Questions tagged [assembly]

A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.

Filter by
Sorted by
Tagged with
0 votes
0 answers
15 views

X32dbg Stepping through assembly, seems to get stuck on one line and not progress forward, even though the application continues to progress forward

I'm using x32dbg. Stepping through assembly, I get to the following instructions: '''76B7CC12 | 8B4C24 54 | mov ecx,dword ptr ss:[esp+54] |''' If I continue to step through ...
1 vote
1 answer
38 views

STATUS_PRIVILEGED_INSTRUCTION 0xc0000096 from kernel mode code?

Running a kernel driver I wrote. The driver includes: mov rax, cr0 btr rax, 10h mov cr0, rax to clear WP bit in cr0. Curiously the last instruction faults and causes a bluescreen, ...
2 votes
1 answer
58 views

Is there any way to understand if a raw binary firmware is Cortex-M or not?

I have a list of firmwares, and I should filter just the Cortex-M type. Is there any automated way that I can distinguish them from other ARM firmwares? I have some ideas like Interrupt vector Table (...
0 votes
0 answers
34 views

How to find the fifth function argument on stack in windbg?

I know that in x64, the first 4 arguments are passed by RCX, RDX, r8, r9. The rest arguments are pushed on stack. In x64, rsp serves as base pointer(prolog) and frame pointer(epilog) and save value ...
0 votes
1 answer
47 views

How do i loop this CreateThread call in Assembly to get 4 threads instead of only one?

Knowledge in C++ Assembly and some reverse engineering experience
0 votes
0 answers
30 views

Tuning motor temperature

I have a DC motor, running in two modes, slow and fast. I will need to run the motor in FAST mode only. The motor is already running for 10 years. The motor experiences variable load. According to the ...
0 votes
1 answer
51 views

Reversing Games like Manfred dis

I've looked at as many resources on Manfred and Manfred's work I've watched the DEFCON 25 Live talk about what he hacked. Here I've also looked, listened and read the dark net diaries Part One - ...
0 votes
1 answer
29 views

PowerPC disassembly with libopcodes

I want to disassemble Wii game executable binaries in C, which use the broadway microprocessor and unfortunately the only disassembler I am aware that I can use is libopcodes. I am following this ...
1 vote
0 answers
66 views

Assemby reverse engineering

I'm new to assembly and need some help understanding what this program does. This program takes a username and serial. If the combination is correct, it prints the magic words. I need to write a ...
  • 11
1 vote
0 answers
36 views

​Why output is disabled in console when using int3?

​I am using NASM(2.15) assembler to generate code. But I am unable to figure out why it does not show output in the console(windows system) when using int3 - software breakpoint, it only shows output ...
  • 301
0 votes
1 answer
130 views

Crackme assistance - unknown function [closed]

i have a problem about a crackme that my friend sent me for a bet. I solved most of it but i am stuck with this function. I can't even understand what the function is trying to do. Please help. images ...
  • 1
6 votes
4 answers
3k views

Do I have to learn computer architecture for underestanding or doing reverse engineering?

I am completely noob in reverse engineering, and I've just started to learn it. Now I have this question in my mind, that does a reverse engineer use any computer architecture knowledge for doing his/...
1 vote
2 answers
171 views

What does MOV RAX,qword ptr FS:[0x28] mean?

I'm trying to understand what MOV RAX,qword ptr FS:[0x28] means. I get that FS:[0x28] is a stack canary. If my understanding is correct the data from RAX gets copied by MOV. Then there's a comma which ...
0 votes
1 answer
39 views

Displacement size (disp_size) of x86 instructions

Given the opcode 80 3d 1d b0 09 00 00. The corresponding capstone instruction is <CsInsn 0x66a4 [803d1db0090000]: cmp byte ptr [rip + 0x9b01d], 0> and has the following properties (c_i being ...
  • 1,456
0 votes
1 answer
99 views

Missing mnemonics '??' in Ghidra Assembly Code

I was just trying to google and search for "??" Ghidra with no luck. I am trying to understand what the following questions mean in this Binary (meant for SuperH2 SH-2 processor) which is ...
1 vote
1 answer
78 views

What is j__ftol2_sse_excpt in IDA?

I was inspecting the c-pseudocode for a PE executable in IDA. I found some function called j__ftol2_sse_excpt() When I open that function I see that the function is calling another function named ...
1 vote
1 answer
65 views

Why is JMP ESP required in buffer overflow?

I was reading this article by Hackers Grimoire on Windows buffer overflow attacks. The article made sense, except for the part where the author searched for a DLL (.dll) file which contained a JMP ESP ...
3 votes
1 answer
70 views

What is the outcome of mov on non bracket memory locations?

I am having problems distinguishing whether the address is loaded or the content from the address. Please help me clarify. 1. mov [rsp+78h+arg_0], rsi 2. mov rsi, cs:qword_1F39B60 3. mov [...
  • 35
0 votes
1 answer
72 views

What is libm_sse2_sin_precise() and how to find it's parameters in IDA?

I'm new to reverse engineering with IDA. I've found libm_sse2_sin_precise while inspecting c-pseudocode for some Win32 executable. I tried clicking that function but the executable requires the DLLs. ...
  • 1
3 votes
0 answers
252 views

Lifting x86 machine code to LLVM IR

I would like to translate a simple x86_64 machine code into LLVM IR, which can be later analyzed. For my particular use case, I need to be able to work with just instructions and opcodes directly, and ...
  • 31
1 vote
0 answers
59 views

What change to the source code would produce an LT compare rather than an OLT compare in MIPS assembly?

I need some help reverse engineering a function in MIPS assembly. It was compiled for the PlayStation 2's EmotionEngine CPU. My goal is to produce a matching decomp of the function; it is the proof-of-...
  • 11
0 votes
1 answer
78 views

Hex editing an IP address of a different length

I am performing some Windows malware research on a rogue AV software called SpySheriff (password: infected). I want to edit the IP address within the PE (.exe) file to change it to my honeypot IP ...
2 votes
1 answer
69 views

Mov instruction from a pointed location at the beginning of a program

I am trying to learn how to read assembly code. So far I have understood the basic instructions. Now I am trying to see if I can understand a dissassembly from a linked executable. So this is an ...
  • 143
2 votes
1 answer
163 views

Understanding disassembly information from Visual Studio's dumpbin and GNU's objdump

I usually write my code on Windows, and there are two different types of development environments, each providing their own tools to view the assembly code of an object file(*.obj) or executable (*....
  • 143
1 vote
1 answer
188 views

Help with Ghidra and rewriting assembly

I'm learning reversing and for that I use Ghidra. There is program I'm trying to modify so I can recompile it and make it work. I have a code that ghidra decompile like this: data=function(4) Going ...
1 vote
1 answer
78 views

C instruction causing an address shift

I am trying to recreate a segment of assembly back into the C code. Below is the progress I've made so far, but I'm getting stumped on a specific section. 00000000000010049 <mysteryFunc>: ...
0 votes
1 answer
392 views

How to get Assembly source from Bin file?

I have a binary file which is coded in assembly x86 and compiled with nasm. I used command nasm file.asm -f bin -o file.bin to compile it with nasm. I deleted the source code from disk long time ago, ...
0 votes
1 answer
82 views

Crackmes challenge not validating all answers

I am playing with this crackme. The executable takes a numerical input (e.g., 123) and adds all the numbers. The total must be 50. However, I noticed that not all inputs adding up to 50 are validated. ...
0 votes
0 answers
68 views

x64dbg placing a on write breakpoint on a dynamic allocated address

I am currently trying to reverse the registration scheme of a crackme. I found the jump instruction that decides if the title of the program says “registered” or “unregistered” by simply searching for ...
0 votes
1 answer
465 views

What is xmmword in IDA Pro?

Probably a silly question. What's the xmmword means in IDA Pro?
0 votes
1 answer
224 views

IDA - What LOC means in assembly?

I have this piece of assembly: .text:0041B322 xor eax, eax .text:0041B324 mov al, byte ptr [ebp+v13] .text:0041B327 cmp eax, 1 .text:0041B32A jz loc_41B37D .text:0041B330 xor eax, ...
0 votes
0 answers
65 views

How to see where the heap is in IDA and how to see the segments for a process using non-source debugging

As in the title. I may be wrong about this but when using non-source debugging, all data coming from outside the source seems to be named debugxxx in the segments tab. .Rodata should be marked as ...
  • 115
0 votes
1 answer
185 views

What's DD ? In IDA Pro

I'm new to reverse engineering with IDA. If dd is short for data, double-word, is a 32-bit value. It shows ? How do I identify the value stored in dword_140007674?
  • 1
1 vote
1 answer
81 views

IDA API: obtain operand size prefix (x64)

I am trying to tell apart the following two instructions: 8D 02 lea eax, [rdx] // auxfix = 0x1810 67 8D 02 lea eax, [edx] // auxfix = 0x810 The only difference is in the insn_t....
1 vote
1 answer
122 views

How to locate memory address in register $esp

000011d9 <main>: 11d9: 8d 4c 24 04 lea 0x4(%esp),%ecx 11dd: 83 e4 f0 and $0xfffffff0,%esp 11e0: ff 71 fc push -0x4(%ecx) 11e3: ...
1 vote
2 answers
146 views

What arguments are passed into a CALL instruction?

While reverse enginnering a simple C program for training, I asked myself what was the point of those lines : LAB_001006b5 XREF[1]: ...
  • 23
1 vote
1 answer
118 views

How to interpret memory dumps?

I'm pretty new to reverse engineering, and I decided to pick up https://microcorruption.com/ CTF to understand a bit more. The following code is from the tutorial section. In a disassembled file, we ...
1 vote
1 answer
129 views

How to use SHL/SAL, LEA and Add for arithmetic operations

I'm having problem computing the following arithmetic questions using SHL/SAL, LEA and ADD, and hoping someone can help explain or find the best ways to apply those: Multiply a variable by 24 ...
0 votes
1 answer
278 views

What is the meaning of jmp dword ptr off_XXXXXXXX + 8 in IDA?

What is the meaning of this kind of jmp instruction in x86 assembly in IDA? Does it mean that we should jump to the address [6CA2E9B0] + 8 or [6CA2E9B0+8]? When I follow that off_XXX, I get to the ...
  • 1
0 votes
0 answers
59 views

Which encryption returns 192 hash value it means 96 in bytes?

I am reversing an APK and there is a signature that needs to be found. The function from where the signature is generated is present in the .so file. I did small debugging. While doing it, the ...
1 vote
1 answer
66 views

ARM/THUMB assembly mismatch between binaries causes crash

I am trying to play around with an app for Android and every time I try to call a function (lua_gettop() from the Lua 5.1 library) from the app's address space, it hits me with ILL_ILLOPC. I made sure ...
  • 11
0 votes
0 answers
41 views

stack explanation from https://revers.engineering/applied-re-the-stack/

I've been reading [1] (By Daax Rynd) to get an understanding the stack and at around the 12th page, I'm a bit stumped by how the value 60 from sub rsp, 60 was arrived at. [Note, all code and quotes ...
  • 135
0 votes
0 answers
208 views

How to resolve illegal instruction for this ARM stack exploitation?

Summary I am trying to write a stack overflow exploit for ARM Cortex-A72 running Raspberry Pi OS (32-bit). Because of my choice of OS, I am restricted to the ARMv7 (32-bit) instruction set. I have ...
1 vote
2 answers
323 views

is there a tool to decompile old exe to C?

I follow the free software implementation of OpenRCT2 from the beggining (when it was in other repository). And the first commits are a bunch of C files, these files has a lot of asm blocks of code ...
1 vote
1 answer
38 views

what is metaData of assemblies and what is used for

hi there I hope you doing well lately, I have searched about ildasm and how to protect my DLLs from reverse engineering, so I found some great open source projects (ConfuseEx..), it works when I tried ...
3 votes
2 answers
382 views

Why does the "MOV DWORD PTR ds:0xdeadbeef" instruction dereference the 0xdeadbeef address?

I'm reverse engineering a binary and I'm confused, because my theoretical knowledge is currently clashing with what's actually happening. I thought that this instruction writes the value 0xdeadbeef ...
1 vote
1 answer
334 views

How to import x86asm into Ghidra?

I have some assembly code as a .txt file (i.e. a list of the instructions, stuff like this): 00000003 E8D001 call 0x1d6 00000006 A08000 mov al,[0x80] 00000009 0C00 ...
1 vote
1 answer
53 views

How To Access Predefined Class Attributes From IDA Pro After Loading The Binary Without Debugger Attached To Process [closed]

I have this class with constructor offsets and attributes: public class example { // Fields public float Attribute_1 = 1.5f; // 0x8 public int Attribute_2 = 102 ; // 0xC // RVA: ...
  • 21
1 vote
1 answer
161 views

A tutorial or docs to unpack a custom packed PE

I am facing an odd situation. I have a licensed game that's doing odd actions on the system. I isolated it as I could and observed the behavior both network and so forth, and I suspect it's a custom-...
  • 11
0 votes
1 answer
96 views

ADDS(operations with S suffix) -Arm

This question was asked before here but in the answers I did get what i was looking for. Consider this: ADDS R0 RO R1 As far as I know to update the cpsr flags a subtraction has to be made. So after ...
  • 144

1
2 3 4 5
15