We’re rewarding the question askers & reputations are being recalculated! Read more.

Hot answers tagged

124

Such small snippets are not too hard to decompile manually. Let's try it. You have already figured out that cl holds a character, this means that eax where it's read from is a pointer to a character array. Let's call it p. Now, let's do a dumb translation for every assembly statement to C: l1: ; l1: mov cl, [eax] ; cl = *p; cmp cl, ' ' ; ...


85

PLT stands for Procedure Linkage Table which is, put simply, used to call external procedures/functions whose address isn't known in the time of linking, and is left to be resolved by the dynamic linker at run time. GOT stands for Global Offsets Table and is similarly used to resolve addresses. Both PLT and GOT and other relocation information is explained ...


54

Kernel perspective: I will try to answer from the kernel perspective, covering various OS's. Memory segmentation is the old way of accessing memory regions. All major operating systems including OSX, Linux, (from version 0.1) and Windows (from NT) are now using paging which is a better way (IMHO) of accessing memory. Intel, has always introduced backward ...


43

This is for position independent code. The call 0xe50b instruction pushes the address of the next instruction, and then jumps. It jumps to the immediately following instruction, which has no effect. The next instruction, pop eax, loads its own address into eax (as it was the value pushed by call). Further down it uses an offset from eax: mov eax, dword [ds:...


40

TL;DR: machine code decompilers are very useful, but do not expect the same miracles that they provide for managed languages. To name several limitations: the result generally can't be recompiled, lacks names, types, and other crucial information from the original source code, is likely to be much more difficult to read than the original source code minus ...


31

TL;DR the first 3 lines set an exception handler (an 'error catcher') the int3 generates an exception execution resumes at next Explanation this trick is (ab)using Structured Exception Handling, a mechanism to define exception handlers, typically by compilers when try/catch blocks are used. In 32bits versions of Windows, they can be set on the fly, ...


26

Nothing like asking a question on stackexchange, only to be humiliated by finding the answer (or at least part of it). After finding the following source file, it started making sense: https://github.com/alexhenrie/wine/blob/master/dlls/krnl386.exe16/fpu.c On old 8086 machines, where there is no trap for invalid instructions, the Elders of the Past came up ...


22

signsrch by Luigi Auriemma has signatures for tables used in common compression libraries (zlib etc.). It has been ported as plugins for ImmDbg and IDA. He also has the offzip tool which tries to identify and unpack compressed streams inside a binary.


22

Here's the official documentation for gas, quoting the relevant section: In AT&T syntax the size of memory operands is determined from the last character of the instruction mnemonic. Mnemonic suffixes of b, w, l and q specify byte (8-bit), word (16-bit), long (32-bit) and quadruple word (64-bit) memory references. Intel syntax accomplishes ...


21

Because this is really hard to do. To elaborate: You'll also need to extract things that are not code. Think of import tables, export tables, strings and other data. When you write code, this is only one part of the program. The other part is the Compiler Optimizations and data section. This makes it almost impossible to create re-compilable assembly. If ...


21

Lets go over the instruction piece by piece: mov movqword ptr ds:[rax+18],r8 This is the opcode part of the instruction. It describes the base operation the CPU is required to perform. mov is an opcode instructing a CPU to copy data from the second operand to the first operand. The first operand on the mov instruction is a target operand, and the second ...


20

Radare 2 is a GPL software, with a good API, and is not using linear disassembling. See visual mode (Vp command) example:


20

This is from the IDA Pro book, but even IDA, as good as it is, is still in the end making guesses. The answers here are from "The IDA Pro Book" by Chris Eagle. "Why there are not any disassemblers that can generate re-assemblable asm code targeting on benign program (one without obfuscation) ?" The compilation process is lossy. At the machine ...


20

It's the wrong question, really. AH is the exception. Now the real question is, why is AH such an exception? It's an old register, from the 8086 era. It exists to facilitate moving over code from the 8080. The 8080 has different registers from the 8086, so you can't move over code directly. In particular, it didn't have an AL,AH or AX register. It did ...


18

If you want to understand the instruction encodings in detail you need to study Intel® 64 and IA-32 Architectures Software Developer’s Manual Volume 2 (Instruction Set Reference, A-Z). Be aware that Intel IA-32 and AMD64 are very complicated instruction sets and in order to hook a function which is not specifically designed to be hooked by injecting a jump ...


18

To better understand this, you need to study instruction encoding formats i.e. x86 for this question. An x86 instruction looks like this +----------------------+--------+--------+-----+--------------+-----------+ | Instruction prefixes | Opcode | ModR/M | SIB | Displacement | Immediate | +----------------------+--------+--------+-----+--------------+-------...


17

The technique of jumping to 64bit code from a 32bit WOW64-ed process is commonly called "Heaven's gate" when performed manually. This is usually done to use 64bit features (such as manipulating 64bit processes by calling 64bit versions of windows APIs) or by malware to make debugging more difficult, which is coincidentally what you seem to be experiencing ;)....


17

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones? It is impossible to access the higher parts of the EAX and RAX registers, or of any other 32 and 64-bit registers, directly. You'll have to use indirect instruction sequences if you're interested in doing that. This is because there are no encodings to access ...


16

These techniques of mutating code (and still keeping it semantically equivalent) are known as polymorphic code. The software that can achieve a mutations of the code is usually called a polymorphic engine. It is a quite widely used technique in Malware design to evade pattern-matching detection of the anti-virus software. With these key words in hand (and ...


15

This is a frequently used "trick" to determine the address of the instruction following the call, i.e. the call instruction pushes the return address on the stack, which in this case corresponds to 0xe50b. After the pop instruction, eax contains that address. For instance, this idiom is used for position independent code (pic), but is also quite commonly ...


15

What the Instructions Are Doing What are the first three instructions before push %ebp doing? Namely, 804841b: 8d 4c 24 04 lea 0x4(%esp),%ecx <- 1 804841f: 83 e4 f0 and $0xfffffff0,%esp <- 2 8048422: ff 71 fc pushl -0x4(%ecx) <- 3 This is easy to see if gdb (or some other ...


14

Now I cannot possibly know what the exact reason is here, but there is another very good reason, not mentioned so far, for using this kind of method: throwing off a disassembler during static analysis. The mechanics of call $+5 have been discussed, so I'll assume they are known by now - otherwise refer to the other answers. Basically like with any call on ...


14

System calls through sysenter sysenter is a i586 instruction, specifically tight to 32-bits applications. It has been subsumed by syscall on 64-bits plateforms. One particularity of sysenter is that it does require, in addition to the usual register setting, a few manipulations on the stack before calling it. This is because before leaving sysenter, the ...


14

That site is good if you're familiar with how the encoding works but if you're just starting I'd skip it for now. The best starting point is probably the Intel's Architectures Software Developer Manuals. Have a look at CHAPTER 2 INSTRUCTION FORMAT in the Volume 2, and also the appendices, particularly APPENDIX B INSTRUCTION FORMATS AND ENCODINGS and ...


12

FS points to the exception handling chain, CS and DS are filled from the OS with code and data segment. SS is the battery/stack segment. From what I remember, GS and ES are free. It shouldn't matter much if kernel or user mode (they are used by some instructions like XLAT, MOVS, and some others, so you have to use them in the same way), but just in case I'm ...


12

There is no "official" calling convention that works like that. What you're seeing is most likely the result of Link-time Code Generation, also known as LTO (Link-time optimization) or WPO (Whole program optimization). When it is enabled, the optimization and code generation is done at link time, when the compiler has access to the code of whole program and ...


12

If you're looking to find the base address of a segment based on its selector, you can use dg<selector>; in this context you would use dg fs: 0:000> dg fs P Si Gr Pr Lo Sel Base Limit Type l ze an es ng Flags ---- -------- -------- ---------- - -- -- -- -- -------- 003B 7ffdf000 00000fff Data RW Ac 3 ...


12

1. TEST According to the x86 Instruction Set Reference entry for TEST found at http://x86.renejeschke.de/, [TEST] computes the bit-wise logical AND of first operand (source 1 operand) and the second operand (source 2 operand) and sets the SF, ZF, and PF status flags according to the result. The result is then discarded. More succinctly: AND imm32 ...


12

The byte 3Eh is the encoding of the segment override DS:. You observe it in an instruction like cmp byte ptr ds:3BEh, 'C' The hex encoding of this instruction is (I did this manually, some bit might be wrong) 3E - segement override prefix 80 - 8 bit ALU instruction 3E - mod/rm byte (reg = 7 -> instruction is CMP, mod = 0/rm = 6 -> ...


11

99% of the calls you'll encounter in modern binaries are near. call near (with opcode E8) is a call relative to the current address, and only affects ?IP. Thus it will add the operand (word or double word) to the next instruction pointer. it's adding the operand to ?IP call far (with opcode 9A) jumps to an absolute segment and offset. ie, it's like setting ...


Only top voted, non community-wiki answers of a minimum length are eligible