Questions tagged [assembly]
A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.
635
questions
0
votes
1answer
86 views
How can I modify these?
So I'm onto something interesting, I asked the less direct way but failed to meet the requirements in terms of explanation
So here it is, how would I go about editing these the same way I would go ...
0
votes
0answers
41 views
Change value of memory in a debugger?
So I got this app loaded in x64, there is a function, let's say
"HeatGainedPerShot", which is basically the value which an object gains everytime it fires,
Such a value would normally exist ...
0
votes
0answers
90 views
Reversing a bootloader code (MIPS)
I'm trying to reverse a bootloader code extracted from raw memory dump of data modem. I think I extracted it correctly.
Bootloader size 32768 bytes. Device use BCM3382 CPU (MIPS32) big-endian(?), eCos ...
2
votes
0answers
65 views
Devirtualization
I've recently become pretty fascinated with virtualization and retrieving original code from a randomly generated byte code, such as protectors like VMProtect/etc. But I can not get a grasp on how it ...
0
votes
1answer
55 views
how could i follow a system call from a dll -> kernel driver syscall
basically i would like to follow (system calls / internal calls) that basically lands in the kernel i would like for example to debug a specific dll ex : ntdll.dll and follow it to (NtXXX) function ...
0
votes
0answers
48 views
strange results with IDA (some function different Pseudo Code)
After show the pseudo code in IDA I see different results:
The function 4436C0 show different pseudo code.
For example:
result = sub_4376C0("vvcbb3.wav",v8,0);
and
result = sub_4376C0((int)...
1
vote
1answer
95 views
How do disassemblers work?
I have 2 questions regarding this, but feel free to elaborate more if you want to, I'm really interested in this topic:
Do they really just read byte by byte until they get a valid instruction? How ...
0
votes
2answers
48 views
Where do arguments 5 and 6 go in this Microsoft x64 function call?
I'm disassembling a working-as-expected compiled C program (MS/Windows x64, MinGW gcc 10.1.0). In the main function, I have the following call which passes 6 arguments to the function DotProduct:
...
/...
0
votes
0answers
23 views
Trace files on disc to addresses in memory
Right now I am trying to dynamically create new NPCs for a multiplayer mod I am working on for a video game. The enemies are tied to level data and will always be the same enemies when you begin the ...
2
votes
1answer
103 views
dll injection (assembly code)
I need some tip to undrestand what is the best way to execute external code from DLL or command line.
I like to add the force feedback support to different games that not support it.
I can write a DLL ...
1
vote
0answers
39 views
Unable to start file “..\ntoskrnl.exe” in ollydbg [What can I do?]
Ollydbg isn't allowing me to open the executable ntoskrnl. I think im missing something but I don't know what it is (Windows 7, Ollydbg10.0,200)
1
vote
0answers
25 views
What numeric properties are used in this Unsigned Integer (64bit) -> Floating Vector (128bit) conversion?
Recently I came across the following set of vector instructions:
movq xmm0, rcx
punpckldq xmm0, 0x4530000043300000
subpd xmm0, 0x4330000000000000
haddpd xmm0, xmm0
The only sensible ...
0
votes
1answer
38 views
Disassemble scanf storage register
I am trying to understand scanf function a have 3 question regarding it.
this is c file:
#include <stdio.h>
#include <stdlib.h>
int main(){
int x;
printf("Enter X:\n");
scanf(...
0
votes
1answer
124 views
Extracting Assembly line code from an executable in Ghidra
I'm using Ghidra to reverse engineer an EXE file and save its assembly line code only. Does Ghidra have any function or scripts which exports the assembly line code? I don't want to manually copy the ...
1
vote
1answer
36 views
Are there some assemblers or disassemblers that allow dw/defw etc directives with specified endianness?
I've been working with reverse engineering tape image and disk image formats and the files and filesystems they contain.
It struck me that sometimes there are data fields that are not in the same ...
0
votes
1answer
287 views
What does 'test al, al' mean?
I'm trying to reverse engineer a program and i found the following instruction:
test al, al
je label
what does these two instruction do ? Can someone explain please ?
2
votes
2answers
194 views
Dealing with obfuscated PUSH PUSH RET instructions
I wanted to run an app on a VM but there are PUSH PUSH RETs stopping me from looking at their anti VM code. There is a messagebox when I run it on a VM. I set a breakpoint at MessageBoxA and it gets ...
0
votes
1answer
37 views
Disassembly to reassembly - 80960: Invalid Scale Factor
I'm disassembling a game which runs on an Intel i960 processor. My disassembly is at a point I would like to try to reassemble it from an IDA Pro generated ASM file. The ASM file needs slight ...
0
votes
1answer
43 views
dereferencing structure members
I am reading a book on reversing and I am curious about one of the assembly snippet i have read in it.
There is a simple disassembly of the function RtlNumberGenericTableElements and it looks like ...
-1
votes
1answer
49 views
Can I traverse the entire WORD array of 4 elements with QWORD PTR?
I want to change values of all WORD array of 4 elements by one step using QWORD PTR
mov ebx, OFFSET arr ; arr is WORD of 1,2,3,4
xor qword ptr [ebx], 8000800080008000h ; I get error of constant ...
1
vote
1answer
57 views
How's this code able to make use of the stack?
I am trying to reverse engineer software to extend its functionality as expected of me. So I don't have the source code with me. Anyways, I am used to seeing codes that start like the one below, and ...
-2
votes
1answer
136 views
Debug and crack .NET executable PE
First of all, i'm trying to learn reverse engineering for testing my codes and that's all and i'm not stupid enough to do illegal things with my knowledge so please don't give me legal advises.
I'm ...
1
vote
1answer
37 views
IDA Pro: How to change segment register value
For a specific Android library that I have loaded into IDA, I want to switch the THUMB/ARM mode to ARM, no matter the consequences that this is going to have to the code. Is there a way to efficiently ...
0
votes
1answer
65 views
Why there are only 8 hexa memory digits while my RAM is 16G
I'm totally new to reverse engineering, when I start debugging my c program with radare2, and start showing assembly, I found that addresses are only 8 hexa digits, which means 16^8 = 4294967296 ...
0
votes
0answers
11 views
Tool for navigating native assembler code and memory hex for interpreted languages like VBA
Complete newbie to this area and I have limited experience writing code in low level languages so I'm not familiar with the debugging techniques, but bear with me:). I'm trying to understand the ...
0
votes
0answers
43 views
Shellcode doesn't match OllyDbg
I have created a simple program that is susceptible to a buffer overflow using strcat(buffer1, buffer2). I have successfully overflowed into the EIP and have placed an address located in NTDLL which ...
0
votes
0answers
52 views
Force gcc to use more complex instructions
I am reverse engineering a piece of assembly. I am trying to write the equivalent code in C, however, when I compile my code, gcc prefers to use simple instructions instead of the complex ones that ...
0
votes
1answer
50 views
Problem with set of instructions in dissasembly
first of all I'm new to reverse engineering so here's a noob question hahaha, I'm trying to solve a crackme and I found this set of instructions:
Why would it move the content of eax into cd:...
1
vote
0answers
46 views
What to do with a text file of disassembly code and binaries?
I am fairly new to software reverse engineering and I'd like to know how proceed with analyzing a program if I have a text file of disassembly code and a bin file of binary data. I understand ...
1
vote
2answers
95 views
How to decompile “call eax” in IDA Pro?
I know that there is a similar question but the answers didn't provide any fix for that problem.
I am decompiling a .dll file, and I have found out the subroutine that I needed, but it's throwing a "...
1
vote
1answer
108 views
Ghidra scripting get information from decompile window
I am using Ghidra and when clicking for example in the decompile window on a specific raw, it change the cursor in the assembly window to the exact location in the assembly. Is there any option to do ...
0
votes
1answer
55 views
Need some help and advices as regards as reverse engineering IoT devices
Hi everyone, I saw this video on youtube as regards as reversing IPTV cameras and finding security vulnerabilities: Black Hat 2013 - Exploiting Network Surveillance Cameras Like a Hollywood Hacker
I ...
-1
votes
1answer
48 views
Automatic decompilation from Assembly x86
Is there a tool to automatic decompile an assembly x86 code?
What I need is a tool where I simply paste my code and it returns C code.
Thanks
1
vote
2answers
48 views
What is the equivalent of the dollar sign from jmp $+1 in GAS syntax?
I have an asm program made with intel syntax. In this program, I am using this syntax jz $+1 from INTEL (+gcc), that means that I jump into the jz instruction (which is 2 bytes). I jump 1 byte further ...
2
votes
1answer
45 views
Way to check if two assembly programs (one possibly compiled with optimizations) come from the same C source code?
Let's suppose I have two programs in assembly code. And I want to check if they both came from the same source code, but one was compiled with optimizations. Is there a tool that can do this? Or some ...
0
votes
1answer
132 views
x86 ELF - argc location on stack?
According to the System V ABI for x86, esp should be pointing at argc when entering main. However, I've seen many binaries where argc instead is retrieved from esp + 4, or esp + 8. Is this correct, or ...
1
vote
2answers
68 views
increment a register which has maximal value?
I am looking at some assembly code and can't get my head around it. The code below is shown in IDA. My question revolves on what happens in the loop.
Let me explain what I exactly don't understand in ...
2
votes
1answer
71 views
Find password in a c compiled binary file
I'm currently learning to do some basic reverse engineering of binary files using Cutter. The program i'm struggling on test if the password entered as argument is correct, if not, return an error ...
0
votes
1answer
71 views
“check:” keyword in Ghidra
I have disassembled the crackme0x06 challenge (http://security.cs.rpi.edu/courses/binexp-spring2015 inside challenges.zip). It's an ELF 32bit unstripped binary. The decompiled C code using Ghidra ...
2
votes
1answer
92 views
Why is there no call to strcpy in assembly?
I try to better understand assembly and currently playing around with some compiled c snippets.
I have the following snippet:
#include <stdio.h>
#include <string.h>
int main() {
char ...
4
votes
1answer
174 views
Is it possible to modify a movss or xmm# in Assembly using Cheat Engine?
Im using cheat engine as a beginner to getting into Disassembly and Hacking, and I want to know how to modify an address/pointer (not really sure how to term it) thats using a movss [...],xmm#?
...
0
votes
1answer
70 views
xor eax,3 why does the input change the way it does?
I am new to reverse engineering and I am trying to figure out exactly what xor is doing in this little program. I know if I put any number other than 0 I get a xor eax,3 so if I put in 1 I get 2 if I ...
1
vote
3answers
901 views
GDB hangs when I try to run and debug a binary
When I type gdb a.out and then run inside the gdb itself I get stuck on the empty line:
jericho-laptop:exploit.education jericho$ gdb a.out
GNU gdb (GDB) 9.1
...
Reading symbols from a.out...
(No ...
4
votes
3answers
668 views
What is the difference between MOV and LEA in example?
Looking at an assembly code snippet I see:
lea rax, [rbp-0x50]
Which tells me that the rax register now points to whatever value is in rbp-hex(50).
Question. Would I achieve the same result doing ...
2
votes
1answer
159 views
Help understanding MOVSXD
I've tried reading the documentation but the functionality of this instruction is still cloudy to me. For an example, I would like to know what is stored in RDX after these instructions:
mov edx, ...
0
votes
1answer
96 views
How to calculate Opcode Length from Ollydbg
Suppose I reverse a dll, and searching for a Function, say for instance Send(), I have reversed the ws2_32.dll now How Can i calculate the number of bytes from there to know that i need 5 bytes of ...
1
vote
1answer
115 views
Adding a static variable to Windows DLL
I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls.
I ...
1
vote
1answer
104 views
Shellcode not working correctly
I wrote a small program in assembly which is supposed to print "AAAA". It works fine when I run it directly, but when I run it as a shellcode in a c program, it doesn't work. Please help.
Here is the ...
1
vote
1answer
277 views
Understanding ghidra disassembly
I'm kind of new to assembly and ghidra as a tool. I have a question about the meaning of this line
Mov dword PTR [ESP] => local_70 , eax
I get we are moving eax into the left side but I'm not ...
0
votes
1answer
66 views
Can relative offsets in instructions like call and jmp change after recompiling the same code, or running it in another computer?
So let's say we want to use some instructions as signature for a malware, and it includes some call instructions or jmp instructions. Now, as far as I have seen, they always contain relative offsets ...
