0

I'm trying to analyze one binary protected by HASP. Since it is pretty old binary (2008) I managed to run it in IDA and it unpacked in memory. When I do tracing + take memory snapshot and reanalyze it, the view of functions I get does not make any sense.

enter image description here

How is it possible that instructions are skipped? Am I doing something wrong here?

1

You are looking at 64bit code disassembled as 32bit code.

dec eax
sub esp, 28h

is the byte pattern 48 83 ec 28, which is

sub rsp, 28h

As a rule of thumb, if you see a lot of dec eax out of place, you're wrongly disassembling 64bit as 32bit code.

2
  • I'm running 32 bit binary on win 7 x64. Is that the reason? – Bojan Vukasovic Sep 9 '20 at 14:14
  • btw this on the right side is output from IDA trace, so I guess that it is actually showing what is executed. Probably the problem is that this binary is self-unpacking and then something happens there. – Bojan Vukasovic Sep 9 '20 at 17:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.