Questions tagged [assembly]

A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.

Filter by
Sorted by
Tagged with
-1
votes
0answers
63 views

ASSEMBLY LANGUAGE [closed]

why does this code not run: GetMax movea.l #$10000,a0 ;point a0 to records movea.l a0,a3 ;init return pointer clr.b d0 ;d0 holds the max mark ...
1
vote
1answer
63 views

How do you recommend going for applying minor changes in an executable through a dll?

My choice of words in the title might be poor, I apologize: english is not my primary language and I have no idea how to word it better. I have a game executable to which I applied several changes, ...
1
vote
1answer
58 views

Why is the offset 16 bits?

I was told that segment:offset pairs were used to represent 20 bits. The segment is 4 bit shifted, and the value plus the offset becomes the physical address. I don't have to worry anymore at 32-bit ...
0
votes
2answers
107 views

how to use class member function defined in a exe within a dll

I have an executable (.exe) containing some classes and functions definition and plan on using those functions from within a DLL, although I know to call a regular C style function using calling ...
0
votes
0answers
49 views

Reverse Engineer Slack Workspace

Is there any Slack workspace for Reverse Engineer experts? I wanna to communicating other people who work in this issue. I am thankful if you know this workspace and invite me.
0
votes
2answers
74 views

find cheat engine pointers in ghidra

I find a pointer of my health so a function would have made the pointer and put the health in it (tell me if I'm wrong) how do I look for the function?
1
vote
2answers
39 views

How to extract port number from shellcode

I saw this shellcode and when they use the connect function they pass the port number 4444: set_address: push byte 0x05 ; retry counter push 0x0100007F ; host 127.0.0.1 push ...
1
vote
1answer
75 views

Help understanding x64 TEST instruction

I have read that TEST does a bitwise and on the two arguments. I have also read that jz and je are both equivalent, and jump if the zero flag is set. So here's the problem I'm struggling with. ...
1
vote
1answer
44 views

Where are the intel manual x86-16?

I was studying the code for x86-16 operating systems(como DOS),with a desassembler, but I can't find the intel manual on the intel website: Searching on google, only unofficial sources. Perhaps the ...
0
votes
2answers
65 views

ASM Debuggers that visualize the stack (beginner friendly)

(Cross-posted from Stack Overflow) Are there any debuggers that constantly show a visual of the stack and where everything is within it? For example, taking some random image: I use gdb for most ...
0
votes
1answer
27 views

How to calculate value inside stack segment (SS)

I have an assembly row which the following information: EBP = 006FFB50 SS = 002B When I looked on this row: mov eax,dword ptr ss:[ebp+8] I assumed that EBP + 8 = 006FFB50 + 8 = 006FFB58. But ...
0
votes
0answers
25 views

How to change value at a memory address?

I am solving Micro Corruption CTF (msp430 assembly) How can I put the value 0x3c4f inside address 0x439c (r15 from Register state)? When cmp instruction executes, we want the value at memory address ...
0
votes
0answers
19 views

Memory Corruption CTF: How to enter null character in user prompted input?

I was solving memory corruption CTF In the picture you see a memory dump. I solve the problem when the string stored at addresses 2400, 2401... 2407 (in assembly it compares 8 memory addresses ...
0
votes
3answers
125 views

How to find if a function is using registers as parameters?

The disassembly of the function Winload!CmpFindNlsData whose prototype I'm trying to construct 00893c10 8bff mov edi,edi 00893c12 55 push ebp 00893c13 8bec ...
0
votes
1answer
48 views

Need help to understand this assembly for fibonacci seq

I understand the assembly properly. I am just confused about variable 'b' and 'c'. It looks like b is stored at 12(%ebp). I conclude this from cmp 12(%ebp), %eax. If you look at func_8048516, it is ...
1
vote
2answers
89 views

how to does this instruction work: `mov qword ptr [rbp-0x30], 0x4020c5`

The following is the code snippet (shown partially) I have: q = strrchr(resolved, '/'); /* given /home/misha/docs.txt, q now pts to the last slash */ if (q != NULL) { p = q + 1; ...
2
votes
2answers
234 views

Getting the algorithm used inside this .so file

I'v been trying to reverse-engineer a BLE "Smartlock" to open it using Python instead of the App that it came with. I progressed quite far with disassembling the SDK they provide, ...
0
votes
1answer
61 views

What is physical address on a pe reader?

What is physical address on a Pe file? I had search on the microsoft website article about pe files and don't have found anything.
1
vote
1answer
80 views

Trying to reverse engineer CmpFindNlsData of winload

I have a basic understanding of assembly language and I'm unable to perfectly define the algorithm of winload!CmpFindNlsData looking at the disassembly. Basically I need to understand how NLS data is ...
0
votes
1answer
34 views

what means “ilegal use of registers”?

I read pe program using a Pe Reader to view all sections, the .text section starts is "0x0001000": What is in the pe program reader: And is this what i see on the debugguer :
0
votes
1answer
65 views

What should I learn in order to reverse elf64 binary files

I'm a little confused. I am using a Linux based system (Ubuntu), 64-bit. and I want to start and reverse 64elf binary files, but there is a lot of things I want to know before. just to be clear, If I ...
1
vote
1answer
97 views

I want to insert instructions but don't have enough space to do so

Sorry if it is a very basic question/bad place to ask/for my bad english. I'm using Ghidra to patch instructions inside the binary of a game. Most of the time I could find some undefined bytes ...
1
vote
0answers
32 views

Statically injecting translated NASM assembly into existing ELF binary

I'm trying to statically patching ELF binaries in order to incorporate code that can help provide run-time protection. In an effort to save time writing and debugging assembly, I took the following no-...
0
votes
1answer
90 views

How can I modify these?

So I'm onto something interesting, I asked the less direct way but failed to meet the requirements in terms of explanation So here it is, how would I go about editing these the same way I would go ...
0
votes
0answers
44 views

Change value of memory in a debugger?

So I got this app loaded in x64, there is a function, let's say "HeatGainedPerShot", which is basically the value which an object gains everytime it fires, Such a value would normally exist ...
0
votes
0answers
116 views

Reversing a bootloader code (MIPS)

I'm trying to reverse a bootloader code extracted from raw memory dump of data modem. I think I extracted it correctly. Bootloader size 32768 bytes. Device use BCM3382 CPU (MIPS32) big-endian(?), eCos ...
2
votes
0answers
75 views

Devirtualization

I've recently become pretty fascinated with virtualization and retrieving original code from a randomly generated byte code, such as protectors like VMProtect/etc. But I can not get a grasp on how it ...
0
votes
1answer
77 views

how could i follow a system call from a dll -> kernel driver syscall

basically i would like to follow (system calls / internal calls) that basically lands in the kernel i would like for example to debug a specific dll ex : ntdll.dll and follow it to (NtXXX) function ...
0
votes
0answers
50 views

strange results with IDA (some function different Pseudo Code)

After show the pseudo code in IDA I see different results: The function 4436C0 show different pseudo code. For example: result = sub_4376C0("vvcbb3.wav",v8,0); and result = sub_4376C0((int)...
1
vote
1answer
113 views

How do disassemblers work?

I have 2 questions regarding this, but feel free to elaborate more if you want to, I'm really interested in this topic: Do they really just read byte by byte until they get a valid instruction? How ...
0
votes
2answers
57 views

Where do arguments 5 and 6 go in this Microsoft x64 function call?

I'm disassembling a working-as-expected compiled C program (MS/Windows x64, MinGW gcc 10.1.0). In the main function, I have the following call which passes 6 arguments to the function DotProduct: ... /...
0
votes
0answers
24 views

Trace files on disc to addresses in memory

Right now I am trying to dynamically create new NPCs for a multiplayer mod I am working on for a video game. The enemies are tied to level data and will always be the same enemies when you begin the ...
2
votes
1answer
118 views

dll injection (assembly code)

I need some tip to undrestand what is the best way to execute external code from DLL or command line. I like to add the force feedback support to different games that not support it. I can write a DLL ...
1
vote
0answers
107 views

Unable to start file “..\ntoskrnl.exe” in ollydbg [What can I do?]

Ollydbg isn't allowing me to open the executable ntoskrnl. I think im missing something but I don't know what it is (Windows 7, Ollydbg10.0,200)
1
vote
0answers
26 views

What numeric properties are used in this Unsigned Integer (64bit) -> Floating Vector (128bit) conversion?

Recently I came across the following set of vector instructions: movq xmm0, rcx punpckldq xmm0, 0x4530000043300000 subpd xmm0, 0x4330000000000000 haddpd xmm0, xmm0 The only sensible ...
0
votes
1answer
49 views

Disassemble scanf storage register

I am trying to understand scanf function a have 3 question regarding it. this is c file: #include <stdio.h> #include <stdlib.h> int main(){ int x; printf("Enter X:\n"); scanf(...
0
votes
1answer
193 views

Extracting Assembly line code from an executable in Ghidra

I'm using Ghidra to reverse engineer an EXE file and save its assembly line code only. Does Ghidra have any function or scripts which exports the assembly line code? I don't want to manually copy the ...
1
vote
1answer
36 views

Are there some assemblers or disassemblers that allow dw/defw etc directives with specified endianness?

I've been working with reverse engineering tape image and disk image formats and the files and filesystems they contain. It struck me that sometimes there are data fields that are not in the same ...
0
votes
1answer
600 views

What does 'test al, al' mean?

I'm trying to reverse engineer a program and i found the following instruction: test al, al je label what does these two instruction do ? Can someone explain please ?
2
votes
2answers
226 views

Dealing with obfuscated PUSH PUSH RET instructions

I wanted to run an app on a VM but there are PUSH PUSH RETs stopping me from looking at their anti VM code. There is a messagebox when I run it on a VM. I set a breakpoint at MessageBoxA and it gets ...
1
vote
1answer
39 views

Disassembly to reassembly - 80960: Invalid Scale Factor

I'm disassembling a game which runs on an Intel i960 processor. My disassembly is at a point I would like to try to reassemble it from an IDA Pro generated ASM file. The ASM file needs slight ...
0
votes
1answer
46 views

dereferencing structure members

I am reading a book on reversing and I am curious about one of the assembly snippet i have read in it. There is a simple disassembly of the function RtlNumberGenericTableElements and it looks like ...
-1
votes
1answer
50 views

Can I traverse the entire WORD array of 4 elements with QWORD PTR?

I want to change values of all WORD array of 4 elements by one step using QWORD PTR mov ebx, OFFSET arr ; arr is WORD of 1,2,3,4 xor qword ptr [ebx], 8000800080008000h ; I get error of constant ...
1
vote
1answer
61 views

How's this code able to make use of the stack?

I am trying to reverse engineer software to extend its functionality as expected of me. So I don't have the source code with me. Anyways, I am used to seeing codes that start like the one below, and ...
-2
votes
1answer
245 views

Debug and crack .NET executable PE

First of all, i'm trying to learn reverse engineering for testing my codes and that's all and i'm not stupid enough to do illegal things with my knowledge so please don't give me legal advises. I'm ...
1
vote
1answer
63 views

IDA Pro: How to change segment register value

For a specific Android library that I have loaded into IDA, I want to switch the THUMB/ARM mode to ARM, no matter the consequences that this is going to have to the code. Is there a way to efficiently ...
0
votes
1answer
70 views

Why there are only 8 hexa memory digits while my RAM is 16G

I'm totally new to reverse engineering, when I start debugging my c program with radare2, and start showing assembly, I found that addresses are only 8 hexa digits, which means 16^8 = 4294967296 ...
0
votes
0answers
11 views

Tool for navigating native assembler code and memory hex for interpreted languages like VBA

Complete newbie to this area and I have limited experience writing code in low level languages so I'm not familiar with the debugging techniques, but bear with me:). I'm trying to understand the ...
0
votes
0answers
53 views

Shellcode doesn't match OllyDbg

I have created a simple program that is susceptible to a buffer overflow using strcat(buffer1, buffer2). I have successfully overflowed into the EIP and have placed an address located in NTDLL which ...
0
votes
0answers
53 views

Force gcc to use more complex instructions

I am reverse engineering a piece of assembly. I am trying to write the equivalent code in C, however, when I compile my code, gcc prefers to use simple instructions instead of the complex ones that ...

1
2 3 4 5
14