Questions tagged [assembly]
A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.
838
questions
0
votes
0
answers
22
views
Tracking where an DITL resource is called within a 68k program
Okay, so I'm a super noob at reverse-engineering and know next to nothing about 68k assembly code. I'm running an emulated version of MacOS 9.0.4, using a program called Resorcerer 2.4.1 to examine my ...
- 1
0
votes
1
answer
54
views
Help with FISTP and FILD interpretation
I need some help with understanding what is being actualy done in those two assembly lines:
fistp qword ptr [esp+10h]
ss:0023:0013be80=0000000000001cf8
fild qword ptr [esp+10h]
ss:0023:0013be80=...
- 35
0
votes
0
answers
34
views
Understanding emulation & tracking IP within a process
I'm working on an end-of-year project for my studies and I was thinking of writing some sort of process emulation debugging tool. What I mean by this is, I want to write a debugger without actually ...
0
votes
1
answer
54
views
Strange SBB behaviour
I have a code in which I have:
EAX=00002c36
and after:
SBB eax, 0
the eax turns:
EAX=00002c35
Is that possible?
Shouldn't eax be the same value?
If it's correct, it seems like I don't really ...
- 35
0
votes
1
answer
71
views
C# reverse engineering bypass obfuscation
I have to extract a flag from a test.exe file. The respective flag is run as an argument for the test.exe file => "test.exe FlagName" and in this way I will reach the next flag.
I managed ...
0
votes
1
answer
56
views
imul instruction with three operands
I want to use a imul instruction with 3 operands. Is the destination operand the first or last? I searched the web and got contradictory informations.
- 35
0
votes
0
answers
111
views
Extract flag from .exe file
I have to extract a flag from a test.exe file. The respective flag is run as an argument for the test.exe file => "test.exe FlagName" and in this way I will reach the next flag.
I ...
1
vote
1
answer
86
views
What is the "Fallthrough" option in Ghidra for?
If you right-click on the assembly window in Ghidra, one of the last options shown will be "Fallthrough":
Can someone explain in plain English what is that option for?
- 1,751
0
votes
1
answer
42
views
struggle with Decrypt Byte Array with a key of unity game using il2cpp
So i'm trying to reverse an unity game using il2cpp to get the assets of it.
After some reverse stuff i found that the asset's (especially here the png image) byte array get encrypted with a key and i ...
- 23
0
votes
1
answer
62
views
Offset addressing
I’m writing a C-SKY (CK803S) processor module for IDA Pro, and a question arose about offsets in transitions, small ones are fine, but long ones lead to nowhere, from the documentation:
in code I ...
- 13
0
votes
1
answer
85
views
X64DBG Conditional Breakpoint on Specific Opcode?
Is there any way to break on specific opcode in X64DBG?
For example i want to break on start of a function which is
55 | push ebp
8BEC | mov ebp,esp
can i set a breakpoint like opcode == 0x00EC8B55?
...
0
votes
0
answers
107
views
Searching for a byte pattern and then hooking all instances of it using frida on iOS
I'm using a frida script to scan for a certain byte pattern when I launch an iOS app.
I can log each offset and confirm these are correct by also printing out the instructions at those locations and ...
- 177
1
vote
1
answer
130
views
how to diassemble an .obj file
I'm new to programming and recently studying an ancient DOS assembly program written for 80186 and assembled with MASM. There are some .obj files that I want to open and take a look. I tried obj2asm....
- 13
0
votes
0
answers
41
views
how to set a BP on button in SunAwtCanvas in x96dbg
I'm trying to debug a program in x96dbg that I think this is written in Matlab. There is no string related to buttons or something interesting. Then I go to Handles tab to find buttons and set break ...
- 1
0
votes
0
answers
45
views
Address arithmetic in Ida Pro
Can someone tell more about address arithmetic in Ida? I were looking for assembly instructions and saw this
LDR R0, =(byte_255914C - 0xC63D50)
I understood right that in r0 will be an address which ...
0
votes
1
answer
140
views
Mnemonic suffixes for x86-64 assembly for AT&T syntax
I'm trying to understand suffixes used for the AT&T syntax for the x64 assembly used for instruction mnemonics.
For regular cases:
'b', // 8_bit
'w', // 16_bit
'l', // 32_bit
'q', /...
- 1,751
11
votes
2
answers
4k
views
Why did Intel chose 90h machine code for their NOP instruction instead of a 0?
Probably just a historical question, if anyone knows.
- 1,751
0
votes
2
answers
210
views
Is DOS Assembly Hexadecimal Different To Modern Hex Editor Hexadecimal?
I am trying to find the correct Data Segment, corresponding to a certain File in a 16bit DOS Game.
The Assembly Instructions for the Decompiled .exe File in IDA Pro Version 5, I am looking at.
I was ...
- 79
1
vote
0
answers
99
views
DOS .exe File Decompiled in Cutter Program Showing Different Than In IDA Pro
I am having an issue when using the Cutter Reverse Engineering Program,
Here is a Segment of Decompiled Assembly, in Cutter :-
at 0000:4ed5 in the picture I posted the .string line of text is there, ...
- 79
2
votes
2
answers
118
views
Keystone rust bindings error when assembling "syscall; ret" shellcode
I'm working on a project related to Process Injection for learning Rust. I have to inject shellcode at some points and use the Keystone engine for assembling shellcode from source.
I detected that the ...
- 23
0
votes
0
answers
25
views
What guidelines and/or tools exist that facilitate the analysis of a program in assembly language for PIC-Microchip?
What tools exist that facilitate the interpretation of a program written in assembly language of a PIC-Microchip, appealing to the construction, for example, of a flowchart and then recoding it in ...
- 1
0
votes
1
answer
113
views
Cracking cryptographic function with radare2
I want to reverse engineer an android game, found a method
public static byte[] MNNOPKMJMFP(byte[] AFFEPNLBIIC, byte[] OENOGNMAMPO, byte[] GLLEHJKGIBK) { }
Names are obfuscated, i know that this is a ...
0
votes
0
answers
49
views
Convert hex chars string to int
For example we have chars buffer with hex value:
char * buff = {"e000"}; //this is our hex value in eax - input for Get_Val().
Then there is function Get_Val() - converts hex (string) to ...
- 363
1
vote
1
answer
1k
views
How to run exe program loaded into IDA Pro or Ghidra
I'm new to reverse engineering, just learning. After the exe program is loaded into IDA or Ghidra, how do I run the exe program that loaded into IDA/Ghidra? so I can interact with the exe program? and ...
- 11
0
votes
1
answer
46
views
Assembler OR operation
Is this asm code:
or unknown_byte_0004AAA7, 1
dseg05:000C7FDC unknown_byte_0004AAA7 db 0
equivalent to this C++ code below?
bool unknown_byte_0004AAA7 = 0;
unknown_byte_0004AAA7 = ...
- 363
0
votes
2
answers
76
views
MS DOS development - Interrupt controller
cseg01:0005229A mov dx, 21h ; '!'
cseg01:0005229E in al, dx ; Interrupt controller, 8259A.
cseg01:0005229F or al, 1
cseg01:...
- 363
1
vote
1
answer
141
views
What means this code?
cseg01:00020DB8 mov eax, offset screen_with_height
cseg01:00045704 mov dword ptr [eax+0Ah], 0
cseg01:0004570B call sub_466F8 ; call some proc
...
- 363
0
votes
0
answers
38
views
Reverse engineering JCALG/LZ?? compression
I think this is related to this this question, but the consts in the example code don't exist in mine, so maybe it's a different level of compression, but I am unsure.
Can anyone provide me the right ...
0
votes
0
answers
139
views
from executable to assembly source code?
let's say i have an ".exe program" and i want to disassemble it and get "disassembled code" .
my question is => can i maintain and organize that "disassembled code" ...
- 23
2
votes
0
answers
143
views
Trying To Understand DOS Game Assembly Instructions
I am trying to understand assembly language instructions, for a DOS Game.
I have looked at the following Link :- https://atrevida.comprenica.com/atrtut07.html
reading about how VGA Graphics work in ...
- 79
0
votes
1
answer
101
views
Assembly for malware analysis
I know we have some architectures for assembly language. But I wanna know this: I need learn x86 assembly ? , or arm assembly ? , or both ? , or others ?..
Please help me , what should I learn?
- 3
3
votes
0
answers
93
views
Is it legal in the US to reverse engineer a product and then share the CAD for free to whoever needs it?
First some background.
I have this 3D printer that sucks, is pretty expensive, and unreliable. Whenever you need a spare part, the manufacturer sells you the entire kit! I needed a thermistor and they ...
- 31
2
votes
0
answers
295
views
Help Needed With Finding Image Data In DOS Game File
I have been analysing, an File called FW190AS.PAC from a 16 Bit Game called Secret Weapons Of The Luftwaffe, in a Hex Editor, the Bytes are displayed in Little Endian format. My aim with this game, is ...
- 79
1
vote
1
answer
181
views
How can i remove dead code and opaque predicates?
I have the following problem on my agenda: There is an obfuscated .exe (this is a virus that I am investigating) in addition to having an MBA, etc. bullshit, he has Opaque predicates and dead code, I ...
- 11
1
vote
0
answers
142
views
Reversing Assembly to C
I've read the open letter addressing students asking for help with their homework and I agree with it, therefore I will try to be less of a pain in the *** ;)
I need to reverse the x86-64 (AT&T) ...
- 11
2
votes
1
answer
102
views
other than x32dbg, is there a more friendly way to check functions, their args and their return values on runtime?
atm I'm using ida and x32dbg, when I find a function that interests me, I set a breakpoint on x32dbg, however, I'm not good enough at assembly to know everything from a function just from looking at ...
- 23
3
votes
1
answer
263
views
How can you tell where an assembly function ends?
Finding the start of a function is sometimes obvious - for example if some part of the code has a call foo then foo must be a function.
But what about finding the end of a function? I realize tools ...
- 143
1
vote
1
answer
241
views
Where is the XOR operation?
I am doing TryHackMe REloaded room, level 3.
When I got stuck I followed this tutorial which mentions an XOR by 7 operation being performed on a string, however I cannot see it anywhere.
Where is it ...
- 195
4
votes
1
answer
1k
views
Change string value when string is in a RAM address x64 c++ program
I'm new to reverse engineering.
I'm simply trying to change the value of a string in x64dbg, of a program I make myself in VS
(It's a c++ program, and is VERY simple; it just prints a string, and two ...
- 41
4
votes
2
answers
2k
views
How to bypass anti debugger? IDA Pro
Im new to reverse engineering and doing a crackme that requires me to make a keygen, yes i know making a keygen isn't a beginner task however im stuborn, i am trying to debug the program to understand ...
- 41
3
votes
1
answer
95
views
Reverse engineer a blackbox function operating on single or double precision floats for emulation
I own and run a NEC VectorEngine 10C which is a PCIe accelerator running a proprietary ISA which has many fun instructions among them is VRSQRT which computes an approximation of the inverse ...
- 131
2
votes
1
answer
73
views
why some functions push data before the prologue
i am a newbie in the world of RE ,
i start to explorer a main entry of a classic game from 90's
and i start to see something confuse me as a newbie
this main entry function start with pushing stuff to ...
- 23
2
votes
1
answer
262
views
What are the prerequisite knowledge needed to start solving crackmes?
I started by reading a book on C language and then moved on to "Programming From Ground Up," which teaches basic programming in x86.
School just ended, I'm working on cracking a game called ...
2
votes
1
answer
158
views
Ghidra Shows Structure Strange
I am new to assembly. When I was disassembling some code, I encounter some strange instruction here. The instruction shows that (RBP + -0x40) is equal to local_48, however at the beginning of the code,...
- 23
2
votes
1
answer
78
views
Why did I have gotten only null bytes argv variable from angr?
I have made simple program to test the angr.
My python code is here.
import angr
import claripy
p=angr.Project('./test2')
buf=claripy.BVS('buf', 8*10)
initial_state=p.factory.entry_state(args=[&...
- 55
3
votes
4
answers
571
views
Reverse Engineering CTF help
I am having trouble figuring out this microcorruption challenge in the link below: https://microcorruption.com/debugger/Halifax
Basically, the 0x7f interrupt has been disabled so I must reenable it ...
- 141
2
votes
2
answers
277
views
Reverse engineer a calculation rule from a video game
I have recently bought an economic simulation video game, but neither the docs not the game UI describe how to estimate some costs; the user needs to actually invest and spend their money, then ...
- 121
1
vote
1
answer
84
views
What was the original math operation after optimizing compiler?
I'm pretty sure that original code was much simpler:
(((x + 16) >> 31) ^ abs(x + 16) & 3) + 4 * ((y + 16) % 4) - ((x + 16) >> 31)
Looks like division with remainder... Any ideas what ...
- 33
3
votes
1
answer
199
views
What tricks can I use to manually decompile a set of instructions
ELF Binary takes user input and stores it in loc.buffer address 0x4020e8. Further, the registers going into the instruction set are
eax
ebx
ecx
edx
esi
length of user input (min length is 3)
0
...
- 141
2
votes
0
answers
288
views
ghidra assigns local variable to register
im reversing a android native library and im trying to understand how a token is generated the toke n is passed to a callback java method and i traced where the method is getting called from
this is ...
- 191