Hot answers tagged

7 votes
Accepted

What does XREF mean?

Cross References (or simply XREFs) is a feature of disassemblers to show you where certain functions and objects were called from or which functions and objects are used by a specific function. We can ...
user avatar
  • 8,639
6 votes
Accepted

How do the PSHUFLW and PSHUFD instructions work?

The visual story of PSHUFLW is as follows: I will use Position as same mean as Order here and starts from Zero (Zero-Indexed). As you can see it selects words from source based on value of N. The ...
user avatar
  • 131
5 votes
Accepted

Undocumented MSR Machine Specific register

GitHub is a good place to search for such stuff, e.g.: https://github.com/search?q=0x13A+IA32+MSR&type=Code (may require logging in) Produces results like: #define MSR_BOOT_GUARD_SACM_INFO ...
user avatar
  • 34.8k
4 votes

Loading 8051 binary to IDA with ROM+External RAM configuration

The default dialog you’re seeing uses so-called “linear addresses” which are global for the whole program and can not intersect. It is mostly useful for processors with unified (Von Neumann) address ...
user avatar
  • 34.8k
4 votes
Accepted

NASM, MASM, Intel, AT&T' syntax?

You are confusing several things. nasm, masm and gas (GNU Assembler) are tools that compile an x86 assembly text file into an executable. Each of them do have a specific syntax to specify your ...
user avatar
  • 18.1k
3 votes
Accepted

Intel ME partitions EFFS and FCRS?

I was working on this this weekend. Turns out it's pretty straight-forward. Simple list of contiguous files. Just copies files when they change, and marks the allocation-table entries as dead, for ...
user avatar
3 votes
Accepted

How can I find out what type of processor an Intel Hex file belongs to?

This sounds analogous to given a document, infer the language. I'd compare the frequency (count for each value in the file) of instructions with the frequency of instructions derived from files for ...
user avatar
3 votes
Accepted

Intel syntax - Meaning of jmp/call instruction with $+5 operand

opcode for call $+5 is e8 00000000 so it calls the next instruction opcode for jmp $+5 is e9 00000000 so it jumps to the next insturction 76E95FE0 E8 00000000 CALL 76E95FE5 ...
user avatar
  • 14.9k
3 votes
Accepted

Understand the CPU cycles of x86 instruction bsr/bsf

I've found a site which seems to indicate this was implemented as a loop when the instructions were introduced: BSF scans forward across bit pattern (0-n) while BSR scans in reverse (n-0). ...
user avatar
  • 2,826
2 votes
Accepted

Optimized vs Unoptimized code comparison

First of all, I would advise you to read about the SystemV ABI for i386 and amd64. You can find the documents here: System V i386 ABI System V amd64 ABI These documents define as precisely as ...
user avatar
  • 18.1k
2 votes

What does XREF mean?

It means a cross-reference. It shows you that this part of code is called or referenced (like data) from another.
user avatar
2 votes
Accepted

Basic hello world stack manipulation troubles

It's not add in the first opcode. It's and. So it will clear the lower nibble for the last byte in the address. This is how the alignment is done and not by adding anything. Only later you sub 16 to ...
user avatar
2 votes

Intel syntax - Meaning of jmp/call instruction with $+5 operand

$ = Current position (beginning of the instruction) +5 = +5 bytes from the beginning of the instruction jmp $+5 = jmp 3 bytes past the jmp instruction (short jmp takes 2 bytes + 3 bytes past that)
user avatar
  • 586
2 votes

How can I find out what type of processor an Intel Hex file belongs to?

You can't - the Intel hex format doesn't hold this kind of data. You need to manually look for the correct architecture. You can use IDA or Ghidra for that and open in the following for each ...
user avatar
2 votes
Accepted

Where is the legacy BIOS stored on a UEFI system?

The legacy BIOS code is usually stored compressed in the UEFI filesystem. You can find it in UEFITool by looking for the magic string IFE$ (49 46 45 24) - signature of the EFI_COMPATIBILITY16_TABLE ...
user avatar
  • 34.8k
2 votes

Why base address of GDT(global descriptor table) differ in intel x64 processor?

IIRC on Linux GDT is separate for each processor so you’re probably seeing the addresses for different processors.
user avatar
  • 34.8k
2 votes

How does this function take the argument if its not pushed into the stack?

var_20 is likely defined as -20h, so the mov instruction is actually accessing [esp]. This puts the argument at the expected location for the called function, but does not change the esp itself. This ...
user avatar
  • 34.8k
1 vote

jmp $+5, why the jump

Are you sure you encounter JMP $+5? A common x86 function prologue pattern has CALL $+5 in the position you describe. In addition to continuing at the next instruction, it also pushes the address of ...
user avatar
1 vote

Intel ME partitions EFFS and FCRS?

I have not encountered FCRS but EFFS is the legacy Flash Filesystem partition, used to store configuration and runtime ME data. The only known tool that can parse it (besides ME firmware itself) is ...
user avatar
  • 34.8k
1 vote

Where are the intel manual x86-16?

The Intel processors still support 16-bit real mode so the latest manuals do describe it as well, although not as prominently as protected or long mode. Look for mentions of “Real-Address or Virtual-...
user avatar
  • 34.8k
1 vote

What is the equivalent of the dollar sign from jmp $+1 in GAS syntax?

you can use intel syntax if you prefer in gas and use $+1 to jump into the middle of the instruction $ cat foo.s .intel_syntax noprefix .global start _start: jz $+1 .byte ...
user avatar
  • 14.9k
1 vote

What is the equivalent of the dollar sign from jmp $+1 in GAS syntax?

This is not really an RE question, but I think . is used to refer to current location in many GAS architectures.
user avatar
  • 34.8k
1 vote

IDA Pro Address doesn't correlate to Immunity Debugger address

This could be ASLR (Address Space Layout Randomization). It randomly changes the base address for binaries so people cannot rely on fixed addresses if they try to write an exploit. There are a few ...
user avatar
1 vote
Accepted

Intel PIN (TracerPIN): adding modification of registers

What worked for me was passing a reference to the register to my changeReg() function with IARG_REG_REFERENCE, then changing the value the reference points to.
user avatar
  • 341
1 vote
Accepted

How to debug Portable executable for AMD64 in IDA PRO?

You did not give any details about your machine's processor. Does it support 64-bit architecture? Does it implement the x86-64 instruction set? This is only a problem if your machine's Intel ...
user avatar
  • 6,859
1 vote

Basic assembly query

First of all, you are using the Intel syntax for the x86/amd64 assembly. So, in this syntax the brackets ([.]) stands for a dereference of the address it contains. If you know C programming, [var] (...
user avatar
  • 18.1k
1 vote

Detecting user<->kernel transitions with hypervisor

Yes, it is possible. I do not want to go into details as there are a lot of comprehensive material available online: Intels manuals which you will have to study in any case if you really want to ...
user avatar
  • 2,842
1 vote
Accepted

igdlh64.inf modify custom resolution

DTD Calculator (http://www.avsforum.com/forum/26-home-theater-computers/947830-custom-resolution-tool-intel-graphics-easier-overscan-correction.html) did the job for me. Using it I was able to ...
user avatar
  • 131

Only top scored, non community-wiki answers of a minimum length are eligible