53
votes
What does mov qword ptr ds:[rax+18], r8 mean?
Lets go over the instruction piece by piece:
mov
movqword ptr ds:[rax+18],r8
This is the opcode part of the instruction. It describes the base operation the CPU is required to perform. mov is an ...
- 11.7k
20
votes
Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?
It's the wrong question, really. AH is the exception.
Now the real question is, why is AH such an exception? It's an old register, from the 8086 era. It exists to facilitate moving over code from ...
- 301
19
votes
Accepted
Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?
Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?
It is impossible to access the higher parts of the EAX and RAX registers, or of any other 32 and 64-bit ...
- 11.7k
18
votes
Accepted
How to investigate Windows 32/64bit (WOW64) transition
The technique of jumping to 64bit code from a 32bit WOW64-ed process is commonly called "Heaven's gate" when performed manually. This is usually done to use 64bit features (such as manipulating 64bit ...
- 11.7k
15
votes
Accepted
Is IDA pulling my leg - or can REX.W sometimes not be determined in static analysis?
In x86-64, any operation that affects only the lower 32 bits of a register automatically zeros out the upper 32 bits.
The relevant part in the Intel Architecture manual is in Volume 1, 3.4.1.1, which ...
- 266
12
votes
Accepted
xor eax, eax in x64
In x64, any operation on a 32-bit register clears the top 32 bits of the corresponding 64-bit register too, so there's no need to use xor rax, rax which would necessitate an extra REX byte for ...
- 36.2k
10
votes
How to obtain x86-64 pseudocode in IDA Pro?
The two other answers here are outdated.
From hex-rays website, in the page about the the hex-rays decompiler:
Currently the decompiler supports compiler generated code for the x86, x64, ARM32, ARM64,...
- 11.7k
9
votes
What does lea rdx,qword ptr ss:[rbp+50] mean?
The code means rdx = rbp + 50.
For the explanation, we'll go bottom up...
qword is 8-bytes (64 bits). It stands for quad-word, same as dword stands for double-word. It is the size of every rXX ...
- 1,557
9
votes
Accepted
How many registers does an x86_64 CPU actually have?
Wikipedia has a page about the x86 architecture and all its known registers. Here is a small picture gathering all what we know about it.
In fact, not all these registers are officially documented. ...
- 18.9k
8
votes
How many registers does an x86_64 CPU actually have?
I believe the discrepancy between 40 and actual sum of 48 is mostly an error, however there are many other registers used for handling hardware, memory management, and control of different features of ...
- 11.7k
7
votes
IDA cannot launch debugger for 64-bit exe files
I write this mostly for myself as I'm tired of going thru this over and over again. Here's how you can debug x64 processes on a local machine with IDA Pro:
(1) Create a .bat file with the following:
...
- 1,527
7
votes
Accepted
IDA cannot launch debugger for 64-bit exe files
Since IDA is a 32 bit process, it can only debug x64 binaries remotely (source).
To do that, you need to use the IDA X.X/dbgsrv/win64_remotex64.exe file and start a debugger. Once the debugger is ...
- 1,557
7
votes
Accepted
XCHG RAX, RAX: 0x09, what does this code do and how does it work?
The shr rax, 3 is an unsigned divide by 8 with truncation towards zero. The inclusion of the adc rax, 0 makes the division round to nearest instead. (Though 0.5 will always be rounded up)
So this ...
- 2,503
7
votes
Accepted
Elf x86_64 adding function
It is possible to do what you want. There are some difficulties you may encounter though. I'll show you a short instruction how it can be done in several different cases.
Have a look at ELF ...
- 3,369
7
votes
What is the difference between MOV and LEA in example?
lea = address
mov = contents
if address 0x401000 contains 0xDeadBeef like ef be ad de
lea MySecretPlace, [401000] MySecretPlace will be 0x401000
Mov MySecretPlace, [401000] MySecretPlace will be ...
- 16.2k
6
votes
Accepted
Determind length of instructions in bytes
Instead of using a list, it would probably be much more efficient for you to use a small and portable length disassembler, such as https://github.com/greenbender/lend.
- 20.6k
6
votes
Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?
Update: Thanks to Nirlzr, I see I missed the emphasized point at the bottom of the post. This answer, though not what OP is looking for, may serve useful for anyone down the road who is looking for a ...
- 2,204
6
votes
Accepted
startup program exits with code 126 when executing program at entrypoint
The program exiting with code 126 in GDB occurs when the current user does not have execute permissions for the binary being debugged:
$ ls -l test
-rw-r--r-- 1 user01 user01 110080 May 1 22:18 test
...
- 7,058
5
votes
Determind length of instructions in bytes
The definitive list is, unsurprisingly, available in Intel's manuals for these processors. These are free downloads from Intel's website. What you want most, or first, is the opcode map. This is ...
5
votes
Windows x86 compability on x64 operating system
There is no need for emulation because x64 processors can execute x86 (32-bit) code natively using so-called compatibility mode. You only need to set up proper descriptors in the GDT (L=0 for 32-bit ...
- 36.2k
5
votes
.00cfg section in the PE file
Windows loader does not care about section names, so the name does not really matter, but usually this section contains the pointer to the indirect call guard check (___guard_check_icall_fptr). The ...
- 36.2k
5
votes
Accepted
x64dbg or alternative: Run to selection while storing all ran opcodes
On Windows Travel Debugging (TTD) is a perfect use case for this scenario.
To use TTD, you need to run the debugger elevated. Install WinDbg Preview from Windows 10 store using an account that has ...
- 1,235
4
votes
Accepted
MSVC Generates Weird Code for Volatile Local Variable
No, it's not a compiler bug.
The x64 calling convention on Windows says that the caller needs to allocate space on the stack for 4 register parameters even if the called function has less than 4 ...
- 2,503
4
votes
Accepted
Correct my understanding on a basic allocation memory
If I understand correctly:
There is a buffer of size 256 bytes created (malloc) in this buffer,
the first 32 bits are set to 0 (because dword designates 32bits size)
the next 32 bits (32 to ...
- 684
4
votes
Accepted
How can I convert this assembly code (x64) to C?
This function computes (in a recursive manner) the sum of the n first integers:
400700: sub rsp,0x18 ; Align the stack
400704: mov QWORD PTR [rsp+0x8],rdi ; Store first ...
- 18.9k
4
votes
Accepted
Is the main function's name in the symbol table of C & C++ programs always 'main'? if not, how to find the name?
Since you mentioned ELF in the tag. WinMain, DllMain, etc should not be a concern for you. They're name conventions for Windows.
The main function is the first function executed for a C/C++ program. ...
- 1,124
4
votes
Does the loader fill the IAT table of an .exe in load time by checking the corresponding export tables or during run time?
When does the PE loader fill in the IAT?
The IAT is updated at load time by the PE Loader [1], this is called Load-time dynamic linking, as opposed to Run-time dynamic linking, where LoadLibrary/...
- 143
4
votes
Accepted
Understanding operand forms
Welcome to the wonderful world of AT&T assembly! The 9 in 9(%rax, %rdx) is commonly called displacement or sometimes base, and you should indeed just add all three values:
9+rax+rdx = 9+0x100+0x3 ...
- 36.2k
4
votes
Accepted
How to find the starting address of text section of a DLL inside a process? (64 bit)
There Are Lots of Documented Helper functions in dbghelp.h to fully parse the Pe file
if you do not wish to use dbghelp.h almost all of these function has an Rtl Equivalent function in ntdll.dll ...
- 16.2k
Only top scored, non community-wiki answers of a minimum length are eligible