20 votes

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

It's the wrong question, really. AH is the exception. Now the real question is, why is AH such an exception? It's an old register, from the 8086 era. It exists to facilitate moving over code from ...
user avatar
  • 301
19 votes
Accepted

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones? It is impossible to access the higher parts of the EAX and RAX registers, or of any other 32 and 64-bit ...
user avatar
  • 11.4k
18 votes
Accepted

Randomly picking up a x86 register for an instruction

To better understand this, you need to study instruction encoding formats i.e. x86 for this question. An x86 instruction looks like this +----------------------+--------+--------+-----+--------------...
user avatar
  • 5,860
8 votes
Accepted

How many registers does an x86_64 CPU actually have?

Wikipedia has a page about the x86 architecture and all its known registers. Here is a small picture gathering all what we know about it. In fact, not all these registers are officially documented. ...
user avatar
  • 18.1k
7 votes
Accepted

Register Calling Convention: written in stone, or in mud?

If the compiler can prove that it has all call sites for a given function under its control then it can discard conventions and arrange things around to its liking. Microsoft's C/C++ compiler has been ...
user avatar
  • 1,960
7 votes

How many registers does an x86_64 CPU actually have?

I believe the discrepancy between 40 and actual sum of 48 is mostly an error, however there are many other registers used for handling hardware, memory management, and control of different features of ...
user avatar
  • 11.4k
6 votes

How can I step through instructions in IDA and know the current EIP?

The valid answer to this problem is in the fact that python script and the debugger execution flows perform asynchornously. So each time we ask the debugger to do a step_into(), we also need to wait ...
user avatar
6 votes
Accepted

Assembly- Using push and ESP-Register to store addresses

First of all, let me clarify this: ESP is a 32-bit register which contains a pointer to the stack. It is not, by any means, big enough to comprise the addresses at [...]. It is just pointing at a ...
user avatar
  • 1,253
6 votes
Accepted

How do the PSHUFLW and PSHUFD instructions work?

The visual story of PSHUFLW is as follows: I will use Position as same mean as Order here and starts from Zero (Zero-Indexed). As you can see it selects words from source based on value of N. The ...
user avatar
  • 131
5 votes

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

Update: Thanks to Nirlzr, I see I missed the emphasized point at the bottom of the post. This answer, though not what OP is looking for, may serve useful for anyone down the road who is looking for a ...
user avatar
  • 2,154
5 votes
Accepted

Strcpy BufferOverflow get shellcode location for EIP

68 A bytes - 23 shellcode bytes: 45 NOPs. NOP is the mnemonic that stands for No OPeration which is the byte \x90, meaning that you'll have to change the A's (\x41) for NOPs (\x90), because \x41 by ...
user avatar
  • 176
5 votes
Accepted

Output of gdb `info registers`

In fact, in assembly you can find only three types of values: Numerical values; Memory addresses; Instructions (opcodes). General purpose registers, such as rax, rbx, ..., are used to store either ...
user avatar
  • 18.1k
5 votes

How are addresses calculated from the values in x86 segment registers?

In protected mode the segment selectors are indexes into the descriptor table (local or global one, depending on the TI bit of the selector). The descriptor entry describes the base address, limit (...
user avatar
  • 34.9k
5 votes

x64dbg (x32dbg) log registers every step like windbg

There is no such functionality in x64dbg out of the box, but we can make your own by writing a plugin! There are many examples (often with source code) available on http://plugins.x64dbg.com. In this ...
user avatar
  • 1,602
5 votes
Accepted

PowerPC TOC and SDA

First, a bit of background on why these registers are needed. PPC is a RISC-like ISA, in that all instructions are of the same size (32 bits) and there is limited space for immediate values (usually ...
user avatar
  • 34.9k
4 votes

How are addresses calculated from the values in x86 segment registers?

You're looking at 32 bit registers (probably in a 32bit process). Since 32bit processors segment registers are rarely used as offset addresses for the simple reason 32 bit is enough to represent a ...
user avatar
  • 11.4k
4 votes
Accepted

Moving integer to xmm register

To move a number into an XMM register, you'll first need to move that number into a memory address since you can't move an immediate into an XMM register (meaning, you can't do something like mov XMM1,...
user avatar
  • 2,154
4 votes
Accepted

Why aren't compilers using registers for their intended purpose?

The "intended purpose" of a processor register is generally irrelevant to a compiler, unless something fundamental about the instruction set or architecture makes use of that aspect of the ...
user avatar
  • 7,879
3 votes
Accepted

Is the value of EBP before the main function important?

__libc_start_main is called by the entry point code (usually in a file called crt0.S or similar) and that code usually sets up the initial EBP value (usually to 0, to denote end of the call stack for ...
user avatar
  • 34.9k
3 votes
Accepted

Added instruction to shellcode

The original shellcode contains only eight instructions, but because you asked gdb to disassemble 14 instructions, it went ahead and did just what you asked. Since you asked to disassemble more than ...
user avatar
  • 34.9k
3 votes

EBP + C what is that?

EBP stands for extended base pointer keeping track of the current stackframe. Since the current ESP (extended stack pointer) changes frequently in functions as stuff gets pushed to and poped of the ...
user avatar
  • 2,826
3 votes

EBP + C what is that?

C is a hexadecimal number (12 in decimal).DWORD PTR SS:[EBP+C] should mean memory at stack segment, by address (value of EBP register + 12). This CMP ECX,DWORD PTR SS:[EBP+C] means "compare the ...
user avatar
  • 7,875
3 votes

Initial ESP and EBP values (Windows x86)

The stack is allocated as part of the loading procedure, after the process is mapped into memory. Its reserve size plays a part in where it can be placed in memory. The location of the stack is not ...
user avatar
  • 4,511
3 votes
Accepted

How to stop IDA debugger when a register is set to a particular value?

You can use the following IDC script for the purpose. It would stop whenever register eax contains 0. The debugger must be running when the script is executed. #include <idc.idc> static main() ...
user avatar
  • 5,860
3 votes
Accepted

TEST instruction and ZF flag

Why the zero flag must be different from zero? It is a little confusing, but the Zero Flag is set (i.e. its value is 1), if the last result IS zero: result is 0 ⇒ ZF is not 0 result is not 0 ⇒ ZF is ...
user avatar
  • 1,042
2 votes

GUI apps uses registry,how?

To see which registry keys your applications accesses while running, use Procmon. If you want to monitor more DLL calls than mere registry accesses, i recommend API Monitor.
user avatar
2 votes
Accepted

How can an IA-32 program seemingly compiled with MSVC send its sole argument via EAX?

We can see from this list that IA-32's Delphi/Free Pascal calling convention is the register calling convention. My guess is you're dealing with a binary that's the result of something like this: How ...
user avatar
  • 2,154
2 votes

Can I step through a binary with IDA (eval version), reading registers step-wise?

I own an IDA license, so I have no use for the free one. I don't know with complete certainty whether the freeware version does debugging, but here's a quote from the freeware download page about the ...
user avatar
  • 7,879
2 votes

How to view registers values in string

Using drr is showing the strings.
user avatar
  • 471
2 votes

x64dbg (x32dbg) log registers every step like windbg

You have registers listed in CPU view (View->CPU) like this: In case you want to get them in a trace log, you have to do: Trace->Trace into... and in Log Text field, write: registerName: {...
user avatar
  • 3,189

Only top scored, non community-wiki answers of a minimum length are eligible