Questions tagged [x86]

A family of instruction set architectures originally based on the Intel 8086 CPU that functions with a very wide array of operating systems, including Windows, MacOS X, Linux, BSD, and Solaris.

Filter by
Sorted by
Tagged with
1
vote
4answers
116 views

What is the need of the Rotation Operation?

I know that shl instruction is like the mul operation and the shr instruction is like the div operation and it's used for optimization. For example, shl eax, n is a more efficient way to implement ...
0
votes
1answer
121 views

Why is using a 32bit system over 64bit recommended for people that are new to reverse engineering? [closed]

I am new to the world of reverse engineering and have been recommended by a number of people that I should start with IA32 because it is easier to learn the concepts. Aside from differences in the ...
3
votes
0answers
344 views

What does fs register value mean in x86 application? [duplicate]

I know that FS points to Thread Environment Block - which is seen by the address at the right part of what OllyDbg shows: What does this value 0x53 mean? Does it have some connection with the address ...
2
votes
1answer
628 views

LEA assembly instruction

I am reading through the 'Practical Malware Analysis' book and got to page 74 which says: lea ebx, [eax*4+4] is the functional equivalent of ebx = (eax+1)* 5 where eax is a number. As of my ...
1
vote
0answers
422 views

Why does clang use ebp relative offsets to put function arguments on the stack?

I've been looking at disassembly of x86 32-bit code generated by GCC vs Clang. Environment is Ubuntu Server 16.04.2 32bit running in VMware. Both are compiled with the same options. No optimizations ...
2
votes
1answer
124 views

Determining an application's library call behaviour

I have a closed source Linux library libfoo that makes calls into another closed source library libbar for additional (mostly unneeded) features. However, I can't use libbar for ethical reasons, so I ...
1
vote
1answer
541 views

Why always get the message “Illegal Instruction (core dumped)”?

I tried to exploiting buffer overflow. In the exploit code I use the Aleph-One shellcode. "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\...
2
votes
0answers
120 views

Instruction and memory tracer for executing program on windows

Anyone know any popular x86 tracer which can capture the instruction and memory change by a running program on windows?
4
votes
0answers
167 views

What is the pictured x86 technique/area called?

I've been reverse-engineering Windows PE files and I've discovered this pattern used quite often, making it a little more difficult to follow API calls. First, I'll go to the file's imports and then I ...
1
vote
1answer
731 views

SHL with 0 operand

in the snippet below of x86 assembly code that was produced by Visual Studio 2017, I see the instruction shl eax,0 What is the purpose of this instruction, as It should act as NOP as I ...
1
vote
1answer
148 views

Length requirement on IOLI crackme input

So I'm just starting to learn reverse engineering and binary exploitation and going through the RPI course where the first lab set is drawn from the IOLI crackmes available on Github. I could post all ...
2
votes
3answers
859 views

legitimate memory pages that are marked as RWX?

In windows and linux x86 (including x86_64) world, is there any legitimate binary (i.e., a program binary generated by the typical compiling-assembling-linking flow and no manual editing on binary ...
3
votes
1answer
19k views

What does the `TEST` instruction do

I'm having trouble understanding the TEST instruction and its use. I'm looking at the following code at the end of a loop 0040A3D1 A9 00010181 TEST EAX,81010100 0040A3D6 74 E8 ...
6
votes
2answers
2k views

What is the purpose of these instructions before the main preamble?

I wrote a small C program below: #include <stdlib.h> int sub(int x, int y){ return 2*x+y; } int main(int argc, char ** argv){ int a; a = atoi(argv[1]); return sub(argc,a); } Compiled ...
0
votes
3answers
857 views

Does x86 instruction SHL/SHR actually rotate the bits?

I was debugging a program. When the register di=0x01, cl=0x11, The instruction "shl di,cl" will actually make di=0x1. Shouldn't the bits that slide off the end disappear?
7
votes
2answers
960 views

basic reversing question about local variable

I do not understand the following: in a very simple dummy C function: void vulnerable_function(char* string) { char buffer[100]; } When I use gdb to disassemble it, I obtain: 0x08048464 <+...
2
votes
2answers
2k views

Disassembling an MS-DOS EXE

I've been disassembling an MS-DOS EXE and I've been using this link http://www.delorie.com/djgpp/doc/exe/ to make heads and tails of the binary. The header seems to be an older version compared to ...
0
votes
1answer
267 views

My nopsled getting Segmentation fault (core dumped)

After overwrite the EIP register, I try breakpoint on the function strcpy() and then run the program after a breakpoint in the debugger. Then I check the ESP register : (gdb) i r esp esp ...
-3
votes
1answer
744 views

How should i read this assembly? [closed]

how should I read this and what does it do? .text:00400526 (main): .text:00400526 55 push %rbp .text:00400527 48 89 e5 mov %rsp,%rbp .text:...
3
votes
1answer
585 views

How should I approach a basic CTF exploitation challenge?

Complete newbie alert so apologies on what you're about to read. I've an executable I'm working with to achieve buffer overflow on. This is for an old CTF that has been and gone but I chose it to ...
-1
votes
1answer
1k views

How ret know where eip is saved?

I'm learning assembly and I have one question. Example: int main() { foo(a); } int foo (x) { return 0; } when the foo function returns to main the ret instruction is executed. How does the ...
3
votes
2answers
1k views

How are addresses calculated from the values in x86 segment registers?

How are the 16-bit values in segment registers used to represent large memory addresses? ES 0023 32bit 0(FFFFFFFF) CS 001B 32bit 0(FFFFFFFF) SS 0023 32bit 0(FFFFFFFF) DS 0023 32bit 0(FFFFFFFF) FS ...
0
votes
1answer
284 views

Change of offset in instruction?

I am learning assembly and injections at the moment. Therefore I wrote a little program which simply prints out a hardcoded string. If I attach ollydbg to that I can inspect the executable I ...
0
votes
3answers
320 views

What exactly is this piece of assembly code doing?

This assembly is for Intel x86-64 bit, seems to be too baffling to me. How come the jz instruction jump to a non-instruction (0x400AC9)? How come the call invokes a non-existing address? For curious ...
-2
votes
1answer
419 views

How decompilation works? [closed]

what is the theory behind the subject of translate assembly code to pseudo code? Could you explain few words ? Also some book about it?
0
votes
2answers
207 views

How to perform memory address translation on x86 instructions?

I have a mechanism that maps memory addresses to other memory addresses, e.g.: { 0x10000 -> 0xA0000 0x20000 -> 0x99000000 0x340000 -> 0x50000000 ; Stack in this example } Some example ...
1
vote
2answers
399 views

Modify program's registry accesses from HKLM to HKCU in assembly

I have a game on my PC that reads and writes registry keys and values to the HKLM hive. I am trying to see if it is possible to modify the game so that it uses the HKCU hive instead. The source code ...
3
votes
1answer
1k views

How can I extract the structure of an operand with displacement in IDAPython?

Consider the following instruction: 8D 8C 4E B0 2F FF FF LEA ECX, [ESI+ECX*2-0xD050] Using IDAPython, how can I extract the structure of the second operand? I'd like to know things like: ESI is ...
0
votes
1answer
2k views

x86 sbb with same register as first and second operand

I am analyzing a sequence of x86 instructions, and become confused with the following code: 135328495: sbb edx, edx 135328497: neg edx 135328499: test edx, edx 135328503: jz 0x810f31c I understand ...
-1
votes
3answers
510 views

What are 'var_8', 'var_C' actually mean?

I am sorry if this is really a silly question. I am trying to learn reverse engineering. What I can't understand is those 'var_8', 'var_12'. Are they just variables? What are the use of them in the ...
2
votes
2answers
1k views

Translating x86-64 assembly to C

I'm trying to convert x86-64 assembly into C code, but am still unsure about some of the lines. This is the assembly code: .... pushq %rbp movq %rsp, %rbp subq $20, %rsp movl %edi, -...
0
votes
1answer
177 views

Linked list in IDA

I debug a program with IDA, it have a part of code that i don't understand loc_8048E30: ; CODE XREF: phase_6+9Ej .text:08048E30 mov esi, [esi+8] .text:08048E33 inc ...
3
votes
1answer
861 views

Good foundation for reverse engineering malware

I have been intrigued by reverse engineering recently and just finished Paul Carter's PC Assembly Language book (http://pacman128.github.io/static/pcasm-book.pdf) which was a great primer for x86. My ...
0
votes
1answer
632 views

Stack pointer values in IDA Pro

I wonder why the values of the stack pointer in IDA Pro have similar values. Can anyone explain their meaning?
0
votes
1answer
104 views

Advice on creating a reverse engineering introduction course? [closed]

I'm organizing an introduction to reverse engineering weekend class in my city and wanted to get some feedback and advice on how to structure it. I'm considering two 5 hour sessions. The objective is ...
0
votes
1answer
267 views

Why ida use redundant registers?

I wrote a statement in visual studio. int sum(int a, int b){ return a + b; } int main(){ tong(3,4); return 0; } And aften i use ida pro Disassembly it. And my function tong has ...
2
votes
2answers
306 views

Programmatically reverse-engineering a dynamic dispatch method

Background: I want to convert Qt RTTI into symbols, to more easily navigate a large executable. If you don't know already, Qt is a C++ application framework based on a message passing system. Since C+...
3
votes
1answer
3k views

What does arg_0 = dword ptr 4 mean?

I try to use IDA dissembler and I don't really understand the following text paragraphs appearing at the head of functions: arg_0 = dword ptr 4 Can anyone explain their meaning?
2
votes
1answer
461 views

Reverse Engineering Windows kernel routines

Problem I'm trying to reverse engineer some Windows kernel routines on a Windows 7 x86 (Home Basic) VM with kd. I have already reversed KeInitializeDpc by disassambling it. The problem with ...
1
vote
1answer
999 views

Intel PIN: How to log the value of the fs and gs registers at every instruction?

I modified the pinatrace pintool example and managed to log all values of the "regular" registers: VOID Instruction(INS ins, VOID *v) { ... // Instrument REGISTER writes using a predicated call, i....
3
votes
1answer
1k views

Getting Access Violation when patching a program

I'm very very newbie in assembly / ollydbg / reverse engineering. I'm totally lost with this error. I have created a simple program in Delphi, just to explore in ollydbg. Here is the program's code: ...
0
votes
1answer
70 views

Is it possible to change/disable the keybindings for a game by modifying the exe using x64db or a similar program? [closed]

So I have a game I've been making mods for. I'd rather not reference the title here to avoid it showing up in google searches and leading people to exploits. By, default, it doesn't allow keybind ...
0
votes
2answers
248 views

Static Linking as an anti-RE method?

A lot of reverse engineering tutorials I've seen involve using the import address table to determine what functions a program calls based on which libraries it imports. But doesn't static linking a ...
1
vote
0answers
101 views

Record-replay tools for Windows?

Are there any user-mode record-replay tools for Windows that can capture native execution of a program so that it can be replayed deterministically later? Instructions, memory accesses, syscalls and ...
0
votes
2answers
1k views

Intel syntax - Meaning of jmp/call instruction with $+5 operand

I'm currently parsing a lot of assembly files and don't understand a specific jmp or call with $+5 as operand: call $+5 jmp $+5 To provide more context I grepped some of the occurrences: mov esp, [...
0
votes
1answer
96 views

Is it possible to change the value of a register when a certain instruction is executed?

I was wondering if it was possible to change the value of a register when an instruction gets executed. For example 0x10 call eax Say eax contains 0x20 at that point, I want to add 0x10 to it so ...
1
vote
1answer
101 views

Why does MSVC x64 Compiler load addresses like this?

Normally, in x86, to load a pointer to a null-terminated string you would use MOV EDX, OFFSET ds:mystring In x64, however, I noticed that the compiler does it like this lea rdx, OFFSET FLAT:$...
2
votes
0answers
99 views

Trace replayer won't load binary debug information

So I'm debugging a linux application with what I believe DWARF debug information on x86-64 host. Everything is working fine and as expected - the source files are loaded immediately on function ...
0
votes
1answer
3k views

Finding password in disassembled code

I'm trying to learn reverse engineering techniques, apologies in advance if I leave anything out I'm trying to find the password in the following section of disassembled code (there are other blocks ...
1
vote
1answer
628 views

What are the results of this sbb instruction?

I'm doing a crackme to learn some reversing, and I stumbled upon this code generated by C++ MFC: sbb eax, eax sbb eax, -1 test eax, eax jz exit Before that code a comparison is done, such as cmp al, ...