Skip to main content
4 votes
Accepted

Cutter shows addresses relative to stack but not rbp. How to change it?

The two pictures probably show the same binary being analyzed. But the two Cutter versions might not be the same, and that's likely the cause for the discrepancy you see. Cutter is a front end for ...
feldspar's user avatar
2 votes

Why does this piece of code modify itself?

Q1 The paper was written in 1996 (published on 8 November 1996 to be exact). In those days, it was the norm for the stack to be executable. In fact, x86 CPUs of that era basically lacked the ...
Nate Eldredge's user avatar
1 vote

Ghidra 11.0 - What does Function > Analyze Stack option do?

How well Analyze Stack works on any particular function in a program is based on: The calling convention selected for the given function, and, How well that calling convention actually models the way ...
g1l1t1's user avatar
  • 31
1 vote

Cutter shows addresses relative to stack but not rbp. How to change it?

@feldspar's reply is 100% accurate. It was a change introduced by the Cutter team as of February 2023. I just wanted to add that the important thing here is to understand how the addressing works, ...
Razvi's user avatar
  • 121
1 vote

Why does this piece of code modify itself?

the paper is quiet old and the compilers have improved a lot it my not be easy to churn out a byte for byte similar code with latest compilers they may not even compile such code it is better not to ...
blabb's user avatar
  • 16.4k
1 vote

Why does this piece of code modify itself?

If I'm wrong at anything, someone please correct me. Q1: the current OSes or compilers (one of these. There are protections on the files themselves enabled by the compiler and others on the OS itself)...
Edw590's user avatar
  • 188
1 vote
Accepted

IDA stack depth differences when branching

So, the problem is that you have two branches with different stack delta: E8 at 5018E4 (fall through from jnz) and F0 at 501c49 (destination of jnz). Normally they should be the same, however IDA ...
Igor Skochinsky's user avatar
  • 36.7k

Only top scored, non community-wiki answers of a minimum length are eligible