Questions tagged [asm]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
48 views

Isolate the call to a function

Is it possible to call a function of a binary and obtain its result (without calling other functions), to isolate; are there any tools to do this?
1
vote
1answer
109 views

Reverse getline(cin, text)

I'm trying to solve a crackme that was made in C++, and I was able to "recreate" a function call, through the library calls the program made. Here's the piece of code that I'm trying to reverse: ...
1
vote
1answer
46 views

Cant see mnemonics on ollydbg 2.01

Im reverse engineering an exe, but i get locked on a specific location, i suppose this is a jump to the same location, when im on this "obfuscated" addresses i cant see any instruction, but the ...
0
votes
0answers
25 views

Go back to the original entry point after executing the instructions in the newly added segment- PE32+, C++

I am learning PE32+ (64 bit) files. I have added a new section to the PE32+ file and made the new section as the entry point. Some simple instructions are added in the new segment. Now I want to go to ...
2
votes
0answers
40 views

How to prepend offset to smart names?

So I'm trying to reassemble an PE to ELF so I can debug it with rr. However masm report duplicate symbol errors. It's because it doesn't enforce scope to it's variables so smart names cause conflicts....
0
votes
1answer
76 views

I'm trying to understand the SEH mechanism

I'm trying to understand the mechanism of SEH (Structured Exception Handling). I understood how it was recorded and saved in FS: [0] on the previous three instructions. But why add interrupt 1 (step ...
0
votes
1answer
30 views

getting ecx register from caller

i need to get the ecx register from the function that is calling my function (__fastcall convention) i've been trying to get ecx by adding 0x8 to ebp since from my understanding ebp + 0x4 = return ...
1
vote
2answers
209 views

Permanently load a DLL to an executable

With the help of IDA I was able to hard-code changes into an executable by simply replacing some bytes with a hex editor, what I did was to change the resolution to something larger. I've learnt that ...
1
vote
1answer
81 views

How are __argc and __wargv globals exported from a 64-bit PE file compiled with Visual Studio?

I need to inject my code into a 64-bit process. I'm wondering, how can I access __argc and __wargv global variables once in the injected process? Are they always present at a static/preset address?
1
vote
1answer
140 views

Inversion of input parameters in ASM

the code is: .global asm0 asm0: push ebp mov ebp,esp mov eax,DWORD PTR [ebp+0x8] mov ebx,DWORD PTR [ebp+0xc] mov eax,ebx mov esp,ebp pop ebp The entry is: asm0(0x2a,...
4
votes
2answers
147 views

Disassemble ELF - PC is set to 0?

I tried to disassemble a ELF file which is a shared object file executed on armv7a (Android). I saw a strange block. It seems that the PC, program counter register, is set to 0. Did I miss something ...
3
votes
1answer
166 views

Using ECX after being modified by a function call

I have a peculiar snippet of code which I cannot wrap my head around: push 0xC ; arg1 for call mov ecx,edi ; set the this pointer for call call sdk.100039F0 ; make the call (...
2
votes
2answers
563 views

ASM code hook/patching with trampoline function

I am stuck on making (my little self-task for learning) that thing: Basically it should be something like Themida or VMProtect (do mutation, virtualization, etc.), but in my case, i want to take ASM ...
1
vote
0answers
288 views

Fixing '__asm' in pseudocode in IDA PRO (inconsistent fpu stack error)

So I was doing some REing in IDA, changed a function parameter type and suddenly my stack pointer messes up (1025B361: inconsistent fpu stack). Does anyone know what to look for here or how to fix it? ...
2
votes
0answers
185 views

What tool is able to analyze/decompile asm execution trace?

I got a trace of the execution from x64dbg and I need to analyze it. The problem is that the trace is quite large and there are quite big chunks of the code that repeat (I assume they are loops). I ...
5
votes
1answer
589 views

How to Make .text Section in Assembly Writeable for Win7-64 EXE

I have a basic XOR decoder that functions perfectly in Linux, but when I try to move it over to an exe in windows, it fails. I am leaving this question open for historical reference since the issue ...
1
vote
1answer
457 views

Debugging EXE File in Windbg and How to set Breakpoints in Assembly

I am trying to set a breakpoint (created in assembly) and step into an EXE file line by line to watch registers and memory behavior. I have done this easily with gdb under Linux like this. gdb -q ./...
1
vote
1answer
72 views

Why the assembly instructions also have an adresses ?

I am wondering why the assembly instructions also have an adresses (When I open Olly and debug any program I see them there next to the op codes) ? Or this is the address where the result of the ...
2
votes
1answer
116 views

What is the encoding format for unconditional Jumps on SPARC/SPARC64?

I am trying to figure out the encoding for unconditional JMPs on SPARC, i.e the JMP. After disassembling a few binaries. In my IDA disassembly the encoding for JMP %g1 is: 81 c0 40 00 Digging ...