Hot answers tagged

6

Cross References (or simply XREFs) is a feature of disassemblers to show you where certain functions and objects were called from or which functions and objects are used by a specific function. We can simplify it by relate to it as XREF-To and XREF-From. The referenced can be either Data or Code. XREFs are a valuable resource when we want to figure out ...


5

The visual story of PSHUFLW is as follows: I will use Position as same mean as Order here and starts from Zero (Zero-Indexed). As you can see it selects words from source based on value of N. The Order/Position of selection will be chosen by 2 bit values of N. for example when N=4, According to first bite (2-bits) of N (= 00), it will select word at ...


5

GitHub is a good place to search for such stuff, e.g.: https://github.com/search?q=0x13A+IA32+MSR&type=Code (may require logging in) Produces results like: #define MSR_BOOT_GUARD_SACM_INFO 0x13A #define B_NEM_INIT BIT0 There is no comment, but from the name it ...


4

The default dialog you’re seeing uses so-called “linear addresses” which are global for the whole program and can not intersect. It is mostly useful for processors with unified (Von Neumann) address space. Since 8051 is a Harvard architecture with separate code and data memories, each one starting at zero, IDA emulates it by creating non-intersecting ...


3

I was working on this this weekend. Turns out it's pretty straight-forward. Simple list of contiguous files. Just copies files when they change, and marks the allocation-table entries as dead, for later collection. The following is incomplete, but it should let you tweak and special-case your way through a specific MFS partition. I've tried to document ...


3

This sounds analogous to given a document, infer the language. I'd compare the frequency (count for each value in the file) of instructions with the frequency of instructions derived from files for known processor types. Effectively a unigram model. If you source the files in a common format I can give you a hand.


3

I've found a site which seems to indicate this was implemented as a loop when the instructions were introduced: BSF scans forward across bit pattern (0-n) while BSR scans in reverse (n-0). Clocks Size Operands 808x 286 386 486 Bytes reg,reg - - 10+3n 6-42 ...


3

opcode for call $+5 is e8 00000000 so it calls the next instruction opcode for jmp $+5 is e9 00000000 so it jumps to the next insturction 76E95FE0 E8 00000000 CALL 76E95FE5 ; <ntdll.call here> 76E95FE5 <ntdll.call here> 00 DB 00 76E95FE6 E9 00000000 JMP 76E95FEB ...


2

First of all, I would advise you to read about the SystemV ABI for i386 and amd64. You can find the documents here: System V i386 ABI System V amd64 ABI These documents define as precisely as possible how a compiler coder should translate some C/C++ code into i386/amd64 assembly code for a Unix-like system. They are extremely important documents and you ...


2

It means a cross-reference. It shows you that this part of code is called or referenced (like data) from another.


2

$ = Current position (beginning of the instruction) +5 = +5 bytes from the beginning of the instruction jmp $+5 = jmp 3 bytes past the jmp instruction (short jmp takes 2 bytes + 3 bytes past that)


2

It's not add in the first opcode. It's and. So it will clear the lower nibble for the last byte in the address. This is how the alignment is done and not by adding anything. Only later you sub 16 to have room for the local variables. Why do we need to modify the value of EBP? We use EBP to store the initial ESP value. EBP is pointing to the current stack ...


2

IIRC on Linux GDT is separate for each processor so you’re probably seeing the addresses for different processors.


2

You can't - the Intel hex format doesn't hold this kind of data. You need to manually look for the correct architecture. You can use IDA or Ghidra for that and open in the following for each architecture it might be. Then you need to disassemble the whole file and look if it makes sense. (Control flow, number of functions, xrefs,...) Or of course, use some ...


2

var_20 is likely defined as -20h, so the mov instruction is actually accessing [esp]. This puts the argument at the expected location for the called function, but does not change the esp itself. This approach of argument passing is used by GCC since many years ago. Supposedly this used to be somewhat faster than pushing in some cases, and also changing esp ...


2

The legacy BIOS code is usually stored compressed in the UEFI filesystem. You can find it in UEFITool by looking for the magic string IFE$ (49 46 45 24) - signature of the EFI_COMPATIBILITY16_TABLE structure. In AMI based firmware it is usually a RAW subsection of a file names CSMCORE. The following script parses the AMI format raw stream and extracts the ...


1

I have not encountered FCRS but EFFS is the legacy Flash Filesystem partition, used to store configuration and runtime ME data. The only known tool that can parse it (besides ME firmware itself) is Intel’s Flash Image Tool (FIT) for the corresponding firmware version. However, the format is likely very similar to that of the newer MFS in ME 11 and later, ...


1

The Intel processors still support 16-bit real mode so the latest manuals do describe it as well, although not as prominently as protected or long mode. Look for mentions of “Real-Address or Virtual-8086 Mode”.


1

you can use intel syntax if you prefer in gas and use $+1 to jump into the middle of the instruction $ cat foo.s .intel_syntax noprefix .global start _start: jz $+1 .byte 0x25,0x45,0x33,0x40,0x00 assemble $ as -o foo.o foo.s disassemble $ objdump.exe -d foo.o foo.o: file format pe-x86-64 Disassembly of section .text: ...


1

This is not really an RE question, but I think . is used to refer to current location in many GAS architectures.


1

You are confusing several things. nasm, masm and gas (GNU Assembler) are tools that compile an x86 assembly text file into an executable. Each of them do have a specific syntax to specify your program. But, they share a lot on assembly instructions. Then, Intel et AT&T are specific syntax to write x86 assembly programs. In fact, nasm and masm use the ...


1

This could be ASLR (Address Space Layout Randomization). It randomly changes the base address for binaries so people cannot rely on fixed addresses if they try to write an exploit. There are a few ways to disable it, some global, some for specific executables. The easiest way to disable it for a single executable is opening it in a PE editor and removing/...


1

What worked for me was passing a reference to the register to my changeReg() function with IARG_REG_REFERENCE, then changing the value the reference points to.


1

You did not give any details about your machine's processor. Does it support 64-bit architecture? Does it implement the x86-64 instruction set? This is only a problem if your machine's Intel processor does not support 64-bit architecture and/or does not does not implement the same instruction set as AMD64 processors. However, AMD64 processors and most 64-...


1

First of all, you are using the Intel syntax for the x86/amd64 assembly. So, in this syntax the brackets ([.]) stands for a dereference of the address it contains. If you know C programming, [var] (in assembly) is exactly similar to '*var'. In fact, the only small difficulty you have to handle here is that the num1 that you defined is already an address (I ...


1

Yes, it is possible. I do not want to go into details as there are a lot of comprehensive material available online: Intels manuals which you will have to study in any case if you really want to understand how things work (from personal experience) A VMM-based System Call Interposition Framework for Program Monitoring - one of the countless examples about ...


1

DTD Calculator (http://www.avsforum.com/forum/26-home-theater-computers/947830-custom-resolution-tool-intel-graphics-easier-overscan-correction.html) did the job for me. Using it I was able to create valid EDIDs and add them to by modifying [NonEDIDMode_AddSwSettings] category in the said inf file(simply modify total number of DTD and add your EDID, do not ...


Only top voted, non community-wiki answers of a minimum length are eligible