Hot answers tagged

7 votes

What is the difference between MOV and LEA in example?

lea = address mov = contents if address 0x401000 contains 0xDeadBeef like ef be ad de lea MySecretPlace, [401000] MySecretPlace will be 0x401000 Mov MySecretPlace, [401000] MySecretPlace will be ...
user avatar
  • 14.9k
7 votes
Accepted

Disassemble ELF - PC is set to 0?

In fact, the behavior you are describing is coming from the usual behavior of the GOT/PLT sections. They are used to dynamically link the program calls to shared libraries functions at runtime. In ...
user avatar
  • 18.1k
5 votes

Permanently load a DLL to an executable

An easy way to do this is to modify the IAT (Import Address Table/Import Directory) which can be done with a tool such as LordPE. From the main screen choose PE Editor and select the executable (or ...
user avatar
  • 2,918
5 votes

Disassemble ELF - PC is set to 0?

While the other answer is not wrong, it does not actually cover the real issue: how come that calling a zero address does not lead to a crash? AFAIK there is no official standard or complete ...
user avatar
  • 34.7k
5 votes
Accepted

What is the encoding format for unconditional Jumps on SPARC/SPARC64?

81 c0 40 00 can be broken down as follows 10 00000 111000 00001 0 0000000000000 ^--op1 ^--rd ^--op3 ^--rs1 ^--i ^--rs2/...
user avatar
  • 1,561
5 votes
Accepted

x64dbg or alternative: Run to selection while storing all ran opcodes

On Windows Travel Debugging (TTD) is a perfect use case for this scenario. To use TTD, you need to run the debugger elevated. Install WinDbg Preview from Windows 10 store using an account that has ...
user avatar
4 votes
Accepted

Issue understanding simple ARM ASM function

This is function dflt (or __aeabi_i2d) from the ARM compiler libraries. It performs a conversion of a 32-bit signed integer in R0 into a a soft-float double (64-bit floating point value) in R0:R1. ...
user avatar
  • 34.7k
3 votes
Accepted

Hook naked function with CPU registers

There is no instruction for pushing xmm registers, but you can do as follow: __asm { sub esp, 16 movdqu [esp], xmm0 sub esp, 16 movdqu [esp], xmm1 pushad } ...
user avatar
3 votes

What is the difference between MOV and LEA in example?

This is basic. Assume that rpb has a value of 55h (Assembler syntax). then lea rax, [rbp-50h] would result in 5. On the other hand, mov rax, [rbp-50h] would most probable crash your application, as ...
user avatar
  • 1,814
3 votes

What is the difference between MOV and LEA in example?

Warning: Illegal instruction used for explanation. If you are wondering if mov can do the work of lea, mov eax, esp+4 and lea eax, [esp+4] copies the same value to eax. However, mov eax, esp+4 is not ...
user avatar
3 votes

ASM code hook/patching with trampoline function

1) If by pointer you mean "pattern" or "watermark" the first thing that comes into my mind is BlackMagic (read FindPattern function) 2) A program is a file that have a certain structure (PE file ...
user avatar
  • 51
3 votes

Why the assembly instructions also have an adresses ?

In fact, the assembly instructions does not have addresses built-in... But, when analyzing a program, you may encounter more than once the same instruction. In order to make it 'unique' in the program ...
user avatar
  • 18.1k
3 votes

How are __argc and __wargv globals exported from a 64-bit PE file compiled with Visual Studio?

These two symbols aren't exported in the usual way (i.e. via the export table). Instead, they are public symbols inside the run-time library itself. The startup code that runs before _main() ...
user avatar
  • 4,511
3 votes

Reverse getline(cin, text)

use print &text or use info locals :\>dir /b & type cin.cpp & g++ -g cin.cpp & echo ========= & gdb -q a.exe cin.cpp #include <iostream> #include <string> using ...
user avatar
  • 14.9k
3 votes
Accepted

Isolate the call to a function

You can use Ida's Appcall functionality: Appcall is a mechanism to call functions inside the debugged program from the debugger or your script as if it were a built-in function. Such a ...
user avatar
  • 2,389
3 votes
Accepted

Cant see mnemonics on ollydbg 2.01

Sometimes OllyDbg analysis of the code is incorrect and it shows data bytes instead. This may happen if the segment of code you are looking at has no direct call/jmp into. If you right-click in the ...
user avatar
  • 822
2 votes
Accepted

I'm trying to understand the SEH mechanism

int 1 is not a part of the SEH setup, that's done by the third instruction. However, int is intercepted by Windows and is translated into an exception which is then dispatched to the handler that has ...
user avatar
  • 34.7k
2 votes

getting ecx register from caller

This makes very little sense. If you are a __factcall function the first parameter in is your ECX register just use it.. If you are trying to access the first parameter of your parent calling ...
user avatar
2 votes
Accepted

Inversion of input parameters in ASM

Calling Conventions: You may be referring to calling conventions and order of parameters being pushed. If so, here is an answer addressing as such. You can read more about calling conventions in ...
user avatar
  • 2,154
2 votes
Accepted

How to Make .text Section in Assembly Writeable for Win7-64 EXE

I don't see that option in golink linker but if you use i.e. link.exe (Microsoft (R) Incremental Linker Version 14.11.25506.0) then you can use /SECTION parameter to specify that. link /SUBSYSTEM:...
user avatar
2 votes
Accepted

Debugging EXE File in Windbg and How to set Breakpoints in Assembly

It seems bp $exentry should set breakpoint on the entrypoint, then you can continue (g) until you hit it.
user avatar
  • 34.7k
2 votes

Using ECX after being modified by a function call

This looks like the result of compiler optimization. The second callee (a fastcall function) takes an argument it obviously doesn't use. The compiler is in a situation where it is unable to modify the ...
user avatar
2 votes

Intercepting game function with C and Assembler, game unstable with minimum changes

It's not add -183. 0xFFFFFE7d is equal to -387. The original conditions is this 387 <= x <= 390 if we add -387 to all the sides we get 0 <= x + (-387) <= 3 and this is exactly what's ...
user avatar
2 votes
Accepted

Pe 32 Add Export function Segment by Extending with dll or Patching pe

Since I don't know any tool to solve your problem easily, I will tell you how it can be done "by hand". First of all, you have to be familiar with PE format. If you are not, you may check ...
user avatar
  • 3,189
2 votes

What is the difference between MOV and LEA in example?

The difference is that lea only calculates the address while mov actually moves the data. If you know C or C++, it’s somewhat similar to: Lea:rax = rbp + 0x50; Mov: rax = rbp[0x50]; (Not equivalent ...
user avatar
  • 34.7k
2 votes

Is there a handy assembly to mock app conversion tool?

I would assemble the code and then analyze it using emulation. Example assembly taken from the link: mov rax, QWORD PTR [rbp-16] ; Move i (=9) to RAX movabs rdx, -3689348814741910323 ; Move ...
user avatar
  • 6,859
2 votes
Accepted

HEX code to call DLL function

The proper way to do this is to rename your A.DLL to another name (let's call it Z.DLL), and then create a new A.DLL which is your code. For each export in the Z.DLL, you create an export in your A....
user avatar
  • 4,511
1 vote

When patching static software, is there a preferred patching strategy?

The better solution (on my opinion) is the simpler, less influencing other program logic, provides length equality of opcodes you want to replace and those you want to insert. By my experience the ...
user avatar
1 vote

Intercepting game function with C and Assembler, game unstable with minimum changes

To add to Paweł Łukasik's answer, the issue with ECX surrounds what is known as a 'calling convention'. Calling conventions set out the obligations on both the caller of a function and on the called ...
user avatar
  • 2,164

Only top scored, non community-wiki answers of a minimum length are eligible