Questions tagged [x86]

A family of instruction set architectures originally based on the Intel 8086 CPU that functions with a very wide array of operating systems, including Windows, MacOS X, Linux, BSD, and Solaris.

Filter by
Sorted by
Tagged with
3
votes
3answers
2k views

Jump into the instructions, is it a case `objdump` can't handle?

So basically I am using objdump on 32 bit x86 Linux, disassembling some static linked binary compiled by gcc In the disassembled asm code, I find this: 80ade23: 74 01 je ...
2
votes
2answers
319 views

How should I reach my shellcode?

I am trying to exploit this little program I found on opensecuritytraining.info. But, somehow, I am stuck at this point. What I did was to create a file which gets read from the program. Here is the ...
3
votes
2answers
13k views

Automatically convert x86 assembly to C

Just started out with x86 assembly and slowly getting the hang of it. IDA produces nice graphs that make it much easier to follow all the jumps and function calls and stuff. I've looked at examples ...
2
votes
2answers
2k views

Why is the ecx register used during an inc instruction

Here's code that performs some arithmetics. int main(void) { int i = 3; i++; i+= 2; return 0; } I compiled it using 32-bit tcc with the following command tcc -o hello.exe hello.c I,...
0
votes
4answers
4k views

Can IDA Pro on Linux disassemble a Windows PE (or Mac OS X app)?

I am thinking of buying IDA Pro for my Linux programming environment after reverse engineering a bit with OllyDBG (under WINE)... But before I endorse into such a costly purchase I ask the following ...
2
votes
2answers
351 views

Understanding a specific assembly line

I try to analyze an .exe file and I have always something like that: MOV EAX, DWORD PTR DS:[ESI] I search a lot for that and I know that the expression with [...] means that we store the context of ...
3
votes
3answers
2k views

Does a JE must follow directly to an CMP?

I wanted to know if a jump instruction as JE must directly follow to a CMP instruction. Until now, I did always see that first a CMP comes and after that a JMP. But today I have discover the following:...
2
votes
2answers
358 views

What does _acmdln_dll?

Does somebody knows what _acmdln_dll is ? I could not find any useful documentation about that. I am asking because I have the following line in the assembly which I try to analyze: MOV EAX, DWORD ...
2
votes
1answer
863 views

IDA PRO and Dos Load Exec

I am trying to reverse some DOS game in IDA pro (5.0 demo). I get stuck when it tries to load the overlay file. Is it possible to load the 2nd executable into the original namespace? It has already ...
4
votes
4answers
992 views

Is it possible to (heuristic) identify the begin addr of main function in a stripped ELF?

So basically I am working on some tripped dynamic linked ELF binaries (32 bit Linux x86), using objdump to disassemble them, modifying and trying to reassemble them. In the unstripped binary, we can ...
4
votes
4answers
1k views

Why addresses of variable on stack are not consecutive?

The code below is generated by gcc from a simple scanf program. My question is that Why these 3 addresses of variables are not consecutive when allocated? If not, when could I speculate the number ...
4
votes
2answers
2k views

What are the sections of a x86 linux binary?

I want to learn reverse engineering so I was starting to try compiling simple (to start with) C programs and then reading the disassembly. The following file int main(void) { return 0; } compiled ...
6
votes
2answers
1k views

Understanding x86 C main function preamble created by Visual C++

I was debugging a simple x86-64 program in Visual Studio 2010 and I noticed that the main function preamble is different from the GNU GCC compiled version of the same C program. To illustrate what I ...
1
vote
4answers
2k views

GUI-based x86 assembly editor

Is there a tool that disassembles x86 executables, presents it in a GUI where you can edit the assembly commands, and reassembles it when you want to save/patch the exe? All it would need is a tool ...
3
votes
3answers
1k views

Good Public Practice Binaries? [closed]

I'm looking for some good x86 linux binaries that cover most general vulnerabilities you would find while reversing. Does anyone have any good references to binaries that are public and available for ...
3
votes
1answer
518 views

What is the proper way to deal with an x86/64 instruction containing multiple prefixes from the same group?

Olly, specifically, will only accept the last prefix it finds if there are more than one from the same group. For example lock rep add dword ptr[eax],eax ; f0 f3 01 00 becomes ??? ...
2
votes
1answer
369 views

What C construct could generate this assembly sequence?

I have the following disassembly: mov BL, [EAX] inc EAX mov [EDX], BL inc EDX I could see this being the result of: uint8_t foo = bar; ++bar; uint8_t tmp = foo; ++foo; But this assumes C99. Is ...
29
votes
5answers
7k views

Why there are not any disassemblers that can generate re-assemblable asm code?

I am struggling on this problem for around three months: How to use disassemblers (IDA Pro and others...) to generate re-assemblable asm code and assemble it back My experience is that: There is NO ...
3
votes
1answer
440 views

What do the first 16 bytes on the stack represent?

Whenever I attach a process in OllyDbg v1.10 on my Windows 7 64-bit machine, I notice that the first saved EBP on the stack doesn't point to the very base of the stack. Instead it points 16 bytes ...
5
votes
1answer
905 views

understanding the stack

I have de-assembled a x86 application use ida, it generates the following code .text:1084FF10 push ebp .text:1084FF11 mov ebp, esp .text:1084FF13 ...
6
votes
1answer
885 views

I need quick correction on this x86 opcode conundrum

I am trying to figure out how to encode the instruction MOV DS, AX, but I am confused from the opcode table as follows: Is MOV DS all one byte, or is MOV one byte, DS the second, and the AX the third?...
11
votes
2answers
2k views

Replacing common x86 instructions with less known ones

Is there any kind of software or research or paper which discusses replacement of frequent x86 instructions with ones which are less common and thus less understandable to the attacker (floating point/...
6
votes
1answer
760 views

How to get IDA Pro Free to automatically change segment on retf?

I have been unable to get IDA pro to do a simple disassembly of a flat 16-bit binary (bootloader) file. I'm just getting started, and it seems to be harder than it should be. There's a simple set of ...
15
votes
4answers
3k views

Open-Source library for Complete Binary Disassembly

One of the major hurdles of x86 disassembly is separating code from data. All available open-source disassembly library only perform a straight line disassembly (starts from the top and skips errors ...
20
votes
1answer
6k views

How to use sysenter under Linux?

I would like to know what are the different ways to perform a system call in x86 assembler under Linux. But, with no cheating, only assembler must be used (i.e. compilation with gcc must be done with -...
6
votes
1answer
747 views

Unusual x86 switch statement?

I have come across the following x86 (Built with some version of Visual Studio AFAIK) switch statement: 0x1009E476 cmp edx, 0x3B 0x1009E479 jnz switch_statement switch_statement: 0x1009E591 movzx ...
6
votes
1answer
617 views

Can I set entry point at code in PE headers?

If I set something like 0x00000040 (my code is located at this address), then the program crashes with this error: The application was unable to start correctly (0xc000007b) But if I jmp from the ...
6
votes
1answer
777 views

GAS/x86 disassembled a bare gs register as an instruction, is it a bug?

I encountered a strange x86-32 instruction (opcode 0x65) decoded by objdump as gs (not %gs but gs). I found it while a full linear sweep of a binary (objdump -D), so the decoding was surely incorrect. ...
8
votes
1answer
2k views

What x86 calling convention passes first parameter via ESI?

I am looking at some x86 code, which I believe was built using a Microsoft tool chain, and am trying to figure out the calling convention used during this call: push esi ; save ESI (it gets ...
3
votes
2answers
3k views

What is an effective way to debug a 32 bits application within a 64 bits OS?

Currently I am on an x64-based system and have been doing some reverse engineering for a while. However I'm still a newbie, and the biggest issue I keep running into is the memory layout differences. ...
24
votes
4answers
22k views

What is the meaning of movabs in gas/x86 AT&T syntax?

I just found a strange instruction by assembling (with gas) and disassembling (with objdump) on a amd64 architecture. The original amd64 assembly code is: mov 0x89abcdef, %al And, after gas ...
2
votes
1answer
985 views

What is this assembly code doing with the command line arguments [duplicate]

I know something is happening with the command line arguments but I don't know what. Can someone walk me through this code? 0x401050 <main>: push %ebp 0x401051 <main+1>: ...
5
votes
3answers
55k views

How to obtain x86-64 pseudocode in IDA Pro?

Does anyone know about obtaining pseudocode for x86-64 in IDA Pro? I already tried the Hex-Rays plugin to obtain pseudocode, but when I try it, the following error pops up: "only 32bit code is ...
3
votes
1answer
2k views

Modifying step value that affects xmm# float value

I don't have much experience with assembly and I am trying to change a step value that changes a final value, these are the opcodes that I am working with and this is how they are set: movss xmm0,[...
7
votes
3answers
3k views

Reverse engineering a VC++ video game

So I know x86 machine language and C++/C language. In the last weeks I've dedicated to learn Windows internals and especially PE format. My target is retrieving the Tomb Raider The Angel of Darkness ...
9
votes
2answers
6k views

Mixed 16/32-bit code reversing using IDA

I am trying to reverse engineer a binary blob I expect to transition from 16-bit real mode into 32-bit protected mode (it is boot time code), so I expect the code to contain code of both sorts. When ...
5
votes
2answers
1k views

OllyDBG's disassembled syntax and c-equivalent

This is probably a pretty simple question as I'm not too used to how the syntax looks for OllyDBG's disassembler. Does this following assembler statement: MOV EAX, DWORD PTR [ESI + 14] Be roughly ...
6
votes
2answers
2k views

NOP instruction

I have recently learned that nop instruction is actually xchg eax, eax... what it does is basically exchanges eax with itself. As far as CPU goes, does the exchange actually happen?
9
votes
3answers
3k views

Why does the function pointer get overwritten even though is declared before the vulnerable buffer?

I am working on io-wargames for fun right now, level3: I do understand why there is a stack-overflow in this code (strlen(argv[1])), but what I don't understand is why it overflows the function ...
3
votes
1answer
315 views

Take A Snippet of Assembly and Make All Side Effects Explicit?

I came across a small function whose only side effects were to modify the state of some processor flags. When I decompiled this function using the Hex Rays decompiler, I simply got an empty function, ...
5
votes
1answer
639 views

What could this sequence of assembly instructions possibly mean?

I have recently came across the following sequence of assembly instructions. call ds:WSAStartup push ecx push edi mov ecx, 69E65AC4h mov edi, 2776452Ah pop edi pop ecx jmp ...
38
votes
3answers
20k views

convert this x86 ASM to C?

How could this 32-bit x86 assembly be written in C? loc_536FB0: mov cl, [eax] cmp cl, ' ' jb short loc_536FBC cmp cl, ',' jnz short loc_536FBF loc_536FBC: mov byte ptr [eax], ' ' loc_536FBF mov cl, ...
61
votes
3answers
92k views

How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?

I try to understand the process of memory segmentation for the i386 and amd64 architectures on Linux. It seems that this is heavily related to the segment registers %fs, %gs, %cs, %ss, %ds, %es. Can ...
9
votes
2answers
11k views

Better explanation of different x86 CALL variations

Hoping to get a better explanation of x86 call instruction. I sort of understand the call near and call far. But I don't fully understand the segment part. A little insight into my main problem, I am ...
78
votes
2answers
59k views

What is PLT/GOT?

From time to time, when disassembling x86 binaries, I stumble on reference to PLT and GOT, especially when calling procedures from a dynamic library. For example, when running a program in gdb: (gdb)...
6
votes
1answer
3k views

What does %reg:value mean in ATT assembly?

When I disassemble a function, I encounter from time to time an expression of the form %reg:value. Typically, I encounter this syntax when I activate the canaries in GCC (-fstack-protector), as in the ...
5
votes
1answer
225 views

Strange GDB behavior in OSX

I'm reversing some malware on an OSX VM when I noticed something peculiar. While stepping through the instructions, the instruction just after a int 0x80 gets skipped i.e. gets executed without me ...
19
votes
1answer
8k views

What's 'fs:[0]' doing and how can I execute it step by step?

In a 32 bits Windows binary, I see this code: push next push fs:[0] mov fs:[0], esp int3 ... next: I see that something happens on the int3 (an error), but I don't understand why,...
34
votes
5answers
5k views

What is the reason for this method to call itself?

While reversing a 32bit Mach-O binary with Hopper, I noticed this peculiar method. The instruction on 0x0000e506 seems to be calling an address right below the instruction. What would be the reason ...
6
votes
1answer
385 views

How can I check I've moved outside the stack without triggering a protection fault?

I'm adding a feature to my Linux debugger (I'm using Ptrace to manipulate the traced process as well as libbfd/libopcodes) to unwind the stack and determine if discrepancies exist between each CALL's ...