Questions tagged [assembly]
A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.
-1
votes
1answer
96 views
How to convert assembly to pseudo code? [closed]
I have the following assembly. I don't know how to follow assembly. I was wondering if there is a way to convert assembly to a human readable pseudo code or better yet C code:
init:
mov eax, [ebp+...
2
votes
1answer
82 views
Call instruction changed while running
While debugging and reverse-engineering my exe, I have found a very weird thing.
call ds:GetModuleFileNameA
This call instruction is formed with below hex bytes in IDA.
FF 15 24 C0 41 00
(I think ...
0
votes
1answer
50 views
Linux Assembly Syscall
I'm learning how to write shellcode by using Linux system call "execve" to spawn a shell with root access privilege.
Here i found a shellcode online:
http://shell-storm.org/shellcode/files/shellcode-...
1
vote
1answer
80 views
What does fs and gs registers provide in Linux?
In a 64 bit ELF binary I found it mainly uses fs register to get some values. How can I know which value it wants to access? I'm familiar with that NT kernel uses fs and gs register for TEB structure ...
1
vote
0answers
36 views
Is there a way to modify number of reads/writes to/from a memory address?
I haven't had any luck researching this, so I thought I would inquire here!
Let's assume I have found a memory address housing a value of interest. Using a program like Cheat Engine, I look for ...
0
votes
1answer
126 views
Is this a good way to get past anti-debugging measures?
This program I am analyzing is full of anti-debugging. It won't even run if most debuggers are loaded before I start the app.
I tried using IDA to static analyze it, but it was written in a OOP ...
12
votes
2answers
3k views
What kind of code would produce this assemby with loads of jump statements?
00EE16CC . E9 DFBB0000 JMP BinFile.00EED2B0
00EE16D1 . E9 64AF0000 JMP <JMP.&MSVCP140D.?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@>
00EE16D6 . E9 15DB0000 JMP BinFile....
0
votes
0answers
86 views
Converting assembly to LLVM IR
What is the best way to convert some assembly code to LLVM IR? Code doesn't contain any jumps/calls/returns. Only arithmetical and stack operations. I have tried McSema but I couldn't get it to work. ...
0
votes
0answers
22 views
two consecutive mov ops with src and dst reversed. Why? [duplicate]
I'm looking at some assembly code (objdump -D) for a 32-bit binary. I have found main(). Here are two lines in main that I have a question about:
8048a35: 89 45 dc mov %eax,-0x24(%ebp) ...
-2
votes
1answer
83 views
Can someone please help me reverse engineer this assembly code to C please! [closed]
I am really bad at understanding assembly code and the way it works. I have little problems given to me in Assembly code and I have to reverse engineer it to C, but I have been doing really bad job at ...
3
votes
1answer
316 views
XCHG RAX, RAX: 0x09, what does this code do and how does it work?
Given the following short assembly snippet:
shr rax, 3
adc rax, 0
I worked this out a bit:
We know SHR sets the CF with the last bit shifted.
We know ADC dest, 0 is just adding the CF.
So ...
4
votes
1answer
209 views
Need help understanding a complex mathematical password checking function?
Below is a complex pseudocode for a mathematical problem which attempts to check if a password entered is correct or not.
Previous Analysis Done:
Data is arranged in the form of 3x3 Matrix with i,j ...
0
votes
0answers
18 views
changing an arguments type from word to dword
I have a game where the damage is limited to WORD. Unfortunately this is no longer high enough. The damage is calculated and passed to a number of functions. All of this is in unsigned __int16. I’m ...
5
votes
2answers
416 views
How many registers does an x86_64 CPU actually have?
I am currently learning reverse engineering and am studying the flags register.
I had in my mind that rflags was just another name for one of the 16 general purpose registers, for example rax or rbx.
...
1
vote
0answers
38 views
getting %localappdata% in asm
I have an old windows x86 application that no longer works properly since windows 8. This app creates files within its own folders for things like app settings. Unfortunately, Microsoft no longer ...
2
votes
1answer
121 views
Why is the process crashing after executing my injected payload?
I tried the following payload for APC injection in Windows.
It gets executed successfully(pops up a MessageBox) but the process crashes after the execution of payload.
What could be the possible ...
1
vote
2answers
86 views
Why there are two different shellcodes for bin/sh with much different syntax and which one is better to use? (x86)
I have found two shellcodes for spawning /bin/sh which are much different from each other. The second one is hardly ever found on the net, and it mostly comes up in reverse engineering websites:
1. "\...
2
votes
1answer
189 views
Converting Assembly x64 code to C
I have the following code:
0000000000400526 <main>:
400526: 55 push rbp
400527: 48 89 e5 mov rbp,rsp
40052a: 48 83 ec 20 sub ...
3
votes
1answer
183 views
How can I convert this assembly code (x64) to C?
I have the following assembly (x64) function:
400700: sub rsp,0x18
400704: mov QWORD PTR [rsp+0x8],rdi
400709: cmp QWORD PTR [rsp+0x8],0x0
40070f: jne 400718 <bar+0x18>
400711: mov eax,0x0
...
1
vote
1answer
93 views
Figuring out what a segment of assembly code does
I have the following assembly code:
0000000000400711 <foo>:
400711: 55 push rbp
400712: 48 89 e5 mov rbp,rsp
400715: 48 89 7d e8 ...
0
votes
1answer
93 views
Analyze raw assembly using IDA Pro
I have a raw assembly dump i.e.
.intel_syntax noprefix
.bits 32
.global main
main:
push ebp
...
And I know it's Intel x86 and the original function was most likely written in C. Now the ...
0
votes
1answer
265 views
What does this assembly language program output?
I have been struggling with this for a long time. I have the following assembly language code:
.intel_syntax noprefix
.bits 32
.global asm0
asm0:
push ebp
mov ebp,esp
mov eax,DWORD ...
-1
votes
1answer
63 views
How can I decompile the CC2650 .hex file to C?
I want to decompile it to C, or at least assembly the CC2650 hex file (Bluetooth Low Energy Sensor Tag), that provide TI.
My goal is to know the specific way used by CC2650 to generate the LTK.
I'll ...
1
vote
1answer
45 views
Explanation of SBB instruction
I have this Asm from a book that suppose to do a Boolean cast: rax := rax ? 1 : 0
1. neg rax
2. sbb rax,rax
3. neg rax
But as i understand this code and the instructions (below), this ...
4
votes
1answer
137 views
Need help identifying main processor for Roland synthesizer
I desperately need help figuring out the ic chips in this unit so I can view the firmware in ida pro.
So the unit is a roland gr-55 guitar synthesizer and i'm trying to disassemble the firmware into ...
1
vote
2answers
103 views
.NET assembly IDA PRO, using LDSTR IL op code, how to patch a string?
I'm trying to patch a string. So right now I'm trying to replace instruction LDSTR with LDSTR "mystring"; however, I have been unsuccessful. After assembling the LDSTR op code, I don't quite ...
0
votes
0answers
26 views
Compare / highlight differences between 2 .dll files [duplicate]
so I have 2 .dlls and I was thinking if it's possible to easily compare/highlight the things that are different between the two with IDA or anything else you have in mind that could make that job ...
1
vote
2answers
89 views
Getting opcode Length , How to
I am apparently not very good with assembly as I am novice to somethings! Hence i wanted to make a question again.
Now i got this from here to make something like a LDE (Length Disassembly Engine) ...
4
votes
4answers
542 views
Calculation of jmp address through subtraction
I don't get why the two addresses of the functions are subtracted in order to get the jump destination.
mov eax, [ebp+func1]
sub eax, [ebp+func2]
sub eax, 5
mov [ebp+var_4], eax
Which ...
2
votes
1answer
43 views
Correct my understanding on a basic allocation memory
Here is the function
If I understand correctly:
There is a buffer of size 256 bytes created (malloc)
in this buffer, the first 32 bits are set to 0 (because dword designates 32bits size)
the next 32 ...
1
vote
1answer
95 views
VirtualProtect failed to revert protections on mrdata section of ntdll, why?
i perform a loop in assembly where i am parsing the sections of ntdll change their memory permissions with VirtualProtect and then revert them back to their original permissions. the code looks like ...
1
vote
1answer
55 views
Need Advice for the purposes of learning [closed]
I would really like to make a multiplayer mod for Fallout 4, I know how to program and i have a basic understanding of how to get opcodes and read/write to those. Now what i don't understand is how to ...
5
votes
4answers
2k views
Purpose of test eax,eax after a strcmp
This is my first program i am trying to reverse and my intro to this field.
The C program will test if two strings match, and it will printf() a message for each occasion.
This is what the reversed ...
4
votes
2answers
120 views
How does the XADD instruction modify the Zero Flag?
I've come across a set of instructions using lock xadd which I'm guessing came from one of the C++ smart pointer templates. (It's been a very long time since I coded C++ so I'm not sure which).
lea ...
0
votes
0answers
61 views
Capstone in reverse mode
I am using capstone in python in order to dissassemble binary instructions.
Is there a way to work in the reverse mode ? I mean typing some asm instructions and ask capstone (in python) to generate ...
2
votes
1answer
73 views
Why do we need to know the address of shellcode?
I have read many articles regarding the buffer overflow exploit. Everywhere its written as follow.
"It's difficult to know the starting address of the shellcode"
Why do we need to know the address ...
2
votes
1answer
103 views
What does this magic number do? [duplicate]
I've opened a 64 bit DLL file in IDA. One function has this pseudocode:
unsigned __int64 output;
ULONG input;
output = (unsigned __int64)(input * (unsigned __int128)0xE38E38E38E38E38Fui64 >> 64)...
-3
votes
1answer
56 views
Change value of an IF condition found in IDA
so I have the .idb file of an executeable I want to modify.
In the IDB file, I found this code
And I basically want to change 4111006 to 1006 in that IF condition.
however, when I press TAB to go to ...
1
vote
1answer
58 views
Is there any way to call function instead of breakpoint, when certain memory area is accessed or register value is matched?
I am studying assembly and hooking.
I know how to hook x86 assembly now.
so if any thread goes to certain address which is overwritten with my code, it automatically returns to my function.
I think ...
2
votes
3answers
246 views
What does ds mean in mov instruction?
I am reversing a 32-bits ELF executable.
I see something like:
mov al, byte ptr ds:xxxxx
xxxxx is an absolute address.
What is the meaning of ds here?
1
vote
1answer
65 views
Generate this assembly from a c program
I want to generate this assembly code:
mov ecx, <absolute address of func1>
call ecx
How can I write and compile C code which generates this code?
0
votes
2answers
126 views
How to interpret disassembled MIPS code?
I have disassembled MIPS binary with raw opcodes. How to interpret, for example, these lines:
Disassembly of section .data:
00000000 <.data>:
... ...
f864: 30a5ffff sd ra,-23248(...
0
votes
1answer
55 views
How to breakpoint atached process with ida when move on
In IDA pro, there is an option to attach to a process using the WinDbg backend.
When I want is to see the process' control flow when the IDA attaches to it.
The only way (that I know) to see the ...
1
vote
1answer
40 views
What are these LOAD segments in an assembly ELF64?
I wrote the following (fasm) assembly program:
format ELF64 executable
segment readable executable
include 'io.inc'
include 'unistd64.inc'
entry main
main:
mov rdi, msg
call print
call ...
3
votes
1answer
275 views
Understanding Program Arguments on the Stack in Assembly
To self-teach myself reverse engineering, I am writing small C programs and reversing them in order to understands how the compiler sees my code. However, I am having quite tough time understanding ...
-3
votes
1answer
82 views
How does array indexing works at the assembly level?
Can anyone give me an example to understand how array indexing is working in assembly.
For example, in C:
char s[1000];
for (int = 0; i < 5; i++)
{
s[i] = i;
}
And, in x86 assembly:
add ...
3
votes
1answer
477 views
Moving integer to xmm register
I was looking at a game code, and I saw the following:
0x171 mov [rbp-30],r12w
....
0x210 movups xmm0,[rbp-30]
I am pretty sure that r12 is an integer here (equals 5). So, is it moving an ...
14
votes
3answers
5k views
Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?
I don't know whether this is a silly question, but I couldn't find any answer.
With the evolution of CPU architecture, register size was extended, from 8, to 16, 32, and eventually 64-bit. I was ...
-1
votes
1answer
104 views
index of array in assembly? [duplicate]
In the following picture the line i want to mention is:
mov [esp+eax*4+0Ch], edx
Here eax is the index in the array. But, where is the address of the array to access?
what does mean this line of ...
