20

It's the wrong question, really. AH is the exception. Now the real question is, why is AH such an exception? It's an old register, from the 8086 era. It exists to facilitate moving over code from the 8080. The 8080 has different registers from the 8086, so you can't move over code directly. In particular, it didn't have an AL,AH or AX register. It did ...


18

To better understand this, you need to study instruction encoding formats i.e. x86 for this question. An x86 instruction looks like this +----------------------+--------+--------+-----+--------------+-----------+ | Instruction prefixes | Opcode | ModR/M | SIB | Displacement | Immediate | +----------------------+--------+--------+-----+--------------+-------...


17

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones? It is impossible to access the higher parts of the EAX and RAX registers, or of any other 32 and 64-bit registers, directly. You'll have to use indirect instruction sequences if you're interested in doing that. This is because there are no encodings to access ...


6

If the compiler can prove that it has all call sites for a given function under its control then it can discard conventions and arrange things around to its liking. Microsoft's C/C++ compiler has been doing this for decades in connection with link-time code generation and profile-guided optimisation, especially internal copies of the compiler like the one ...


6

First of all, let me clarify this: ESP is a 32-bit register which contains a pointer to the stack. It is not, by any means, big enough to comprise the addresses at [...]. It is just pointing at a memory location which holds a, b, and c. What your exploit does is push a string to the stack. Look at the /bin//sh hexadecimal representation: 2f 62 69 6e 2f 2f ...


5

Update: Thanks to Nirlzr, I see I missed the emphasized point at the bottom of the post. This answer, though not what OP is looking for, may serve useful for anyone down the road who is looking for a way to access those bits. Apologies for missing OPs full intention! I actually wrote an in-depth article on this topic a couple of years ago: Accessing and ...


5

In fact, in assembly you can find only three types of values: Numerical values; Memory addresses; Instructions (opcodes). General purpose registers, such as rax, rbx, ..., are used to store either numerical values (that will trigger the behavior of the program) or memory addresses (to know where to read/write or to jump). Of course, as most of human ...


5

The valid answer to this problem is in the fact that python script and the debugger execution flows perform asynchornously. So each time we ask the debugger to do a step_into(), we also need to wait for this process to end. This can be done by inserting GetDebuggerEvent(WFNE_SUSP, -1) after step_into import idaapi x=0 while x<10: idaapi.step_into() ...


4

68 A bytes - 23 shellcode bytes: 45 NOPs. NOP is the mnemonic that stands for No OPeration which is the byte \x90, meaning that you'll have to change the A's (\x41) for NOPs (\x90), because \x41 by itself it's not a valid ASM instruction in the x86 processor hence making your program crash. Taking this into account, first part goes like: python -c 'print ...


3

I believe the discrepancy between 40 and actual sum of 48 is mostly an error, however there are many other registers used for handling hardware, memory management, and control of different features of the CPU. The answer you linked to covers all the commonly used registers in the following image (taken from there): There are, however plenty of less ...


3

Wikipedia has a page about the x86 architecture and all its known registers. Here is a small picture gathering all what we know about it. In fact, not all these registers are officially documented. But, all the registers we know (and we know how to use) are listed in the picture. And, it makes much more than 40. And, I do not know what are these 'hardware' ...


3

__libc_start_main is called by the entry point code (usually in a file called crt0.S or similar) and that code usually sets up the initial EBP value (usually to 0, to denote end of the call stack for the debuggers). Here's a sample entry point code from a random ELF binary: _start: xor ebp, ebp pop esi mov ecx, esp and ...


3

To move a number into an XMM register, you'll first need to move that number into a memory address since you can't move an immediate into an XMM register (meaning, you can't do something like mov XMM1,9). If need be, you can allocate your own memory to store a number in, or in your scenario, if it's feasible, you could inject code to put your own value into ...


3

The original shellcode contains only eight instructions, but because you asked gdb to disassemble 14 instructions, it went ahead and did just what you asked. Since you asked to disassemble more than there actually are, it disassembled whatever bytes happened to be present after the variable (likely zero padding but maybe also other parts of the executable). ...


3

EBP stands for extended base pointer keeping track of the current stackframe. Since the current ESP (extended stack pointer) changes frequently in functions as stuff gets pushed to and poped of the stack, the base pointer remebers the value of ESP at the beginning of the function (convention). For this reason, EBP is often used to referr to arguments or ...


3

C is a hexadecimal number (12 in decimal).DWORD PTR SS:[EBP+C] should mean memory at stack segment, by address (value of EBP register + 12). This CMP ECX,DWORD PTR SS:[EBP+C] means "compare the content of ECX register with 32 bit from address [ebp + 12].


3

In protected mode the segment selectors are indexes into the descriptor table (local or global one, depending on the TI bit of the selector). The descriptor entry describes the base address, limit (size) and some other attributes of the segment (data or code, 16- or 32-bit). For more info see the following links: Global Descriptor Table; Memory Translation ...


3

You're looking at 32 bit registers (probably in a 32bit process). Since 32bit processors segment registers are rarely used as offset addresses for the simple reason 32 bit is enough to represent a pretty big address range. Instead, some segment registers (CS, SS, DS) are now used for permissions, memory protection and paging, while others are used as ...


3

The stack is allocated as part of the loading procedure, after the process is mapped into memory. Its reserve size plays a part in where it can be placed in memory. The location of the stack is not fixed, but ends up with a common value when the stack size and process image base is the default size. It's simply the result of a memory allocation function, ...


3

You can use the following IDC script for the purpose. It would stop whenever register eax contains 0. The debugger must be running when the script is executed. #include <idc.idc> static main() { for(;;) { StepInto(); if (GetDebuggerEvent(WFNE_SUSP, -1) == STEP) { if (eax == 0) { ...


3

The visual story of PSHUFLW is as follows: I will use Position as same mean as Order here and starts from Zero (Zero-Indexed). As you can see it selects words from source based on value of N. The Order/Position of selection will be chosen by 2 bit values of N. for example when N=4, According to first bite (2-bits) of N (= 00), it will select word at ...


2

To see which registry keys your applications accesses while running, use Procmon. If you want to monitor more DLL calls than mere registry accesses, i recommend API Monitor.


2

We can see from this list that IA-32's Delphi/Free Pascal calling convention is the register calling convention. My guess is you're dealing with a binary that's the result of something like this: How to call a function using Delphi's register calling conventions from Visual C++? To partially quote the top-voted answer: Delphi's register calling ...


2

I own an IDA license, so I have no use for the free one. I don't know with complete certainty whether the freeware version does debugging, but here's a quote from the freeware download page about the limitations of the freeware version: lacks support for many processors, file formats, debugging etc... You might be out of luck trying to debug with the ...


2

Using drr is showing the strings.


2

There is no such functionality in x64dbg out of the box, but we can make your own by writing a plugin! There are many examples (often with source code) available on http://plugins.x64dbg.com. In this case you will want to register a callback for CB_STEPPED, which gets called after every step. The basic functionality could look something like this: ...


2

First, a bit of background on why these registers are needed. PPC is a RISC-like ISA, in that all instructions are of the same size (32 bits) and there is limited space for immediate values (usually 16 bits at most) that you would use for things like addresses. So how do you address more that 16 bits? One option is to build addresses by 16-bit slices, e.g. ...


1

What worked for me was passing a reference to the register to my changeReg() function with IARG_REG_REFERENCE, then changing the value the reference points to.


1

It doesn't work like that, unfortunately. I'm going to be drastically oversimplifying the topic, but the 10,000-foot view is that you have two ways to reverse engineer: Static Analysis: Studying a binary without running it. Programs like IDA can be used to disassemble a binary to automagically lay bare what it can of the binary's workings. This does A LOT ...


1

Igor is right... The original shellcode does not include any ret (0xc3), so there are none in the decompiled asm. The thing is that when you ask gdb to disassemble 14 instructions, it disassembles 14 instructions interpreting the content of the memory as if it was instructions. As a proof of what I say, here is a disassembly of the instruction add %al,(%ecx)...


Only top voted, non community-wiki answers of a minimum length are eligible