53
votes
What does mov qword ptr ds:[rax+18], r8 mean?
Lets go over the instruction piece by piece:
mov
movqword ptr ds:[rax+18],r8
This is the opcode part of the instruction. It describes the base operation the CPU is required to perform. mov is an ...
- 11.7k
25
votes
Knowledge about CPU hardware
To extend the answer of perror:
Perhaps you should take a look into a recently published whitepaper named Breaking the x86 ISA, by Christopher Domas. It was published on blackhat17 and describes an ...
- 1,257
25
votes
Accepted
What kind of code would produce this assemby with loads of jump statements?
This looks like the output of Visual C++ linker in incremental linking mode. In this mode, the linker adds a section with incremental linking thunks (ILTs) at the start of the code section (.text), ...
- 36.4k
22
votes
Accepted
Purpose of test eax,eax after a strcmp
Register eax will contain the return code from strcmp, after the call. The test eax, eax is the same as and eax, eax (bitwise and) except that it doesn't store the result in eax. So eax isn't affected ...
- 10.9k
20
votes
Accepted
What does the `TEST` instruction do
1. TEST
According to the x86 Instruction Set Reference entry for TEST found at http://x86.renejeschke.de/,
[TEST] computes the bit-wise logical AND of first operand (source 1 operand) and the ...
- 7,078
20
votes
Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?
It's the wrong question, really. AH is the exception.
Now the real question is, why is AH such an exception? It's an old register, from the 8086 era. It exists to facilitate moving over code from ...
- 301
19
votes
Accepted
Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?
Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?
It is impossible to access the higher parts of the EAX and RAX registers, or of any other 32 and 64-bit ...
- 11.7k
18
votes
Accepted
Randomly picking up a x86 register for an instruction
To better understand this, you need to study instruction encoding formats i.e. x86 for this question.
An x86 instruction looks like this
+----------------------+--------+--------+-----+--------------...
- 6,040
15
votes
Accepted
Is IDA pulling my leg - or can REX.W sometimes not be determined in static analysis?
In x86-64, any operation that affects only the lower 32 bits of a register automatically zeros out the upper 32 bits.
The relevant part in the Intel Architecture manual is in Volume 1, 3.4.1.1, which ...
- 266
14
votes
Accepted
Translate ASSEMBLY to C
Here is exact answer to you question.
Go to http://www.tutorialspoint.com/compile_assembly_online.php
Doubleclick on main.asm in upper-left corner of the screen
Copy your snippet to the text window....
- 8,388
14
votes
Why did Intel chose 90h machine code for their NOP instruction instead of a 0?
From the Intel manual under NOP:
The one-byte NOP instruction is an alias mnemonic for the XCHG (E)AX, (E)AX instruction.
This XCHG mnemonic is encoded as 90+reg encoding used as a second parameter ...
- 4,912
13
votes
Accepted
ARM64 syscalls table
arm64 syscall numbers are defined at: https://github.com/torvalds/linux/blob/v4.17/include/uapi/asm-generic/unistd.h
This is a bit confusing since it is quite different from x86 and x86_64 and arm 32-...
12
votes
Accepted
xor eax, eax in x64
In x64, any operation on a 32-bit register clears the top 32 bits of the corresponding 64-bit register too, so there's no need to use xor rax, rax which would necessitate an extra REX byte for ...
- 36.4k
12
votes
Purpose of test eax,eax after a strcmp
You might be missing the fact that call strcmp will not set ZF for you - it returns the result in the EAX register. But JNE instruction tests ZF, and that test eax, eax serves to set ZF according to ...
- 251
12
votes
Accepted
Need help understanding a complex mathematical password checking function?
Since you've already mostly decoded the code, there are two things left: 1) understand what the code is doing and 2) understand how to compute the appropriate input.
The original code
First, here'...
- 2,521
11
votes
Accepted
What do the 20 lines of executable code in this exploit do?
EDIT: @EnricoGhirardi Thanks for pointing the mul esi inaccuracy I previously posted!
To start out, the first instruction mul esi zeroes out rax and rdx in the example below (this is only because rsi ...
- 440
11
votes
Meaning of cmp byte ptr [EBP-9], 0
Let's break this down.
First, we have the mnemonic: cmp
As you state, it performs a compare, though in truth it performs a subtraction (first operand minus the second) without storing the result, ...
- 336
11
votes
Accepted
Which operators use sal, shl, sar or shr
First it should be noted that there are so many architectures out there, each with its own instruction set. Here I assume you mean x86 (and you should indeed tag the proper architecture as 0xC0000022L ...
- 476
11
votes
Accepted
ARMv8 (AArch64, ARM64) opcodes list
This doc may be interesting for you:
https://github.com/CAS-Atlantic/AArch64-Encoding
- 246
11
votes
What does 'test al, al' mean?
In x86 assembly, al is the least significant byte of eax register, which is typically used to return values from function calls.
The test al,al is a bitwise AND operation between al and itself.
If ...
- 882
10
votes
Accepted
Reverse engineering the virtual machine based crackme
First of all, the fact to turn a program into a bytecode that will be interpreted by a crafted VM which will be embedded into the software is a quite well-known technique of obfuscation. There have ...
- 18.9k
10
votes
Accepted
How does this EB F2 x86 instruction work?
from google starmans realm
quoting relevant info
These are also known as SHORT Relative Jumps. Programs using only Relative
Jump instructions can be relocated anywhere in memory without ...
- 16.3k
10
votes
Accepted
Do I have to learn computer architecture for underestanding or doing reverse engineering?
The question is too broad, but I'll try to answer and hope that it will help.
It depends on what exactly do you mean by computer architecture and area you applying your reverse engineering skills to.
...
- 8,388
9
votes
Knowledge about CPU hardware
In fact, the CPU are much more checked and verified than programs. It is very unlikely to find a (significant) bug in a CPU. Even though it happens from time to time.
Therefore, it is much more ...
- 18.9k
9
votes
Accepted
Where ES/GS/FS are pointing to?
On x86 32bit windows the FS segment register points to a structure called the Thread Information Block or the TIB for short. This structure is created by the kernel on thread creation and is used to ...
- 11.7k
9
votes
Accepted
Batch disassembling DLL and EXE files?
If you have any version of Visual Studio or Visual Studio Build Tools installed, you have a powerful command line tool called dumpbin, which includes a disassembler option, available to you.
dumpbin /...
- 311
9
votes
ARM64 syscalls table
Update: See this answer for up-to-date information on where ARM64 syscall definitions are found. Note that the information below may just be for backwards-compatibility.
See arch/arm64/include/asm/...
- 191
9
votes
Accepted
How many registers does an x86_64 CPU actually have?
Wikipedia has a page about the x86 architecture and all its known registers. Here is a small picture gathering all what we know about it.
In fact, not all these registers are officially documented. ...
- 18.9k
9
votes
What kind of code would produce this assemby with loads of jump statements?
If they were all to external targets then it would be the stubs for external functions when dynamically loading dlls.
This way you can limit the amount of pages that need updating when a new dll get ...
- 617
9
votes
Accepted
What does fs and gs registers provide in Linux?
The gs/fs segment can be used for thread local storage similar to what you have encountered in Windows. Variable specific to a thread such as errno, stack canary etc are usually stored here in Linux.
...
- 2,629
Only top scored, non community-wiki answers of a minimum length are eligible