Hot answers tagged

7 votes

What is the difference between MOV and LEA in example?

lea = address mov = contents if address 0x401000 contains 0xDeadBeef like ef be ad de lea MySecretPlace, [401000] MySecretPlace will be 0x401000 Mov MySecretPlace, [401000] MySecretPlace will be ...
user avatar
  • 14.8k
6 votes

Segmentation fault while pushing onto the stack

The segmentation fault error doesn't have anything to do with pushing the strings on the stack. I used gdb to debug it, and the problem lies at: ;exit(int ret) mov al,1 xor ebx, ebx int 0x80 ...
user avatar
  • 219
5 votes
Accepted

What's the meaning of dword_XXXX and offset dword_XXXX in IDA?

I think I figured out what's going on. The opcodes for the printing were (assuming dword_AAAAAAAA instead of general dword_XXXX): FF 35 AA AA AA AA push dword_AAAAAAAA; otherPointer 68 AA AA AA ...
user avatar
  • 175
5 votes
Accepted

Objective-C disassembling - I dont understand this code

The instructions mov qword [rbp - 16], rax mov rax, qword [rbp - 16] are created by the compiler which is using stack based memory allocation to store the result from the NSString objc call. If ...
user avatar
  • 1,321
4 votes
Accepted

How to directly re-use the dumped content of `.rodata`, `.data` and `.bss` section?

As an assembly programmer I would say that gas is rarely used to assemble external code. The task of calling gas is usually left to the compiler, and most of the assembly that gas has to handle in ...
user avatar
  • 2,603
4 votes
Accepted

NASM, MASM, Intel, AT&T' syntax?

You are confusing several things. nasm, masm and gas (GNU Assembler) are tools that compile an x86 assembly text file into an executable. Each of them do have a specific syntax to specify your ...
user avatar
  • 18k
3 votes

Is there a way to 'mov eax, ax'?

The answer is to use rol: rol eax, 10
user avatar
  • 723
3 votes
Accepted

Working Linux assembly XOR Encoder/Decoder Failing on Windows

There are few issues with your code. 1st is what Igor mentioned - .text section is RO. This was solved in this answer. The 2nd is that you did not copy correctly the bytes or lost some of them in ...
user avatar
3 votes

What is the difference between MOV and LEA in example?

This is basic. Assume that rpb has a value of 55h (Assembler syntax). then lea rax, [rbp-50h] would result in 5. On the other hand, mov rax, [rbp-50h] would most probable crash your application, as ...
user avatar
  • 1,804
3 votes

What is the difference between MOV and LEA in example?

Warning: Illegal instruction used for explanation. If you are wondering if mov can do the work of lea, mov eax, esp+4 and lea eax, [esp+4] copies the same value to eax. However, mov eax, esp+4 is not ...
user avatar
2 votes

far jump do not point to instruction?

first of all you have a 32bit binary and you are debugging it on a 64 bit system see the wow64 symbol it means you are looking at some kind of in-between it means the far jump is pointing to a ...
user avatar
  • 14.8k
2 votes

What is the difference between MOV and LEA in example?

The difference is that lea only calculates the address while mov actually moves the data. If you know C or C++, it’s somewhat similar to: Lea:rax = rbp + 0x50; Mov: rax = rbp[0x50]; (Not equivalent ...
user avatar
  • 34.6k
2 votes
Accepted

Reassembling reversed ASM

SYNONYMS for Instruction ( PUSH ALL DOUBLE WORDS / longs) pushad intel (masm , yasm , nasm , tasm) pushal at&t with ( gas ) sqrtps = square root of single precision floating point if ...
user avatar
  • 14.8k
2 votes
Accepted

Inversion of input parameters in ASM

Calling Conventions: You may be referring to calling conventions and order of parameters being pushed. If so, here is an answer addressing as such. You can read more about calling conventions in ...
user avatar
  • 2,144
2 votes
Accepted

How to Make .text Section in Assembly Writeable for Win7-64 EXE

I don't see that option in golink linker but if you use i.e. link.exe (Microsoft (R) Incremental Linker Version 14.11.25506.0) then you can use /SECTION parameter to specify that. link /SUBSYSTEM:...
user avatar
2 votes

Segmentation fault while pushing onto the stack

In addition to the answer by @user2389688 it's important to note that the syscall numbers are wrong if you're doing amd64, as are the passed in registers. Here's a 64 bit abi version which corrects ...
user avatar
  • 1,561
2 votes

Working Linux assembly XOR Encoder/Decoder Failing on Windows

I think the problem is that the executable code is not writeable by default on Windows, so it fails when xor tries to modify the code. You should look into how to modify .text section permissions, ...
user avatar
  • 34.6k
2 votes
Accepted

Debugging EXE File in Windbg and How to set Breakpoints in Assembly

It seems bp $exentry should set breakpoint on the entrypoint, then you can continue (g) until you hit it.
user avatar
  • 34.6k
1 vote

Segmentation fault while pushing onto the stack

I tried your code in a 64 bit machine and there are some considerations: when you push the 2 snippets of the string, the stack is containing a void word between them: Breakpoint 1, ...
user avatar
1 vote

Injecting shellcode in ELF binary

As @goodies said in the comment what is happening here is that you are destroying some register values and thus causing a crash. Extend your payload with pusha/popa like this _start: pusha jmp ...
user avatar
1 vote

How to directly re-use the dumped content of `.rodata`, `.data` and `.bss` section?

thanks @yaspr for his excellent answer. So in this post I was asking that How to re-use .rodata .data and .bss sections' contents? Here is my answer: you can quickly go this way once you dumped ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible