Reverse Engineering Chat

User 834861965 changed username from enTE_16 to enE_16

What do you have in mind so far? And what is your threat model? There are numerous ways to protect your software.

Buy a protection software! Don't hold your breath, nobody has made un-reversable software yet, but the commercial stuff will get you to a good enough point

Please speak in english

I was waiting for more info. If it's super sensible and there is some Budget, looking into dongle solutions might be an option

Try hack / crack Oscilloscopes Spectrum Analyzers Any help is Welcome from this group

Some companies work on that there’re many

Wha you are doing is not a simple as merge & go, so the answer isnt simple either. The lack of details of your project makes it impossible to answer

could you further explain your question, please? in general, an instruction can have multiple reasons to crash, for this instruction, you could, e.g., observe a #GP (resulting in a SIGSEGV) when the instruction itself is on an inaccessible memory page. besides that, a lock prefix could also lead to an #UD exception for nop.

I think it might be an invalid pointer, rax+rax results in a number much larger than inside the memory space

do you have a case where that leads to a crash?:o because the instruction should not crash with an invalid address in rax afaik

Either this is completely new to me, or... Since when does nop have params?

i didnt think it did either

Wondering the same

Look up "multibyte NOP". It is a somewhat obscure feature of x86 processors.

Oh, that's interesting. I'm surprised that I also never read before how one byte nops are in the inner workings (xchg eax, eax)

User 🥀💞 has 1/3 warnings; be careful! Reason: irrelevant

Then I can imagine if the multibyte nop is not supported.

New FedBan Fed: Libra's Empire FedAdmin: ❤🦦 User: Ruy Benton User ID: 411393219 Reason: illegal activity

The well-known opcode 90 hex (short encoding for xchg eax, eax) is a very special case because operations over 32-bit registers in x86-64 clear the upper half of the matching 64-bit destination register (i.e., xchg eax, eax would zero-extend eax into rax, but in fact it is regarded as a nop). Opcode 87 C0 is a larger encoding for xchg eax, eax which will clear the upper half of rax in 64-bit mode. For example, xchg edi, edi would do the same on rdi. These instructions require a prefix to promote the operand size to 64-bit and thus avoid the zero extension.

Hey guys, does anyone know if it’s possible on xdbg to make the stack view static? It annoys me to be looking at an address expecting a value to pop in there after steps and the stack just changes position and I need to again find the address. I have tried to go to options and custom menus and apply Freeze Stack but it didn’t work.