Questions tagged [assembly]
A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.
716
questions
0
votes
0answers
24 views
stack explanation from https://revers.engineering/applied-re-the-stack/
I've been reading [1] (By Daax Rynd) to get an understanding the stack and at around the 12th page, I'm a bit stumped by how the value 60 from sub rsp, 60 was arrived at.
[Note, all code and quotes ...
0
votes
0answers
21 views
How to resolve illegal instruction for this ARM stack exploitation?
Summary
I am trying to write a stack overflow exploit for ARM Cortex-A72 running
Raspberry Pi OS (32-bit). Because of my choice of OS, I am restricted to
the ARMv7 (32-bit) instruction set.
I have ...
1
vote
2answers
74 views
is there a tool to decompile old exe to C?
I follow the free software implementation of OpenRCT2 from the beggining (when it was in other repository).
And the first commits are a bunch of C files, these files has a lot of asm blocks of code ...
1
vote
1answer
23 views
what is metaData of assemblies and what is used for
hi there I hope you doing well
lately, I have searched about ildasm and how to protect my DLLs from reverse engineering,
so I found some great open source projects (ConfuseEx..), it works when I tried ...
3
votes
2answers
107 views
Why does the "MOV DWORD PTR ds:0xdeadbeef" instruction dereference the 0xdeadbeef address?
I'm reverse engineering a binary and I'm confused, because my theoretical knowledge is currently clashing with what's actually happening.
I thought that this instruction writes the value 0xdeadbeef ...
1
vote
1answer
95 views
How to import x86asm into Ghidra?
I have some assembly code as a .txt file (i.e. a list of the instructions, stuff like this):
00000003 E8D001 call 0x1d6
00000006 A08000 mov al,[0x80]
00000009 0C00 ...
1
vote
1answer
39 views
How To Access Predefined Class Attributes From IDA Pro After Loading The Binary Without Debugger Attached To Process [closed]
I have this class with constructor offsets and attributes:
public class example
{
// Fields
public float Attribute_1 = 1.5f; // 0x8
public int Attribute_2 = 102 ; // 0xC
// RVA: ...
1
vote
1answer
97 views
A tutorial or docs to unpack a custom packed PE
I am facing an odd situation. I have a licensed game that's doing odd actions on the system. I isolated it as I could and observed the behavior both network and so forth, and I suspect it's a custom-...
0
votes
1answer
66 views
ADDS(operations with S suffix) -Arm
This question was asked before here but in the answers I did get what i was looking for.
Consider this:
ADDS R0 RO R1
As far as I know to update the cpsr flags a subtraction has to be made. So after ...
1
vote
0answers
44 views
failed to trigger packer's loader by overwritting the entry of rela.dyn on aarch64
I have implemented packer of x86_64 shared library.
Briefly, a loader is injected to a shared library, and
the rela.dyn entry is modified such that it points to the address of the loader. Once the ...
1
vote
1answer
53 views
.data segment seems to contain code?
I have recently been trying to improve my skills on reverse engineering. So, I opened C:/Windows/System32/DriverStore/FileRepository/xboxgip.inf_amd64_90ed6b3fdc759a5b/devauthe.sys in IDA. While ...
0
votes
2answers
80 views
What is the data on the start of .rdata segment?
I've been doing some reverse engineering lately trying to improve my skills and came across the following bytes on the start of .rdata segment.
Filename: C:/cygwin64/bin/xkbcomp.exe
Bytes:
70 D3 FD FF ...
2
votes
1answer
92 views
Useless instructions in a compiled getter
This is the second time I see this kind of function today :
.text:00000000000010B0 sub_10B0 proc near ; CODE XREF: sub_1120:loc_1143↓p
.text:00000000000010B0 lea ...
4
votes
1answer
94 views
How to reverse engineer a setjmp/longjmp sequence?
I'm trying to reverse engineer the GNU libc x86 (32 bit) setjmp / longjmp (re a vuln which may allow arbitrary overwrite of the jmp_buf env.
There's a great writeup of the musl setjmp but I can find ...
0
votes
0answers
82 views
Starting out with reverse engineering. What assembly is disassembled code
I am new to reverse engineering and want to analyze my own exe/dll files. I took a look at nasm and masm and so far I have the feeling that this is unnecessary for me to learn in detail because it ...
1
vote
1answer
51 views
How to step into an invoked method from a DotNet DLL in dnSpy?
I've been analyzing a malware written in C# using dnSpy. It loaded a dotnet assembly DLL from its Resources:
I tried stepping into InvokeMember function, but could not go further when hitting this ...
0
votes
1answer
121 views
Translate ASM code x86 32 bits in C
I have a exercise which i can't resolve it, and i need help. If anyone can help me it would be great. I have the next ASM code in x86 32 bits which i need to translate in C language:
Dump of assembler ...
0
votes
1answer
42 views
Branching in arm assembly
This is an example assembly code:
function0()
0x0.mov r0, #1
0x8.mov r1, #20
0x10.mov r2, #6
0x18.cmp r1, #16
0x20.b function1
function1()
0x28.cmp r0, #1
0x30.b functionX
functionX(...
2
votes
1answer
60 views
When would a program normally transfer data between memory and coprocessor?
In the analysis of an ARM binary, when would one normally encounter transfer operations between memory and a coprocessor? These are encoded as the LDC and STC operators.
Would it be common for ...
0
votes
2answers
64 views
Not Understanding the FU540 Boot Process
I'm reading the manual for the SiFive FU540-C000 trying to understand the boot process, and I'm not making sense of the initial steps after power on.
I'm using MSEL = 1111 based on the recommendation ...
1
vote
0answers
56 views
I have a dos file/database that i need to extract into MS Excel or My Sql
I have a dos file/database(decades old) that I need to extract into MS Excel or My SQL.
I am using a MacBook.
The file appears to have no extension.
The file type I can see when I do "get info&...
2
votes
1answer
69 views
What C++ construct could emit such Watcom C++ 10.5 assembler listing?
Based on the assembler listings, a C++ object is locally allocated on the stack without constructing the object in the caller routine and the callee takes the address to the allocated stack space and ...
0
votes
1answer
47 views
How does this function take the argument if its not pushed into the stack?
I dont understand how does the function take the argument without pushing
push ebp
mov ebp, esp
and esp, 0FFFFFFF0h
sub esp, 20h
mov [esp+20h+var_20], offset aEnterX ; "Enter X:"
call _puts
1
vote
3answers
169 views
TEST instruction and ZF flag
In the part 07 of lena151 RE tutorial, we arrive to these instructions:
AL = 0
TEST AL,AL
JNZ ...
And notice:
Because of the JNZ, AL must be different from zero when arriving here to be registered.
...
-1
votes
1answer
56 views
How to find bugs in a modern desktop application with reverse enginnering?
I would like to clarify the context for the question: I have studied different types of exploiting but all the studies I have carried out were with command line programs and with functions that I ...
1
vote
0answers
80 views
Confusing objdump with data as code
I am trying to confuse objdump to solve the first exercise of chapter 6 in Practical Binary Analysis. Admittedly I am super weak with inline assembler but I made a best-effort attempt and tried to get ...
0
votes
0answers
93 views
What kind of code creates this function call pattern?
While using WinDbg: u/uf to disassemble functions in ntoskrnl.exe there are functions that are used in system calls and exception handling that have these weird function call patterns and I can't ...
5
votes
1answer
191 views
Would hiring a RE service be worth it?
Before I clarify my question, I will explain the project I'm working on, and what I've done so far so there will be a better understanding of what I'm trying to do. I'm trying to modify the UI of a ...
2
votes
2answers
179 views
MIPS assembly to C code
I think I'm really brain-dead and am not really sure what to do next, but I am trying to manually convert assembly code to a C program. It's not really working, but I'm not sure what is wrong. I would ...
1
vote
1answer
53 views
Reversing bit rotations
so I have a question regarding the assembly instructions ror and rol:
Is it possible to properly reverse them?
So assuming I have something like
ROR EDX, 0x4
and know the contents of EDX after ...
2
votes
2answers
281 views
Is decompilation significantly more limited when performed on handwritten assembly?
I understand C language decompilers are designed to decompile code produced by a C compiler, and that such decompilers have a lot of limitations and sometimes are actually wrong (in the sense that ...
1
vote
0answers
259 views
C# Console Application can't load file or assembly, but needs a dll which doesn't exists?
I have a strange error. I created for testing purposes a normal Console Application and run my own Tracer which is written with the help of Mono.Cecil on this application. I embedd a Stopwatch at the ...
1
vote
0answers
48 views
RE on firmware images that seem to use weak encryption/obfuscation. Robot vacuum
I have been playing with some robot vacuums that utilize very basic navigation, and I am wanting to play around with my own provisioning along with adding a Rpi to augment features.
These vacuums are ...
0
votes
1answer
76 views
Understanding the basics of Reverse Engineering a segment of code
Currently trying to understand the following code and what it is doing.
mov eax, 1
test eax, eax
jz loc_411503
mov esi, esp
call ds:_kbhit
cmp esi, esp
call sub_411159
test ...
-1
votes
1answer
109 views
what do these assembly code doing?
I tried to reverse engineer an apk app, and it was loading a native code. I have observed that the app was using the native code like this
public static String v = sUQWWyTBEs().toString().substring(32,...
1
vote
1answer
104 views
Can the return value of this function be determined with static analysis?
I have an assignment and i tried solving it. However i can't seem to solve it, despite double checking everything and investing multiple hours.
My task is to reverse engineer the following functions ...
0
votes
0answers
67 views
Assembly to C decompiler
I need an assembly to C decompiler, I tried this one https://onlinedisassembler.com/odaweb/ but my code looks like this:
#include <p16F887.inc>
cblock 0x20
Delay1 ; Assign an ...
1
vote
1answer
91 views
IDA Pro - How to remove multi-line bit definitions for register
I've just started reversing some microcontroller code and have the RAM, ROM, and SFR (Special Function Registers) segments set up. I've selected my processor architecture and it has named most of the ...
1
vote
0answers
57 views
Trying to call the Exit Shellcode in a c program
#include<stdio.h>
#include<stdint.h>
char shellcode[] = "\xb8\x3c\x00\x00\x00"
"\xbf\x14\x00\x00\x00"
"\x0f\x05";
int ...
2
votes
2answers
92 views
Changing value of parameter with gdb
I have a file named exploit.c inside which:
#include <stdbool.h>
#include <stdio.h>
const char y1 = 'a';
const char y2 = 'b';
const char y3 = 'x';
const char y4 = 'y';
const char y5 = 'i';...
0
votes
0answers
28 views
Can't figure out the type of hash
I know that SHA-1 is a cryptographic hash and it takes 20-byte and this is an example of it 64C1F7689B32D9805C5A1D5DABF3EAD31446B80C
The problem is with iirc,
I'm working in a small project, and ...
0
votes
1answer
44 views
troublesome stack frame setup
I have a function with the first few instructions defined as follows:
sub rsp, 0x80
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x58], rsi
mov qword [rbp + 0x50], rbx
mov qword [rbp + 0x70], rcx
mov ...
1
vote
1answer
169 views
GDB inserting breakpoint cause Segmentation Fault
I was trying to play around with gdb, and I'm especially interest in seeing how the Procedural Linkage Table(PLT) and the Global Offset Table (GOT) interact with each other. So I set some breakpoints ...
1
vote
1answer
38 views
Help understanding ARM Cortex-M4 SBC instruction
Page 88 of the ARM Cortex-M4 Generic User Guide says "The SBC instruction subtracts the value of Operand2 from the value in Rn. If the carry flag is CLEAR, the result is reduced by one." Why ...
0
votes
0answers
53 views
Access violation writing location
I am currently playing with C# and detours/trampolines using a library I found here:
https://github.com/xcvd/Detours
I am attempting to hook a known function in a game and then call the original ...
0
votes
1answer
83 views
Do Stack frames grow upwards?
I am currently learning RE and I came upon this piece of code which made me question whether stack frames grow upward:
0x080483f4 <main+0>: push ebp
0x080483f5 <main+1>: mov ...
0
votes
1answer
43 views
Objdump -S without assembly
I compiled my c source code and got an elf.
I use "objdump -Sl" but don't need the assembly instructions.
Is there a way to use objdump without the assembly part (or other tool)?
for example,...
2
votes
1answer
148 views
Help with LDR, LDRD and STR instructions
The Cortex™-M3 Devices Generic User Guide explains the instruction LDRD R8, R9, [R3, #0x20] as "Load R8 from a word 8 bytes above the address in R3, and load R9 from a word 9 bytes above the ...
0
votes
1answer
83 views
Why compiler is doing this?
While I was disassembling my own C code for practice I saw an interesting point which I want to share with you guys and needs to know the answer as I always get from here. Now, the interesting point ...
0
votes
0answers
50 views
Disassembly a win Linux file
I have a file that has a compiled assembly code and being loaded into javascript code for execution.
How can I “inspect” the file? I am aware of tools like immunity debugger or ollydbg but I am not ...