14
votes
Why did Intel chose 90h machine code for their NOP instruction instead of a 0?
From the Intel manual under NOP:
The one-byte NOP instruction is an alias mnemonic for the XCHG (E)AX, (E)AX instruction.
This XCHG mnemonic is encoded as 90+reg encoding used as a second parameter ...
- 4,912
4
votes
How to bypass anti debugger? IDA Pro
I'll try to "teach you to fish" and provide a good general process to bypass these checks while debugging (without patching the binary)
Set a breakpoint on the call of interest (e.g. ...
- 61
3
votes
Accepted
Keystone rust bindings error when assembling "syscall; ret" shellcode
There is a problem with the keystone crate available on crates.io - It runs with the version 0.9.0 and hasn't been updated for a while. It also has a few bugs which have now been fixed in 0.9.2.
You ...
- 2,629
3
votes
Why did Intel chose 90h machine code for their NOP instruction instead of a 0?
I don't think that was the reason why 0x00 didn't become a NOP, but from today's security perspective it would totally make sense to not have 0x00 as a NOP. This is because today's architectures are ...
- 173
3
votes
What means this code?
It's writing the dword-sized value 0 (which may be an integer or a NULL pointer on x86) to the dword-sized field at +0Ah in some struct. Nobody can tell you any more than that given three lines of ...
- 9,178
3
votes
Accepted
other than x32dbg, is there a more friendly way to check functions, their args and their return values on runtime?
Api Monitor is a great tool to hook api's, watch parameters and return values and optionally modify them before/after call.
API Monitor is a free software that lets you monitor and control API calls ...
- 3,198
3
votes
Accepted
why some functions push data before the prologue
It's saving registers that might be modified by the function. Notice that you can see assignments to all three of those registers throughout the function body. Also notice at the bottom of your ...
- 9,178
3
votes
Accepted
Reading memory values in IDA
In order to change the representation of the data to byte, word(2 bytes), dword(4 bytes) or qword(8 bytes) you can use the following shortcuts after locating the cursor at the needed adress:
U: ...
- 8,388
2
votes
Accepted
Overclock CPU in BIOS - ARM/C/C++/Py
How to change the clock-speed of a microprocessor using inline assembly language
General procedures for utilizing assembly language to overclock a microprocessor are :
Ascertain the CPU and ...
- 171
2
votes
Accepted
Ghidra Shows Structure Strange
Without seeing the full function, I suspect what you're seeing is a result of how Ghidra identifies a stack-based variable, as described in the answer to this question.
The Stack[-0x##] numbers in ...
- 91
2
votes
Accepted
How can you tell where an assembly function ends?
There's no definitive way to tell what instructions correspond to a single function, i.e. what exactly represents a function when looking only at the set of instructions. Compilers are free to ...
- 191
2
votes
Change string value when string is in a RAM address x64 c++ program
not sure what your intent is
i think you want to log a std::string that is being output by std::cout
to the log window of x64dbg based on the use of {s:whatever} syntax in your query.
if that is the ...
- 16.3k
2
votes
Reverse engineer a blackbox function operating on single or double precision floats for emulation
My starting point here wouldn't be to look at generic emulation approaches as these themselves produce approximations to the function being emulated. (If an approximation is good enough then why not ...
- 2,503
2
votes
Reverse engineer a calculation rule from a video game
Here are my suggestions about reversing traditional offline games.
If the game uses a well known game engine, then you can search for tools that are specifically created for that engine.
If the game ...
- 143
2
votes
Keystone rust bindings error when assembling "syscall; ret" shellcode
Cmake Version
D:\>cmake --version
cmake version 3.28.0-rc3
CMake suite maintained and supported by Kitware (kitware.com/cmake).
rust version
D:\>cargo -V
cargo 1.73.0 (9c4383fb5 2023-08-26)
...
- 16.3k
1
vote
Accepted
Mnemonic suffixes for x86-64 assembly for AT&T syntax
Yes, you are right: Operation suffixes on wikibooks.
- 126
1
vote
Assembler OR operation
Almost, but not exactly. bool is not required to be 1 byte long in C++, so I'd declare unknown_byte_0004AAA7 as uint8_t, to make sure it is one byte long.
- 121
1
vote
MS DOS development - Interrupt controller
you could probably simulate most of this by running some pyhton or any other easy to use environment or simulators
or al , 1
for i in range(0,32,1):
... al = i
... print(bin(al | 1) , end = &...
- 16.3k
1
vote
MS DOS development - Interrupt controller
The first section of code is disabling IRQ0, while the second section of code is enabling IRQ0. Assuming this is code that works on a standard PC, it is specifically disabling the real-time clock ...
- 111
1
vote
Reverse engineer a calculation rule from a video game
If you've already spotted the instructions then you just need to work at converting the assembly into a higher level construct.
You can work on your assembly interpretation skills by compiling small ...
- 796
1
vote
What tricks can I use to manually decompile a set of instructions
you could start with something like below and then optimize it
the flow below is not tested but should provide a starting point
the code below is trying to mimic the flow of assembly and does not ...
- 16.3k
1
vote
Accepted
Why did I have gotten only null bytes argv variable from angr?
You do not use the initial_state you create with constraints for buf arg.
From the doc
If nothing is passed in, the SimulationManager is seeded with a state initialized for the program entry point, i....
- 2,629
1
vote
Reverse Engineering CTF help
I've managed to complete the other challenges but I'm also stalled on Halifax.
The other interrupts appear to be a dead end. All the interrupts used in St. John are available (sha1, sha256, sha512), ...
- 11
1
vote
Reverse Engineering CTF help
To add to your interrupt discussion, you can also do a sha1 hash with 0x30 or a sha512 hash with 0x32. Not sure how that would help, but maybe there are more interrupts out there?
- 11
1
vote
Reverse Engineering CTF help
Im also stuck. It is a bit weird that, according the the manual, INT 0x41 is to be used to unlock, but in the code it is used to produce a hash of the SRAM... This is what I've tried so far:
Other ...
- 11
1
vote
How to resolve illegal instruction for this ARM stack exploitation?
The Error which you are getting is because the shell is expecting the input from STDIN, because of which it is terminating with the SIGKILL,
I have tried to explain the details Here . If you add the ...
- 111
1
vote
Only top scored, non community-wiki answers of a minimum length are eligible