Questions tagged [x86]
A family of instruction set architectures originally based on the Intel 8086 CPU that functions with a very wide array of operating systems, including Windows, MacOS X, Linux, BSD, and Solaris.
495 questions
0
votes
0
answers
27
views
Annotating I/O address space addresses and bits
I'm trying to reverse engineer an old embedded system that has a NEC v40 on it, which is very similar to an 80186 (more like 80188) I guess. As a member of the x86 family, it has a separate I/O memory ...
- 101
0
votes
0
answers
59
views
Nvidia DLSS data extraction - IDAPro
I have a display from TurzX where I can display CPU, GPU, etc info. I want to show the DLSS version and preset in the display. The reason for this is I just want to disable the in-game DLSS overlay ...
- 101
0
votes
1
answer
201
views
How can I compile an EXE with GCC such that the .idata and .text sections are merged together?
Given this classic helloworld.c example,
#include <stdio.h>
int main()
{
printf("Hello world!\n");
}
Under normal circumstances, a compiled EXE file consists of several sections, ...
- 1
1
vote
1
answer
132
views
Attaching into an x86 process in windbg
How can I attach into an x86 process from windbg?
currently I am waiting for the process to load then I am breaking into wow64cpu!KiFastSystemCall to switch into x86 context and only then put bp to ...
- 13
0
votes
0
answers
94
views
x86 When we use fastcall, why does caller clean stack?
In fastcall functions, the callee cleans the stack and returns the value in eax. This completes the function call.And actually we put first two arguments in ecx and edx, still caller cleans stack 8 ...
- 1
1
vote
1
answer
138
views
Static offsets Vs. Loaded Offsets
I am developing an application integrity concept tool that performs integrity checks based on a comparison of Windows syscalls in a static PE file on disk to those loaded. Can I match the offset of ...
- 11
1
vote
0
answers
98
views
Freeware x86 decompilers for Windows with debug? [closed]
I'm searching for a software that is capable of decompiling x86 code in C-like code and run a debug session within it with the possibility to see the content of the variables.
That above was a quick ...
- 111
1
vote
0
answers
204
views
Analyse a statically linked binary and extract syscall from it using angr
How to extract all syscalls from analysing a statically linked binary.
I have a script written using angr(Latest - v9.2.78) but when I start my script I get few syscalls and the analysis is like hung ...
- 11
0
votes
0
answers
177
views
from executable to assembly source code?
let's say i have an ".exe program" and i want to disassemble it and get "disassembled code" .
my question is => can i maintain and organize that "disassembled code" ...
- 23
2
votes
1
answer
245
views
What triggers RIP_EVENT?
The documentation for the Windows Debugger API mentions a debug event called RIP_EVENT. It offers little explanation of what a RIP_EVENT is, only stating that the structure "contains the error ...
- 137
2
votes
1
answer
224
views
What is the meaning of 32 bit offset in x86 16 bit jump
Consider x86 16 bit mode instruction:
$ echo 66 EA 66 55 44 33 22 11 | xxd -p -r | ndisasm -b16 -
00000000 66EA665544332211 jmp dword 0x1122:0x33445566
I thought 16 bit code jumps work by combining ...
- 185
4
votes
0
answers
162
views
Reverse Engineering Technique "Step by Step"
Sometimes, I see how someone puts on the github, some reverse engineering project for some famous game.
By researching these projects - I come to the conclusion that:
people just took the code from ...
user42316
2
votes
1
answer
90
views
why some functions push data before the prologue
i am a newbie in the world of RE ,
i start to explorer a main entry of a classic game from 90's
and i start to see something confuse me as a newbie
this main entry function start with pushing stuff to ...
- 23
2
votes
1
answer
191
views
Ghidra Shows Structure Strange
I am new to assembly. When I was disassembling some code, I encounter some strange instruction here. The instruction shows that (RBP + -0x40) is equal to local_48, however at the beginning of the code,...
- 23
3
votes
1
answer
151
views
Unable to determine what esp is pointing to
I'm going through the book Practical Malware Analysis (specifically, Lab07-03) and I've been stuck on a rather simple problem. I've divided the code section of main() into three parts to ease my ...
1
vote
1
answer
166
views
Unable to understand x86 instruction(s)
Recently I have been given a set of assembly instructions which I must learn to understand. I know an extremely basic level of x86 assembly but I'm starting to come across more nuances that are very ...
- 13
4
votes
1
answer
332
views
How to force IDA to show size of pointer dereference?
IDA's default x86 assembly syntax is not very clear about pointer dereferences. One of these is dereferencing the memory operand, and one is simply moving the address to the register:
mov ecx, ...
2
votes
1
answer
1k
views
What is a "far call" in an x86 or x86_64 cpu
I do not understand the usefulness of the "far call" instruction in a 86 CPU.
On a 32 bits CPU for example each process has an addressing space of 4Gb (0x00000000 to 0xFFFFFFFF).
There can ...
- 787
0
votes
1
answer
87
views
Trying to understand this interrupted (?) function prologue
Note: The uninterrupted disassembly is at the bottom
Hey, I'm looking at the the assembly and I'm trying to reverse engineer the function
Here, it seems like we are saving the previous rbp. Though, it ...
- 101
3
votes
1
answer
970
views
Locating function parameters in x32dbg
I'm a bit rusty and trying to analyze a piece of code in x32dbg. As follows:
0627BF49 | 8B0B | mov ecx,dword ptr ds:[ebx] |
0627BF4B | 8B85 CCF5FFFF ...
2
votes
0
answers
98
views
jump to invalid address when emulating
I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect ...
- 41
4
votes
2
answers
2k
views
Disassemble bios code
I have a Gigabyte G41MT-S2PT motherboard with Intel core 2 Pentium processor installed on it for test.I decided to disassemble its bios code.Its bios produced by Award Software International and its ...
- 41
6
votes
4
answers
4k
views
Do I have to learn computer architecture for underestanding or doing reverse engineering?
I am completely noob in reverse engineering, and I've just started to learn it.
Now I have this question in my mind, that does a reverse engineer use any computer architecture knowledge for doing his/...
- 63
0
votes
1
answer
108
views
Displacement size (disp_size) of x86 instructions
Given the opcode 80 3d 1d b0 09 00 00.
The corresponding capstone instruction is
<CsInsn 0x66a4 [803d1db0090000]: cmp byte ptr [rip + 0x9b01d], 0>
and has the following properties (c_i being ...
- 1,570
1
vote
1
answer
189
views
What does the code do?
Challenge #64
What does this code do?
An array of array[x][y] form is accessed here. Try to determine the dimensions of the array, at least partially, by finding y.
_array$ = 8
_x$ = 12
_y$ = 16
_f ...
