News for hackers. Stuff that matters.

A comment on Reversing the Petya ransomware with constraint solvers. Parent comment

Re:Reversing the Petya ransomware with constraint solvers by a1k0n on Sunday April 24, 2016 @10:22AM (#11559767)
You don't even need to be in protected mode to use 32-bit registers. You can sort of bounce in and out just enough to use them with the 66 prefix. I used to do that but it's been so long I forgot how.
[ Parent | on HN ]
Re:Reversing the Petya ransomware with constraint solvers by commentereleven on Sunday April 24, 2016 @11:08AM (#11559891)
I think you're talking about unreal mode.

http://wiki.osdev.org/Unreal_Mode

[ Parent | on HN ]
Re:Reversing the Petya ransomware with constraint solvers by a1k0n on Monday April 25, 2016 @07:53PM (#11568332)
That's right, I was, but on further reflection you don't need to do anything special in this case since it's just doing 32 bit math, not 32 bit addressing. EAX/EBX/etc should just work in real mode IIRC.
[ Parent | on HN ]