Hot answers tagged

20 votes

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

It's the wrong question, really. AH is the exception. Now the real question is, why is AH such an exception? It's an old register, from the 8086 era. It exists to facilitate moving over code from ...
user avatar
  • 301
19 votes
Accepted

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones? It is impossible to access the higher parts of the EAX and RAX registers, or of any other 32 and 64-bit ...
user avatar
  • 11.3k
8 votes
Accepted

How many registers does an x86_64 CPU actually have?

Wikipedia has a page about the x86 architecture and all its known registers. Here is a small picture gathering all what we know about it. In fact, not all these registers are officially documented. ...
user avatar
  • 18k
7 votes
Accepted

XCHG RAX, RAX: 0x09, what does this code do and how does it work?

The shr rax, 3 is an unsigned divide by 8 with truncation towards zero. The inclusion of the adc rax, 0 makes the division round to nearest instead. (Though 0.5 will always be rounded up) So this ...
user avatar
  • 2,134
7 votes
Accepted

Converting Assembly x64 code to C

I believe the best tool for rewriting assembly to C is IDA Graph View, which is toggled with space. It let you see the function as Basic Blocks, connected by control flow instructions. In this ...
user avatar
  • 693
7 votes

How many registers does an x86_64 CPU actually have?

I believe the discrepancy between 40 and actual sum of 48 is mostly an error, however there are many other registers used for handling hardware, memory management, and control of different features of ...
user avatar
  • 11.3k
7 votes

What is the difference between MOV and LEA in example?

lea = address mov = contents if address 0x401000 contains 0xDeadBeef like ef be ad de lea MySecretPlace, [401000] MySecretPlace will be 0x401000 Mov MySecretPlace, [401000] MySecretPlace will be ...
user avatar
  • 14.8k
5 votes
Accepted

Elf x86_64 adding function

It is possible to do what you want. There are some difficulties you may encounter though. I'll show you a short instruction how it can be done in several different cases. Have a look at ELF ...
user avatar
  • 3,179
5 votes

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

Update: Thanks to Nirlzr, I see I missed the emphasized point at the bottom of the post. This answer, though not what OP is looking for, may serve useful for anyone down the road who is looking for a ...
user avatar
  • 2,144
5 votes
Accepted

x64dbg or alternative: Run to selection while storing all ran opcodes

On Windows Travel Debugging (TTD) is a perfect use case for this scenario. To use TTD, you need to run the debugger elevated. Install WinDbg Preview from Windows 10 store using an account that has ...
user avatar
4 votes
Accepted

Is the main function's name in the symbol table of C & C++ programs always 'main'? if not, how to find the name?

Since you mentioned ELF in the tag. WinMain, DllMain, etc should not be a concern for you. They're name conventions for Windows. The main function is the first function executed for a C/C++ program. ...
user avatar
  • 1,074
4 votes

.00cfg section in the PE file

Windows loader does not care about section names, so the name does not really matter, but usually this section contains the pointer to the indirect call guard check (___guard_check_icall_fptr). The ...
user avatar
  • 34.6k
4 votes
Accepted

How can I convert this assembly code (x64) to C?

This function computes (in a recursive manner) the sum of the n first integers: 400700: sub rsp,0x18 ; Align the stack 400704: mov QWORD PTR [rsp+0x8],rdi ; Store first ...
user avatar
  • 18k
4 votes
Accepted

Understanding operand forms

Welcome to the wonderful world of AT&T assembly! The 9 in 9(%rax, %rdx) is commonly called displacement or sometimes base, and you should indeed just add all three values: 9+rax+rdx = 9+0x100+0x3 ...
user avatar
  • 34.6k
4 votes
Accepted

Radare2 - what does dot mean in disassembly

Since the number of bytes in the instructions can be different and they had to put some limit on the column width, this is how it is indicated that there are more bytes in the instruction that those ...
user avatar
4 votes
Accepted

how to does this instruction work: `mov qword ptr [rbp-0x30], 0x4020c5`

mov QWORD PTR [rbp-0x30],0x4020c5 means exactly "move 0x4020c5 to a memory location rbp-0x30 and treat this number as qword" (8 - byte number). But q is at the memory location rbp - 0x30, so ...
user avatar
  • 3,179
4 votes
Accepted

startup program exits with code 126 when executing program at entrypoint

The program exiting with code 126 in GDB occurs when the current user does not have execute permissions for the binary being debugged: $ ls -l test -rw-r--r-- 1 user01 user01 110080 May 1 22:18 test ...
user avatar
  • 6,829
4 votes
Accepted

How to get offset of specific function in exe?

x64dbg can load the pdb and list all the function names if you have pdb for your executable view->modules->download symbols for this module also x64dbg can use the source file (ctrl+shift+s) ...
user avatar
  • 14.8k
3 votes

Elf x86_64 adding function

I would like to extend the .text section and insert [code]. If there's a better method of inserting new functionality into an ELF I'm all ears. Techniques for adding arbitrary code to ELF files were ...
user avatar
  • 6,829
3 votes

Is the main function's name in the symbol table of C & C++ programs always 'main'? if not, how to find the name?

Just a quick note in case you would not be aware of this: $ cat tiny.c #include <unistd.h> void _start() { _exit(42); } on x86-64, here is what I get (you need a static libc: libc.a): $ gcc ...
user avatar
  • 323
3 votes

Why do I get e8 00 00 00 00 for all libc function calls?

If you use -dr instead of plain -d, objdump will list relocation info next to the instructions. E.g. here's a random sample I just compiled 00000000 <main>: 0: 55 push ...
user avatar
  • 34.6k
3 votes
Accepted

brute force remote nop sled memory address

Brute force is not the way you should look to in anything unless its your last resort. The address space of x64 is too large to get brute force to work. Look up on this technique called ROP(Return ...
user avatar
  • 2,345
3 votes

How are __argc and __wargv globals exported from a 64-bit PE file compiled with Visual Studio?

These two symbols aren't exported in the usual way (i.e. via the export table). Instead, they are public symbols inside the run-time library itself. The startup code that runs before _main() ...
user avatar
  • 4,511
3 votes
Accepted

Isolate the call to a function

You can use Ida's Appcall functionality: Appcall is a mechanism to call functions inside the debugged program from the debugger or your script as if it were a built-in function. Such a ...
user avatar
  • 2,345
3 votes

What is the difference between MOV and LEA in example?

This is basic. Assume that rpb has a value of 55h (Assembler syntax). then lea rax, [rbp-50h] would result in 5. On the other hand, mov rax, [rbp-50h] would most probable crash your application, as ...
user avatar
  • 1,804
3 votes

What is the difference between MOV and LEA in example?

Warning: Illegal instruction used for explanation. If you are wondering if mov can do the work of lea, mov eax, esp+4 and lea eax, [esp+4] copies the same value to eax. However, mov eax, esp+4 is not ...
user avatar
3 votes

Where do arguments 5 and 6 go in this Microsoft x64 function call?

when you are here 4017ff: 55 push rbp your 5th argument will be available at [rsp+28] (8 bytes for return address and 20 bytes for HOMEPARAMS (space for saving the 4 args ...
user avatar
  • 14.8k
3 votes
Accepted

Help understanding x64 TEST instruction

je is normally used with cmp instruction like cmp Reg16/32/64,const je someplace while jz is normally used to check specifically for 0 or null like dec reg16/32/64 jz someplace i just modified your ...
user avatar
  • 14.8k
3 votes
Accepted

IDA API: obtain operand size prefix (x64)

Open up intel.hpp that ships with the SDK. The aux prefix flags are defined at the top; the one you're interested in is as follows: #define aux_natad 0x00001000 // addressing mode is not ...
user avatar
  • 7,814
2 votes

.00cfg section in the PE file

The most useful reference I've seen about this section is in this Adobe source comment: // // Allocate xyz in the .00cfg so that it is implicitly merged into the // import section of the binary (...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible