opcode

What is the purpose of the 40h REX opcode in ASM x64?

故事扮演 提交于 2019-12-05 12:32:23
I've been trying to understand the purpose of the 0x40 REX opcode for ASM x64 instructions. Like for instance, in this function prologue from Kernel32.dll: As you see they use push rbx as: 40 53 push rbx But using just the 53h opcode (without the prefix) also produces the same result: According to this site , the layout for the REX prefix is as follows: So 40h opcode seems to be not doing anything. Can someone explain its purpose? Nathan Fellman the 04xh bytes (i.e. 040h , 041h ... 04fh ) are indeed REX bytes. Each bit in the lower nibble has a meaning, as you listed in your question. The

Accessing memory with Java

余生颓废 提交于 2019-12-05 07:55:06
I have a program loaded in the memory. Now I want to access the memory directly and change the OPCODE and DATA in the memory for that program. For this I need to write a Java program. Can you please tell me if this is feasible? If yes, please let me know how to write such a program. Thanks in advance! Little Child Java is not designed for this. The main aim of Java is to let the JVM manage the memory for you. Thus, your programs are sandboxed. However, there seems to be a backdoor in HotSpot JVM: Java was initially designed as a safe, managed environment. Nevertheless, Java HotSpot VM contains

Status of JSR/RET in JVM spec

为君一笑 提交于 2019-12-05 02:39:30
There are some parts of the JVM specification which suggest that the operations JSR (Jump SubRoutine) , JSR_W (Jump SubRoutine Wide) and RET (RETurn from subroutine) may be used only up to class file version 50.0 (JDK 1.6): 3.13 Compiling Finally (This section assumes a compiler generates class files with version number 50.0 or below, so that the jsr instruction may be used. See also §4.10.2.5 .) And later: 4.10.2.5. Exceptions and finally To implement the try - finally construct, a compiler for the Java programming language that generates class files with version number 50.0 or below may use

Using Br_S OpCode to point to next instruction using Reflection.Emit.Label

别来无恙 提交于 2019-12-04 05:12:19
问题 I am experimenting with parsing IL in order to emit a method. I have gotten the IL code of a method in a string[] where each string is an IL instruction. I am looping over this array and adding OpCodes using an ILGenerator: foreach (string ins in instructions) //string representations of IL { string opCode = ins.Split(':').ElementAt(1); // other conditions omitted if (opCode.Contains("br.s")) { Label targetInstruction = ilGenerator.DefineLabel(); ilGenerator.MarkLabel(targetInstruction);

In IL code, why is there not a nop opcode in a given situation? Why is there a br.s opcode in a given situation?

不羁岁月 提交于 2019-12-04 05:07:57
Suppose I have the following code: public class Class1 { private Class2 obj; public void MethodA() { var class2 = new Class2(); class2.PropertyI = 2; obj = MethodB(class2); } public Class2 MethodB(Class2 class2) { return class2; } } public class Class2 { public int PropertyI { get; set; } } The generated IL code from compiling with Visual Studio 2010 as a .NET 2.0 assembly is the following: .method public hidebysig instance void MethodA() cil managed { .maxstack 3 .locals init ( [0] class ClassLibrary1.Class2 class2) L_0000: nop L_0001: newobj instance void ClassLibrary1.Class2::.ctor() L_0006

Unhandled dwarf expression

牧云@^-^@ 提交于 2019-12-04 00:18:15
Can anybody tell me what exactly the following segmentation fault means? Unhandled dwarf expression opcode 0x93 Its on solaris 10 i386. Any advice appreciated. This sort of error message ("unhandled dwarf expression") can occur if your version of GDB is too old (older than the compiler that generated the code). Try installing the latest version of gdb and running that. This may not immediately help, but "dwarf" probably refers to the DWARF Debugging Standard . The wikipedia entry for DWARF indicates that the file format contains "byte-coded instructions for simple, special-purpose finite state

Does [ebp*2] reference DS or SS segment?

|▌冷眼眸甩不掉的悲伤 提交于 2019-12-03 23:58:01
IDM says the memory op uses SS segment if EBP is used as base register. As a result, [ebp + esi] and [esi + ebp] references SS and DS segments, respectively. See NASM's doc: 3.3 Effective Address . In the above same section, NASM mentioned how to generate shorter machine code by replacing [eax*2] with [eax+eax] . However, NASM also generates [ebp + ebp] for [ebp*2] (i.e. no base register). I suspect [ebp+ebp] references SS segment, and [ebp*2] references DS segment. I asked NASM this question. They think [ebp*2] and [ebp+ebp] are the same, but it doesn't make sense to me. Obviously, [ebp+ebp]

Optimize APC Caching

…衆ロ難τιáo~ 提交于 2019-12-03 02:02:51
问题 here is a link to how my APC is running : [removed] As you can see, it fills up pretty quickly and my Cache Full Count goes over 1000 sometimes My website uses Wordpress. I notice that every time I make a new post or edit a post, 2 things happen. 1) APC Memory "USED" resets 2) I get a whole lot of Fragments I've tried giving more Memory to APC (512 mb) but then it crashes sometimes, it seems 384 is best. I also have a Cron job that restarts apache, clearing all APC of fragments and used

Intel x86 Opcode Reference?

血红的双手。 提交于 2019-12-03 01:10:35
问题 What is a relatively quick and easy method of looking up what an arbitrary opcode means (say, 0xC8 ) in x86? The Intel Software Developer's manual isn't very fun to search through... 回答1: Check this very complete table of x86 opcodes on x86asm.net. Just CTRL+F and you're done! Be sure to read the correct line tho, as C8 for example may appear in several locations. 回答2: Here is a pretty nice visual. Doesn't go into much detail, but if you just need to look up a hex value really quick, this

Optimize APC Caching

吃可爱长大的小学妹 提交于 2019-12-02 17:11:29
here is a link to how my APC is running : [removed] As you can see, it fills up pretty quickly and my Cache Full Count goes over 1000 sometimes My website uses Wordpress. I notice that every time I make a new post or edit a post, 2 things happen. 1) APC Memory "USED" resets 2) I get a whole lot of Fragments I've tried giving more Memory to APC (512 mb) but then it crashes sometimes, it seems 384 is best. I also have a Cron job that restarts apache, clearing all APC of fragments and used memory, every 4 hours. Again, my apache crashes if APC is running for a long period of time, I think due to