Skip to main content
14 votes

Why did Intel chose 90h machine code for their NOP instruction instead of a 0?

From the Intel manual under NOP: The one-byte NOP instruction is an alias mnemonic for the XCHG (E)AX, (E)AX instruction. This XCHG mnemonic is encoded as 90+reg encoding used as a second parameter ...
Paweł Łukasik's user avatar
3 votes

Why did Intel chose 90h machine code for their NOP instruction instead of a 0?

I don't think that was the reason why 0x00 didn't become a NOP, but from today's security perspective it would totally make sense to not have 0x00 as a NOP. This is because today's architectures are ...
Fee's user avatar
  • 173
3 votes
Accepted

Keystone rust bindings error when assembling "syscall; ret" shellcode

There is a problem with the keystone crate available on crates.io - It runs with the version 0.9.0 and hasn't been updated for a while. It also has a few bugs which have now been fixed in 0.9.2. You ...
sudhackar's user avatar
  • 2,709
3 votes

What means this code?

It's writing the dword-sized value 0 (which may be an integer or a NULL pointer on x86) to the dword-sized field at +0Ah in some struct. Nobody can tell you any more than that given three lines of ...
Rolf Rolles's user avatar
  • 9,198
2 votes

Keystone rust bindings error when assembling "syscall; ret" shellcode

Cmake Version D:\>cmake --version cmake version 3.28.0-rc3 CMake suite maintained and supported by Kitware (kitware.com/cmake). rust version D:\>cargo -V cargo 1.73.0 (9c4383fb5 2023-08-26) ...
blabb's user avatar
  • 16.4k
2 votes

How do I go about overriding a function internally defined in a binary on Linux?

First off, I would like to thank @wisk for his answer. We've been trying to patch some software running in an experiment on the ISS and building from his answer we were finally able to figure this ...
Compholio's user avatar
  • 121
1 vote
Accepted

how to diassemble an .obj file

This obj (or omf) file is an assembled 8086 executable that should contain executable code (no headers). IDA Pro can disassemble it, but the free version won't. Ghidra can handle it. You may have to ...
Yotamz's user avatar
  • 1,272
1 vote
Accepted

Mnemonic suffixes for x86-64 assembly for AT&T syntax

Yes, you are right: Operation suffixes on wikibooks.
Ruslan Garipov's user avatar
1 vote

Assembler OR operation

Almost, but not exactly. bool is not required to be 1 byte long in C++, so I'd declare unknown_byte_0004AAA7 as uint8_t, to make sure it is one byte long.
Dario Petrillo's user avatar
1 vote

MS DOS development - Interrupt controller

you could probably simulate most of this by running some pyhton or any other easy to use environment or simulators or al , 1 for i in range(0,32,1): ... al = i ... print(bin(al | 1) , end = &...
blabb's user avatar
  • 16.4k
1 vote

MS DOS development - Interrupt controller

The first section of code is disabling IRQ0, while the second section of code is enabling IRQ0. Assuming this is code that works on a standard PC, it is specifically disabling the real-time clock ...
Steve Mathwig's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible