20
votes
Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?
It's the wrong question, really. AH is the exception.
Now the real question is, why is AH such an exception? It's an old register, from the 8086 era. It exists to facilitate moving over code from ...
- 301
19
votes
Accepted
Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?
Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?
It is impossible to access the higher parts of the EAX and RAX registers, or of any other 32 and 64-bit ...
- 11.7k
18
votes
Accepted
Randomly picking up a x86 register for an instruction
To better understand this, you need to study instruction encoding formats i.e. x86 for this question.
An x86 instruction looks like this
+----------------------+--------+--------+-----+--------------...
- 6,040
9
votes
Accepted
How many registers does an x86_64 CPU actually have?
Wikipedia has a page about the x86 architecture and all its known registers. Here is a small picture gathering all what we know about it.
In fact, not all these registers are officially documented. ...
- 18.9k
8
votes
How many registers does an x86_64 CPU actually have?
I believe the discrepancy between 40 and actual sum of 48 is mostly an error, however there are many other registers used for handling hardware, memory management, and control of different features of ...
- 11.7k
7
votes
Accepted
Register Calling Convention: written in stone, or in mud?
If the compiler can prove that it has all call sites for a given function under its control then it can discard conventions and arrange things around to its liking. Microsoft's C/C++ compiler has been ...
- 2,010
7
votes
Accepted
PowerPC TOC and SDA
First, a bit of background on why these registers are needed. PPC is a RISC-like ISA, in that all instructions are of the same size (32 bits) and there is limited space for immediate values (usually ...
- 36.4k
6
votes
Accepted
How do the PSHUFLW and PSHUFD instructions work?
The visual story of PSHUFLW is as follows:
I will use Position as same mean as Order here and starts from Zero (Zero-Indexed).
As you can see it selects words from source based on value of N. The ...
- 141
6
votes
x64dbg (x32dbg) log registers every step like windbg
There is no such functionality in x64dbg out of the box, but we can make your own by writing a plugin! There are many examples (often with source code) available on http://plugins.x64dbg.com.
In this ...
- 1,652
6
votes
Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?
Update: Thanks to Nirlzr, I see I missed the emphasized point at the bottom of the post. This answer, though not what OP is looking for, may serve useful for anyone down the road who is looking for a ...
- 2,234
5
votes
How can I step through instructions in IDA and know the current EIP?
The valid answer to this problem is in the fact that python script and the debugger execution flows perform asynchornously. So each time we ask the debugger to do a step_into(), we also need to wait ...
- 61
5
votes
Accepted
Strcpy BufferOverflow get shellcode location for EIP
68 A bytes - 23 shellcode bytes: 45 NOPs.
NOP is the mnemonic that stands for No OPeration which is the byte \x90, meaning that you'll have to change the A's (\x41) for NOPs (\x90), because \x41 by ...
- 176
5
votes
How are addresses calculated from the values in x86 segment registers?
In protected mode the segment selectors are indexes into the descriptor table (local or global one, depending on the TI bit of the selector). The descriptor entry describes the base address, limit (...
- 36.4k
4
votes
How are addresses calculated from the values in x86 segment registers?
You're looking at 32 bit registers (probably in a 32bit process). Since 32bit processors segment registers are rarely used as offset addresses for the simple reason 32 bit is enough to represent a ...
- 11.7k
4
votes
EBP + C what is that?
EBP stands for extended base pointer keeping track of the current stackframe.
Since the current ESP (extended stack pointer) changes frequently in functions as stuff gets pushed to and poped of the ...
- 2,896
4
votes
Accepted
Moving integer to xmm register
To move a number into an XMM register, you'll first need to move that number into a memory address since you can't move an immediate into an XMM register (meaning, you can't do something like mov XMM1,...
- 2,234
4
votes
Accepted
TEST instruction and ZF flag
Why the zero flag must be different from zero?
It is a little confusing, but the Zero Flag is set (i.e. its value is 1), if the last result IS zero:
result is 0 ⇒ ZF is not 0
result is not 0 ⇒ ZF is ...
- 1,120
4
votes
Accepted
Why aren't compilers using registers for their intended purpose?
The "intended purpose" of a processor register is generally irrelevant to a compiler, unless something fundamental about the instruction set or architecture makes use of that aspect of the ...
- 9,178
3
votes
Accepted
Is the value of EBP before the main function important?
__libc_start_main is called by the entry point code (usually in a file called crt0.S or similar) and that code usually sets up the initial EBP value (usually to 0, to denote end of the call stack for ...
- 36.4k
3
votes
Accepted
Added instruction to shellcode
The original shellcode contains only eight instructions, but because you asked gdb to disassemble 14 instructions, it went ahead and did just what you asked. Since you asked to disassemble more than ...
- 36.4k
3
votes
Accepted
How to stop IDA debugger when a register is set to a particular value?
You can use the following IDC script for the purpose. It would stop whenever register eax contains 0. The debugger must be running when the script is executed.
#include <idc.idc>
static main()
...
- 6,040
3
votes
EBP + C what is that?
C is a hexadecimal number (12 in decimal).DWORD PTR SS:[EBP+C] should mean memory at stack segment, by address (value of EBP register + 12).
This CMP ECX,DWORD PTR SS:[EBP+C] means "compare the ...
- 8,428
2
votes
Accepted
How can an IA-32 program seemingly compiled with MSVC send its sole argument via EAX?
We can see from this list that IA-32's Delphi/Free Pascal calling convention is the register calling convention. My guess is you're dealing with a binary that's the result of something like this: How ...
- 2,234
2
votes
Can I step through a binary with IDA (eval version), reading registers step-wise?
I own an IDA license, so I have no use for the free one. I don't know with complete certainty whether the freeware version does debugging, but here's a quote from the freeware download page about the ...
- 9,178
2
votes
x64dbg (x32dbg) log registers every step like windbg
You have registers listed in CPU view (View->CPU) like this:
In case you want to get them in a trace log, you have to do: Trace->Trace into... and in Log Text field, write: registerName: {...
- 3,369
2
votes
2
votes
Ollydbg: How to set a conditinal breakpoint for a register gets special value
(Not exactly an answer but too long for a comment)
This sounds like a simple problem but technically it isn't! I'd like to explain why and how if there is a solution for it, it is probably going to ...
- 1,391
2
votes
Ollydbg: How to set a conditinal breakpoint for a register gets special value
ctrl+t -> Set Trace Condition
checkmark condition is true check box and enter the condition
in your case ecx == 12345678
and start tracing with either ctrl+f11 or ctrl+f12
snap shot shows trace ...
- 16.3k
2
votes
How can I move an integer number into a XMM register with Cheat Engine?
By its definition, movaps instruction can't get immediate value. It can only get another register or memory location. You can see it in its documentation.
MOVAPS xmm1, xmm2/m128 Move packed single-...
- 1,848
2
votes
Accepted
Why is the offset 16 bits?
You are referring to the early 80s of the last century. The 8086 architecture used this way of addressing 20-bit physical memory, the then tremendous amount of 1 (One!) MByte, or "one million ...
- 1,964
Only top scored, non community-wiki answers of a minimum length are eligible