Questions tagged [x86]

A family of instruction set architectures originally based on the Intel 8086 CPU that functions with a very wide array of operating systems, including Windows, MacOS X, Linux, BSD, and Solaris.

Filter by
Sorted by
Tagged with
1 vote
1 answer
2k views

Radare2 - Insert asm instructions without overwriting

In order to patch a x86 elf file on Linux, I'm struggling to insert a specific assembler instruction into the binary file without overwriting any of the preexisting instructions. I've been reading ...
user avatar
4 votes
1 answer
1k views

Question about the limit and base address in x86-64 segmentation model?

I'm trying to understand how segmentation works under x86-64. From what I see, it's mostly disabled, but not entirely. It looks like GS and FS registers are still using it. So I was reviewing the ...
user avatar
  • 1,315
-2 votes
1 answer
390 views

x86 Assembly Data Types [closed]

For the code below can anyone help with these questions? xor eax, eax mov ecx, 5 lea edi, [edx] rep stosd mov al, 0xFF stosw stosb stosb How many times does the 'stosd' operation run? Why? If edx ...
user avatar
1 vote
1 answer
658 views

sidt, sldt, sgdt, str anti-vm techniques does not work anymore on VMWare 12?

They are all privileged(??) x86 instructions. sidt : Stores the Interrupt Descriptor Table Register (IDTR) content. (Red pill) sldt : Stores the segment selector from the Local Descriptor Table ...
user avatar
  • 41
4 votes
2 answers
1k views

How do you look for a a particular value at address in IDA

So, I was trying to load some binary and in the main function, I saw instructions such as mov edi, [esi+1Ch] ... lea eax, [esi+18h] So, what are these values at [esi+1Ch] and [esi+18h]. How do ...
user avatar
  • 41
1 vote
1 answer
562 views

Reverse engineering a VST to learn about signal processing and hopefully help me make my own.

I have been trying to simply open and view the source code for a VST I am researching as I hope to create my own VST sometime in the future. I have two .dat files which I presume contain the audio ...
user avatar
  • 111
2 votes
1 answer
225 views

What does __return_ptr do in IDA?

Let's say I have this program: struct A { int x; }; struct A func1(int z) { struct A result; result.x = z+1; return result; } int main() { return func1(1).x; } When compiling ...
user avatar
4 votes
3 answers
2k views

IDA: add segments without losing data

I'm browsing an old 80186 BIOS ROM in IDA free. I have loaded the binary file at the correct address and created one big segment for the entire thing since I knew nothing about the internal structure. ...
user avatar
  • 55
1 vote
0 answers
60 views

Threads blocking in kernel when I attach, can't control them

I'm attaching to a simple program and the new thread breaks at DbgBreakPoint as expected. I'm using x64dbg (32-bit). The problem is, when I go to the Threads window it shows all the threads' EIPs as ...
user avatar
  • 153
5 votes
1 answer
1k views

How to specify stack-based return values in IDA Pro (GoLang)

tl;dr: I am reversing a GoLang 1.10 executable, compiled for Windows. I am trying to make IDA correctly recognize the calling convention. Details: I am looking at an x86 executable where the ...
user avatar
  • 61
0 votes
1 answer
83 views

Identifying code that accesses encrypted overlay in PE

I’m reviewing a malware sample that stores an encrypted PE file in its overlay. I’m attempting to identify in IDA pieces of x86 that may be responsible for accessing the overlay and performing the ...
user avatar
  • 21
2 votes
1 answer
484 views

Meaning of code used to find kernel32.dll in shellcode

I'm attempting to reverse some shellcode created by metasploit to increase my understanding of shellcode. I understand the overall point of the code is attempting to locate kernel32.dll in the list of ...
user avatar
  • 21
1 vote
1 answer
936 views

Hex-Rays can't parse switch (bad target for case)

I need to add new case, so here is that I do. Copy the jump table for switch statement to 0048199C and add new ref to 4819C0. Add new instructions below Set new address 0048199C In the indirect ...
user avatar
5 votes
1 answer
686 views

Why do many imported functions jump to addresses that do not contain instructions?

I am learning to analyze binaries using radare2 and have been confused about what occurs within imported functions. In the binary below, titled Lab2B, I statically disassembled the binary and then ...
user avatar
1 vote
2 answers
139 views

How is the IV generated from a timestamp based on this function?

Background: I am currently looking to make some diagnostic software interoperable with other software, but all communication that occurs in this software is encrypted with AES-128-CBC. A sample ...
user avatar
  • 13
0 votes
1 answer
475 views

IDA Pro Address doesn't correlate to Immunity Debugger address

I'm trying to use immunity debugger to step through a confusing binary. When I open it in IDA Pro, I see certain addresses next to the instructions: .text:01001392 inc eax When I ...
user avatar
  • 1
4 votes
2 answers
294 views

General x86 to C tips?

I'm currently trying to finish an assignment for one of my classes that requires a sequence of ten Hexadecimal numbers for it not to blow up. The task is to find these numbers and input them in the ...
user avatar
1 vote
3 answers
636 views

Question relating to learning Assembly through CTF challenges

I've just started to dip into Assembly for CTF reversing challenges, and am having a great time. A loop structure in the current challenge I'm working on has me stumped, however - hoping someone can ...
user avatar
5 votes
2 answers
6k views

What does XREF mean?

I have been learning about the x86 assembly language by analyzing a binary using radare2 that is stored on a Intel 80386 machine. When I have been analyzing functions on the binary, I noticed that "...
user avatar
1 vote
1 answer
220 views

How is data transferred from the process’ memory to the console screen?

I am learning about how the call stack works by reverse engineering binaries using Radare2 (in a Linux environment). The ISA on the server (a P5 micro-architecture) I am analyzing binaries off of is ...
user avatar
1 vote
2 answers
475 views

Printing bytecode in bytes given a string of assembly for Radare to disassemble?

Megabeets determined in this answer that depending on asm.bits Radare may show either lea edx, [0x80490c8] (asm.bits=32) lea edx, [rip + 0x80490c8] (asm.bits=64) If I want to see what the ...
user avatar
  • 1,664
6 votes
2 answers
7k views

Disassembly shows `LEA` with RIP?

When I disassemble this instruction using pad on Radare I get an LEA with rip [0x00000000]> pad 8d 15 c8 90 04 08 lea edx, [rip + 0x80490c8] I got this instruction from this post here I'm ...
user avatar
  • 1,664
2 votes
2 answers
2k views

translate arm instructions to hex

I looking for simple tool(not site) to translate arm instruction to hex like http://armconverter.com/. Without linker , I want put 1 instruction , and want get the hex . Do you know one please?
user avatar
2 votes
1 answer
241 views

Changing parameters in an OS X executable

very new here so please bear with me. I'm an artist trying to realise an idea for a camera that takes photos every X interval during a month. Everything works, except that the app with which I ...
user avatar
0 votes
1 answer
401 views

Arm function save registers r0 and r1

I see arm 32 bits assembly code. Usually each function do push { r4-r9,lr} ( save 6 registers on stack ). And in the end of function pop them . I see function that save push {r0,r1,r4-r9,lr} but ...
user avatar
  • 29
1 vote
5 answers
357 views

C representation of simple assembly

I have the following very simple X86 assembly: shr cx, 1 jae short <addr> So basically, the jump will be taken if the Carry flag is not set. In the case of shr, CF will be set to the value of ...
user avatar
2 votes
0 answers
946 views

loading memory dump into ida pro?

I'm looking for a good method to load custom memory dumps (of usermode processes under Windows) into IDA Pro. These memory dumps may be partial or complete - in terms of other DLLs, such as kernel32, ...
user avatar
0 votes
1 answer
746 views

How can I circumvent rdtsc when used as an anti-debugger technique?

I using x86dbg and am working on unpacking a target. The unpacking stub appears to be using some anti-debugging techniques - most of which I can detour with a plugin. However, there are a lot of ...
user avatar
  • 253
3 votes
1 answer
149 views

Instruction without "apparent" previous instruction

I am working through the educational "bomb.exe" file where you must defuse the bomb by entering the correct inputs. This can only be accomplished by reversing the executable file. There are no hints ...
user avatar
5 votes
1 answer
1k views

How does this EB F2 x86 instruction work?

In the following code snippet, the EB F2 instruction is causing execution to jump back up to the line indicated by the arrow. How is this the case given that there is no address supplied to EB and the ...
user avatar
  • 1,625
2 votes
1 answer
180 views

Windows x86 compability on x64 operating system

I know some about wow64 system, in x64 windows version, and i looked up into this wow64* dlls, to see how the actual syscall transition happen, but something i can't find, and this is probably done by ...
user avatar
0 votes
2 answers
84 views

Composition of a Binary File trouble [closed]

I am working with some malware samples and I need to determine if one of them is primarily composed of 32-bit Intel Code. This would seem easy as I can just check the metadata describing it as a 32-...
user avatar
1 vote
1 answer
611 views

re-construction of c code: movsx with test instruction

I just started learning about reconstructing C code from assembler instructions. I have the following piece of assembler code: mov eax dword ptr [ebp+8] add eax, dword ptr[ebp-4] movsx ecx, byte ptr ...
user avatar
1 vote
2 answers
6k views

scanf return value

Looking this snippet of code I can't figure out where is stored the return value of the scanf() function. EDIT: From man page, scanf() return an int value representing the number of input items ...
user avatar
  • 429
0 votes
1 answer
254 views

Example of key fishing with OllyDbg logging? [closed]

I'm new to reverse engineering. Can you give an example of a crackme to do "non-hardcoded" key fishing and how to log the x86 registers to spot the generated key?
user avatar
  • 3
5 votes
2 answers
337 views

Flare-ON#3: Problem understanding some parts in the program

I was trying the flare on challenge. When trying the challenge#3 I got into some trouble and could not solve it. After looking into solutions wrote by other I now do know how the program works, but i ...
user avatar
1 vote
0 answers
280 views

Pointer disassembly

I'm using the Capstone engine to develop an ELF disassembler. I have implemented a linear sweep algorithm as the most basic version. My goal is to implement the recursive traversal now. Consider ...
user avatar
-2 votes
1 answer
2k views

how to represent -1 in assembly?

Question: You are given eax = 0x1. Could you set eax to zero using only one add instruction ? Answer: add %eax, 0xffffffff Why is that ?
user avatar
5 votes
3 answers
2k views

Changing a windows name by patching create window function call

I use x64dbg and IDA Pro the process is 32bit. I'm not sure if I'm doing this right or not because I'm getting a crash which I'm not sure if it's caused by me doing something wrong or the startup ...
user avatar
  • 51
1 vote
0 answers
184 views

windbg stopped after I set up a breakpoint, keeping busing

I'm studying reverse engineering, I wrote the following code to see how it is to pass struct variables in the disassembly. struct s { int a; int b; int c; }; struct s get_some_values(int ...
user avatar
  • 11
7 votes
2 answers
14k views

Import table vs Import Address Table

What's the difference between the Import Table and the Import Address Table?
user avatar
  • 367
-1 votes
1 answer
2k views

What does test bl al, bl al mean? [closed]

In a website I`ve seen a command like this: test bl al, bl al jz 0xaddress What does this mean? Does this belong to a specific compiler to generate such these assembly codes?
user avatar
  • 1
-1 votes
1 answer
226 views

where the variable and it's size are stored inside windows executabe file?

i am beginner in reverse engineering. i want to understand where the variables and it's size are stored inside an windows executable file. somehow i can able to find the values of variables i ...
user avatar
1 vote
2 answers
2k views

how data types and variables are converted to machine code?

I know that every x86 instruction has an opcode for that, but I don't know how data types and variables are converted to machine code. So I tried to figure out. I wrote a simple C program and ...
user avatar
3 votes
2 answers
387 views

Unicorn emulator: find out if register is undefined

Maybe I am stupid, but I really dont see anything in their documentation. Say I emulate this code mov eax, 1 mov ecx, 2 Then I can get the result like so: int rr; uc_reg_read(uc, UC_X86_REG_ECX, &...
user avatar
7 votes
1 answer
12k views

Difference between INT 0X80 and SYSCALL

The SYSCALL instruction is said to be the 64-bit version of INT 0X80, however it's still possible to use the latter in 64-bit code (although strace decodes it wrong because of the 64-bit ABI I guess) ...
user avatar
  • 367
2 votes
0 answers
334 views

Calling original function that uses unconventional calling convention

I'm using MinHook to hook a static function with the following signature: float __usercall RadarManager::Add_Blip@<xmm0>(int position@<ecx>, int shape@<edx>, int colorId, float ...
user avatar
  • 133
2 votes
1 answer
400 views

Log EIP while in a certain memory range?

I'm looking for a means to log EIP of a process while it is within a certain memory range. I've dabbled a little bit in x64dbg's logging functionality, but was unsuccessful in getting a memory range ...
user avatar
  • 21
0 votes
1 answer
587 views

What do I need to know in order to reverse-engineer software on Windows? [duplicate]

My question is: What do I need to know in order to reverse-engineer software on Windows? I have knowledge of Assembly already and now what else I need to learn? Also, can you recommend any book/...
user avatar
  • 151
1 vote
2 answers
2k views

Basic shellcode doesn't work when read from stdin

I am working on a basic shellcode that will spawn a shell after getting called in a 32-bit program. Here is the shellcode i'm using: xor %eax,%eax push %eax push $0x68732f2f push $...
user avatar
  • 13

1
3 4
5
6 7
10