Questions tagged [x86]

A family of instruction set architectures originally based on the Intel 8086 CPU that functions with a very wide array of operating systems, including Windows, MacOS X, Linux, BSD, and Solaris.

Filter by
Sorted by
Tagged with
0 votes
0 answers
16 views

Crash afrer dll modification

i am trying to remove messageboxa function, but after modifing and injecting game got crash. How to fix it? Thanks
user avatar
0 votes
0 answers
44 views

Wrong access .data segment

Preface I'm a PHP programmer, in my spare time I've been doing reverse work. Achieved good progress in the analysis game. But there was a big problem on my way. And now, more than ever, i need the ...
user avatar
1 vote
1 answer
131 views

What does the code do?

Challenge #64 What does this code do? An array of array[x][y] form is accessed here. Try to determine the dimensions of the array, at least partially, by finding y. _array$ = 8 _x$ = 12 _y$ = 16 _f ...
user avatar
3 votes
1 answer
117 views

How can I make Ghidra have access to external libraries?

I am trying to decompile a executable file, I have the source code of the external libraries that it is using, I wonder if there is a way that I can make Ghidra recognize these libraries, just like it ...
user avatar
2 votes
1 answer
123 views

x86 - How do I detect virtualized code by looking at the assembly?

How can I detected virtualized code by say, vmprotect, obsidium or themida just by looking at the assembly code? I know that just looking at the PE section name would help, but I wanted to detect ...
user avatar
  • 49
1 vote
1 answer
76 views

C instruction causing an address shift

I am trying to recreate a segment of assembly back into the C code. Below is the progress I've made so far, but I'm getting stumped on a specific section. 00000000000010049 <mysteryFunc>: ...
user avatar
0 votes
0 answers
66 views

ADD right before CMP?

I am a beginner in RE. I compiled some code (x86 32bit), and opened it up in Ghidra. I come across the following instruction block: CALL _strcmp MOV dword ptr [EBP + local_1c], EAX MOV EAX, dword ptr [...
user avatar
0 votes
0 answers
46 views

PUSH x VS MOV [ESP], x?

I am a beginner in RE. I compiled some code (x86 32bit), and opened it up in Ghidra. I come across the following instruction right before a call: MOV dword ptr [ESP], 0x3c Where 0x3c is the offset to ...
user avatar
2 votes
0 answers
21 views

Why does OllyDbg label data segment as read only?

I'm working on this problem: Challenge 53 When compiling with cl c53.c /Fac53.asm /MD in VS2019 X86 Development Console and loading the .exe into OllyDbg, I found OllyDbg labels all segments of c53 as ...
user avatar
0 votes
0 answers
49 views

Normal artifact or something else?

I'm working on a Linux ELF challenge. I have found this bit of code in the .text disassembly using objdump -d -M intel program 922: 83 c4 10 add esp,0x10 925: c7 45 f4 00 00 00 ...
user avatar
  • 101
1 vote
2 answers
65 views

Relationship between compiled bytes of jmp instruction and target memory address

I'm very new to all this, so sorry if I mess up and/or am unclear. I'm working on reverse engineering assault cube, where a lot of people start, and I'm struggling to understand how this one AOB ...
user avatar
0 votes
0 answers
22 views

Invalid memory access and class check in operator implementation

Say I have the following disassembled function, taken from my favourite 32 bit DLL that was compiled with an old version of MSVC: mov eax, ecx mov ecx, DWORD PTR [eax+4] cmp ecx, CAbstractBlitObj::`...
user avatar
1 vote
1 answer
83 views

How to locate memory address in register $esp

000011d9 <main>: 11d9: 8d 4c 24 04 lea 0x4(%esp),%ecx 11dd: 83 e4 f0 and $0xfffffff0,%esp 11e0: ff 71 fc push -0x4(%ecx) 11e3: ...
user avatar
0 votes
0 answers
63 views

how to get register size in ida python

I am aware i can decode the instruction, then check the op.dtype. But this doesnt work in cases such as mov eax, dword [rax] because the second operand will be of dtype dword, while the basereg ...
user avatar
0 votes
1 answer
166 views

What is the meaning of jmp dword ptr off_XXXXXXXX + 8 in IDA?

What is the meaning of this kind of jmp instruction in x86 assembly in IDA? Does it mean that we should jump to the address [6CA2E9B0] + 8 or [6CA2E9B0+8]? When I follow that off_XXX, I get to the ...
user avatar
  • 1
0 votes
1 answer
89 views

Understanding the meaning of EBP + 0xffff98b4

I'm currently reverse-engineering an old game from 2003 to extend its functionality. I have now found what I am looking for and since it was written in C++ I'm trying to re-create the used classes. I ...
user avatar
2 votes
1 answer
54 views

Why does this hooking function work and never cause a "backwards" jump?

//src = the place to write the hook, dst is the function you jump to, len is length //of stolen bytes (MUST fall on a boundray between instructions) BYTE* TrampHook32(BYTE* src, BYTE* dst, const ...
user avatar
1 vote
2 answers
65 views

IDA decompiler syntax: for function int __usercall sub_45BD46@ <eax>(char a1@<bl>, int a2@<esi>, int a3)

I have a function with the following header sub_45BD46@eax(char a1@bl, int a2@esi, int a3), my question is: I am right that sub_45BD46@eax means the result value is in eax?
user avatar
  • 49
0 votes
0 answers
37 views

Unable to redirect program because function address is not correctly written to the heap

I have a heap overflow example program (heap0.c)compiled as follows: gcc heap0.c -w -g -no-pie -z execstack -o heap0 In order to overwrite the instruction pointer with (BBBB = \x42\x42\x42\x42), I ...
user avatar
0 votes
1 answer
51 views

Constructors testing for strange in-stack value

This is something that I found in a lot of constructors that have to do with classes that inherit from other classes. I have a vague idea as to why it's done, but I'd rather have it confirmed before ...
user avatar
1 vote
1 answer
78 views

List instructions to fix wrong IDA analysis

I don't want to get too much into detail, but a disastrous chain of events that began with a boolean of incorrect size forced the IDA analyzer to discard a lot of instruction sections of many ...
user avatar
  • 97
0 votes
1 answer
44 views

One class with different sizes

After looking at some basic examples of how C++ classes are compiled by MSVC, I tried to apply the knowledge to a DLL I'm working on. While searching for a class to start with, I came across ...
user avatar
1 vote
1 answer
272 views

How to import x86asm into Ghidra?

I have some assembly code as a .txt file (i.e. a list of the instructions, stuff like this): 00000003 E8D001 call 0x1d6 00000006 A08000 mov al,[0x80] 00000009 0C00 ...
user avatar
1 vote
1 answer
134 views

IDA Pro - configure register clobbering

TL;DR: The __fastcall convention in IDA Pro assumes that all the registers which could be used for transferring parameters are clobbered after a call (tested on x86, clobbered regs are eax, edx, ebx, ...
user avatar
0 votes
2 answers
165 views

Why windbg skips syscall on kernel mode?

I have a VM running windows with notepad open, I did list the modules with lm: start end module name 00007ffc`60fb0000 00007ffc`60fe2000 vertdll (deferred) ...
user avatar
  • 49
1 vote
0 answers
173 views

What is happening with this *param_1?

I am a bit of a starter, so bear with me as I can't find the answer through Google (a common thing in Ghidra work I noticed so far). I have a function that seems to read like it is a Constructor. But ...
user avatar
1 vote
1 answer
160 views

Binary diff + patching across versions

What are the current options for binary patching which works across different versions of the binary? E.g. we created a binary patch for a specific version of a binary and want to apply that patch to ...
user avatar
5 votes
1 answer
134 views

How to reverse engineer a setjmp/longjmp sequence?

I'm trying to reverse engineer the GNU libc x86 (32 bit) setjmp / longjmp (re a vuln which may allow arbitrary overwrite of the jmp_buf env. There's a great writeup of the musl setjmp but I can find ...
user avatar
1 vote
1 answer
120 views

What's purpose of mov ebx, [esp+0]?

I'm disassembling one SO library for fun and was wondering what's purpose of following procedure: sub_3699 proc near mov ebx, [esp+0] retn sub_3699 endp It's widely used across entire library ...
user avatar
  • 113
0 votes
0 answers
45 views

Why would compiler emit a null pointer assignment

I have been reversing a popular Windows application and ended up in a very interesting place while debugging. What I can clearly see as valid x86 instructions that eventually lead to some sort of &...
user avatar
  • 11
0 votes
1 answer
248 views

Translate ASM code x86 32 bits in C

I have a exercise which i can't resolve it, and i need help. If anyone can help me it would be great. I have the next ASM code in x86 32 bits which i need to translate in C language: Dump of assembler ...
user avatar
  • 1
0 votes
1 answer
141 views

How do I interpret this double offset?

While looking at that old game I've found a class CStr that is used in an unusual (to me) manner. Most of the times a member of CStr is used, it's done as follows. In both cases, this is a CStr *. ...
user avatar
0 votes
1 answer
48 views

How does this function take the argument if its not pushed into the stack?

I dont understand how does the function take the argument without pushing push ebp mov ebp, esp and esp, 0FFFFFFF0h sub esp, 20h mov [esp+20h+var_20], offset aEnterX ; "Enter X:" call _puts
user avatar
1 vote
2 answers
312 views

Can't figure out a crash in IDA "The memory could not be read -> 00000710 (exc.code c0000005, tid 20612)"

I'm trying to debug out a game. Basically, the Steam version works perfectly but the GOG version (which is 8kb smaller) has an annoying problem where for some people (which happen to be me) the game ...
user avatar
0 votes
0 answers
25 views

How to add include path in Cutter

Hi I have an program waiting for debug. But the executable is based on another so file, which need to be added into LD_LIBRARY_PATH variable. I have search over the internet but cannot find a way of ...
user avatar
  • 101
0 votes
2 answers
97 views

What does the cs register do here?

I've come across this sequence of bytes: 2e 88 38. Hopper disassembles this as: mov byte [cs:rax], bh This online disassembler gives slightly different output: mov BYTE PTR cs:[rax],bh Either ...
user avatar
  • 137
1 vote
1 answer
348 views

I'm having trouble understanding this specific notation in Ghidra

I'm reversing a code construct I created to learn Ghidra, and it looks different to what it is in GDB. I was wondering if anyone could clarify what the highlighted LEA instruction means: [I don't know ...
user avatar
1 vote
1 answer
1k views

startup program exits with code 126 when executing program at entrypoint

I want to reverse engineer a program. I managed to find the entry point but every time I want to launch the application I get the same error `During startup program exited with code 126. Here is what ...
user avatar
0 votes
1 answer
131 views

A question about moving data with LEA and MOV

Given the above code, i am struggling to understand what happens in line 5 and 6 As i understand it, in line 5 the Adress of the ESP is loaded into the EAX register. While there may be the value 4 ...
user avatar
1 vote
1 answer
83 views

Finding API in ROM dump (DOS debug)

Have dumped the ROM from a HP 200LX using these instructions: debug #Enters the debug mode r bx #Reads the bx register and prompts you to enter a new value 30 #The new value for bx r cx #Reads the cx ...
user avatar
  • 133
3 votes
1 answer
91 views

Confused about the use of the shl instruction in this disassembly

I created a code construct in C to see how it looks in x86. I'm confused about the use of the shl instructions. I'm confused about what is happening in between the lines <+39> and <+51> I ...
user avatar
1 vote
2 answers
115 views

Why eax is assigned to 'variable looked' like addresses

#include <stdio.h> int main() { int number1, number2, sum; printf("Enter two integers: "); scanf("%d %d", &number1, &number2); sum = number1 + ...
user avatar
2 votes
1 answer
104 views

How do you build a virtual machine to interpret machine code?

How does the parser parse the machine code? Does it go byte by byte? How does it know how many bytes to read when parsing an instruction? Does it have some sorts of tables of bytes to translate the ...
user avatar
  • 153
2 votes
2 answers
177 views

How to test and debug x86 Assembly exceptions in NASM?

I have seen all the exception "IDs" in the Intel Manuals, and just came across sandpile's exception guide, which actually shows some hexcodes. For example, "divide by zero error": ...
user avatar
  • 153
1 vote
1 answer
341 views

How to write these 4 example x86 assembly instructions in opcodes, according to the Intel docs?

Okay so I have been studying Chapter 2 of Volume 2 of the Intel Manuals. I have as best an understanding as I can get of the ModR/M byte, the REX byte, the SIB byte, and the general instruction ...
user avatar
  • 153
1 vote
1 answer
73 views

How to split bytes into instructions in binary ELF file for x86

I'm working on a static code injector for ELF files. I need to "steal" some bytes in order to write jump to my code on their place and then execute stolen instructions somewhere in the ...
user avatar
1 vote
0 answers
43 views

Weird x86 function calling convention [duplicate]

I have come across some weird function. It's in an x86 LE Windows executable compiled with Visual Studio and linking to v100 runtime. The function seems to be an __stdcall as it ends with a move into ...
user avatar
  • 111
4 votes
1 answer
2k views

Correct way to understand local_ in ghidra disassembly

Attached is the part of a disassembled main from a x86 binary file, generated by ghidra. ************************************************************** ...
user avatar
  • 113
5 votes
1 answer
1k views

How can I get the inferred register value for an instruction in Ghidra scripting?

I'd like to get the inferred value of a register at a particular point in the disassembly listing in a Ghidra script. In my case the target instruction is a rdmsr or wrmsr instruction, which reads or ...
user avatar
  • 1,212
1 vote
1 answer
2k views

Mul(Multiplication) in x64 and in x32 assembly

I'm completely new in malware reverse engineering. I'm stuck in a confusion that, I studied that in x32, mul instruction multiplies the source with eax register and store the result as 64 bit value ...
user avatar

1
2 3 4 5
10