x86 assembly code from the IOLI crackme0x06 challenge. Context But first of all, here is the context : I've successfully cracked the ...
1
vote
0answers
138 views

Is there a way to generate a PE from a web assembly module?

I am in the process of analysing a large web assembly. I have the compiled .wasm file and using the tools available I can convert this to a .wat text representation. Currently, I am doing the ...
1
vote
0answers
205 views

How can a segfault happen during the libc exit call on Linux?

I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge. While testing, I have noticed ...
1
vote
0answers
515 views

IDA 7 handling strings in debugger pseudocode

When running a remote debugger to a linux server, is there a way to get IDA (7.0) to properly handle strings? When I go to the pseudocode view, I get things like this; v7 = sub_804AD60((std::string *)...
1
vote
0answers
59 views

getting %localappdata% in asm

I have an old windows x86 application that no longer works properly since windows 8. This app creates files within its own folders for things like app settings. Unfortunately, Microsoft no longer ...
1
vote
0answers
53 views

Threads blocking in kernel when I attach, can't control them

I'm attaching to a simple program and the new thread breaks at DbgBreakPoint as expected. I'm using x64dbg (32-bit). The problem is, when I go to the Threads window it shows all the threads' EIPs as ...
1
vote
0answers
247 views

Pointer disassembly

I'm using the Capstone engine to develop an ELF disassembler. I have implemented a linear sweep algorithm as the most basic version. My goal is to implement the recursive traversal now. Consider ...
1
vote
0answers
162 views

windbg stopped after I set up a breakpoint, keeping busing

I'm studying reverse engineering, I wrote the following code to see how it is to pass struct variables in the disassembly. struct s { int a; int b; int c; }; struct s get_some_values(int ...
1
vote
0answers
560 views

Why does clang use ebp relative offsets to put function arguments on the stack?

I've been looking at disassembly of x86 32-bit code generated by GCC vs Clang. Environment is Ubuntu Server 16.04.2 32bit running in VMware. Both are compiled with the same options. No optimizations ...
1
vote
0answers
107 views

Record-replay tools for Windows?

Are there any user-mode record-replay tools for Windows that can capture native execution of a program so that it can be replayed deterministically later? Instructions, memory accesses, syscalls and ...
1
vote
1answer
477 views

Ghidra Decompiler Optimized Strings

Looking at a large x86 binary, I'm seeing lots of instances where strings are assembled on the stack as quadwords like so: If I try to set the type of puStack40 to char[38], I get the following ...
1
vote
1answer
290 views

How to debug a crash in wow64.dll in 32bit process

I have a 32bit application and a few wrapper tools that I use one after another to inject code, hook system dll functions (using the patch-first-bytes-of-the-function-with-jump approach). Also I have ...
0
votes
0answers
27 views

Why would compiler emit a null pointer assignment

I have been reversing a popular Windows application and ended up in a very interesting place while debugging. What I can clearly see as valid x86 instructions that eventually lead to some sort of &...
0
votes
0answers
22 views

How to add include path in Cutter

Hi I have an program waiting for debug. But the executable is based on another so file, which need to be added into LD_LIBRARY_PATH variable. I have search over the internet but cannot find a way of ...
0
votes
0answers
20 views

Tools for tracing down a Windows-specific UUID generation?

I'm have a kind of "Crackme" program that generates a 4-byte Windows system-specific UUID. It doesn't seem to be hardware-dependent - I have created 2 identical Windows 7 virtualboxes - same ...
0
votes
0answers
43 views

Remapping Branch Instructions After Obfuscation

Recently I've been working on a project. I've already got a hint for a problem that I had here: (Garbage Assembly Code Generationat at random offsets) however, the accepted answer's solution doesn't ...
0
votes
3answers
140 views

Order of arguments in __usercall

i have the following function with five arguments: ; int __cdecl trampolineRegister(void) a4= dword ptr 8 a5= dword ptr 0Ch push ebp mov ebp, esp add eax, ...
0
votes
0answers
38 views

Emulator that emulates arm hardware

I want to hook arm instructions as they executes but most of the emulators are based on VirtualBox that uses houdini to translate arm instructions to x86, and i really can't hook a native JNI lib, ...
0
votes
1answer
400 views

Getting function arguments in ida

I'm trying to extract the callee arguments in my intel x86 binary using IDA Pro 7.3. I tried the following line: ida_typeinf.get_arg_addrs(call_address) # call address points at `call some_func` ...
0
votes
0answers
83 views

Some more questions related to C++ exceptions (catchHigh)

I've came up with the most convoluted example but still can't find the purpose of the catchHigh field. I find it that the right handler can be selected simply by looking at the tryblock map from start ...
0
votes
0answers
89 views

Disassembly - First steps

I decided that I need to understand this more thoroughly, so am working in parallel with two resources: one more modern and one original from @Aleph1. In the essay, there is a basic code snippet, ...
0
votes
0answers
47 views

Alternative APIs to hook instead of messagebox for message pop ups?

So i am reversing an app that pops up a message at some point, but its not doing this using messagebox i also tried to pause and then run to user code but didn't work, so what are some of the other ...
0
votes
1answer
365 views

IDA Interpreting mov instructions in a unusual way

When analysing mach-o binaries IDA seems to interpret const/literal part of x86 mov instruction(0x8B) as an offset. Hex rerpresentation: 8B 40 0A Correct assembly: mov eax,DWORD PTR [eax+0x0A] ; 8B ...
0
votes
0answers
401 views

Intercepting syscall in a shared object (dynamically linked)

Ditto. Any technique that allows to intercept sys calls issued from a shared object file? At runtime, the shared object is dlopen'ed by main(). One candidate is to use static binary rewriting (e.g. ...
0
votes
0answers
270 views

Weird self-modify instruction

Trying to finding the main caller of a series of nested function I ended in a switch table (or at least ollydbg says it's so) of address: DD address1 DD address2 DD myfunction DD adress4 .. AND SO ON ...
0
votes
1answer
74 views

Translate ASM code x86 32 bits in C

I have a exercise which i can't resolve it, and i need help. If anyone can help me it would be great. I have the next ASM code in x86 32 bits which i need to translate in C language: Dump of assembler ...
-1
votes
1answer
431 views

How can I convert the following assembly code to pseudo code?

I got the following disassembly code in IDA pro. I really find it hard to convert it into pseudo code. push ebp mov ebp, esp sub esp, 14h mov dword ptr [ebp-14h], 1 mov dword ptr [ebp-10h], 2 mov ...
-1
votes
1answer
259 views

Using x86dbg valid opcodes produce '??? invalid instruction' output

Using the most recent ( as of today ) version of x86dbg I have a problem that follow every executable I have tried. The disassembler in the CPU window, look at the 5th line from the top: Any ideas ...