Questions tagged [x86]

A family of instruction set architectures originally based on the Intel 8086 CPU that functions with a very wide array of operating systems, including Windows, MacOS X, Linux, BSD, and Solaris.

Filter by
Sorted by
Tagged with
4
votes
2answers
659 views

How does the XADD instruction modify the Zero Flag?

I've come across a set of instructions using lock xadd which I'm guessing came from one of the C++ smart pointer templates. (It's been a very long time since I coded C++ so I'm not sure which). lea ...
4
votes
1answer
372 views

Using ECX after being modified by a function call

I have a peculiar snippet of code which I cannot wrap my head around: push 0xC ; arg1 for call mov ecx,edi ; set the this pointer for call call sdk.100039F0 ; make the call (...
4
votes
1answer
346 views

GS Cookie and exception handlers

I'm trying to understand how this GS cookie implementation is working. From what I've read on the topic, a cookie is set during the prologue then checked again in the epilogue. Well I can see the ...
1
vote
5answers
21k views

Older versions of IDA free?

I'm looking for an IDA free version previous to 7.0 so I can use it in x86 systems, the current one being only x64, but can't seem to find one and it doesn't look like I saved one neither. Does ...
2
votes
1answer
764 views

What does this magic number do? [duplicate]

I've opened a 64 bit DLL file in IDA. One function has this pseudocode: unsigned __int64 output; ULONG input; output = (unsigned __int64)(input * (unsigned __int128)0xE38E38E38E38E38Fui64 >> 64)...
1
vote
1answer
290 views

How to debug a crash in wow64.dll in 32bit process

I have a 32bit application and a few wrapper tools that I use one after another to inject code, hook system dll functions (using the patch-first-bytes-of-the-function-with-jump approach). Also I have ...
5
votes
1answer
89 views

Passing a (string) argument via the return address?

I'm debugging an old PC BIOS and it has most of its constant strings interspersed directly with the code, like this: As the comment notes, the function putsc will take the string as its argument, ...
2
votes
1answer
126 views

Why are these 0-byte jumps used as a delay?

I'm debugging an old PC BIOS and see a lot of what I assume are delay sequences, using 0-byte jump instructions (EB 00 = jmp short $+2). Why this particular instruction? I'm guessing it must have ...
2
votes
1answer
1k views

Trap Flag - Anti-debugging trick

I am trying to reverse a program which is employing some kind of anti-debugging trick based on the use of SEHs and the TF. The code stars with: So apparently it's generating an exception with XOR ...
1
vote
1answer
111 views

Data moved after program rebase

Consider the following piece of code: .text:00F74B42 call sub_12D1130 .text:00F74B47 mov eax, dword_15A0C80 Now, I want to add a sanity check but as I don't have enough space to do that I ...
5
votes
1answer
976 views

What's the meaning of dword_XXXX and offset dword_XXXX in IDA?

Consider the following code: In C++: SomeClass* globalPointer; // we don't know what it points to, but it's not null a pointer, it's initialized void someFunction() { globalPointer->...
0
votes
1answer
105 views

Keygenme - Key location

So I was messing with an interesting keygenme, written in C++, which derives the key based on the values of the OSINFO structure. Now, when checking for a valid key it uses the following instruction: ...
18
votes
3answers
12k views

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

I don't know whether this is a silly question, but I couldn't find any answer. With the evolution of CPU architecture, register size was extended, from 8, to 16, 32, and eventually 64-bit. I was ...
1
vote
1answer
297 views

ELF binary corrupted after adding instruction in non-executable section

I've been messing around a little with Radare2 trying to master binary exploitation and patching. I added a couple of assembly instructions to an x86 elf binary in a non-executable section of the file,...
3
votes
1answer
207 views

Shellcode issue

I'm currently trying to understand a peculiar behaviour with a shellcode. When reaching a MOV instruction just before an interrupt the shellcode get modified: As you can see on the radare2 output, my ...
1
vote
1answer
783 views

How to move one step back in a debugger

When I debug a .exe file on Windows with IDA, I do it step by step. Can I move one step back and reset all the registers and stack to what they were one instruction ago? By the way, when I'm looking ...
2
votes
2answers
2k views

What is the difference between Windbg and local debugger in IDA

When I want to debug an .exe on Windows with IDA I can choose between Windbg or local debugger. What is the difference? By the way, is there any difference if I use Windbg tool (windows software) ...
2
votes
1answer
72 views

How to identify when a function is being called using IDA?

I'm debugging a .exe file on Windows with IDA's debugger. How can I identify when the code calls the random() function?
3
votes
2answers
56 views

Finding a particular call to an offset within a vtable using pattern matching

Let's say I have a very simple pattern I'm looking for. E.g. the following regex, mov.*(eax|edx|ecx|esi|edi), \[(eax|edx|ecx|esi|edi)\+30h\] Now, I'm also looking for references to this in which the ...
1
vote
1answer
1k views

Radare2 - Insert asm instructions without overwriting

In order to patch a x86 elf file on Linux, I'm struggling to insert a specific assembler instruction into the binary file without overwriting any of the preexisting instructions. I've been reading ...
4
votes
1answer
916 views

Question about the limit and base address in x86-64 segmentation model?

I'm trying to understand how segmentation works under x86-64. From what I see, it's mostly disabled, but not entirely. It looks like GS and FS registers are still using it. So I was reviewing the ...
-2
votes
1answer
312 views

x86 Assembly Data Types [closed]

For the code below can anyone help with these questions? xor eax, eax mov ecx, 5 lea edi, [edx] rep stosd mov al, 0xFF stosw stosb stosb How many times does the 'stosd' operation run? Why? If edx ...
1
vote
1answer
559 views

sidt, sldt, sgdt, str anti-vm techniques does not work anymore on VMWare 12?

They are all privileged(??) x86 instructions. sidt : Stores the Interrupt Descriptor Table Register (IDTR) content. (Red pill) sldt : Stores the segment selector from the Local Descriptor Table ...
4
votes
2answers
1k views

How do you look for a a particular value at address in IDA

So, I was trying to load some binary and in the main function, I saw instructions such as mov edi, [esi+1Ch] ... lea eax, [esi+18h] So, what are these values at [esi+1Ch] and [esi+18h]. How do ...
1
vote
1answer
462 views

Reverse engineering a VST to learn about signal processing and hopefully help me make my own.

I have been trying to simply open and view the source code for a VST I am researching as I hope to create my own VST sometime in the future. I have two .dat files which I presume contain the audio ...
2
votes
1answer
189 views

What does __return_ptr do in IDA?

Let's say I have this program: struct A { int x; }; struct A func1(int z) { struct A result; result.x = z+1; return result; } int main() { return func1(1).x; } When compiling ...
4
votes
3answers
2k views

IDA: add segments without losing data

I'm browsing an old 80186 BIOS ROM in IDA free. I have loaded the binary file at the correct address and created one big segment for the entire thing since I knew nothing about the internal structure. ...
1
vote
0answers
53 views

Threads blocking in kernel when I attach, can't control them

I'm attaching to a simple program and the new thread breaks at DbgBreakPoint as expected. I'm using x64dbg (32-bit). The problem is, when I go to the Threads window it shows all the threads' EIPs as ...
5
votes
1answer
1k views

How to specify stack-based return values in IDA Pro (GoLang)

tl;dr: I am reversing a GoLang 1.10 executable, compiled for Windows. I am trying to make IDA correctly recognize the calling convention. Details: I am looking at an x86 executable where the ...
0
votes
1answer
78 views

Identifying code that accesses encrypted overlay in PE

I’m reviewing a malware sample that stores an encrypted PE file in its overlay. I’m attempting to identify in IDA pieces of x86 that may be responsible for accessing the overlay and performing the ...
2
votes
1answer
440 views

Meaning of code used to find kernel32.dll in shellcode

I'm attempting to reverse some shellcode created by metasploit to increase my understanding of shellcode. I understand the overall point of the code is attempting to locate kernel32.dll in the list of ...
1
vote
1answer
811 views

Hex-Rays can't parse switch (bad target for case)

I need to add new case, so here is that I do. Copy the jump table for switch statement to 0048199C and add new ref to 4819C0. Add new instructions below Set new address 0048199C In the indirect ...
5
votes
1answer
587 views

Why do many imported functions jump to addresses that do not contain instructions?

I am learning to analyze binaries using radare2 and have been confused about what occurs within imported functions. In the binary below, titled Lab2B, I statically disassembled the binary and then ...
1
vote
2answers
135 views

How is the IV generated from a timestamp based on this function?

Background: I am currently looking to make some diagnostic software interoperable with other software, but all communication that occurs in this software is encrypted with AES-128-CBC. A sample ...
0
votes
1answer
432 views

IDA Pro Address doesn't correlate to Immunity Debugger address

I'm trying to use immunity debugger to step through a confusing binary. When I open it in IDA Pro, I see certain addresses next to the instructions: .text:01001392 inc eax When I ...
4
votes
2answers
286 views

General x86 to C tips?

I'm currently trying to finish an assignment for one of my classes that requires a sequence of ten Hexadecimal numbers for it not to blow up. The task is to find these numbers and input them in the ...
1
vote
3answers
600 views

Question relating to learning Assembly through CTF challenges

I've just started to dip into Assembly for CTF reversing challenges, and am having a great time. A loop structure in the current challenge I'm working on has me stumped, however - hoping someone can ...
5
votes
2answers
5k views

What does XREF mean?

I have been learning about the x86 assembly language by analyzing a binary using radare2 that is stored on a Intel 80386 machine. When I have been analyzing functions on the binary, I noticed that "...
1
vote
1answer
183 views

How is data transferred from the process’ memory to the console screen?

I am learning about how the call stack works by reverse engineering binaries using Radare2 (in a Linux environment). The ISA on the server (a P5 micro-architecture) I am analyzing binaries off of is ...
1
vote
2answers
434 views

Printing bytecode in bytes given a string of assembly for Radare to disassemble?

Megabeets determined in this answer that depending on asm.bits Radare may show either lea edx, [0x80490c8] (asm.bits=32) lea edx, [rip + 0x80490c8] (asm.bits=64) If I want to see what the ...
6
votes
2answers
6k views

Disassembly shows `LEA` with RIP?

When I disassemble this instruction using pad on Radare I get an LEA with rip [0x00000000]> pad 8d 15 c8 90 04 08 lea edx, [rip + 0x80490c8] I got this instruction from this post here I'm ...
2
votes
2answers
2k views

translate arm instructions to hex

I looking for simple tool(not site) to translate arm instruction to hex like http://armconverter.com/. Without linker , I want put 1 instruction , and want get the hex . Do you know one please?
2
votes
1answer
231 views

Changing parameters in an OS X executable

very new here so please bear with me. I'm an artist trying to realise an idea for a camera that takes photos every X interval during a month. Everything works, except that the app with which I ...
0
votes
1answer
351 views

Arm function save registers r0 and r1

I see arm 32 bits assembly code. Usually each function do push { r4-r9,lr} ( save 6 registers on stack ). And in the end of function pop them . I see function that save push {r0,r1,r4-r9,lr} but ...
1
vote
5answers
348 views

C representation of simple assembly

I have the following very simple X86 assembly: shr cx, 1 jae short <addr> So basically, the jump will be taken if the Carry flag is not set. In the case of shr, CF will be set to the value of ...
2
votes
0answers
819 views

loading memory dump into ida pro?

I'm looking for a good method to load custom memory dumps (of usermode processes under Windows) into IDA Pro. These memory dumps may be partial or complete - in terms of other DLLs, such as kernel32, ...
0
votes
1answer
672 views

How can I circumvent rdtsc when used as an anti-debugger technique?

I using x86dbg and am working on unpacking a target. The unpacking stub appears to be using some anti-debugging techniques - most of which I can detour with a plugin. However, there are a lot of ...
3
votes
1answer
139 views

Instruction without "apparent" previous instruction

I am working through the educational "bomb.exe" file where you must defuse the bomb by entering the correct inputs. This can only be accomplished by reversing the executable file. There are no hints ...
5
votes
1answer
1k views

How does this EB F2 x86 instruction work?

In the following code snippet, the EB F2 instruction is causing execution to jump back up to the line indicated by the arrow. How is this the case given that there is no address supplied to EB and the ...
2
votes
1answer
164 views

Windows x86 compability on x64 operating system

I know some about wow64 system, in x64 windows version, and i looked up into this wow64* dlls, to see how the actual syscall transition happen, but something i can't find, and this is probably done by ...

1 2 3
4
5
9