Hot answers tagged

45

Lets go over the instruction piece by piece: mov movqword ptr ds:[rax+18],r8 This is the opcode part of the instruction. It describes the base operation the CPU is required to perform. mov is an opcode instructing a CPU to copy data from the second operand to the first operand. The first operand on the mov instruction is a target operand, and the second ...


28

Nothing like asking a question on stackexchange, only to be humiliated by finding the answer (or at least part of it). After finding the following source file, it started making sense: https://github.com/alexhenrie/wine/blob/master/dlls/krnl386.exe16/fpu.c On old 8086 machines, where there is no trap for invalid instructions, the Elders of the Past came up ...


27

Let me summarize the links given at https://reverseengineering.stackexchange.com/a/1993/12321 without going into serious disasembly analysis for now. When the Linux kernel + dynamic linker is going to run a binary with exec, it traditionally just dumped the ELF section into a known memory location specified by the linker during link time. So, whenever ...


22

Because this is really hard to do. To elaborate: You'll also need to extract things that are not code. Think of import tables, export tables, strings and other data. When you write code, this is only one part of the program. The other part is the Compiler Optimizations and data section. This makes it almost impossible to create re-compilable assembly. If ...


20

This is from the IDA Pro book, but even IDA, as good as it is, is still in the end making guesses. The answers here are from "The IDA Pro Book" by Chris Eagle. "Why there are not any disassemblers that can generate re-assemblable asm code targeting on benign program (one without obfuscation) ?" The compilation process is lossy. At the machine ...


20

Radare 2 is a GPL software, with a good API, and is not using linear disassembling. See visual mode (Vp command) example:


20

It's the wrong question, really. AH is the exception. Now the real question is, why is AH such an exception? It's an old register, from the 8086 era. It exists to facilitate moving over code from the 8080. The 8080 has different registers from the 8086, so you can't move over code directly. In particular, it didn't have an AL,AH or AX register. It did ...


19

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones? It is impossible to access the higher parts of the EAX and RAX registers, or of any other 32 and 64-bit registers, directly. You'll have to use indirect instruction sequences if you're interested in doing that. This is because there are no encodings to access ...


18

To better understand this, you need to study instruction encoding formats i.e. x86 for this question. An x86 instruction looks like this +----------------------+--------+--------+-----+--------------+-----------+ | Instruction prefixes | Opcode | ModR/M | SIB | Displacement | Immediate | +----------------------+--------+--------+-----+--------------+-------...


18

What the Instructions Are Doing What are the first three instructions before push %ebp doing? Namely, 804841b: 8d 4c 24 04 lea 0x4(%esp),%ecx <- 1 804841f: 83 e4 f0 and $0xfffffff0,%esp <- 2 8048422: ff 71 fc pushl -0x4(%ecx) <- 3 This is easy to see if gdb (or some other ...


18

The technique of jumping to 64bit code from a 32bit WOW64-ed process is commonly called "Heaven's gate" when performed manually. This is usually done to use 64bit features (such as manipulating 64bit processes by calling 64bit versions of windows APIs) or by malware to make debugging more difficult, which is coincidentally what you seem to be experiencing ;)....


17

1. TEST According to the x86 Instruction Set Reference entry for TEST found at http://x86.renejeschke.de/, [TEST] computes the bit-wise logical AND of first operand (source 1 operand) and the second operand (source 2 operand) and sets the SF, ZF, and PF status flags according to the result. The result is then discarded. More succinctly: AND imm32 ...


16

These techniques of mutating code (and still keeping it semantically equivalent) are known as polymorphic code. The software that can achieve a mutations of the code is usually called a polymorphic engine. It is a quite widely used technique in Malware design to evade pattern-matching detection of the anti-virus software. With these key words in hand (and ...


15

That site is good if you're familiar with how the encoding works but if you're just starting I'd skip it for now. The best starting point is probably the Intel's Architectures Software Developer Manuals. Have a look at CHAPTER 2 INSTRUCTION FORMAT in the Volume 2, and also the appendices, particularly APPENDIX B INSTRUCTION FORMATS AND ENCODINGS and ...


15

If you're looking to find the base address of a segment based on its selector, you can use dg<selector>; in this context you would use dg fs: 0:000> dg fs P Si Gr Pr Lo Sel Base Limit Type l ze an es ng Flags ---- -------- -------- ---------- - -- -- -- -- -------- 003B 7ffdf000 00000fff Data RW Ac 3 ...


14

As general, I recommend reading the PE Format documentation on MSDN regarding the PE structure. Import Table The Import Table is actually called "Import Directory Table" and contains entries for every DLL which is loaded by the executable. Each entry contains, among other, Import Lookup Table (ILT) and Import Address Table (IAT) To quote from the PE ...


12

This aligns the stack pointer to 8 byte boundary. This is done by the compiler to improve performance, as reads from non-aligned addresses results in performance degradation.


12

There are several factors involved in how much space is allocated by the compiler for a function's stack frame on the process runtime stack: space required for saving copies of arguments to the function in the stack frame space required for storing local variables in the stack frame Stack alignment to a 16-byte boundary (GCC default for i386 architecture) ...


12

You can easily view it using Visual Panels in radare2. Here's a teaser: Installation First of all, install radare2 from git repository: $ git clone https://github.com/radare/radare2.git $ cd radare2 $ ./sys/install.sh Debugging To debug a program with radare2 call it with the debug flag -d: $ r2 -d /bin/ls Now the program is opened in debug mode. Use v! to ...


12

The byte 3Eh is the encoding of the segment override DS:. You observe it in an instruction like cmp byte ptr ds:3BEh, 'C' The hex encoding of this instruction is (I did this manually, some bit might be wrong) 3E - segement override prefix 80 - 8 bit ALU instruction 3E - mod/rm byte (reg = 7 -> instruction is CMP, mod = 0/rm = 6 -> ...


11

Yes, that type of tool is called a decompiler Several examples below: Hex-Rays Decompiler Hopper REC Studio SmartDec Retargetable Decompiler


11

These are multi byte nop instructions. From http://www.felixcloutier.com/x86/NOP.html Description This instruction performs no operation. It is a one-byte or multi-byte NOP that takes up space in the instruction stream but does not impact machine context, except for the EIP register. The multi-byte form of NOP is available on processors ...


11

What you're seeing is an efficiency trick that compilers like to use. Internally, the CPU doesn't make a difference between numbers and addresses - 32 bit integers and pointers are the same thing. (Or 64 bit, if you're using newer architecture, but as your register names start with e, you're using 32 bit). The lea instruction loads the address of its ...


10

Your question is very interesting, though, not really new. Many people already use what we call binary rewriting for profiling purposes. For example DynInst & MAQAO do that to profile applications in order to locate bottlenecks in basic blocks. Now the question you'll probably be asking yourself is how is it done ? Simple. Most available disassemblers ...


10

It is perfectly normal, compilers tend to emit such code for sake of optimization. Moreover delaying the conditional jump is helpful for instruction prefetching & branch handling. The code is valid too unless the code in between modify the EFLAGS register.


10

Current IDA versions (as of 6.5) are pretty much equivalent for all three platforms. You can disassemble all file formats on all three platforms. You can definitely analyze PE and Mach-O files on Linux. Most debuggers are also available on all platforms. A couple of features are available only in the Windows version: WinDbg and Symbian debuggers WinCE ...


10

from google starmans realm quoting relevant info These are also known as SHORT Relative Jumps. Programs using only Relative Jump instructions can be relocated anywhere in memory without having to change the machine code for the Jumps. The first byte of a SHORT Jump is always EB and the second is a relative offset from 00h to 7Fh for ...


10

I'll dive into the past and try to give an explanation of the different checks you are observing in your software. I found three references explaining the behaviour (as I hope), which I will reference to in this answer as /1/, /2/, /3/. /1/ http://www.drdobbs.com/embedded-systems/processor-detection-schemes/184409011 It is an archive article from the ...


9

The two other answers here are outdated. From hex-rays website, in the page about the the hex-rays decompiler: Currently the decompiler supports compiler generated code for the x86, x64, ARM32, ARM64, and PowerPC processors. We plan to port it to other platforms and add a programmatic API. This will allow our customers to implement their own analysis ...


9

The .ctors section is a list of pointers terminated with -1 (0xFFFFFFFF), so it does not make sense to disassemble it. If you rearrange the bytes as data, you get: __CTOR_LIST__: .long 0xffffffff __CTOR_END__: .long 0x00000000 So, for whatever reason, the resulting exe does not actually use the .ctors section. I suspect the linker instead placed the ...


Only top voted, non community-wiki answers of a minimum length are eligible