Hot answers tagged

4

lea = address mov = contents if address 0x401000 contains 0xDeadBeef like ef be ad de lea MySecretPlace, [401000] MySecretPlace will be 0x401000 Mov MySecretPlace, [401000] MySecretPlace will be DeadBeef mov MySecretPlace, byte ptr [401000] MySecretPlace will be 0xef 0r 0xef depending on EndianNess mov MySecretPlace, word ptr [401000] ...


4

Since the number of bytes in the instructions can be different and they had to put some limit on the column width, this is how it is indicated that there are more bytes in the instruction that those that you see on the screen. A '.' indicates that there's more and it doesn't mean it's always zero(s)- it can be anything. If this bothers you there are flags ...


4

On Windows Travel Debugging (TTD) is a perfect use case for this scenario. To use TTD, you need to run the debugger elevated. Install WinDbg Preview from Windows 10 store using an account that has administrator privileges and use that account when recording in the debugger. In order to run the debugger elevated, select and hold (or right-click) the WinDbg ...


3

mov QWORD PTR [rbp-0x30],0x4020c5 means exactly "move 0x4020c5 to a memory location rbp-0x30 and treat this number as qword" (8 - byte number). But q is at the memory location rbp - 0x30, so anything you write into that address, will be written into q. So, the number 0x4020c5 was written into q. The number 0x4020c5 is not a string itself - it's a ...


3

je is normally used with cmp instruction like cmp Reg16/32/64,const je someplace while jz is normally used to check specifically for 0 or null like dec reg16/32/64 jz someplace i just modified your code to an infinite loop and emulated it in x86 emulator see below for code and gif. code mov ax, 0x2 dec ax and ax, 0x1 jz equal je equal test ax,...


3

when you are here 4017ff: 55 push rbp your 5th argument will be available at [rsp+28] (8 bytes for return address and 20 bytes for HOMEPARAMS (space for saving the 4 args passed via register) two pushes and one subtract will make your argument no 5 available at 0x28 + 0x8 +0x8 +0x48 = 0x80 so rbp+0 will hold the address of 5th ...


2

It's called x86 but you have the option to pick size - 64.


2

movsxd moves the dword by sign extending the dword into qword so for this example rdx will be eax+edx C:\>python -c "print( hex(0x26d1+0x40d)) 0x2ade you can use some emulators like unicorn or use a debugger and patch this instructions some place and loop or compile a small source as below to get an understanding (the code below sign extends a 16bit ...


2

For the overflow from name to command to work, the difference between the addresses of both should be 0x10 bytes. I verified what I mentioned in the case earlier - Adding printf("%p:%p\n", name, command); Under a debugger stepping through main gives the addresses as 0x100404080:0x1002059f0 Here delta > 0x10 bytes and hence the name strcpy ...


1

First make sure you are using correct calling convention, in 64-bit Windows most APIs expect parameters via registers not push. An example of calling convention for 64-bit Windows: lea r9d, uType ; uType lea r8, Caption ; Caption lea rdx, Text ; Text mov rcx, hWnd ; hWnd Call cs:MessageBoxW This is covered in more ...


1

Assemblers are faced with a similar problem: the user writes textual labels such as @loop, and references them in conditional branch instructions such as jbe @loop. However, the assembler does not know ahead of time how far the branch is from the label (in order to generate the displacement for the branch). It only learns that after generating machine code ...


1

here is the sample code that will show both the constructs if there is an atomic exchange requirement you use the api or intrinsc provided else simply assign source #include <stdio.h> #include <windows.h> #include <intrin.h> long tmp[10] = {NULL}; long *m_someMemoryPool[10] ={NULL}; int main (void) { tmp[0] = 0xbee5deed; long foo ...


1

you can add some print address of variable debug aid in your source to get a grip of these addresses see the disassembly of line no 5 in the paste below #include <stdio.h> int main (void) { char * q; q = "/"; printf("%p\n",&q); } disassembly slashaddr!main: 3 01141000 55 push ebp 3 01141001 ...


1

the instruction lea loads the Effective Address of its operand so after executing lea rcx, qword ptr ds:[xxxxxxx] rcx will hold the address xxxxxxx so if you are sure you need rcx to be 0 in that instruction simply wipe the address from that specific operand that is make 48:8d05 xyzabcd as 48:8d0425 00000000 or assemble lea rax,qword ptr ds:[0] keep in mind ...


1

I've spent many hours (too many for me to admit) trying to figure this out and I just realized what it is, right after hitting submit. push instructions implicitly decrease the stack pointer. The call to the function DotProduct calls push three times; once in the call instruction itself, where the return address is implicitly pushed, and twice in the ...


1

Options-General-Analysis-Processor specific options, [x] Explicit RIP-addressing.


1

Is movq rax, xmm0 buggy in Radare2? No, it's just not fully implemented in all debuggers yet. Native Debugger Works! This instruction works fine using the native debugger. The native debugger is launched with r2 -d yourFileGoesHere. Alternatively, if you are already in r2 looking at the file, but r2 wasn't launched with the -d switch, the file can be ...


1

Actually, it's automatic. I don't have to pick size. When I create a new project with a 64 bit binary the project shows: Processor=x86, Endian=little, Address Size=64, Compiler=gcc, Format=ELF When I create a new project with a 32 bit binary the project shows: Processor=x86, Endian=little, Addesss Size=32, Compiler=gcc, Format=ELF


1

This is basic. Assume that rpb has a value of 55h (Assembler syntax). then lea rax, [rbp-50h] would result in 5. On the other hand, mov rax, [rbp-50h] would most probable crash your application, as it would try to read the content of the address 5 and put it into rax. Thus, the difference is that the first is direct, the second indirect. BTW, you can ...


Only top voted, non community-wiki answers of a minimum length are eligible