20

It's the wrong question, really. AH is the exception. Now the real question is, why is AH such an exception? It's an old register, from the 8086 era. It exists to facilitate moving over code from the 8080. The 8080 has different registers from the 8086, so you can't move over code directly. In particular, it didn't have an AL,AH or AX register. It did ...


19

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones? It is impossible to access the higher parts of the EAX and RAX registers, or of any other 32 and 64-bit registers, directly. You'll have to use indirect instruction sequences if you're interested in doing that. This is because there are no encodings to access ...


18

To better understand this, you need to study instruction encoding formats i.e. x86 for this question. An x86 instruction looks like this +----------------------+--------+--------+-----+--------------+-----------+ | Instruction prefixes | Opcode | ModR/M | SIB | Displacement | Immediate | +----------------------+--------+--------+-----+--------------+-------...


7

If the compiler can prove that it has all call sites for a given function under its control then it can discard conventions and arrange things around to its liking. Microsoft's C/C++ compiler has been doing this for decades in connection with link-time code generation and profile-guided optimisation, especially internal copies of the compiler like the one ...


6

First of all, let me clarify this: ESP is a 32-bit register which contains a pointer to the stack. It is not, by any means, big enough to comprise the addresses at [...]. It is just pointing at a memory location which holds a, b, and c. What your exploit does is push a string to the stack. Look at the /bin//sh hexadecimal representation: 2f 62 69 6e 2f 2f ...


6

The valid answer to this problem is in the fact that python script and the debugger execution flows perform asynchornously. So each time we ask the debugger to do a step_into(), we also need to wait for this process to end. This can be done by inserting GetDebuggerEvent(WFNE_SUSP, -1) after step_into import idaapi x=0 while x<10: idaapi.step_into() ...


5

68 A bytes - 23 shellcode bytes: 45 NOPs. NOP is the mnemonic that stands for No OPeration which is the byte \x90, meaning that you'll have to change the A's (\x41) for NOPs (\x90), because \x41 by itself it's not a valid ASM instruction in the x86 processor hence making your program crash. Taking this into account, first part goes like: python -c 'print &...


5

In fact, in assembly you can find only three types of values: Numerical values; Memory addresses; Instructions (opcodes). General purpose registers, such as rax, rbx, ..., are used to store either numerical values (that will trigger the behavior of the program) or memory addresses (to know where to read/write or to jump). Of course, as most of human ...


5

Update: Thanks to Nirlzr, I see I missed the emphasized point at the bottom of the post. This answer, though not what OP is looking for, may serve useful for anyone down the road who is looking for a way to access those bits. Apologies for missing OPs full intention! I actually wrote an in-depth article on this topic a couple of years ago: Accessing and ...


5

Wikipedia has a page about the x86 architecture and all its known registers. Here is a small picture gathering all what we know about it. In fact, not all these registers are officially documented. But, all the registers we know (and we know how to use) are listed in the picture. And, it makes much more than 40. And, I do not know what are these 'hardware' ...


5

I believe the discrepancy between 40 and actual sum of 48 is mostly an error, however there are many other registers used for handling hardware, memory management, and control of different features of the CPU. The answer you linked to covers all the commonly used registers in the following image (taken from there): There are, however plenty of less ...


5

The visual story of PSHUFLW is as follows: I will use Position as same mean as Order here and starts from Zero (Zero-Indexed). As you can see it selects words from source based on value of N. The Order/Position of selection will be chosen by 2 bit values of N. for example when N=4, According to first bite (2-bits) of N (= 00), it will select word at ...


4

To move a number into an XMM register, you'll first need to move that number into a memory address since you can't move an immediate into an XMM register (meaning, you can't do something like mov XMM1,9). If need be, you can allocate your own memory to store a number in, or in your scenario, if it's feasible, you could inject code to put your own value into ...


4

First, a bit of background on why these registers are needed. PPC is a RISC-like ISA, in that all instructions are of the same size (32 bits) and there is limited space for immediate values (usually 16 bits at most) that you would use for things like addresses. So how do you address more that 16 bits? One option is to build addresses by 16-bit slices, e.g. ...


3

__libc_start_main is called by the entry point code (usually in a file called crt0.S or similar) and that code usually sets up the initial EBP value (usually to 0, to denote end of the call stack for the debuggers). Here's a sample entry point code from a random ELF binary: _start: xor ebp, ebp pop esi mov ecx, esp and ...


3

The original shellcode contains only eight instructions, but because you asked gdb to disassemble 14 instructions, it went ahead and did just what you asked. Since you asked to disassemble more than there actually are, it disassembled whatever bytes happened to be present after the variable (likely zero padding but maybe also other parts of the executable). ...


3

EBP stands for extended base pointer keeping track of the current stackframe. Since the current ESP (extended stack pointer) changes frequently in functions as stuff gets pushed to and poped of the stack, the base pointer remebers the value of ESP at the beginning of the function (convention). For this reason, EBP is often used to referr to arguments or ...


3

C is a hexadecimal number (12 in decimal).DWORD PTR SS:[EBP+C] should mean memory at stack segment, by address (value of EBP register + 12). This CMP ECX,DWORD PTR SS:[EBP+C] means "compare the content of ECX register with 32 bit from address [ebp + 12].


3

In protected mode the segment selectors are indexes into the descriptor table (local or global one, depending on the TI bit of the selector). The descriptor entry describes the base address, limit (size) and some other attributes of the segment (data or code, 16- or 32-bit). For more info see the following links: Global Descriptor Table; Memory Translation ...


3

You're looking at 32 bit registers (probably in a 32bit process). Since 32bit processors segment registers are rarely used as offset addresses for the simple reason 32 bit is enough to represent a pretty big address range. Instead, some segment registers (CS, SS, DS) are now used for permissions, memory protection and paging, while others are used as ...


3

The stack is allocated as part of the loading procedure, after the process is mapped into memory. Its reserve size plays a part in where it can be placed in memory. The location of the stack is not fixed, but ends up with a common value when the stack size and process image base is the default size. It's simply the result of a memory allocation function, ...


3

You can use the following IDC script for the purpose. It would stop whenever register eax contains 0. The debugger must be running when the script is executed. #include <idc.idc> static main() { for(;;) { StepInto(); if (GetDebuggerEvent(WFNE_SUSP, -1) == STEP) { if (eax == 0) { ...


2

To see which registry keys your applications accesses while running, use Procmon. If you want to monitor more DLL calls than mere registry accesses, i recommend API Monitor.


2

We can see from this list that IA-32's Delphi/Free Pascal calling convention is the register calling convention. My guess is you're dealing with a binary that's the result of something like this: How to call a function using Delphi's register calling conventions from Visual C++? To partially quote the top-voted answer: Delphi's register calling ...


2

I own an IDA license, so I have no use for the free one. I don't know with complete certainty whether the freeware version does debugging, but here's a quote from the freeware download page about the limitations of the freeware version: lacks support for many processors, file formats, debugging etc... You might be out of luck trying to debug with the ...


2

Using drr is showing the strings.


2

There is no such functionality in x64dbg out of the box, but we can make your own by writing a plugin! There are many examples (often with source code) available on http://plugins.x64dbg.com. In this case you will want to register a callback for CB_STEPPED, which gets called after every step. The basic functionality could look something like this: ...


2

(Not exactly an answer but too long for a comment) This sounds like a simple problem but technically it isn't! I'd like to explain why and how if there is a solution for it, it is probably going to be very very slow. A debugger does not actually know all the register values at every single point in the program. It doesn't know any register values until a ...


2

By its definition, movaps instruction can't get immediate value. It can only get another register or memory location. You can see it in its documentation. MOVAPS xmm1, xmm2/m128 Move packed single-precision floating-point values from xmm2/m128 to xmm1. MOVAPS xmm2/m128, xmm1 Move packed single-precision floating-point values from xmm1 to xmm2/m128. ...


2

You are referring to the early 80s of the last century. The 8086 architecture used this way of addressing 20-bit physical memory, the then tremendous amount of 1 (One!) MByte, or "one million bytes of memory", as Intel calls it in /1/, p.2-7. These "logical addresses", as Intel called them in /1/, served primarily two purposes: One idea ...


Only top voted, non community-wiki answers of a minimum length are eligible