-3

A lot of the texts I’ve looked at seems to be based on 32 bit processors. How different is reversing 32 bit and 64 bit? Is it easy to pick up the 64 bit stuff if I learn the 32 bit stuff?

closed as too broad by Steffen Ullrich, Anders, ISMSDEV, Jacco, Shurmajee Nov 20 '17 at 9:18

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

1

I'm going to assume by x86 and x64 you mean i386 and amd64, respectively.

Exploitation

This is a very complex question. For x86 at least, the general behavior of 32 bit and 64 bit processors are quite similar. The basics are the same (i.e. ROP is not a significantly different beast on one or the other). The primary difference is that 64 bit processors usually have some newer instructions, and of course have registers which are twice as large. You can still use 32 bit registers on a 64 bit processor (for example mov eax,32 works on both processors, whereas mov rax,32 only works on 64 bit). Many times you'll see 64 bit programs which use all kinds of instructions and registers, and even something like mov al,32 is perfectly valid. A useful explaination of that is given here.

There are a few subtle differences when it comes to low-level behavior. A 64 bit processor runs in long mode, whereas a 32 bit processor is limited to protected mode. This results in things such as memory segmentation being unavailable on the former. This doesn't usually matter when it comes to basic application exploitation though.

Operating system behavior may also be different. There are a few different syscalls, with different behaviors, on 32 bit Linux compared to 64 bit Linux. A vulnerability in 32 bit-specific code may not be present on 64 bit Linux (for example, a vulnerability in the vm86() syscall). Likewise, system libraries may behave slightly differently between the two. There are also different ways of invoking syscalls. On 32 bit systems, you use an interrupt, called as int 0x80. On 64 bit systems, there is the faster syscall instruction, which raises an exception rather than an interrupt.

Reverse engineering

You also ask if RE is much different (RE is separate from exploitation). Yes, it is a bit different, but only in that there are new instructions and registers. A disassembler will be able to show you what is what. There will be a lot of familiar sights, even familiar if all you've ever used is an old 8086 (since ax and al are still perfectly valid registers). There is some not-so-obvious differences however, like an action on a 32 bit register clearing the upper half of the equivalent 64 bit register.

Additionally, there are a few more general purpose registers. This means you may see instructions like xchg rax,r12. They do have 32 bit versions though despite only being added on 64 bit systems, where they are named things like r12d.

Disassembly of a 64 bit hello world:

hello64:     file format elf64-x86-64

Disassembly of section .text:
0000000000400080 <_start>:
  400080:   b8 01 00 00 00          mov    eax,0x1
  400085:   bf 01 00 00 00          mov    edi,0x1
  40008a:   48 8d 34 25 a4 00 40    lea    rsi,ds:0x4000a4
  400091:   00 
  400092:   ba 0e 00 00 00          mov    edx,0xe
  400097:   0f 05                   syscall 
  400099:   b8 3c 00 00 00          mov    eax,0x3c
  40009e:   31 ff                   xor    edi,edi
  4000a0:   0f 05                   syscall 

Contents of section .rodata:
 4000a4 48656c6c 6f2c2077 6f726c64 210a      Hello, world!.  

Disassembly of a 32 bit hello world:

hello32:     file format elf32-i386

Disassembly of section .text:
08048060 <_start>:
 8048060:   b8 04 00 00 00          mov    eax,0x4
 8048065:   bf 01 00 00 00          mov    edi,0x1
 804806a:   8d 35 80 80 04 08       lea    esi,ds:0x8048080
 8048070:   ba 0e 00 00 00          mov    edx,0xe
 8048075:   cd 80                   int    0x80
 8048077:   b8 01 00 00 00          mov    eax,0x1
 804807c:   31 ff                   xor    edi,edi
 804807e:   cd 80                   int    0x80

Contents of section .rodata:
 8048080 48656c6c 6f2c2077 6f726c64 210a      Hello, world!.  

Takeaway

If you already know exploitation or reverse engineering, migrating to a 64 bit system will easy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.