Questions tagged [x86]

A family of instruction set architectures originally based on the Intel 8086 CPU that functions with a very wide array of operating systems, including Windows, MacOS X, Linux, BSD, and Solaris.

Filter by
Sorted by
Tagged with
1
vote
1answer
97 views

What type of function gets called using a register instead of address in the binary? how to find the address statically?

So I'm trying to write a reversing tool right now and trying to make a CALL graph the problem I'm having is some calls are like Call *eax instead Call 'address' I can easily generate the call-graph ...
2
votes
1answer
507 views

What's the effect of adding a REP(N(E)) prefix to a JMP instruction?

I'm attempting to reverse engineer an executable packer, and I'm a little stumped on this x86 instruction: F2 EB F5 repne jmp short near ptr unk_88801B According to the Intel manual a repeat ...
1
vote
4answers
182 views

Modify formula by adding a subtraction

I have the following Assembler Code in a x86 Program and I need to modify it as it is buggy: fld ds:(flt_203B8 - 29C48h)[ebx] fdivr dword ptr [esi+44h] fmul ds:(flt_203BC - 29C48h)[ebx] ...
-1
votes
1answer
431 views

How can I convert the following assembly code to pseudo code?

I got the following disassembly code in IDA pro. I really find it hard to convert it into pseudo code. push ebp mov ebp, esp sub esp, 14h mov dword ptr [ebp-14h], 1 mov dword ptr [ebp-10h], 2 mov ...
-1
votes
1answer
589 views

How can I convert the following disassembly code to pseudo code or C code?

I used IDA pro to get the following disassembly code. I am having difficulty converting it into the equivalent c code. mov dword ptr [ebp-8], 1 mov dword ptr [ebp-4], 0 loc_401014: cmp dword ptr [...
1
vote
0answers
138 views

Is there a way to generate a PE from a web assembly module?

I am in the process of analysing a large web assembly. I have the compiled .wasm file and using the tools available I can convert this to a .wat text representation. Currently, I am doing the ...
0
votes
2answers
819 views

What's happening in the assembly main function?

I'm currently inspecting a 32-bit malware executable in a WinXP VM using IDA Pro (free version). I don't understand what's happening in the main function here. Where should I set the breakpoints (...
4
votes
2answers
9k views

How the CMP instruction uses condition flags?

I am trying to figure out the behavior of conditional jumps (JE/JNE, JZ/JNZ) in the x86 instruction set familly. Which condition flags CMP instruction sets and how, if the result is equal and if it ...
1
vote
1answer
3k views

How does the x86 instruction, call 135b<__x86.get_pc_thunk.ax> work?

I think the below instruction is used for position independent code. Could anyone please help me understand how it works? call 135b<__x86.get_pc_thunk.ax> What are the use of the below ...
1
vote
1answer
505 views

debugging with radare2

I am using radare2 for disassemble an x86 binary: $ r2 ./mynbinary [0x00001000]> aaa ... [0x00001000]> pdf ;-- section..text: ;-- section.LOAD1: ;-- rip: / (...
0
votes
1answer
114 views

Why Ida pseudo-code translate test as AND?

In IDA when disassembling a x86 EXE file there is a line test byte ptr [ebp+XXX], cl Before this line cl has a value of 0x11 The Hex-Rays decompiler plugin translates it as if (v10 &0x11). Why ...
1
vote
2answers
166 views

Assembly that just seems to be a jumble

I've disassembled an old DOS program into assembly and I'm trying to figure out a function call. Here is the ASM: seg000:373C ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦...
7
votes
2answers
1k views

What's this assembly doing?

I have been trying to figure out the assembly for part of a DOS game and there is an operation that keeps getting called that uses all 4 registers. I can see what each line does but I can't for the ...
-2
votes
1answer
211 views

Can anyone please explain the following dissasembly codes?

Disassembly: 0: 31 c9 xor ecx,ecx 2: f7 e1 mul ecx 4: 51 push ecx 5: 68 2f 2f 73 68 push 0x68732f2f a: 68 2f 62 69 ...
1
vote
1answer
212 views

How to set a breakpoint in an execve'd program in radare2?

If I have a program A, which uses execve to run program B. How can I set a breakpoint in program B's main routine if I'm debugging program A? After a certain point in the execve routine, program B ...
1
vote
1answer
986 views

Understand the CPU cycles of x86 instruction bsr/bsf

I am on the hook to analysis some "timing channels" of some x86 binary code. I am posting one question to comprehend bsf/bsr opcode. So high-levelly, these two opcodes can be modeled as a "loop", ...
-1
votes
2answers
2k views

XOR encryption - How to find the key?

I'm trying to solve a crackme which basically uses a XOR encryption scheme in which the password is used as the key to an encrypted buffer which is subsequently executed. The following is the ...
1
vote
0answers
205 views

How can a segfault happen during the libc exit call on Linux?

I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge. While testing, I have noticed ...
0
votes
1answer
2k views

x64dbg - Conditional breakpoint based on function argument

How can I set a conditional breakpoint based on the argument of a function? I am trying to break on the windows function LoadLibraryExW: https://docs.microsoft.com/en-us/windows/desktop/api/...
5
votes
1answer
958 views

Radare2 Disassembler How Do You Organize Visual Panels (V!)?

I would like to use Radare2 to learn about how C is assembled into assembly but I am having trouble with the layout. I think the V! mode would be very handy as you can watch the registers update as ...
4
votes
1answer
1k views

How do the PSHUFLW and PSHUFD instructions work?

I have been trying to figure out exactly what is happening with these instructions and can't make sense of them. I can see that the PSHUFLW instruction acts upon the first 16 bytes of the XMM register ...
1
vote
1answer
242 views

How is the I/O address space on the PC arranged?

I'm disassembling a 16-bit DOS executable, and looking at the following three instructions: mov dx,0x3ce mov ax,0xff08 out dx,ax I know it writes the value 0xff08 to I/O port 0x3ce. I also know that ...
4
votes
1answer
381 views

Undocumented MSR Machine Specific register

I'm reversing the BIOS of my laptop, for fun and for learning something new. Inside it, I just stepped into this piece of code: mov ecx, 13Ah rdmsr and eax, 1 jnz SkipCacheAsRAM Looking ...
1
vote
1answer
288 views

IDA - large jump table, missing cases in analysis

I have come across the following jump table with a large amount of cases (160+). There seems to be cases missing from IDAs analysis though. For example it skips from cases 22 -> 38 -> 91, and I can ...
1
vote
2answers
517 views

Lots of mov instructions into ebp+offset - What is happening?

While learning RE I have come across this large segment of instructions that contains a majority of mov [ebp+offset], value instructions. I believe that ebp + offset are local variables? I think? ...
0
votes
1answer
365 views

IDA Interpreting mov instructions in a unusual way

When analysing mach-o binaries IDA seems to interpret const/literal part of x86 mov instruction(0x8B) as an offset. Hex rerpresentation: 8B 40 0A Correct assembly: mov eax,DWORD PTR [eax+0x0A] ; 8B ...
6
votes
1answer
551 views

Simplifying assembly

I'm analysing some binary trace, it's pretty much obfuscated. What I need to do is to understand work flow of its alghoritms. However I cannot find any reliable tool which would help me with that. I ...
1
vote
1answer
402 views

What purpose of MOVZX EAX,AX after MOVZX EAX, WORD PTR [RBP+ADDR.SA_DATA]?

I thought it was strange when I was looking at the code below. The first instruction clearly has completed the task of data transfer and expansion into 16 bits. Why is there a "mov Eax,ax" in the ...
-1
votes
1answer
3k views

How to convert assembly to pseudo code? [closed]

I have the following assembly. I don't know how to follow assembly. I was wondering if there is a way to convert assembly to a human readable pseudo code or better yet C code: init: mov eax, [ebp+...
2
votes
1answer
145 views

Call instruction changed while running

While debugging and reverse-engineering my exe, I have found a very weird thing. call ds:GetModuleFileNameA This call instruction is formed with below hex bytes in IDA. FF 15 24 C0 41 00 (I think ...
0
votes
1answer
309 views

How to locate an specific data structure in an executable?

I need to locate an specific "struct" variable in the data section from an assembly. This structure is used for an specific System Function (Windows) "SetCommState()". I'm wondering how to locate the ...
2
votes
1answer
5k views

What does fs and gs registers provide in Linux?

In a 64 bit ELF binary I found it mainly uses fs register to get some values. How can I know which value it wants to access? I'm familiar with that NT kernel uses fs and gs register for TEB structure ...
1
vote
1answer
244 views

While loop function disassembly x86

I am trying to convert this binary to C but I am having trouble with the while loop. What does sub esp, 8 mean? as well as push [ebp+_a] ? I am able to get the esp 8 sometimes while changing the ...
0
votes
1answer
180 views

Where to find address of registers populated in a binary

This question might sound very naive, however, I got stuck when one of my friends asked me where can I find the address of an initialized register in the stack. For e.g., info registers in gdb gives ...
1
vote
0answers
515 views

IDA 7 handling strings in debugger pseudocode

When running a remote debugger to a linux server, is there a way to get IDA (7.0) to properly handle strings? When I go to the pseudocode view, I get things like this; v7 = sub_804AD60((std::string *)...
3
votes
1answer
266 views

Finding the main function without symbols

for a C/C++ program compiled on windows using the x86 architecture, what is the best way to find the main function within disassembled code? I've found various answers to questions similar to this, ...
1
vote
1answer
253 views

Changing local variable in caller from callee in C? [closed]

I'm implementing a function which is going to perform some time-consuming task, and I'd like to hack the benchmarking part a bit by changing the variable indicating the CPU time my function has ...
3
votes
1answer
792 views

XCHG RAX, RAX: 0x09, what does this code do and how does it work?

Given the following short assembly snippet: shr rax, 3 adc rax, 0 I worked this out a bit: We know SHR sets the CF with the last bit shifted. We know ADC dest, 0 is just adding the CF. So ...
0
votes
1answer
207 views

XCHG RAX, RAX: 0x03, what does this code do and how does it work?

"XCHG RAX, RAX" is a kind of riddle book that provides assembly code for you to reverse and undercover the meaning. Some of the examples calculate the Fibonacci sequence others bit-twiddle to toggle ...
1
vote
0answers
59 views

getting %localappdata% in asm

I have an old windows x86 application that no longer works properly since windows 8. This app creates files within its own folders for things like app settings. Unfortunately, Microsoft no longer ...
2
votes
2answers
1k views

Why there are two different shellcodes for bin/sh with much different syntax and which one is better to use? (x86)

I have found two shellcodes for spawning /bin/sh which are much different from each other. The second one is hardly ever found on the net, and it mostly comes up in reverse engineering websites: 1. "\...
1
vote
1answer
934 views

Is the value of EBP before the main function important?

So before we come to the main function, it looks we are in a function with a name __libc_start_main and before we come to our main function we obviously push EBP value in the stack ( the value of EBP ...
1
vote
2answers
971 views

Getting opcode Length , How to

I am apparently not very good with assembly as I am novice to somethings! Hence i wanted to make a question again. Now i got this from here to make something like a LDE (Length Disassembly Engine) ...
4
votes
4answers
5k views

Calculation of jmp address through subtraction

I don't get why the two addresses of the functions are subtracted in order to get the jump destination. mov eax, [ebp+func1] sub eax, [ebp+func2] sub eax, 5 mov [ebp+var_4], eax Which ...
1
vote
1answer
788 views

What is the password to this file? I can't figure it out with radare2 or gdb

Here is the binary file. https://drive.google.com/file/d/1ywN60yZYIhPPRyZMGbQudZRYoLYBhkeJ/view?usp=sharing I am able to figure out some of the assembly, but can't get the correct password. I know ...
10
votes
2answers
561 views

How did this 80286 detection code work?

I'm poking through a disassembled 16-bit DOS game circa 1992. The original system requirements state that the game needs an IBM AT-compatible machine or later, with the 286 processor, to run. And ...
7
votes
1answer
851 views

WHY and WHEN do we need SEH for buffer overflowing

In our course in university, we recently moved on from standard buffer-overflows to SEH based ones. My exploit is already ready and working thanks to some nice tutorials, although I am still not sure ...
3
votes
0answers
69 views

Recognizing instructions containing low-level control flows

There are some x86 instructions which containing a low-level** control flow in its semantics, for example div because its semantics is roughly as: if (source == 0) throw exception... else ...
6
votes
2answers
3k views

What are the difference syscall and int 0x2E instructions?

From this question: How does the Windows Native API communicate with the kernel? Here is an example of ZwClose(HANDLE Handle); system call in NTDLL.DLL in Windows 10 X86_64: NtClose proc near ...
2
votes
1answer
1k views

XMM register instructions and their c equivalents

I'm trying to convert some x86 assembly back into C++, and I cannot figure out how this set of instructions was originally written. movd xmm0,eax ; byte read from device '0x04' cvtdq2pd xmm0,xmm0 ; ...

1 2
3
4 5
9