20
It's the wrong question, really. AH is the exception.
Now the real question is, why is AH such an exception? It's an old register, from the 8086 era. It exists to facilitate moving over code from the 8080.
The 8080 has different registers from the 8086, so you can't move over code directly. In particular, it didn't have an AL,AH or AX register. It did ...
19
Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?
It is impossible to access the higher parts of the EAX and RAX registers, or of any other 32 and 64-bit registers, directly. You'll have to use indirect instruction sequences if you're interested in doing that. This is because there are no encodings to access ...
7
I believe the discrepancy between 40 and actual sum of 48 is mostly an error, however there are many other registers used for handling hardware, memory management, and control of different features of the CPU.
The answer you linked to covers all the commonly used registers in the following image (taken from there):
There are, however plenty of less ...
7
Wikipedia has a page about the x86 architecture and all its known registers. Here is a small picture gathering all what we know about it.
In fact, not all these registers are officially documented. But, all the registers we know (and we know how to use) are listed in the picture. And, it makes much more than 40.
And, I do not know what are these 'hardware' ...
7
The shr rax, 3 is an unsigned divide by 8 with truncation towards zero. The inclusion of the adc rax, 0 makes the division round to nearest instead. (Though 0.5 will always be rounded up)
So this operation sets RAX to
1 if RAX is in the range of [4-11] (8*1 ±4)
2 if RAX is in the range of [12-20] (8*2 ±4)
3 if RAX is in the range of [20-27] (8*3 ±4)
You ...
7
I believe the best tool for rewriting assembly to C is IDA Graph View, which is toggled with space.
It let you see the function as Basic Blocks, connected by control flow instructions. In this specific function, I cannot spot any jumps so you will see one long block.
The first thing you usually see in a function is the function prologue which sets up the ...
6
lea = address
mov = contents
if address 0x401000 contains 0xDeadBeef like ef be ad de
lea MySecretPlace, [401000] MySecretPlace will be 0x401000
Mov MySecretPlace, [401000] MySecretPlace will be DeadBeef
mov MySecretPlace, byte ptr [401000] MySecretPlace will be 0xef 0r 0xef depending on EndianNess
mov MySecretPlace, word ptr [401000] ...
5
It is possible to do what you want. There are some difficulties you may encounter though. I'll show you a short instruction how it can be done in several different cases.
Have a look at ELF specification to know how every file in that format looks like, which sections it consists of and how they are located in the process image at the runtime. Even when ...
5
Update: Thanks to Nirlzr, I see I missed the emphasized point at the bottom of the post. This answer, though not what OP is looking for, may serve useful for anyone down the road who is looking for a way to access those bits. Apologies for missing OPs full intention!
I actually wrote an in-depth article on this topic a couple of years ago: Accessing and ...
5
On Windows Travel Debugging (TTD) is a perfect use case for this scenario.
To use TTD, you need to run the debugger elevated. Install WinDbg Preview from Windows 10 store using an account that has administrator privileges and use that account when recording in the debugger. In order to run the debugger elevated, select and hold (or right-click) the WinDbg ...
4
Since you mentioned ELF in the tag. WinMain, DllMain, etc should not be a concern for you. They're name conventions for Windows.
The main function is the first function executed for a C/C++ program. However, it doesn't mean this is the real first function / code executed. You will usually find some initialization code before this function is called.
my ...
4
Windows loader does not care about section names, so the name does not really matter, but usually this section contains the pointer to the indirect call guard check (___guard_check_icall_fptr). The pointer to it is stored in the GuardCFCheckFunctionPointer field of the load configuration directory.
I guess in the newer files it may contain some additional ...
4
This function computes (in a recursive manner) the sum of the n first integers:
400700: sub rsp,0x18 ; Align the stack
400704: mov QWORD PTR [rsp+0x8],rdi ; Store first argument on stack
400709: cmp QWORD PTR [rsp+0x8],0x0 ; test (n == 0)
+--40070f: jne 400718 <bar+0x18> ; jump to 400718 if (n != 0)
| ...
4
Since the number of bytes in the instructions can be different and they had to put some limit on the column width, this is how it is indicated that there are more bytes in the instruction that those that you see on the screen. A '.' indicates that there's more and it doesn't mean it's always zero(s)- it can be anything.
If this bothers you there are flags ...
4
mov QWORD PTR [rbp-0x30],0x4020c5 means exactly "move 0x4020c5 to a memory location rbp-0x30 and treat this number as qword" (8 - byte number).
But q is at the memory location rbp - 0x30, so anything you write into that address, will be written into q. So, the number 0x4020c5 was written into q. The number 0x4020c5 is not a string itself - it's a ...
4
The program exiting with code 126 in GDB occurs when the current user does not have execute permissions for the binary being debugged:
$ ls -l test
-rw-r--r-- 1 user01 user01 110080 May 1 22:18 test
$ gdb -q test
...
gef➤ run
Starting program: /home/user01/test
/bin/bash: /home/user01/test: Permission denied
/bin/bash: line 0: exec: /home/user01/test: ...
4
x64dbg can load the pdb and list all the function names if you have pdb for your executable
view->modules->download symbols for this module
also x64dbg can use the source file (ctrl+shift+s)
just for completion sake windbg usage
:\>cdb -c ".lines;bp `winchk.cpp:17`" winchk.exe
Microsoft (R) Windows Debugger Version 10.0.17763.132 AMD64
...
3
I would like to extend the .text section and insert [code]. If there's a better method of inserting new functionality into an ELF I'm all ears.
Techniques for adding arbitrary code to ELF files were pioneered by Linux virus writers beginning all the way back in the 1990s. In comparison with the methods they developed, as well as with more modern techniques,...
3
Just a quick note in case you would not be aware of this:
$ cat tiny.c
#include <unistd.h>
void _start() {
_exit(42);
}
on x86-64, here is what I get (you need a static libc: libc.a):
$ gcc -static -ffreestanding -nostartfiles -s -o tiny tiny.c
$ ./tiny || echo $?
42
Pay attention that:
$ file tiny
tiny: ELF 64-bit LSB executable, x86-64, ...
3
If you use -dr instead of plain -d, objdump will list relocation info next to the instructions. E.g. here's a random sample I just compiled
00000000 <main>:
0: 55 push %ebp
1: 89 e5 mov %esp,%ebp
3: 83 e4 f0 and $0xfffffff0,%esp
6: 83 ec 20 sub $0x20,%...
3
Brute force is not the way you should look to in anything unless its your last resort. The address space of x64 is too large to get brute force to work. Look up on this technique called ROP(Return Oriented Programming). Currently you're bruteforcing the RIP, what if there's some code in the binary that will help you jump to your shellcode without ...
3
These two symbols aren't exported in the usual way (i.e. via the export table). Instead, they are public symbols inside the run-time library itself. The startup code that runs before _main() performs the command-line resolution, assigning parameters into the __wargv array, and storing the count in __argc. The relative addresses are fixed for the file, but ...
3
Welcome to the wonderful world of AT&T assembly! The 9 in 9(%rax, %rdx) is commonly called displacement or sometimes base, and you should indeed just add all three values:
9+rax+rdx = 9+0x100+0x3 = 0x10C
This address is then dereferenced so the value 0x11 is loaded from the address 0x10C.
I would recommend reading the Solaris x86 Assembly Language ...
3
You can use Ida's Appcall functionality:
Appcall is a mechanism to call functions inside the debugged program
from the debugger or your script as if it were a built-in function.
Such a mechanism can be used for debugging, fuzzing and testing
applications. Appcall mechanism highly depends on the type information
of the function to be called. For ...
3
This is basic. Assume that rpb has a value of 55h (Assembler syntax). then
lea rax, [rbp-50h]
would result in 5.
On the other hand, mov rax, [rbp-50h] would most probable crash your application, as it would try to read the content of the address 5 and put it into rax.
Thus, the difference is that the first is direct, the second indirect.
BTW, you can ...
3
Warning: Illegal instruction used for explanation.
If you are wondering if mov can do the work of lea,
mov eax, esp+4 and lea eax, [esp+4] copies the same value to eax.
However, mov eax, esp+4 is not a legal instruction! (esp+4 is not a legal addressing mode.)
But then, can you replace lea eax, [esp+4] with the following?
mov eax, esp
add eax, 4
Not really! ...
3
when you are here 4017ff: 55 push rbp
your 5th argument will be available at [rsp+28]
(8 bytes for return address and 20 bytes for HOMEPARAMS (space for saving the 4 args passed via register)
two pushes and one subtract will make your argument no 5 available at
0x28 + 0x8 +0x8 +0x48 = 0x80
so rbp+0 will hold the address of 5th ...
3
je is normally used with cmp instruction like
cmp Reg16/32/64,const
je someplace
while jz is normally used to check specifically for 0 or null
like
dec reg16/32/64
jz someplace
i just modified your code to an infinite loop and emulated it in x86 emulator
see below for code and gif.
code
mov ax, 0x2
dec ax
and ax, 0x1
jz equal
je equal
test ax,...
2
The most useful reference I've seen about this section is in this Adobe source comment:
//
// Allocate xyz in the .00cfg so that it is implicitly merged into the
// import section of the binary (which is read-only).
// Indirect calls using this pointer do not have the guard check function,
// and so will not fail the CFG check.
//
The code appears to add ...
2
Actually, there is no lea edx, [0x80490c8] for 64-bits addressing modes. Since, afaik, in all 64-bits addressing modes lea is a register relative opcode.
LEA - Load Effective Address
Computes the effective address of the second operand (the
source operand) and stores it in the first operand (destination
operand). The source operand is a memory ...
Only top voted, non community-wiki answers of a minimum length are eligible