A lot of the texts I’ve looked at seems to be based on 32 bit processors. How different is reversing 32 bit and 64 bit? Is it easy to pick up the 64 bit stuff if I learn the 32 bit stuff?
closed as too broad by Steffen Ullrich, Anders, ISMSDEV, Jacco, Shurmajee Nov 20 '17 at 9:18
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
I'm going to assume by x86 and x64 you mean i386 and amd64, respectively.
This is a very complex question. For x86 at least, the general behavior of 32 bit and 64 bit processors are quite similar. The basics are the same (i.e. ROP is not a significantly different beast on one or the other). The primary difference is that 64 bit processors usually have some newer instructions, and of course have registers which are twice as large. You can still use 32 bit registers on a 64 bit processor (for example
mov eax,32 works on both processors, whereas
mov rax,32 only works on 64 bit). Many times you'll see 64 bit programs which use all kinds of instructions and registers, and even something like
mov al,32 is perfectly valid. A useful explaination of that is given here.
There are a few subtle differences when it comes to low-level behavior. A 64 bit processor runs in long mode, whereas a 32 bit processor is limited to protected mode. This results in things such as memory segmentation being unavailable on the former. This doesn't usually matter when it comes to basic application exploitation though.
Operating system behavior may also be different. There are a few different syscalls, with different behaviors, on 32 bit Linux compared to 64 bit Linux. A vulnerability in 32 bit-specific code may not be present on 64 bit Linux (for example, a vulnerability in the
vm86() syscall). Likewise, system libraries may behave slightly differently between the two. There are also different ways of invoking syscalls. On 32 bit systems, you use an interrupt, called as
int 0x80. On 64 bit systems, there is the faster
syscall instruction, which raises an exception rather than an interrupt.
You also ask if RE is much different (RE is separate from exploitation). Yes, it is a bit different, but only in that there are new instructions and registers. A disassembler will be able to show you what is what. There will be a lot of familiar sights, even familiar if all you've ever used is an old 8086 (since
al are still perfectly valid registers). There is some not-so-obvious differences however, like an action on a 32 bit register clearing the upper half of the equivalent 64 bit register.
Additionally, there are a few more general purpose registers. This means you may see instructions like
xchg rax,r12. They do have 32 bit versions though despite only being added on 64 bit systems, where they are named things like
Disassembly of a 64 bit hello world:
hello64: file format elf64-x86-64 Disassembly of section .text: 0000000000400080 <_start>: 400080: b8 01 00 00 00 mov eax,0x1 400085: bf 01 00 00 00 mov edi,0x1 40008a: 48 8d 34 25 a4 00 40 lea rsi,ds:0x4000a4 400091: 00 400092: ba 0e 00 00 00 mov edx,0xe 400097: 0f 05 syscall 400099: b8 3c 00 00 00 mov eax,0x3c 40009e: 31 ff xor edi,edi 4000a0: 0f 05 syscall Contents of section .rodata: 4000a4 48656c6c 6f2c2077 6f726c64 210a Hello, world!.
Disassembly of a 32 bit hello world:
hello32: file format elf32-i386 Disassembly of section .text: 08048060 <_start>: 8048060: b8 04 00 00 00 mov eax,0x4 8048065: bf 01 00 00 00 mov edi,0x1 804806a: 8d 35 80 80 04 08 lea esi,ds:0x8048080 8048070: ba 0e 00 00 00 mov edx,0xe 8048075: cd 80 int 0x80 8048077: b8 01 00 00 00 mov eax,0x1 804807c: 31 ff xor edi,edi 804807e: cd 80 int 0x80 Contents of section .rodata: 8048080 48656c6c 6f2c2077 6f726c64 210a Hello, world!.
If you already know exploitation or reverse engineering, migrating to a 64 bit system will easy.