Hot answers tagged

53 votes

What does mov qword ptr ds:[rax+18], r8 mean?

Lets go over the instruction piece by piece: mov movqword ptr ds:[rax+18],r8 This is the opcode part of the instruction. It describes the base operation the CPU is required to perform. mov is an ...
NirIzr's user avatar
  • 11.8k
38 votes

What is PLT/GOT?

Let me summarize the links given at https://reverseengineering.stackexchange.com/a/1993/12321 without going into serious disasembly analysis for now. When the Linux kernel + dynamic linker is going ...
Ciro Santilli OurBigBook.com's user avatar
29 votes
Accepted

What is the protocol for x87 floating point emulation in MS-DOS?

Nothing like asking a question on stackexchange, only to be humiliated by finding the answer (or at least part of it). After finding the following source file, it started making sense: https://github....
John Källén's user avatar
20 votes
Accepted

What does the `TEST` instruction do

1. TEST According to the x86 Instruction Set Reference entry for TEST found at http://x86.renejeschke.de/, [TEST] computes the bit-wise logical AND of first operand (source 1 operand) and the ...
julian's user avatar
  • 7,108
20 votes

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

It's the wrong question, really. AH is the exception. Now the real question is, why is AH such an exception? It's an old register, from the 8086 era. It exists to facilitate moving over code from ...
MSalters's user avatar
  • 301
19 votes
Accepted

What is the purpose of these instructions before the main preamble?

What the Instructions Are Doing What are the first three instructions before push %ebp doing? Namely, 804841b: 8d 4c 24 04 lea 0x4(%esp),%ecx <- 1 804841f: 83 e4 f0 ...
julian's user avatar
  • 7,108
19 votes
Accepted

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones? It is impossible to access the higher parts of the EAX and RAX registers, or of any other 32 and 64-bit ...
NirIzr's user avatar
  • 11.8k
18 votes
Accepted

Randomly picking up a x86 register for an instruction

To better understand this, you need to study instruction encoding formats i.e. x86 for this question. An x86 instruction looks like this +----------------------+--------+--------+-----+--------------...
0xec's user avatar
  • 6,060
18 votes
Accepted

How to investigate Windows 32/64bit (WOW64) transition

The technique of jumping to 64bit code from a 32bit WOW64-ed process is commonly called "Heaven's gate" when performed manually. This is usually done to use 64bit features (such as manipulating 64bit ...
NirIzr's user avatar
  • 11.8k
17 votes
Accepted

Import table vs Import Address Table

As general, I recommend reading the PE Format documentation on MSDN regarding the PE structure. Import Table The Import Table is actually called "Import Directory Table" and contains entries for ...
Megabeets's user avatar
  • 8,959
14 votes

Struggling between syscall or sysenter ( Windows )

The Intel and AMD instruction sets are similar but not identical. There are many examples of that: FMA3/FMA4, AMD-V and VT-x (and their extensions), etc. The fast system call interface is yet ...
conio's user avatar
  • 652
12 votes

basic reversing question about local variable

There are several factors involved in how much space is allocated by the compiler for a function's stack frame on the process runtime stack: space required for saving copies of arguments to the ...
julian's user avatar
  • 7,108
12 votes

Is there any tool to visually see program stack in linux while debugging?

You can easily view it using Visual Panels in radare2. Here's a teaser: Installation First of all, install radare2 from git repository: $ git clone https://github.com/radare/radare2.git $ cd radare2 $...
Megabeets's user avatar
  • 8,959
12 votes
Accepted

Why does IDA add "db" statements between disassembled code

The byte 3Eh is the encoding of the segment override DS:. You observe it in an instruction like cmp byte ptr ds:3BEh, 'C' The hex encoding of this instruction is (I did this manually, some bit ...
Michael Karcher's user avatar
11 votes

nop with argument in x86_64

These are multi byte nop instructions. From http://www.felixcloutier.com/x86/NOP.html Description This instruction performs no operation. It is a one-byte or multi-byte NOP that takes up ...
0xec's user avatar
  • 6,060
11 votes
Accepted

Question about LEA instruction

What you're seeing is an efficiency trick that compilers like to use. Internally, the CPU doesn't make a difference between numbers and addresses - 32 bit integers and pointers are the same thing. (...
Guntram Blohm's user avatar
11 votes
Accepted

Difference between INT 0X80 and SYSCALL

The short answer is that syscall has less overhead than int 0x80. For more details on why this is the case, see the accepted answer to Intel x86 vs x64 system call, where a nearly identical question ...
julian's user avatar
  • 7,108
11 votes

What does 'test al, al' mean?

In x86 assembly, al is the least significant byte of eax register, which is typically used to return values from function calls. The test al,al is a bitwise AND operation between al and itself. If ...
Yotamz's user avatar
  • 1,093
10 votes

How to obtain x86-64 pseudocode in IDA Pro?

The two other answers here are outdated. From hex-rays website, in the page about the the hex-rays decompiler: Currently the decompiler supports compiler generated code for the x86, x64, ARM32, ARM64,...
NirIzr's user avatar
  • 11.8k
10 votes
Accepted

Where ES/GS/FS are pointing to?

On x86 32bit windows the FS segment register points to a structure called the Thread Information Block or the TIB for short. This structure is created by the kernel on thread creation and is used to ...
NirIzr's user avatar
  • 11.8k
10 votes
Accepted

How does this EB F2 x86 instruction work?

from google starmans realm quoting relevant info These are also known as SHORT Relative Jumps. Programs using only Relative Jump instructions can be relocated anywhere in memory without ...
blabb's user avatar
  • 16.3k
10 votes
Accepted

How did this 80286 detection code work?

I'll dive into the past and try to give an explanation of the different checks you are observing in your software. I found three references explaining the behaviour (as I hope), which I will reference ...
josh's user avatar
  • 1,964
10 votes
Accepted

Do I have to learn computer architecture for underestanding or doing reverse engineering?

The question is too broad, but I'll try to answer and hope that it will help. It depends on what exactly do you mean by computer architecture and area you applying your reverse engineering skills to. ...
w s's user avatar
  • 8,448
9 votes

Import table vs Import Address Table

First, beside “yours” two tables, I introduce a third one, the Import Lookup Table. Side by side with the Import Address Table, these two tables look like in this simplified picture: This picture ...
MarianD's user avatar
  • 1,130
9 votes
Accepted

XMM register instructions and their c equivalents

You likely won't get an exact reproduction because cvtdq2pd takes the lower 64 bits of the second operand but since we're limited to 32 bits because we're using eax here, there are probably better(?) ...
Abigail's user avatar
  • 684
9 votes
Accepted

What does fs and gs registers provide in Linux?

The gs/fs segment can be used for thread local storage similar to what you have encountered in Windows. Variable specific to a thread such as errno, stack canary etc are usually stored here in Linux. ...
sudhackar's user avatar
  • 2,639
9 votes
Accepted

What's this assembly doing?

This looks like a 32-bit shift right compiler helper. In 16-bit era, 32-bit numbers were represented by a pair of registers, in this case ax:dx. The check for 16 is an optimization: if the shift is ...
Igor Skochinsky's user avatar
  • 36.5k
9 votes
Accepted

How the CMP instruction uses condition flags?

Furthermore, with the CMP instruction, the destination operand doesn't change. Just the flags. Let me illustrate. Let's say EAX = 00000005 and EBX = 00000005. If we do this arithmetic operation: ...
she_roar's user avatar
  • 106
9 votes
Accepted

Correct way to understand local_ in ghidra disassembly

Since local variables are usually placed on the stack in x86 and esp register can change during function execution, it is more convenient to save the value of esp register on function entry and access ...
bart1e's user avatar
  • 3,369
9 votes

Do I have to learn computer architecture for underestanding or doing reverse engineering?

A solid understanding of the fundamentals of computer architecture is very useful for a Reverse Engineer. That said - it depends on your target. If you are reverse engineering a Java application or a ...
h0r53's user avatar
  • 211

Only top scored, non community-wiki answers of a minimum length are eligible