Hot answers tagged

41

Lets go over the instruction piece by piece: mov movqword ptr ds:[rax+18],r8 This is the opcode part of the instruction. It describes the base operation the CPU is required to perform. mov is an opcode instructing a CPU to copy data from the second operand to the first operand. The first operand on the mov instruction is a target operand, and the second ...


28

Nothing like asking a question on stackexchange, only to be humiliated by finding the answer (or at least part of it). After finding the following source file, it started making sense: https://github.com/alexhenrie/wine/blob/master/dlls/krnl386.exe16/fpu.c On old 8086 machines, where there is no trap for invalid instructions, the Elders of the Past came up ...


27

Here's the official documentation for gas, quoting the relevant section: In AT&T syntax the size of memory operands is determined from the last character of the instruction mnemonic. Mnemonic suffixes of b, w, l and q specify byte (8-bit), word (16-bit), long (32-bit) and quadruple word (64-bit) memory references. Intel syntax accomplishes ...


25

Let me summarize the links given at https://reverseengineering.stackexchange.com/a/1993/12321 without going into serious disasembly analysis for now. When the Linux kernel + dynamic linker is going to run a binary with exec, it traditionally just dumped the ELF section into a known memory location specified by the linker during link time. So, whenever ...


22

Because this is really hard to do. To elaborate: You'll also need to extract things that are not code. Think of import tables, export tables, strings and other data. When you write code, this is only one part of the program. The other part is the Compiler Optimizations and data section. This makes it almost impossible to create re-compilable assembly. If ...


20

Radare 2 is a GPL software, with a good API, and is not using linear disassembling. See visual mode (Vp command) example:


20

This is from the IDA Pro book, but even IDA, as good as it is, is still in the end making guesses. The answers here are from "The IDA Pro Book" by Chris Eagle. "Why there are not any disassemblers that can generate re-assemblable asm code targeting on benign program (one without obfuscation) ?" The compilation process is lossy. At the machine ...


20

It's the wrong question, really. AH is the exception. Now the real question is, why is AH such an exception? It's an old register, from the 8086 era. It exists to facilitate moving over code from the 8080. The 8080 has different registers from the 8086, so you can't move over code directly. In particular, it didn't have an AL,AH or AX register. It did ...


19

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones? It is impossible to access the higher parts of the EAX and RAX registers, or of any other 32 and 64-bit registers, directly. You'll have to use indirect instruction sequences if you're interested in doing that. This is because there are no encodings to access ...


18

To better understand this, you need to study instruction encoding formats i.e. x86 for this question. An x86 instruction looks like this +----------------------+--------+--------+-----+--------------+-----------+ | Instruction prefixes | Opcode | ModR/M | SIB | Displacement | Immediate | +----------------------+--------+--------+-----+--------------+-------...


18

What the Instructions Are Doing What are the first three instructions before push %ebp doing? Namely, 804841b: 8d 4c 24 04 lea 0x4(%esp),%ecx <- 1 804841f: 83 e4 f0 and $0xfffffff0,%esp <- 2 8048422: ff 71 fc pushl -0x4(%ecx) <- 3 This is easy to see if gdb (or some other ...


17

The technique of jumping to 64bit code from a 32bit WOW64-ed process is commonly called "Heaven's gate" when performed manually. This is usually done to use 64bit features (such as manipulating 64bit processes by calling 64bit versions of windows APIs) or by malware to make debugging more difficult, which is coincidentally what you seem to be experiencing ;)....


16

These techniques of mutating code (and still keeping it semantically equivalent) are known as polymorphic code. The software that can achieve a mutations of the code is usually called a polymorphic engine. It is a quite widely used technique in Malware design to evade pattern-matching detection of the anti-virus software. With these key words in hand (and ...


16

1. TEST According to the x86 Instruction Set Reference entry for TEST found at http://x86.renejeschke.de/, [TEST] computes the bit-wise logical AND of first operand (source 1 operand) and the second operand (source 2 operand) and sets the SF, ZF, and PF status flags according to the result. The result is then discarded. More succinctly: AND imm32 ...


15

That site is good if you're familiar with how the encoding works but if you're just starting I'd skip it for now. The best starting point is probably the Intel's Architectures Software Developer Manuals. Have a look at CHAPTER 2 INSTRUCTION FORMAT in the Volume 2, and also the appendices, particularly APPENDIX B INSTRUCTION FORMATS AND ENCODINGS and ...


15

If you're looking to find the base address of a segment based on its selector, you can use dg<selector>; in this context you would use dg fs: 0:000> dg fs P Si Gr Pr Lo Sel Base Limit Type l ze an es ng Flags ---- -------- -------- ---------- - -- -- -- -- -------- 003B 7ffdf000 00000fff Data RW Ac 3 ...


14

System calls through sysenter sysenter is a i586 instruction, specifically tight to 32-bits applications. It has been subsumed by syscall on 64-bits plateforms. One particularity of sysenter is that it does require, in addition to the usual register setting, a few manipulations on the stack before calling it. This is because before leaving sysenter, the ...


14

As general, I recommend reading the PE Format documentation on MSDN regarding the PE structure. Import Table The Import Table is actually called "Import Directory Table" and contains entries for every DLL which is loaded by the executable. Each entry contains, among other, Import Lookup Table (ILT) and Import Address Table (IAT) To quote from the PE ...


12

This aligns the stack pointer to 8 byte boundary. This is done by the compiler to improve performance, as reads from non-aligned addresses results in performance degradation.


12

There is no "official" calling convention that works like that. What you're seeing is most likely the result of Link-time Code Generation, also known as LTO (Link-time optimization) or WPO (Whole program optimization). When it is enabled, the optimization and code generation is done at link time, when the compiler has access to the code of whole program and ...


12

There are several factors involved in how much space is allocated by the compiler for a function's stack frame on the process runtime stack: space required for saving copies of arguments to the function in the stack frame space required for storing local variables in the stack frame Stack alignment to a 16-byte boundary (GCC default for i386 architecture) ...


12

The byte 3Eh is the encoding of the segment override DS:. You observe it in an instruction like cmp byte ptr ds:3BEh, 'C' The hex encoding of this instruction is (I did this manually, some bit might be wrong) 3E - segement override prefix 80 - 8 bit ALU instruction 3E - mod/rm byte (reg = 7 -> instruction is CMP, mod = 0/rm = 6 -> ...


11

Windows 8 introduces a new restriction: the AddressOfEntryPoint can't be smaller than SizeOfHeaders. Set SizeOfHeaders to AddressOfEntryPoint to make it work. The error you get is defined in ntstatus.h as follows: // // MessageId: STATUS_INVALID_IMAGE_FORMAT // // MessageText: // // {Bad Image} // %hs is either not designed to run on Windows or it ...


11

Yes, that type of tool is called a decompiler Several examples below: Hex-Rays Decompiler Hopper REC Studio SmartDec Retargetable Decompiler


11

What you're seeing is an efficiency trick that compilers like to use. Internally, the CPU doesn't make a difference between numbers and addresses - 32 bit integers and pointers are the same thing. (Or 64 bit, if you're using newer architecture, but as your register names start with e, you're using 32 bit). The lea instruction loads the address of its ...


11

You can easily view it using Visual Panels in radare2. Here's a teaser: Installation First of all, install radare2 from git repository: $ git clone https://github.com/radare/radare2.git $ cd radare2 $ ./sys/install.sh Debugging To debug a program with radare2 call it with the debug flag -d: $ r2 -d /bin/ls Now the program is opened in debug mode. ...


10

Your question is very interesting, though, not really new. Many people already use what we call binary rewriting for profiling purposes. For example DynInst & MAQAO do that to profile applications in order to locate bottlenecks in basic blocks. Now the question you'll probably be asking yourself is how is it done ? Simple. Most available disassemblers ...


10

It is perfectly normal, compilers tend to emit such code for sake of optimization. Moreover delaying the conditional jump is helpful for instruction prefetching & branch handling. The code is valid too unless the code in between modify the EFLAGS register.


10

Current IDA versions (as of 6.5) are pretty much equivalent for all three platforms. You can disassemble all file formats on all three platforms. You can definitely analyze PE and Mach-O files on Linux. Most debuggers are also available on all platforms. A couple of features are available only in the Windows version: WinDbg and Symbian debuggers WinCE ...


10

These are multi byte nop instructions. From http://www.felixcloutier.com/x86/NOP.html Description This instruction performs no operation. It is a one-byte or multi-byte NOP that takes up space in the instruction stream but does not impact machine context, except for the EIP register. The multi-byte form of NOP is available on processors ...


Only top voted, non community-wiki answers of a minimum length are eligible