52
votes
What does mov qword ptr ds:[rax+18], r8 mean?
Lets go over the instruction piece by piece:
mov
movqword ptr ds:[rax+18],r8
This is the opcode part of the instruction. It describes the base operation the CPU is required to perform. mov is an ...
- 11.7k
37
votes
What is PLT/GOT?
Let me summarize the links given at https://reverseengineering.stackexchange.com/a/1993/12321 without going into serious disasembly analysis for now.
When the Linux kernel + dynamic linker is going ...
29
votes
Accepted
What is the protocol for x87 floating point emulation in MS-DOS?
Nothing like asking a question on stackexchange, only to be humiliated by finding the answer (or at least part of it). After finding the following source file, it started making sense:
https://github....
- 1,060
20
votes
Accepted
What does the `TEST` instruction do
1. TEST
According to the x86 Instruction Set Reference entry for TEST found at http://x86.renejeschke.de/,
[TEST] computes the bit-wise logical AND of first operand (source 1 operand) and the ...
- 7,058
20
votes
Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?
It's the wrong question, really. AH is the exception.
Now the real question is, why is AH such an exception? It's an old register, from the 8086 era. It exists to facilitate moving over code from ...
- 301
19
votes
Accepted
What is the purpose of these instructions before the main preamble?
What the Instructions Are Doing
What are the first three instructions before push %ebp doing?
Namely,
804841b: 8d 4c 24 04 lea 0x4(%esp),%ecx <- 1
804841f: 83 e4 f0 ...
- 7,058
19
votes
Accepted
Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?
Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?
It is impossible to access the higher parts of the EAX and RAX registers, or of any other 32 and 64-bit ...
- 11.7k
18
votes
Accepted
Randomly picking up a x86 register for an instruction
To better understand this, you need to study instruction encoding formats i.e. x86 for this question.
An x86 instruction looks like this
+----------------------+--------+--------+-----+--------------...
- 6,030
18
votes
Accepted
How to investigate Windows 32/64bit (WOW64) transition
The technique of jumping to 64bit code from a 32bit WOW64-ed process is commonly called "Heaven's gate" when performed manually. This is usually done to use 64bit features (such as manipulating 64bit ...
- 11.7k
17
votes
Accepted
Import table vs Import Address Table
As general, I recommend reading the PE Format documentation on MSDN regarding the PE structure.
Import Table
The Import Table is actually called "Import Directory Table" and contains entries for ...
- 8,899
12
votes
basic reversing question about local variable
There are several factors involved in how much space is allocated by the compiler for a function's stack frame on the process runtime stack:
space required for saving copies of arguments to the ...
- 7,058
12
votes
Is there any tool to visually see program stack in linux while debugging?
You can easily view it using Visual Panels in radare2. Here's a teaser:
Installation
First of all, install radare2 from git repository:
$ git clone https://github.com/radare/radare2.git
$ cd radare2
$...
- 8,899
12
votes
Accepted
Why does IDA add "db" statements between disassembled code
The byte 3Eh is the encoding of the segment override DS:. You observe it in an instruction like
cmp byte ptr ds:3BEh, 'C'
The hex encoding of this instruction is (I did this manually, some bit ...
- 921
11
votes
nop with argument in x86_64
These are multi byte nop instructions.
From http://www.felixcloutier.com/x86/NOP.html
Description
This instruction performs no operation. It is a one-byte or multi-byte
NOP that takes up ...
- 6,030
11
votes
Accepted
Question about LEA instruction
What you're seeing is an efficiency trick that compilers like to use.
Internally, the CPU doesn't make a difference between numbers and addresses - 32 bit integers and pointers are the same thing. (...
- 12.9k
11
votes
Accepted
Difference between INT 0X80 and SYSCALL
The short answer is that syscall has less overhead than int 0x80.
For more details on why this is the case, see the accepted answer to Intel x86 vs x64 system call, where a nearly identical question ...
- 7,058
10
votes
How to obtain x86-64 pseudocode in IDA Pro?
The two other answers here are outdated.
From hex-rays website, in the page about the the hex-rays decompiler:
Currently the decompiler supports compiler generated code for the x86, x64, ARM32, ARM64,...
- 11.7k
10
votes
Accepted
How does this EB F2 x86 instruction work?
from google starmans realm
quoting relevant info
These are also known as SHORT Relative Jumps. Programs using only Relative
Jump instructions can be relocated anywhere in memory without ...
- 16.2k
10
votes
Accepted
How did this 80286 detection code work?
I'll dive into the past and try to give an explanation of the different checks you are observing in your software. I found three references explaining the behaviour (as I hope), which I will reference ...
- 1,964
10
votes
What does 'test al, al' mean?
In x86 assembly, al is the least significant byte of eax register, which is typically used to return values from function calls.
The test al,al is a bitwise AND operation between al and itself.
If ...
- 862
10
votes
Accepted
Do I have to learn computer architecture for underestanding or doing reverse engineering?
The question is too broad, but I'll try to answer and hope that it will help.
It depends on what exactly do you mean by computer architecture and area you applying your reverse engineering skills to.
...
- 8,343
9
votes
Accepted
Why are PUSHF and POPF so slow?
Clever (some would say incomprehensible) misuse of x86 features could do this for you. The loop instruction will decrement the ecx register, jump if it's nonzero, and not modify flags. You can use ...
- 12.9k
9
votes
Accepted
Where ES/GS/FS are pointing to?
On x86 32bit windows the FS segment register points to a structure called the Thread Information Block or the TIB for short. This structure is created by the kernel on thread creation and is used to ...
- 11.7k
9
votes
Import table vs Import Address Table
First, beside “yours” two tables, I introduce a third one, the Import Lookup Table.
Side by side with the Import Address Table, these two tables look like in this simplified picture:
This picture ...
- 1,120
9
votes
Accepted
XMM register instructions and their c equivalents
You likely won't get an exact reproduction because cvtdq2pd takes the lower 64 bits of the second operand but since we're limited to 32 bits because we're using eax here, there are probably better(?) ...
- 684
9
votes
Accepted
What does fs and gs registers provide in Linux?
The gs/fs segment can be used for thread local storage similar to what you have encountered in Windows. Variable specific to a thread such as errno, stack canary etc are usually stored here in Linux.
...
- 2,584
9
votes
Accepted
What's this assembly doing?
This looks like a 32-bit shift right compiler helper. In 16-bit era, 32-bit numbers were represented by a pair of registers, in this case ax:dx. The check for 16 is an optimization: if the shift is ...
- 36.2k
9
votes
Accepted
Correct way to understand local_ in ghidra disassembly
Since local variables are usually placed on the stack in x86 and esp register can change during function execution, it is more convenient to save the value of esp register on function entry and access ...
- 3,369
9
votes
Do I have to learn computer architecture for underestanding or doing reverse engineering?
A solid understanding of the fundamentals of computer architecture is very useful for a Reverse Engineer.
That said - it depends on your target. If you are reverse engineering a Java application or a ...
- 211
8
votes
How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?
i wrote a windows specific answer to a question that was marked as duplicate and closed and the close flag referred to this thread so i post an answer here
os win7 sp1 32 bit machine
kernel dump ...
- 16.2k
Only top scored, non community-wiki answers of a minimum length are eligible