19
votes
Accepted
What is the purpose of these instructions before the main preamble?
What the Instructions Are Doing
What are the first three instructions before push %ebp doing?
Namely,
804841b: 8d 4c 24 04 lea 0x4(%esp),%ecx <- 1
804841f: 83 e4 f0 ...
- 7,078
7
votes
What is the purpose of these instructions before the main preamble?
What does this do?
These three statements serve to move the stackframe of main, beginning with its return address, to the next 16-byte-aligned address.
lea 0x4(%esp),%ecx # save address of ...
- 187
7
votes
What is a non-virtual thunk?
The answer should really state what the difference is between a virtual thunk and a non virtual thunk. They are identical in operation but just have a different name. The thunk for a virtually ...
- 295
6
votes
Accepted
How to disable relro while compilation?
To enable full relro:
-Wl, -z,relro,-z,now
What does this do? - it provides -z,relro,-z,now flag to linker as an argument. This enables full relro (notice -z,now flag).
Partial relro is enabled by ...
- 1,797
5
votes
Accepted
GCC change the order of variable declaration
My best guess : memory alignment.
An integer in C is 4 bytes and a char 1 byte. Therefore, your declarations go like this : 4B & 1x10=10B & 4B. This order means that the 10B won't be aligned ...
- 2,663
5
votes
How to find out if PE executable was compiled with gcc or VisualStudio?
While not a definitive way of determining if GCC OR MSVC (Visual Studio) was used, the presence of the Rich header does determine whether Microsoft's link.exe (MS VC Toolset's linker) was used. (Note: ...
- 151
4
votes
How to find out if PE executable was compiled with gcc or VisualStudio?
Additional to PE detection tools (like PEiD, Detect it easy ,Etc) there is some especial code patterns for GCC and MSVC for example GCC use MOVinst instead of PUSH inst for pushing a value on stack.
4
votes
Accepted
C++ to assembly, GCC vs CL
Given that you didn't specify any optimization flag and used -m32, GCC performed no optimization on your code. The -m32 flag specifies the generation of a 32 bit code for a compiler configured to ...
- 2,663
4
votes
Accepted
What is the difference between these two function prologue instruction sequences?
It seems like the functions are defined like this:
int quotearg_n(int a, int b) {
return quotearg_n_options(a, b, -1, "some_string");
}
int quotearg(int a) {
return quotearg_n(0, a);
}
(the ...
- 12.9k
3
votes
Use GCC and objdump to disassemble any hex to assembly code
Linux binutils tools, such as objdump, gdb etc. rely on the BFD library, meaning they take well-formed ELF files, not arbitrary byte values or ASCII hex strings, as input. If you want to create your ...
- 7,078
3
votes
Accepted
Strings weirdly split in binary
Shot in the dark: Maybe this text (or the whole binary image) is compressed. Think something like LZSS.
The fact that there is a mystery byte containing eight 1 bits, followed by eight literal and ...
- 258
3
votes
Can't find the password anywhere in the binary
you're looking the wrong way. look in the functions before running main and you will find the decryption function.
when you're using the decrypt function, you get a key for the archive: ...
3
votes
Accepted
What does __return_ptr do in IDA?
The "problem" with your example is that the structure is too small (four bytes), so it fits in a register and is not actually passed on the stack. From the Itanium C++ ABI (used by most GCC ...
- 36.4k
3
votes
Accepted
Passing argument through registers instead of the stack
This behavior is totally normal. The way functions are handled is usually described in what's called an ABI (Application Binary Interface). It defines calling conventions which detail how a call is ...
- 2,663
3
votes
Accepted
Comparing the static address of the vtable of a class, to the pointer to it held by the object
The Itanium C++ ABI is sometimes not very clear about what exactly is “vtable”.
In practice, the symbol such as _ZTV12DerivedClass points to the complete vtable structure, which includes the two ...
- 36.4k
2
votes
Accepted
How to get the information of "how many and which symbols are resolved by linker"?
Information about symbols resolved at link time, including the symbol name and memory address, can be acquired by by executing ld with the -M option plus the name of the object file to be linked:
$ ...
- 7,078
2
votes
Accepted
Shells CTF segfault - wrong address
I think your shellcode is missing the specifier for the bit-ness of the shellcode. You're compiling the shells in 32 bits, but for the nasm (I'm assuming you're using that) doesn't have anything. I'm ...
- 4,912
2
votes
newbie trying to understand disassembled code
The stack is for data storage, not code
I figured it out. It looks like the sub statement is allocating space for the entire program rounded to the nearest qword. Program 1 requires only 0x17 bytes ...
- 7,078
2
votes
Accepted
Basic hello world stack manipulation troubles
It's not add in the first opcode. It's and. So it will clear the lower nibble for the last byte in the address. This is how the alignment is done and not by adding anything. Only later you sub 16 to ...
- 4,912
2
votes
Accepted
C/C++ to Assembly language
I believe the best thing to do would be to learn about compilation in general and code generation in particular. The dragon book would be a good start. Then you can check Engineering a Compiler by ...
- 2,663
2
votes
Find functions names in .init_array section in unstripped library
This can easily be achieved with radare2. I have this version installed
[rese] r2 -v
radare2 4.6.0-git 25072 @ linux-x86-64 git.4.4.0-486-ga5e8cf0c9
commit: a5e8cf0c9bd94e5f8d679e281c486584f23251e3 ...
- 2,629
2
votes
Accepted
Unknown parameters in custom signal handler on Linux
It seems to be %rip (the address of the ud2):
#include <signal.h>
#include <stdio.h>
#include <ucontext.h>
void handler(int signo, siginfo_t *info, void *context) {
ucontext_t *...
- 911
2
votes
Accepted
Can't find the password anywhere in the binary
Since another question was based on the same binary and the accepted answer doesn't go into detail on how to find the function responsible, here's a writeup.
Usual stuff $ r2 wysiNwyg; aaa
have a ...
- 2,629
2
votes
Use GCC and objdump to disassemble any hex to assembly code
You can do this using objdump:
echo 0000: b0 55 15 de ad f1 55 | xxd -r > x.bin
objdump -D -m i386 -b binary x.bin
- 1,829
2
votes
What is the first argument (rdi) to operator+ on x86_64 SystemV?
since this is tangentially related to query
I am adding this as another answer instead of editing the first answer
it appears the code in question possibly ignores compiler warnings
<source>: In ...
- 16.3k
2
votes
How to locate memory address in register $esp
You are approaching it wrong, the problem is the memory of esp can't be known before you run the program because the value is always random at the runtime so you can't know for sure the real register ...
- 176
1
vote
Arrangement of variables on the stack - out of order?
Keep in mind Your program as is when compiled with -O will become just
mov eax,0
return
every thing out there in your Source is Dead Code and Will be eliminated
since you are compiling this in ...
- 16.3k
1
vote
Strings weirdly split in binary
A quick Google search revelead that ÿ in UTF8 is U+00FF. My guess would be that you're either looking at UTF8 bytes that are not being interpreted correctly or your dump has differences from ...
- 164
1
vote
How to find out if PE executable was compiled with gcc or VisualStudio?
If you use WinDbg, an easy way to tell might be to simply do a search for 0x00400000 (or whatever the image base address is) through every code page.
I don't know why GCC does this but apparently, it ...
Only top scored, non community-wiki answers of a minimum length are eligible