49 votes

What does mov qword ptr ds:[rax+18], r8 mean?

Lets go over the instruction piece by piece: mov movqword ptr ds:[rax+18],r8 This is the opcode part of the instruction. It describes the base operation the CPU is required to perform. mov is an ...
user avatar
  • 11.4k
25 votes

Knowledge about CPU hardware

To extend the answer of perror: Perhaps you should take a look into a recently published whitepaper named Breaking the x86 ISA, by Christopher Domas. It was published on blackhat17 and describes an ...
user avatar
  • 1,227
25 votes
Accepted

What kind of code would produce this assemby with loads of jump statements?

This looks like the output of Visual C++ linker in incremental linking mode. In this mode, the linker adds a section with incremental linking thunks (ILTs) at the start of the code section (.text), ...
user avatar
  • 34.9k
22 votes
Accepted

Purpose of OR EAX,0xFFFFFFFF

I think that in order to understand why the compiler does this, study the following disassembly: B8 FF FF FF FF mov eax, 0FFFFFFFFh 83 C8 FF ...
user avatar
22 votes
Accepted

Purpose of test eax,eax after a strcmp

Register eax will contain the return code from strcmp, after the call. The test eax, eax is the same as and eax, eax (bitwise and) except that it doesn't store the result in eax. So eax isn't affected ...
user avatar
  • 10.5k
20 votes

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

It's the wrong question, really. AH is the exception. Now the real question is, why is AH such an exception? It's an old register, from the 8086 era. It exists to facilitate moving over code from ...
user avatar
  • 301
19 votes
Accepted

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones? It is impossible to access the higher parts of the EAX and RAX registers, or of any other 32 and 64-bit ...
user avatar
  • 11.4k
18 votes
Accepted

Randomly picking up a x86 register for an instruction

To better understand this, you need to study instruction encoding formats i.e. x86 for this question. An x86 instruction looks like this +----------------------+--------+--------+-----+--------------...
user avatar
  • 5,860
17 votes
Accepted

What does the `TEST` instruction do

1. TEST According to the x86 Instruction Set Reference entry for TEST found at http://x86.renejeschke.de/, [TEST] computes the bit-wise logical AND of first operand (source 1 operand) and the ...
user avatar
  • 6,859
14 votes
Accepted

Translate ASSEMBLY to C

Here is exact answer to you question. Go to http://www.tutorialspoint.com/compile_assembly_online.php Doubleclick on main.asm in upper-left corner of the screen Copy your snippet to the text window....
user avatar
  • 7,875
13 votes
Accepted

Has XOR EAX, EBX another purpose?

As the first answer states, XOR is a bitewise XOR, not an XOR swap. To do the Xor swap that you referenced from wikipedia it takes 3 instructions : xor eax, ebx xor ebx, eax xor eax, ebx Since ...
user avatar
  • 1,216
12 votes
Accepted

Where is ntdll.dll?

The code below will set EAX to the image base address of ntdll.dll: MOV EAX, DWORD PTR FS:[30] ; EAX = PEB MOV EAX, DWORD PTR DS:[EAX+0C] ; EAX = PEB->Ldr MOV EAX, DWORD PTR DS:[EAX+1C] ; EAX =...
user avatar
12 votes
Accepted

What do the 20 lines of executable code in this exploit do?

EDIT: @EnricoGhirardi Thanks for pointing the mul esi inaccuracy I previously posted! To start out, the first instruction mul esi zeroes out rax and rdx in the example below (this is only because rsi ...
user avatar
  • 420
12 votes
Accepted

ARM64 syscalls table

arm64 syscall numbers are defined at: https://github.com/torvalds/linux/blob/v4.17/include/uapi/asm-generic/unistd.h This is a bit confusing since it is quite different from x86 and x86_64 and arm 32-...
user avatar
12 votes

Purpose of test eax,eax after a strcmp

You might be missing the fact that call strcmp will not set ZF for you - it returns the result in the EAX register. But JNE instruction tests ZF, and that test eax, eax serves to set ZF according to ...
user avatar
  • 251
12 votes
Accepted

Need help understanding a complex mathematical password checking function?

Since you've already mostly decoded the code, there are two things left: 1) understand what the code is doing and 2) understand how to compute the appropriate input. The original code First, here'...
user avatar
  • 2,426
11 votes

Has XOR EAX, EBX another purpose?

The XOR mnemonic does not represent an XOR swap; it represents a bitwise XOR.
user avatar
11 votes
Accepted

How to detect thumb mode in ARM disassembly?

An ARM object file should contain symbols identifying the regions that are arm code ($a), thumb code ($t) and literal data ($d). You can see these as symbols #4 and #5 in your read-elf output. i.e. ...
user avatar
  • 2,229
11 votes
Accepted

xor eax, eax in x64

In x64, any operation on a 32-bit register clears the top 32 bits of the corresponding 64-bit register too, so there's no need to use xor rax, rax which would necessitate an extra REX byte for ...
user avatar
  • 34.9k
10 votes
Accepted

How to recover the exception info from .gcc_except_table and .eh_handle sections?

(I think you may get some extra comments if you use -fverbose-asm.) Recovering information from these tables is definitely possible, although documentation is scarce and is often present only in the ...
user avatar
  • 34.9k
10 votes

Reverse Engineering of a packet encryption function of a game

First I would run some static analysis on the application such as Findcrypt or ProtectID and PEID's Kanal plugin to scan for known static values used in various encryption algorithms. If you find ...
user avatar
10 votes
Accepted

mov ecx, arg - How to replicate in C++?

You can either typedef it like this: // typedef <return-type>(__thiscall* <type-name>)(<ecx>, <stack-1>, <stack-2>); typedef int(__thiscall* tSomeFunc)(int thisPtr, int ...
user avatar
  • 1,253
10 votes
Accepted

Reverse engineering the virtual machine based crackme

First of all, the fact to turn a program into a bytecode that will be interpreted by a crafted VM which will be embedded into the software is a quite well-known technique of obfuscation. There have ...
user avatar
  • 18.1k
10 votes
Accepted

How does this EB F2 x86 instruction work?

from google starmans realm quoting relevant info These are also known as SHORT Relative Jumps. Programs using only Relative Jump instructions can be relocated anywhere in memory without ...
user avatar
  • 15k
10 votes

Meaning of cmp byte ptr [EBP-9], 0

Let's break this down. First, we have the mnemonic: cmp As you state, it performs a compare, though in truth it performs a subtraction (first operand minus the second) without storing the result, ...
user avatar
10 votes
Accepted

Which operators use sal, shl, sar or shr

First it should be noted that there are so many architectures out there, each with its own instruction set. Here I assume you mean x86 (and you should indeed tag the proper architecture as 0xC0000022L ...
user avatar
  • 466
10 votes
Accepted

Do I have to learn computer architecture for underestanding or doing reverse engineering?

The question is too broad, but I'll try to answer and hope that it will help. It depends on what exactly do you mean by computer architecture and area you applying your reverse engineering skills to. ...
user avatar
  • 7,875
9 votes

How does sysenter instruction in windows 7 work?

Here is a perfect explanation how sysenter works: http://www.osronline.com/article.cfm?id=257 In essence: All native API calls from User Mode have a body that simply loads an index into EAX, executes ...
user avatar
  • 336
9 votes
Accepted

Call to an imported function in a PE file: Why is destination prepended with ds (call ds:func_name)?

The FF 15 is an absolute indirect call. It is fetching the value at a memory location, and then transferring control to the fetched address. In order to specify that memory location precisely, the ...
user avatar
  • 4,511
9 votes

How to bypass ZwContinue?

ntdll!ZwContinue takes the same parameters than ntdll!NtContinue, that is the following : NTSTATUS NTAPI NtContinue ( IN PCONTEXT ThreadContext, IN BOOLEAN RaiseAlert ); You can read the "Eip" ...
user avatar
  • 578

Only top scored, non community-wiki answers of a minimum length are eligible