Hot answers tagged

53 votes

What does mov qword ptr ds:[rax+18], r8 mean?

Lets go over the instruction piece by piece: mov movqword ptr ds:[rax+18],r8 This is the opcode part of the instruction. It describes the base operation the CPU is required to perform. mov is an ...
NirIzr's user avatar
  • 11.8k
20 votes

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

It's the wrong question, really. AH is the exception. Now the real question is, why is AH such an exception? It's an old register, from the 8086 era. It exists to facilitate moving over code from ...
MSalters's user avatar
  • 301
19 votes
Accepted

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones? It is impossible to access the higher parts of the EAX and RAX registers, or of any other 32 and 64-bit ...
NirIzr's user avatar
  • 11.8k
18 votes
Accepted

How to investigate Windows 32/64bit (WOW64) transition

The technique of jumping to 64bit code from a 32bit WOW64-ed process is commonly called "Heaven's gate" when performed manually. This is usually done to use 64bit features (such as manipulating 64bit ...
NirIzr's user avatar
  • 11.8k
15 votes
Accepted

Is IDA pulling my leg - or can REX.W sometimes not be determined in static analysis?

In x86-64, any operation that affects only the lower 32 bits of a register automatically zeros out the upper 32 bits. The relevant part in the Intel Architecture manual is in Volume 1, 3.4.1.1, which ...
jakobbotsch's user avatar
14 votes

Struggling between syscall or sysenter ( Windows )

The Intel and AMD instruction sets are similar but not identical. There are many examples of that: FMA3/FMA4, AMD-V and VT-x (and their extensions), etc. The fast system call interface is yet ...
conio's user avatar
  • 652
12 votes
Accepted

xor eax, eax in x64

In x64, any operation on a 32-bit register clears the top 32 bits of the corresponding 64-bit register too, so there's no need to use xor rax, rax which would necessitate an extra REX byte for ...
Igor Skochinsky's user avatar
  • 36.5k
10 votes

How to obtain x86-64 pseudocode in IDA Pro?

The two other answers here are outdated. From hex-rays website, in the page about the the hex-rays decompiler: Currently the decompiler supports compiler generated code for the x86, x64, ARM32, ARM64,...
NirIzr's user avatar
  • 11.8k
10 votes
Accepted

How many registers does an x86_64 CPU actually have?

Wikipedia has a page about the x86 architecture and all its known registers. Here is a small picture gathering all what we know about it. In fact, not all these registers are officially documented. ...
perror's user avatar
  • 19k
8 votes

How many registers does an x86_64 CPU actually have?

I believe the discrepancy between 40 and actual sum of 48 is mostly an error, however there are many other registers used for handling hardware, memory management, and control of different features of ...
NirIzr's user avatar
  • 11.8k
7 votes

IDA cannot launch debugger for 64-bit exe files

I write this mostly for myself as I'm tired of going thru this over and over again. Here's how you can debug x64 processes on a local machine with IDA Pro: (1) Create a .bat file with the following: ...
c00000fd's user avatar
  • 1,649
7 votes
Accepted

XCHG RAX, RAX: 0x09, what does this code do and how does it work?

The shr rax, 3 is an unsigned divide by 8 with truncation towards zero. The inclusion of the adc rax, 0 makes the division round to nearest instead. (Though 0.5 will always be rounded up) So this ...
Ian Cook's user avatar
  • 2,523
7 votes
Accepted

Elf x86_64 adding function

It is possible to do what you want. There are some difficulties you may encounter though. I'll show you a short instruction how it can be done in several different cases. Have a look at ELF ...
bart1e's user avatar
  • 3,369
7 votes

What is the difference between MOV and LEA in example?

lea = address mov = contents if address 0x401000 contains 0xDeadBeef like ef be ad de lea MySecretPlace, [401000] MySecretPlace will be 0x401000 Mov MySecretPlace, [401000] MySecretPlace will be ...
blabb's user avatar
  • 16.3k
6 votes
Accepted

Determind length of instructions in bytes

Instead of using a list, it would probably be much more efficient for you to use a small and portable length disassembler, such as https://github.com/greenbender/lend.
Jason Geffner's user avatar
6 votes

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

Update: Thanks to Nirlzr, I see I missed the emphasized point at the bottom of the post. This answer, though not what OP is looking for, may serve useful for anyone down the road who is looking for a ...
dsasmblr's user avatar
  • 2,234
6 votes
Accepted

startup program exits with code 126 when executing program at entrypoint

The program exiting with code 126 in GDB occurs when the current user does not have execute permissions for the binary being debugged: $ ls -l test -rw-r--r-- 1 user01 user01 110080 May 1 22:18 test ...
julian's user avatar
  • 7,118
5 votes

Determind length of instructions in bytes

The definitive list is, unsurprisingly, available in Intel's manuals for these processors. These are free downloads from Intel's website. What you want most, or first, is the opcode map. This is ...
Geoff Chappell's user avatar
5 votes

Windows x86 compability on x64 operating system

There is no need for emulation because x64 processors can execute x86 (32-bit) code natively using so-called compatibility mode. You only need to set up proper descriptors in the GDT (L=0 for 32-bit ...
Igor Skochinsky's user avatar
  • 36.5k
5 votes

.00cfg section in the PE file

Windows loader does not care about section names, so the name does not really matter, but usually this section contains the pointer to the indirect call guard check (___guard_check_icall_fptr). The ...
Igor Skochinsky's user avatar
  • 36.5k
5 votes
Accepted

x64dbg or alternative: Run to selection while storing all ran opcodes

On Windows Travel Debugging (TTD) is a perfect use case for this scenario. To use TTD, you need to run the debugger elevated. Install WinDbg Preview from Windows 10 store using an account that has ...
chentiangemalc's user avatar
4 votes
Accepted

MSVC Generates Weird Code for Volatile Local Variable

No, it's not a compiler bug. The x64 calling convention on Windows says that the caller needs to allocate space on the stack for 4 register parameters even if the called function has less than 4 ...
Ian Cook's user avatar
  • 2,523
4 votes
Accepted

Correct my understanding on a basic allocation memory

If I understand correctly: There is a buffer of size 256 bytes created (malloc) in this buffer, the first 32 bits are set to 0 (because dword designates 32bits size) the next 32 bits (32 to ...
Abigail's user avatar
  • 684
4 votes
Accepted

How can I convert this assembly code (x64) to C?

This function computes (in a recursive manner) the sum of the n first integers: 400700: sub rsp,0x18 ; Align the stack 400704: mov QWORD PTR [rsp+0x8],rdi ; Store first ...
perror's user avatar
  • 19k
4 votes
Accepted

Is the main function's name in the symbol table of C & C++ programs always 'main'? if not, how to find the name?

Since you mentioned ELF in the tag. WinMain, DllMain, etc should not be a concern for you. They're name conventions for Windows. The main function is the first function executed for a C/C++ program. ...
wisk's user avatar
  • 1,124
4 votes

Does the loader fill the IAT table of an .exe in load time by checking the corresponding export tables or during run time?

When does the PE loader fill in the IAT? The IAT is updated at load time by the PE Loader [1], this is called Load-time dynamic linking, as opposed to Run-time dynamic linking, where LoadLibrary/...
plowsec's user avatar
  • 143
4 votes
Accepted

Understanding operand forms

Welcome to the wonderful world of AT&T assembly! The 9 in 9(%rax, %rdx) is commonly called displacement or sometimes base, and you should indeed just add all three values: 9+rax+rdx = 9+0x100+0x3 ...
Igor Skochinsky's user avatar
  • 36.5k
4 votes
Accepted

How to find the starting address of text section of a DLL inside a process? (64 bit)

There are lots of helper functions in dbghelp.h to fully parse the PE file if you do not wish to use dbghelp.h almost all of these function has an Rtl Equivalent function in ntdll.dll which you can ...
blabb's user avatar
  • 16.3k
4 votes
Accepted

Radare2 - what does dot mean in disassembly

Since the number of bytes in the instructions can be different and they had to put some limit on the column width, this is how it is indicated that there are more bytes in the instruction that those ...
Paweł Łukasik's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible