Hot answers tagged

49 votes

What does mov qword ptr ds:[rax+18], r8 mean?

Lets go over the instruction piece by piece: mov movqword ptr ds:[rax+18],r8 This is the opcode part of the instruction. It describes the base operation the CPU is required to perform. mov is an ...
user avatar
  • 11.4k
30 votes

What is PLT/GOT?

Let me summarize the links given at https://reverseengineering.stackexchange.com/a/1993/12321 without going into serious disasembly analysis for now. When the Linux kernel + dynamic linker is going ...
user avatar
28 votes
Accepted

What is the protocol for x87 floating point emulation in MS-DOS?

Nothing like asking a question on stackexchange, only to be humiliated by finding the answer (or at least part of it). After finding the following source file, it started making sense: https://github....
user avatar
20 votes

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

It's the wrong question, really. AH is the exception. Now the real question is, why is AH such an exception? It's an old register, from the 8086 era. It exists to facilitate moving over code from ...
user avatar
  • 301
19 votes
Accepted

What is the purpose of these instructions before the main preamble?

What the Instructions Are Doing What are the first three instructions before push %ebp doing? Namely, 804841b: 8d 4c 24 04 lea 0x4(%esp),%ecx <- 1 804841f: 83 e4 f0 ...
user avatar
  • 6,859
19 votes
Accepted

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones? It is impossible to access the higher parts of the EAX and RAX registers, or of any other 32 and 64-bit ...
user avatar
  • 11.4k
18 votes
Accepted

Randomly picking up a x86 register for an instruction

To better understand this, you need to study instruction encoding formats i.e. x86 for this question. An x86 instruction looks like this +----------------------+--------+--------+-----+--------------...
user avatar
  • 5,850
18 votes
Accepted

How to investigate Windows 32/64bit (WOW64) transition

The technique of jumping to 64bit code from a 32bit WOW64-ed process is commonly called "Heaven's gate" when performed manually. This is usually done to use 64bit features (such as manipulating 64bit ...
user avatar
  • 11.4k
17 votes
Accepted

What does the `TEST` instruction do

1. TEST According to the x86 Instruction Set Reference entry for TEST found at http://x86.renejeschke.de/, [TEST] computes the bit-wise logical AND of first operand (source 1 operand) and the ...
user avatar
  • 6,859
16 votes
Accepted

Import table vs Import Address Table

As general, I recommend reading the PE Format documentation on MSDN regarding the PE structure. Import Table The Import Table is actually called "Import Directory Table" and contains entries for ...
user avatar
  • 8,639
15 votes

How can I view FS:[0] with windbg?

If you're looking to find the base address of a segment based on its selector, you can use dg<selector>; in this context you would use dg fs: 0:000> dg fs P ...
user avatar
12 votes

basic reversing question about local variable

There are several factors involved in how much space is allocated by the compiler for a function's stack frame on the process runtime stack: space required for saving copies of arguments to the ...
user avatar
  • 6,859
12 votes

Is there any tool to visually see program stack in linux while debugging?

You can easily view it using Visual Panels in radare2. Here's a teaser: Installation First of all, install radare2 from git repository: $ git clone https://github.com/radare/radare2.git $ cd radare2 $...
user avatar
  • 8,639
12 votes
Accepted

Why does IDA add "db" statements between disassembled code

The byte 3Eh is the encoding of the segment override DS:. You observe it in an instruction like cmp byte ptr ds:3BEh, 'C' The hex encoding of this instruction is (I did this manually, some bit ...
user avatar
11 votes
Accepted

Automatically convert x86 assembly to C

Yes, that type of tool is called a decompiler Several examples below: Hex-Rays Decompiler Hopper REC Studio SmartDec Retargetable Decompiler
user avatar
11 votes

nop with argument in x86_64

These are multi byte nop instructions. From http://www.felixcloutier.com/x86/NOP.html Description This instruction performs no operation. It is a one-byte or multi-byte NOP that takes up ...
user avatar
  • 5,850
11 votes
Accepted

Question about LEA instruction

What you're seeing is an efficiency trick that compilers like to use. Internally, the CPU doesn't make a difference between numbers and addresses - 32 bit integers and pointers are the same thing. (...
user avatar
10 votes

How to obtain x86-64 pseudocode in IDA Pro?

The two other answers here are outdated. From hex-rays website, in the page about the the hex-rays decompiler: Currently the decompiler supports compiler generated code for the x86, x64, ARM32, ARM64,...
user avatar
  • 11.4k
10 votes

Why there are not any disassemblers that can generate re-assemblable asm code?

Your question is very interesting, though, not really new. Many people already use what we call binary rewriting for profiling purposes. For example DynInst & MAQAO do that to profile ...
user avatar
  • 2,603
10 votes
Accepted

Does a JE must follow directly to an CMP?

It is perfectly normal, compilers tend to emit such code for sake of optimization. Moreover delaying the conditional jump is helpful for instruction prefetching & branch handling. The code is ...
user avatar
  • 5,850
10 votes

Can IDA Pro on Linux disassemble a Windows PE (or Mac OS X app)?

Current IDA versions (as of 6.5) are pretty much equivalent for all three platforms. You can disassemble all file formats on all three platforms. You can definitely analyze PE and Mach-O files on ...
user avatar
  • 34.8k
10 votes
Accepted

How to recover the exception info from .gcc_except_table and .eh_handle sections?

(I think you may get some extra comments if you use -fverbose-asm.) Recovering information from these tables is definitely possible, although documentation is scarce and is often present only in the ...
user avatar
  • 34.8k
10 votes
Accepted

How does this EB F2 x86 instruction work?

from google starmans realm quoting relevant info These are also known as SHORT Relative Jumps. Programs using only Relative Jump instructions can be relocated anywhere in memory without ...
user avatar
  • 14.9k
10 votes
Accepted

How did this 80286 detection code work?

I'll dive into the past and try to give an explanation of the different checks you are observing in your software. I found three references explaining the behaviour (as I hope), which I will reference ...
user avatar
  • 1,814
9 votes
Accepted

How to recover information stored in .ctors section?

The .ctors section is a list of pointers terminated with -1 (0xFFFFFFFF), so it does not make sense to disassemble it. If you rearrange the bytes as data, you get: __CTOR_LIST__: .long 0xffffffff ...
user avatar
  • 34.8k
9 votes

How can I generate a call graph from an unstripped x86 Linux ELF?

Radare2 is also able to collect the callgraph of a program based on its binary only. Some time ago, I asked this question which is somehow related to yours and one of the author of Radare2 answered: ...
user avatar
  • 18.1k
9 votes
Accepted

Difference between INT 0X80 and SYSCALL

The short answer is that syscall has less overhead than int 0x80. For more details on why this is the case, see the accepted answer to Intel x86 vs x64 system call, where a nearly identical question ...
user avatar
  • 6,859
9 votes
Accepted

XMM register instructions and their c equivalents

You likely won't get an exact reproduction because cvtdq2pd takes the lower 64 bits of the second operand but since we're limited to 32 bits because we're using eax here, there are probably better(?) ...
user avatar
  • 664
9 votes
Accepted

What's this assembly doing?

This looks like a 32-bit shift right compiler helper. In 16-bit era, 32-bit numbers were represented by a pair of registers, in this case ax:dx. The check for 16 is an optimization: if the shift is ...
user avatar
  • 34.8k
8 votes

How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?

i wrote a windows specific answer to a question that was marked as duplicate and closed and the close flag referred to this thread so i post an answer here os win7 sp1 32 bit machine kernel dump ...
user avatar
  • 14.9k

Only top scored, non community-wiki answers of a minimum length are eligible