Skip to main content
19 votes
Accepted

What is the purpose of these instructions before the main preamble?

What the Instructions Are Doing What are the first three instructions before push %ebp doing? Namely, 804841b: 8d 4c 24 04 lea 0x4(%esp),%ecx <- 1 804841f: 83 e4 f0 ...
julian's user avatar
  • 7,176
7 votes

What is the purpose of these instructions before the main preamble?

What does this do? These three statements serve to move the stackframe of main, beginning with its return address, to the next 16-byte-aligned address. lea 0x4(%esp),%ecx # save address of ...
pesco's user avatar
  • 187
7 votes

What is a non-virtual thunk?

The answer should really state what the difference is between a virtual thunk and a non virtual thunk. They are identical in operation but just have a different name. The thunk for a virtually ...
Lewis Kelsey's user avatar
6 votes
Accepted

How to disable relro while compilation?

To enable full relro: -Wl, -z,relro,-z,now What does this do? - it provides -z,relro,-z,now flag to linker as an argument. This enables full relro (notice -z,now flag). Partial relro is enabled by ...
R4444's user avatar
  • 1,807
5 votes
Accepted

GCC change the order of variable declaration

My best guess : memory alignment. An integer in C is 4 bytes and a char 1 byte. Therefore, your declarations go like this : 4B & 1x10=10B & 4B. This order means that the 10B won't be aligned ...
yaspr's user avatar
  • 2,673
5 votes

How to find out if PE executable was compiled with gcc or VisualStudio?

While not a definitive way of determining if GCC OR MSVC (Visual Studio) was used, the presence of the Rich header does determine whether Microsoft's link.exe (MS VC Toolset's linker) was used. (Note: ...
SheepReaper's user avatar
4 votes

How to find out if PE executable was compiled with gcc or VisualStudio?

Additional to PE detection tools (like PEiD, Detect it easy ,Etc) there is some especial code patterns for GCC and MSVC for example GCC use MOVinst instead of PUSH inst for pushing a value on stack.
EIP Passenger's user avatar
4 votes
Accepted

C++ to assembly, GCC vs CL

Given that you didn't specify any optimization flag and used -m32, GCC performed no optimization on your code. The -m32 flag specifies the generation of a 32 bit code for a compiler configured to ...
yaspr's user avatar
  • 2,673
3 votes

Use GCC and objdump to disassemble any hex to assembly code

Linux binutils tools, such as objdump, gdb etc. rely on the BFD library, meaning they take well-formed ELF files, not arbitrary byte values or ASCII hex strings, as input. If you want to create your ...
julian's user avatar
  • 7,176
3 votes
Accepted

Strings weirdly split in binary

Shot in the dark: Maybe this text (or the whole binary image) is compressed. Think something like LZSS. The fact that there is a mystery byte containing eight 1 bits, followed by eight literal and ...
smitelli's user avatar
  • 258
3 votes

Can't find the password anywhere in the binary

you're looking the wrong way. look in the functions before running main and you will find the decryption function. when you're using the decrypt function, you get a key for the archive: ...
partoftheworlD's user avatar
3 votes
Accepted

What does __return_ptr do in IDA?

The "problem" with your example is that the structure is too small (four bytes), so it fits in a register and is not actually passed on the stack. From the Itanium C++ ABI (used by most GCC ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes
Accepted

Passing argument through registers instead of the stack

This behavior is totally normal. The way functions are handled is usually described in what's called an ABI (Application Binary Interface). It defines calling conventions which detail how a call is ...
yaspr's user avatar
  • 2,673
3 votes
Accepted

Comparing the static address of the vtable of a class, to the pointer to it held by the object

The Itanium C++ ABI is sometimes not very clear about what exactly is “vtable”. In practice, the symbol such as _ZTV12DerivedClass points to the complete vtable structure, which includes the two ...
Igor Skochinsky's user avatar
  • 36.8k
2 votes
Accepted

How to get the information of "how many and which symbols are resolved by linker"?

Information about symbols resolved at link time, including the symbol name and memory address, can be acquired by by executing ld with the -M option plus the name of the object file to be linked: $ ...
julian's user avatar
  • 7,176
2 votes
Accepted

Shells CTF segfault - wrong address

I think your shellcode is missing the specifier for the bit-ness of the shellcode. You're compiling the shells in 32 bits, but for the nasm (I'm assuming you're using that) doesn't have anything. I'm ...
Paweł Łukasik's user avatar
2 votes

newbie trying to understand disassembled code

The stack is for data storage, not code I figured it out. It looks like the sub statement is allocating space for the entire program rounded to the nearest qword. Program 1 requires only 0x17 bytes ...
julian's user avatar
  • 7,176
2 votes
Accepted

Basic hello world stack manipulation troubles

It's not add in the first opcode. It's and. So it will clear the lower nibble for the last byte in the address. This is how the alignment is done and not by adding anything. Only later you sub 16 to ...
Paweł Łukasik's user avatar
2 votes
Accepted

C/C++ to Assembly language

I believe the best thing to do would be to learn about compilation in general and code generation in particular. The dragon book would be a good start. Then you can check Engineering a Compiler by ...
yaspr's user avatar
  • 2,673
2 votes

Find functions names in .init_array section in unstripped library

This can easily be achieved with radare2. I have this version installed [rese] r2 -v radare2 4.6.0-git 25072 @ linux-x86-64 git.4.4.0-486-ga5e8cf0c9 commit: a5e8cf0c9bd94e5f8d679e281c486584f23251e3 ...
sudhackar's user avatar
  • 2,709
2 votes
Accepted

Unknown parameters in custom signal handler on Linux

It seems to be %rip (the address of the ud2): #include <signal.h> #include <stdio.h> #include <ucontext.h> void handler(int signo, siginfo_t *info, void *context) { ucontext_t *...
booto's user avatar
  • 931
2 votes
Accepted

Can't find the password anywhere in the binary

Since another question was based on the same binary and the accepted answer doesn't go into detail on how to find the function responsible, here's a writeup. Usual stuff $ r2 wysiNwyg; aaa have a ...
sudhackar's user avatar
  • 2,709
2 votes

Use GCC and objdump to disassemble any hex to assembly code

You can do this using objdump: echo 0000: b0 55 15 de ad f1 55 | xxd -r > x.bin objdump -D -m i386 -b binary x.bin
Willem Hengeveld's user avatar
2 votes
Accepted

How to find function start in stripped binary?

In a nutshell, stripping a binary means removing sections containing symbol and debug information from the file. These sections lie at the end of the binary, separate from the code. Removing this ...
julian's user avatar
  • 7,176
2 votes

What is the first argument (rdi) to operator+ on x86_64 SystemV?

since this is tangentially related to query I am adding this as another answer instead of editing the first answer it appears the code in question possibly ignores compiler warnings <source>: In ...
blabb's user avatar
  • 16.4k
2 votes

How to locate memory address in register $esp

You are approaching it wrong, the problem is the memory of esp can't be known before you run the program because the value is always random at the runtime so you can't know for sure the real register ...
haxerl's user avatar
  • 176
1 vote

Detecting and solutions of stack smash protection

You can identify if a function is protected by the presence of __stack_chk_fail. It doesn't matter if it's user-custom code or it is statically compiled from libraries. gets is a very problematic ...
macro_controller's user avatar
1 vote

Arrangement of variables on the stack - out of order?

Keep in mind Your program as is when compiled with -O will become just mov eax,0 return every thing out there in your Source is Dead Code and Will be eliminated since you are compiling this in ...
blabb's user avatar
  • 16.4k
1 vote

Strings weirdly split in binary

A quick Google search revelead that ÿ in UTF8 is U+00FF. My guess would be that you're either looking at UTF8 bytes that are not being interpreted correctly or your dump has differences from ...
shxdow's user avatar
  • 164

Only top scored, non community-wiki answers of a minimum length are eligible