Questions tagged [x86]

A family of instruction set architectures originally based on the Intel 8086 CPU that functions with a very wide array of operating systems, including Windows, MacOS X, Linux, BSD, and Solaris.

Filter by
Sorted by
Tagged with
-1
votes
1answer
1k views

What does test bl al, bl al mean? [closed]

In a website I`ve seen a command like this: test bl al, bl al jz 0xaddress What does this mean? Does this belong to a specific compiler to generate such these assembly codes?
-1
votes
1answer
90 views

where the variable and it's size are stored inside windows executabe file?

i am beginner in reverse engineering. i want to understand where the variables and it's size are stored inside an windows executable file. somehow i can able to find the values of variables i ...
1
vote
2answers
806 views

how data types and variables are converted to machine code?

I know that every x86 instruction has an opcode for that, but I don't know how data types and variables are converted to machine code. So I tried to figure out. I wrote a simple C program and ...
3
votes
2answers
280 views

Unicorn emulator: find out if register is undefined

Maybe I am stupid, but I really dont see anything in their documentation. Say I emulate this code mov eax, 1 mov ecx, 2 Then I can get the result like so: int rr; uc_reg_read(uc, UC_X86_REG_ECX, &...
3
votes
1answer
6k views

Difference between INT 0X80 and SYSCALL

The SYSCALL instruction is said to be the 64-bit version of INT 0X80, however it's still possible to use the latter in 64-bit code (although strace decodes it wrong because of the 64-bit ABI I guess) ...
2
votes
0answers
160 views

Calling original function that uses unconventional calling convention

I'm using MinHook to hook a static function with the following signature: float __usercall RadarManager::Add_Blip@<xmm0>(int position@<ecx>, int shape@<edx>, int colorId, float ...
2
votes
1answer
220 views

Log EIP while in a certain memory range?

I'm looking for a means to log EIP of a process while it is within a certain memory range. I've dabbled a little bit in x64dbg's logging functionality, but was unsuccessful in getting a memory range ...
0
votes
1answer
279 views

What do I need to know in order to reverse-engineer software on Windows? [duplicate]

My question is: What do I need to know in order to reverse-engineer software on Windows? I have knowledge of Assembly already and now what else I need to learn? Also, can you recommend any book/...
1
vote
2answers
1k views

Basic shellcode doesn't work when read from stdin

I am working on a basic shellcode that will spawn a shell after getting called in a 32-bit program. Here is the shellcode i'm using: xor %eax,%eax push %eax push $0x68732f2f push $...
2
votes
1answer
188 views

How to debug a hang application with radare2?

Could anyone tell me the basic steps and most used radare2 commands for debugging a hang x86 application to find the source of the hang? I know this question may sound a bit broad but I don't know ...
3
votes
1answer
1k views

Where ES/GS/FS are pointing to?

As far as I know those segments are extra or general. But at which part of program memory they are actually pointing? If I undestand it correctly DS is poining at entry point of Dump, SS stands for ...
1
vote
1answer
139 views

Unknown comparison

I'm trying to decompile some singleplayer code for a game (C++ on X86 architecture Linux). I do this with the help of some already available source code, a file (compiled on linux) with debug ...
4
votes
2answers
1k views

What could be the purpose of XORing esp with a global variable? (stack canary protection)

I am currently looking at a function inside a Win32 executable's main module. After allocating memory on the stack (sub esp) and saving some registers on the stack, the value of esp is XORed with a ...
5
votes
0answers
2k views

What is the current state on Christopher Domas' “killer poke” find? [closed]

On 2017-07-22 Christopher Domas (@xoreaxeaxeax) announced a new "killer poke" that he found on some x86 processor: https://twitter.com/xoreaxeaxeax/status/888702029744324608 (also cf. https://...
8
votes
1answer
3k views

How to investigate Windows 32/64bit (WOW64) transition

There is surprisingly little information about Windows WOW64 mechanism. I'm trying to investigate it. So when we have system call in 32-land, it calls an address that is stored in FS, which leads us ...
10
votes
2answers
3k views

Why does IDA add “db” statements between disassembled code

I'm trying to analyze a MS-DOS COM file that I wrote a few years ago with IDA Free 5.0, I've since renamed the segment to code_and_data and named constants and set data types correctly. However, when ...
1
vote
1answer
540 views

Optimized vs Unoptimized code comparison

After reading a number of blog posts, forums, and watching tutorials I figured I would start learning to reverse software the old fashion way. Creating simple C files and looking at their disassembly....
0
votes
1answer
337 views

Idenifying far call target in protected mode (x86 assembly)

I am currently analysing a regular Windows x86 executable (-> protected mode) and I came across several far call instructions in the disassembly. I know that far calls, for example, are used in WOW64 ...
5
votes
3answers
3k views

Is there any tool to visually see program stack in linux while debugging?

By stack I mean the location where local variable, return address etc are stored. Which is pointed to by the esp and ebp.
0
votes
1answer
234 views

Link between C and x86 asm

I wonder how to link theses instructions (down to register details) to the original C code. Where are the variables (whether they are local variables, global variables, static variables, or parameters ...
3
votes
1answer
799 views

Debugger always paused in ntdll

I'm a beginner at reverse engineering so any help would be appreciated. I apologise if a similar question has already been asked or if this is a dumb question, but I couldn't find anything. I have ...
1
vote
1answer
6k views

How calls work in x86

I am studying some X86 code and I often see calls: call sym.imp.printf call sym.imp.scanf call sym.imp.strcmp call sym.imp.__stack_chk_fail Those examples are the most common calls. But how do they ...
1
vote
1answer
137 views

“Proper” way to recreate undocumented structs / classes given memory layout in C++?

Firstly I acknowledge that this is very borderline opinionated, but I'd like to emphasize this is more a thing of possibilities given some shortcomings of the default just writing down the offsets of ...
1
vote
4answers
126 views

What is the need of the Rotation Operation?

I know that shl instruction is like the mul operation and the shr instruction is like the div operation and it's used for optimization. For example, shl eax, n is a more efficient way to implement ...
0
votes
1answer
122 views

Why is using a 32bit system over 64bit recommended for people that are new to reverse engineering? [closed]

I am new to the world of reverse engineering and have been recommended by a number of people that I should start with IA32 because it is easier to learn the concepts. Aside from differences in the ...
3
votes
0answers
362 views

What does fs register value mean in x86 application? [duplicate]

I know that FS points to Thread Environment Block - which is seen by the address at the right part of what OllyDbg shows: What does this value 0x53 mean? Does it have some connection with the address ...
2
votes
1answer
672 views

LEA assembly instruction

I am reading through the 'Practical Malware Analysis' book and got to page 74 which says: lea ebx, [eax*4+4] is the functional equivalent of ebx = (eax+1)* 5 where eax is a number. As of my ...
1
vote
0answers
454 views

Why does clang use ebp relative offsets to put function arguments on the stack?

I've been looking at disassembly of x86 32-bit code generated by GCC vs Clang. Environment is Ubuntu Server 16.04.2 32bit running in VMware. Both are compiled with the same options. No optimizations ...
2
votes
1answer
129 views

Determining an application's library call behaviour

I have a closed source Linux library libfoo that makes calls into another closed source library libbar for additional (mostly unneeded) features. However, I can't use libbar for ethical reasons, so I ...
1
vote
1answer
618 views

Why always get the message “Illegal Instruction (core dumped)”?

I tried to exploiting buffer overflow. In the exploit code I use the Aleph-One shellcode. "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\...
2
votes
0answers
126 views

Instruction and memory tracer for executing program on windows

Anyone know any popular x86 tracer which can capture the instruction and memory change by a running program on windows?
4
votes
0answers
170 views

What is the pictured x86 technique/area called?

I've been reverse-engineering Windows PE files and I've discovered this pattern used quite often, making it a little more difficult to follow API calls. First, I'll go to the file's imports and then I ...
1
vote
1answer
830 views

SHL with 0 operand

in the snippet below of x86 assembly code that was produced by Visual Studio 2017, I see the instruction shl eax,0 What is the purpose of this instruction, as It should act as NOP as I ...
1
vote
1answer
153 views

Length requirement on IOLI crackme input

So I'm just starting to learn reverse engineering and binary exploitation and going through the RPI course where the first lab set is drawn from the IOLI crackmes available on Github. I could post all ...
2
votes
3answers
1k views

legitimate memory pages that are marked as RWX?

In windows and linux x86 (including x86_64) world, is there any legitimate binary (i.e., a program binary generated by the typical compiling-assembling-linking flow and no manual editing on binary ...
5
votes
1answer
22k views

What does the `TEST` instruction do

I'm having trouble understanding the TEST instruction and its use. I'm looking at the following code at the end of a loop 0040A3D1 A9 00010181 TEST EAX,81010100 0040A3D6 74 E8 ...
6
votes
2answers
2k views

What is the purpose of these instructions before the main preamble?

I wrote a small C program below: #include <stdlib.h> int sub(int x, int y){ return 2*x+y; } int main(int argc, char ** argv){ int a; a = atoi(argv[1]); return sub(argc,a); } Compiled ...
0
votes
3answers
946 views

Does x86 instruction SHL/SHR actually rotate the bits?

I was debugging a program. When the register di=0x01, cl=0x11, The instruction "shl di,cl" will actually make di=0x1. Shouldn't the bits that slide off the end disappear?
7
votes
2answers
1k views

basic reversing question about local variable

I do not understand the following: in a very simple dummy C function: void vulnerable_function(char* string) { char buffer[100]; } When I use gdb to disassemble it, I obtain: 0x08048464 <+...
2
votes
2answers
2k views

Disassembling an MS-DOS EXE

I've been disassembling an MS-DOS EXE and I've been using this link http://www.delorie.com/djgpp/doc/exe/ to make heads and tails of the binary. The header seems to be an older version compared to ...
0
votes
1answer
292 views

My nopsled getting Segmentation fault (core dumped)

After overwrite the EIP register, I try breakpoint on the function strcpy() and then run the program after a breakpoint in the debugger. Then I check the ESP register : (gdb) i r esp esp ...
-3
votes
1answer
840 views

How should i read this assembly? [closed]

how should I read this and what does it do? .text:00400526 (main): .text:00400526 55 push %rbp .text:00400527 48 89 e5 mov %rsp,%rbp .text:...
3
votes
1answer
616 views

How should I approach a basic CTF exploitation challenge?

Complete newbie alert so apologies on what you're about to read. I've an executable I'm working with to achieve buffer overflow on. This is for an old CTF that has been and gone but I chose it to ...
-1
votes
1answer
1k views

How ret know where eip is saved?

I'm learning assembly and I have one question. Example: int main() { foo(a); } int foo (x) { return 0; } when the foo function returns to main the ret instruction is executed. How does the ...
3
votes
2answers
1k views

How are addresses calculated from the values in x86 segment registers?

How are the 16-bit values in segment registers used to represent large memory addresses? ES 0023 32bit 0(FFFFFFFF) CS 001B 32bit 0(FFFFFFFF) SS 0023 32bit 0(FFFFFFFF) DS 0023 32bit 0(FFFFFFFF) FS ...
0
votes
1answer
307 views

Change of offset in instruction?

I am learning assembly and injections at the moment. Therefore I wrote a little program which simply prints out a hardcoded string. If I attach ollydbg to that I can inspect the executable I ...
0
votes
3answers
342 views

What exactly is this piece of assembly code doing?

This assembly is for Intel x86-64 bit, seems to be too baffling to me. How come the jz instruction jump to a non-instruction (0x400AC9)? How come the call invokes a non-existing address? For curious ...
-2
votes
1answer
447 views

How decompilation works? [closed]

what is the theory behind the subject of translate assembly code to pseudo code? Could you explain few words ? Also some book about it?
0
votes
2answers
228 views

How to perform memory address translation on x86 instructions?

I have a mechanism that maps memory addresses to other memory addresses, e.g.: { 0x10000 -> 0xA0000 0x20000 -> 0x99000000 0x340000 -> 0x50000000 ; Stack in this example } Some example ...
1
vote
2answers
448 views

Modify program's registry accesses from HKLM to HKCU in assembly

I have a game on my PC that reads and writes registry keys and values to the HKLM hive. I am trying to see if it is possible to modify the game so that it uses the HKCU hive instead. The source code ...