This post is by a banned member (s0cialw4ste) - Unhide
OP 06 February, 2022 - 04:27 PM
(This post was last modified: 06 February, 2022 - 06:42 PM by s0cialw4ste. Edited 2 times in total.)
Reply
I have this project that I'm working on for a while now, and it was working just fine before I switched from releasing an x86 version to an x64 one.
This is the line of code where the first error appeared:
```CPP
ReadProcessMemory(a.hProcess, LPCVOID(b->Ebx + 8), LPVOID(&c), 4, 0);
```
I don't understand assembly but when the Error appeared at `b->Ebx` I changed it to `b->Rbx`. and it compiled and run but it didn't do the job it was supposed to do.
Am I using the wrong register?
**After a little bit of debugging, I found that i have a read access violation at the last line of this piece of code**
```
pe_dos_h = PIMAGE_DOS_HEADER(pe_image);
pe_nt_h = PIMAGE_NT_HEADERS(DWORD(pe_image) + pe_dos_h->e_lfanew);
//error when trying to assign a value or access the signature in nt-headers
//ERROR: read access violation
IMAGE_NT_HEADERS* pe_nt_h->Signature == IMAGE_NT_SIGNATURE;//0x00004550-PE00
```
The pe_image is raw data copied from a PE(.exe) file. Is the difference is in handling x86 PE image vs x64 one?
This is a simplified version of the code. If you think the problem is out of the scope of this piece of code let me know.
This post is by a banned member (SHA512) - Unhide
07 February, 2022 - 10:42 PM
Reply
Well x86 stems from the early intel i8086 series chips (look em up, really neat), and they are 32 bits.
x64 is just 64 bits. its weird like that
x86 -> 32bits, named this way because of the intel series of chips
x64 -> 64bits, named this way because of amds stuff im pretty sure
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
as for your registers,
its fairly standard for computers to work in chunks of bits called words.
a word is just how many bits a computer can work with on its databus.
so it can be anything from 1 bit, to bazillion bits, as long as the computer supports it on its hardware level.
normally, when we use "words" for x86 assembly, we mean 16 bits.
so 1 word -> 16 bits, or 2 bytes.
these 1 word registers are called:
AX, BX, CX, DX, ...
for 32 bit registers, or x86 registers, they are called
EAX, EBX, ECX, EDX, ...
the E stands for extended
for 64 bit registers, or x64, we have
RAX, RBX, RCX, RDX, ...
im not sure what the R stands for and im too lazy to find out honestly
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
everything above this line can be applied to anything that uses x86 assembly, they're pretty standard
DO NOTE*** this is for x86 assembly, and theres sooo many different versions of assembly. assembly is just a hardware-specific abstraction of the instructions the cpu works on. it changes per cpu, since they have different instructions that make em run
i highly highly recommend looking at the hardware-level of this too, its amazing. just google thigns like "i8086 microarchitecture" and see a new world of technology open up to you
so normally issues with x64 and x86 dont really happen much, but when working in lower levels it will yes.
This post is by a banned member (s0cialw4ste) - Unhide
OP 07 February, 2022 - 11:01 PM
Reply
(07 February, 2022 - 10:42 PM)SHA512 Wrote: Show MoreWell x86 stems from the early intel i8086 series chips (look em up, really neat), and they are 32 bits.
x64 is just 64 bits. its weird like that
x86 -> 32bits, named this way because of the intel series of chips
x64 -> 64bits, named this way because of amds stuff im pretty sure
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
as for your registers,
its fairly standard for computers to work in chunks of bits called words.
a word is just how many bits a computer can work with on its databus.
so it can be anything from 1 bit, to bazillion bits, as long as the computer supports it on its hardware level.
normally, when we use "words" for x86 assembly, we mean 16 bits.
so 1 word -> 16 bits, or 2 bytes.
these 1 word registers are called:
AX, BX, CX, DX, ...
for 32 bit registers, or x86 registers, they are called
EAX, EBX, ECX, EDX, ...
the E stands for extended
for 64 bit registers, or x64, we have
RAX, RBX, RCX, RDX, ...
im not sure what the R stands for and im too lazy to find out honestly
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
everything above this line can be applied to anything that uses x86 assembly, they're pretty standard
DO NOTE*** this is for x86 assembly, and theres sooo many different versions of assembly. assembly is just a hardware-specific abstraction of the instructions the cpu works on. it changes per cpu, since they have different instructions that make em run
i highly highly recommend looking at the hardware-level of this too, its amazing. just google thigns like "i8086 microarchitecture" and see a new world of technology open up to you
so normally issues with x64 and x86 dont really happen much, but when working in lower levels it will yes.
thanks for the detailed answer. now I have a better understanding.
This post is by a banned member (SHA512) - Unhide
07 February, 2022 - 11:21 PM
Reply
(07 February, 2022 - 11:01 PM)s0cialw4ste Wrote: Show More (07 February, 2022 - 10:42 PM)SHA512 Wrote: Show MoreWell x86 stems from the early intel i8086 series chips (look em up, really neat), and they are 32 bits.
x64 is just 64 bits. its weird like that
x86 -> 32bits, named this way because of the intel series of chips
x64 -> 64bits, named this way because of amds stuff im pretty sure
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
as for your registers,
its fairly standard for computers to work in chunks of bits called words.
a word is just how many bits a computer can work with on its databus.
so it can be anything from 1 bit, to bazillion bits, as long as the computer supports it on its hardware level.
normally, when we use "words" for x86 assembly, we mean 16 bits.
so 1 word -> 16 bits, or 2 bytes.
these 1 word registers are called:
AX, BX, CX, DX, ...
for 32 bit registers, or x86 registers, they are called
EAX, EBX, ECX, EDX, ...
the E stands for extended
for 64 bit registers, or x64, we have
RAX, RBX, RCX, RDX, ...
im not sure what the R stands for and im too lazy to find out honestly
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
everything above this line can be applied to anything that uses x86 assembly, they're pretty standard
DO NOTE*** this is for x86 assembly, and theres sooo many different versions of assembly. assembly is just a hardware-specific abstraction of the instructions the cpu works on. it changes per cpu, since they have different instructions that make em run
i highly highly recommend looking at the hardware-level of this too, its amazing. just google thigns like "i8086 microarchitecture" and see a new world of technology open up to you
so normally issues with x64 and x86 dont really happen much, but when working in lower levels it will yes.
thanks for the detailed answer. now I have a better understanding.
no problem
|