Questions tagged [assembly]
A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.
599
questions
0
votes
0answers
6 views
I cannot access files on my removable drive
I cannot access files on my removable drive but there is a 'readme' txt that says my files are encrypted. files changed type to 'OPQZ'. please advise
0
votes
1answer
37 views
“check:” keyword in Ghidra
I have disassembled the crackme0x06 challenge (http://security.cs.rpi.edu/courses/binexp-spring2015 inside challenges.zip). It's an ELF 32bit unstripped binary. The decompiled C code using Ghidra ...
2
votes
1answer
65 views
Why is there no call to strcpy in assembly?
I try to better understand assembly and currently playing around with some compiled c snippets.
I have the following snippet:
#include <stdio.h>
#include <string.h>
int main() {
char ...
4
votes
1answer
73 views
Is it possible to modify a movss or xmm# in Assembly using Cheat Engine?
Im using cheat engine as a beginner to getting into Disassembly and Hacking, and I want to know how to modify an address/pointer (not really sure how to term it) thats using a movss [...],xmm#?
...
0
votes
1answer
60 views
xor eax,3 why does the input change the way it does?
I am new to reverse engineering and I am trying to figure out exactly what xor is doing in this little program. I know if I put any number other than 0 I get a xor eax,3 so if I put in 1 I get 2 if I ...
0
votes
2answers
94 views
GDB hangs when I try to run and debug a binary
When I type gdb a.out and then run inside the gdb itself I get stuck on the empty line:
jericho-laptop:exploit.education jericho$ gdb a.out
GNU gdb (GDB) 9.1
...
Reading symbols from a.out...
(No ...
4
votes
3answers
217 views
What is the difference between MOV and LEA in example?
Looking at an assembly code snippet I see:
lea rax, [rbp-0x50]
Which tells me that the rax register now points to whatever value is in rbp-hex(50).
Question. Would I achieve the same result doing ...
2
votes
1answer
80 views
Help understanding MOVSXD
I've tried reading the documentation but the functionality of this instruction is still cloudy to me. For an example, I would like to know what is stored in RDX after these instructions:
mov edx, ...
0
votes
1answer
58 views
How to calculate Opcode Length from Ollydbg
Suppose I reverse a dll, and searching for a Function, say for instance Send(), I have reversed the ws2_32.dll now How Can i calculate the number of bytes from there to know that i need 5 bytes of ...
1
vote
1answer
83 views
Adding a static variable to Windows DLL
I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls.
I ...
1
vote
1answer
93 views
Shellcode not working correctly
I wrote a small program in assembly which is supposed to print "AAAA". It works fine when I run it directly, but when I run it as a shellcode in a c program, it doesn't work. Please help.
Here is the ...
1
vote
1answer
163 views
Understanding ghidra disassembly
I'm kind of new to assembly and ghidra as a tool. I have a question about the meaning of this line
Mov dword PTR [ESP] => local_70 , eax
I get we are moving eax into the left side but I'm not ...
0
votes
1answer
40 views
Can relative offsets in instructions like call and jmp change after recompiling the same code, or running it in another computer?
So lets say we want to use some instructions as signature for a malware, and it includes some call instructions or jmp instructions, now as far as i have seen they always contain relative offset as ...
0
votes
0answers
42 views
Performing Buffer overflow in Linux
I have buffer overflow in a program i check(it is an array of pointers, and i can overflow the data in the first pointer), but the data i can write is not on the stack, it is on a space the system ...
1
vote
2answers
119 views
High-level langage decompiler on WIndows
So I have been using Binary ninja and I was wondering if there was any other tool except IDA or any binary ninja plugin that would transform assembly code into high level code, I already tried binja-...
0
votes
2answers
99 views
Byte-patch a JMP
I have an address and I want to byte-patch it because there is a JMP that I want to block. But when I NOP it, the game just crash because it corrupt the function. So, I don't know what to do for block ...
0
votes
0answers
53 views
How to detect the language of an assembly code? How radare does it?
I've opened an executable in Radare2 (on Cutter) and it says that it was written in C language. Is it just a guess or there is a good way to find in which language a binary was written?
5
votes
3answers
482 views
ARMv8 (AArch64, ARM64) opcodes list
I'm sorry for such as questions where answer would seem to be easily searched in google...
Some time ago I have seen table/list of ARMv8 instructions with opcodes and it was perfect, but I lost link. ...
0
votes
1answer
94 views
LDR specifier combination UXTW
Sorry, if this question seems stupid, but I am new in arm64 and next 2 assembly lines seriously damaged my brain:
LDR W0, [X30,W0,UXTW#2]
ADD X30, X30, W0,UXTW
I have readed ...
1
vote
1answer
63 views
Is there a handy assembly to mock app conversion tool?
It might be too silly of a question, but here you go.
Suppose you have some software that contains a tricky nested assembly sequence (like this one) you try to reverse engineer. brain*[pen&paper] ...
0
votes
0answers
61 views
Why does this execve shellcode work with this argv?
I wrote the following program in fasm, and am using Evan's Debugger on Ubuntu to debug it:
format ELF64 executable 3
segment readable executable
entry $
mov rbp, rsp
sub rsp, 32
mov rax, 'this a t'
...
0
votes
0answers
29 views
Reading float value within delphi binary
I have a Delphi program that I am trying to read data from. the data is stored in a TEIDataWindow, this particular snippet of code comes from the update method. the data is presented in the form of an ...
2
votes
2answers
187 views
Static analysis obfuscated code
I'm reversing a code that is heavily obfuscated. It uses opaque predicates, call stack tampering, junk code and control flow flattering.
Call stack tampering uses indirect branches (push register / ...
2
votes
1answer
56 views
Finding the correct input of an executable to print out the flag. IDA 7
I'm trying to understand the behaviour of the code below so I can determine what input will trigger the "YOU DID IT !~!" string (at the end of the program instructions):
.text:00C21034 Buf= byte ptr -...
3
votes
1answer
77 views
CreateTimerQueueTimer arguments differs from WinAPI
I was reading a man page about CreateTimerQueueTimer.
BOOL CreateTimerQueueTimer(
PHANDLE phNewTimer,
HANDLE TimerQueue,
WAITORTIMERCALLBACK Callback,
PVOID ...
2
votes
1answer
111 views
change compare function in assembly and .exe stopped working x64dbg
I'm trying to bypass (crack) a very old software that require license in order to unlock all the features
i was digging in the lines with a little bit of knowledge in assembly
and i found the line ...
2
votes
1answer
170 views
bypass license of very old software, Access violation (C0000005) x32dbg
I'm trying to bypass the license of a very old software that i was using many years ago, now, the company of that software is closed and i can't get a license
so, with a little bit of knowledge in ...
2
votes
1answer
36 views
CMP ecx with DAT_
So I encountered this bit of assembly code:
cmp dword ptr [ECX + 0x24c], DAT_007c6bc0
It's comparing ECX + 0x24c with DAT_007c6bc0. If they are not equal, it will just return from the function.
I ...
3
votes
0answers
54 views
Uniden FW Hacking
I recently purchased a Uniden Radio Scanner (BCD325P2). I looked at the Windows FW Update App in dnSpy, then pulled the FW bin directly.
FCC Parts List gets me R5F5631BCDFP#V0, which appears to be a ...
1
vote
2answers
324 views
Why Windows Defender is not able to get rid of this trojan?
Every time I start my PC, Windows Defender shows a notification saying that the virus Trojan:Win32/Ceprolad.A was deleted, which means indeed that it wasn't, as most antivirus I've tried these days (...
0
votes
1answer
72 views
How to Modify CBZ Branch in ARM64?
If I want after running the CBZ W0, loc_C5C8 command
Run to the ADRP X8,#selRef_curent_version@PAGE command
regardless of the condition (in picture), what should I do?
0
votes
0answers
35 views
is it possible to write the first byte at the entry point of a process dll module?
Hello
so my problem is kind of weird ..
im trying to write memory using this :
WriteProcessMemory(intptr pHandle, intptr lpBaseAddr, byte[] lpBuffer, uint nSize, int lpNbrOfBytesWritten);
have a ...
2
votes
1answer
88 views
What are some useful strategies for understanding undocumented assembly language?
What are some useful strategies for tackling a list of undocumented assembly language instructions? Even as someone who writes assembly code, I find it to be challenging at times to understand someone ...
2
votes
1answer
89 views
How can I objdump the assembler code of dynamically linked functions in a dynamically linked executable?
Compiling a minimal C++ program:
g++ -g -Wall -Wextra -std=c++17 -o prog main.cpp
int main()
{
}
Performing an objdump -C -D prog of all sections I am given the following output:
prog: file ...
0
votes
0answers
44 views
Setting struct according to offset relative to struct base
I would like to know whether it's possible to define a struct according to offsets from base in Hopper.
Assuming there is a register in the assembly code, that I believe it represent the instance ...
0
votes
0answers
68 views
jmp to 4 byte address in shellcode
I'm playing around with the PE header and the Import Address Table. I wrote a dummy program that calls MessageBoxA with some retard parameters. After successfully replacing the MessageBoxA function ...
0
votes
1answer
44 views
OllyDbg: Constant does not fit into operand
I'm trying to assemble this instruction:
I'm not being able to do it..
When I test with MOV AX,55000 I get this error:
I tested before in Cheat Engine, and this is working as AOB injection: MOV AX,#...
3
votes
3answers
214 views
Strange vtable setup in constructor disassembly
In a program I'm trying to recover data structures I've discovered the following strange (ARM) disassembly code:
ctor_1:
ldr r1, =vtable_base
str r1, [r0] ;r0 always contains ...
0
votes
1answer
56 views
Why doesn't alloca_probe follow x64 calling convention?
I was practising reverse engineering on some Windows x64 applications when I came across this function:
call alloca_probe
This alloca_probe function has some strange implementation:
EAX is used as ...
3
votes
3answers
96 views
Stack-Smashing Protection error message
Here is a very ugly C program:
#include <stdio.h>
#include <string.h>
int main(int argc, char *argv[])
{
char buffer[10];
memcpy(buffer,argv[1],strlen(argv[1]));
printf("%...
1
vote
1answer
107 views
Entry point of a program
im new to assembly and reverse engineering, i have a question regarding to how the address work.
I examined the entry point of a program using varies PE tools, the result is 0x00043b33, but when i ...
0
votes
2answers
112 views
IDA Pro, replace exit() with continue;
This is the function:
loc_BA060: ; status
xor edi, edi
call _exit
How can one replace exit with continue?
0
votes
1answer
111 views
What is, and why, “byte[ ] + number” in this IDA pseudocode?
This is a decompile of an .so file, so it originated from C or C++. Can you kindly try to explain to me what this does?
How would one rewrite this into readable code? I don't mind any programming ...
0
votes
0answers
65 views
Why is U-Boot changing this bit marked as “DO NOT CHANGE”?
While reverse engineering very early hardware initialization code of an old S3C6410 based tablet, I came across an instruction that changes a bit that the user manual (relevant info on pg. 3-50) ...
0
votes
2answers
63 views
How to Calculate ds Pointer
How do I calculate the location of the string in this sample located at offset 0x1CAD8?
The instruction at 0x140001A97 in the sample is:
0x140001A97 F2 0F1005 39C60100 movsd xmm0, qword [rip + ...
0
votes
2answers
49 views
Error when changing push 0 to push function
Hi I am sort of new to ida pro even though I've used a lot but when I push a function where a 0 used to be it gives me sp-analysis failure
I've searched for a fix for a while to no avail
help would ...
0
votes
1answer
89 views
What do square brackets do in IDA's pseudocode representation?
I've been a bit stumped recently on my decomp work. I've not dealt with C in depth nor have I dealt with IDA's pseudocode system very much at all. I understand asm, but because of how IDA merges ...
1
vote
2answers
572 views
Local variables and addition not shown in Ghidra
I am having some troubles with my learning of Assembly and reverse engineering. Specifically, I am learning about Global vs Local variables. For Global variables I have managed to get insights in ...
2
votes
1answer
941 views
Simple C program disassembled with Ghidra
I am trying to figure out what is going on with my simple example programs, when I disassemble them with Ghidra. I am not sure whether this is some strange Ghidra behaviour or something that is set by ...
-1
votes
1answer
186 views
What is the following assembly code doing? [closed]
str fp,[sp, -4]!
add fp, sp, #0
sub sp, sp, #12
str r0, [fp, #-8]
str r1 [fp, #-12]
L5:
ldr r3, [fp, #-8]
ldrb r3, [r3]
cmp r3, #0
beq .L2
ldr r3, [fp, #-12]
ldrb r3, [r3]
cmp r3, #0
beq .L2
ldr r3, [...
