x86-64 | 易学教程

linux assembly: how to call syscall?

阅读更多关于 linux assembly: how to call syscall?

I want to call a syscall in assembly. The problem is I can't mov ecx,rsp . rsp is 64-bit register, ecx is a 32-bit register. I want to pass the buffer addr as a parameter of this syscall. What can I do? Thanks. section .data s0: db "Largest basic function number supported:%s\n",0 s0len: equ $-s0 section .text global main extern write main: sub rsp, 16 xor eax, eax cpuid mov [rsp], ebx mov [rsp+4], edx mov [rsp+8], ecx mov [rsp+12], word 0x0 mov eax, 4 mov ebx, 1 mov ecx, rsp mov edx, 4 int 80h mov eax, 4 mov ebx, 1 mov ecx, s0 mov edx, s0len int 80h mov eax, 1 int 80h To make a system call in

Get installed software list using C#

阅读更多关于 Get installed software list using C#

问题 I try to get a list of installed application keys: RegistryKey RegKeyUninstallList = Registry.LocalMachine; string strUninstallList = @"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"; string[] test = RegKeyUninstallList.OpenSubKey(strUninstallList).GetSubKeyNames(); I get only the Keys from: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall But I need also the Keys from: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall My program

Parsing Call and Ret with ptrace.

阅读更多关于 Parsing Call and Ret with ptrace.

问题 I try to parse all the Calls and Rets from an executable with ptrace. Conforming the the x64opcode, I found opcodes for Calls: 0xe8 and for Rets: 0xc3, 0xc2, 0xca, 0xcb . Since I parsed them I found more Rets than Calls. There is the program I trace: void func() { write(1, "i", 1); } int main(int ac) { func(); return(0); } There is my tracer: int tracer(t_info *info) { int status; long ptr; int ret = 0; int call = 0; waitpid(info->pid, &status, 0); while (WIFSTOPPED(status)) { ptrace(PTRACE

Writing x86_64 linux kernel module in assembler

阅读更多关于 Writing x86_64 linux kernel module in assembler

问题 I try write simple kernel module (v3.6) in nasm, but insmod say me: $ sudo insmod ./hello.ko insmod: ERROR: could not insert module ./hello.ko: Invalid module format $ echo $? 1 I compile my code with: $ nasm -f elf64 -o hello.m hello.asm $ ld -m elf_x86_64 -r -o hello.ko hello.m and my module code: section .modinfo __mod_kernel_version db "kernel_version=3.6.8", 0 __mod_license db "license=GPL", 0 __mod_author db "author=actics", 0 __mod_description db "description=hello world module in nasm

Disassemble into x86_64 on OSX10.6 (But with _Intel_ Syntax)

阅读更多关于 Disassemble into x86_64 on OSX10.6 (But with _Intel_ Syntax)

问题 I know of otool -tv , but I would much rather use the Intel syntax rather than AT&Ts, mainly to easily follow along in a book and not have to look over thousands of % 's and $ 's. I'd also appreciate any tips to where I might find gdb 's config file. EDIT: I forgot: I'm running a 64bit processor, but was wondering if it would be possible to also disassemble into 32 bit assembly? Not only that, but does OSX's gdb 's list command work differently than the standard GNU version? Thanks so much!

Can rip be used with another register with RIP-relative addressing?

阅读更多关于 Can rip be used with another register with RIP-relative addressing?

I'm familiar with memory references of this form: XXX ptr [base + index * size + displacement] where XXX is some size (byte/word/dword/etc), both base and index are registers, size is a small power of two, and displacement is a signed value. amd64 introduced rip-relative addressing. As I understand it, I should be able to use rip as a base register. However, when I try this with clang-900.0.39.2: mov r8b, byte ptr [rip + rdi * 1 + Lsomething] I get: error: invalid base+index expression mov r8b, byte ptr [rip + rdi * 1 + Lsomething] Is it impossible to use an index register when using rip as

x86-64: canonical addresses and actual available range

阅读更多关于 x86-64: canonical addresses and actual available range

Intel and AMD documentation says that for 64 bit mode only 48 bits are actually available for virtual addresses, and bits from 48 to 63 must replicate bit 47 (sign-extension). As far as I know, all current CPU are implemented this way, but nothing (in theory) forbids to extend the available space in future implementations (and this won't break the binary compatibility). Is there a standard way to programatically determine the number of meaningful bits? (i.e. some specific CPUID, as happens for physical addresses). I know that in practice 48 bits are far more than enough for any reasonable

Why is x86 ugly? Why is it considered inferior when compared to others? [closed]

阅读更多关于 Why is x86 ugly? Why is it considered inferior when compared to others? [closed]

问题 As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance. Closed 7 years ago . Recently I've been reading some SO archives and encountered statements against the x86 architecture. Why do we need different CPU

Switch from 32bit mode to 64 bit (long mode) on 64bit linux

阅读更多关于 Switch from 32bit mode to 64 bit (long mode) on 64bit linux

My program is in 32bit mode running on x86_64 CPU (64bit OS, ubuntu 8.04). Is it possible to switch to 64bit mode (long mode) in user mode temporarily? If so, how? Background story: I'm writing a library linked with 32bit mode program, so it must be 32bit mode at start. However, I'd like to use faster x86_64 intructions for better performance. So I want to switch to 64bit mode do some pure computation (no OS interaction; no need 64bit addressing) and come back to 32bit before returning to caller. I found there are some related but different questions. For example, run 32 bit code in 64 bit

rdtsc timing for a measuring a function

阅读更多关于 rdtsc timing for a measuring a function

问题 I want to time a function call with rdtsc. So I measured it in two ways as follows. Call it in a loop. Aggregate each rdtsc difference within the loop and divide by number of calls. (Let's say this is N) Call it in a loop. Get the rdtsc difference of the loop itself and divide by N. But I see couple of inconsistent behaviors. When I increase N the times get reduced rather monotonically in both method 1 and 2. For method 2 it is understandable in that it would amortize the loop control