Questions tagged [assembly]

A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.

Filter by
Sorted by
Tagged with
1
vote
0answers
29 views

Adding my own assembly code to x64 .exe

I have assembly code like this: 142cccc0c c7 43 18 MOV dword ptr [RBX + 0x18],0x4000 00 40 00 00 142cccc13 e8 a8 79 CALL FUN_141a845c0 ...
0
votes
1answer
42 views

Assuming x is a number smaller than 0xff what happens to x after the assignment LOBYTE(x)=x-1?

I understand that LOBYTE is an IDA macro for retrieving the lower byte of a variable. My question is what is the difference between the result of x=x-1 and LOBYTE(x)=x-1 when x is smaller than or ...
1
vote
1answer
35 views

Link decompiled C code to Assembly (retdec decompiled object into C code, but with many errors, i found the kill switch which i need to edit)

I am using retdec to decompile a piece of software. It has a "kill switch" to detect if it's being run in an untrusted environment, in the decompiled code it just a simple if (env_untrusted()...
1
vote
1answer
29 views

What do the following AARCH64 LDR and STR instructions do exactly?

The following instructions are part of a IDA's disassembly of an AARCH64 binary. While it is fairly obvious that the # represent pure numbers and the [] probably refer to the memory address referred ...
0
votes
1answer
45 views

How JNE work in Ollydbg?

I have a question about JNE. I use ollydbg and ReverseMe tutorial. In JNE condition, the zero flag is equal to 1. and it mean the arithmetic result is zero. Right? The Z=1 meaning the condition is ...
2
votes
1answer
53 views

What are my options to add instructions to a binary?

I am fairly new to reversing so apologies in advance if any terminology is incorrect. I am currently using ghidra on windows to look at the instructions/decompilation of a binary and I am looking to ...
1
vote
0answers
54 views

Is there a meaning to the test instruction if it isnt followed by a conditional jump?

Pasting a snippet of code I found inside a malware sample. 0040F695 push ecx 0040F696 lea ecx,dword ptr ss:[esp+8] 0040F69A sub ecx,1000 0040F6A0 sub ...
1
vote
1answer
58 views

Why does decompiling a C++ using Snowman yield some full variable names and some obfuscated ones?

I decompiled a C++ exe file using Snowman, hoping to see if it was malware or not (Although, honestly, I have no clue how to continue that - The file is really large, and the decompilation mostly ...
1
vote
1answer
78 views

Finding Ropper/ROPgadget offsets in Ghidra disassembly

How is the offsets returned from ROP gadget finders related to the files they come from? For example, if the ROP gadget finder says that a certain gadget is at offset 0x0002ae74 in libuClibc.0.9.3.so ...
0
votes
0answers
33 views

Remapping Branch Instructions After Obfuscation

Recently I've been working on a project. I've already got a hint for a problem that I had here: (Garbage Assembly Code Generationat at random offsets) however, the accepted answer's solution doesn't ...
2
votes
0answers
53 views

Where to start with reversing a custom JavaScript VM?

I have recently ran into the most heavy JavaScript obfuscation I've seen. It is using a custom VM to execute bytecodes. I have never dealt with such obfuscation, and I am wondering where I can start ...
0
votes
1answer
57 views

Converting rep movsd to to C without memcpy

So I am currently in the stages of creating binexact version of functions in decompiled code. I noticed that in this function the rep movsd is called and logically this is translated as Qmemcpy/memcpy ...
1
vote
1answer
74 views

Garbage Assembly Code Generationat at random offsets

Recently I've been working on a project. The main purpose of the project is to generated statically undetectable PE samples. Where each time one generates a PE sample, each generated sample is going ...
0
votes
1answer
74 views

I am translating some assembly code into C

I am translating some assembly code into C, and I need some help with a part of it: .equ UBRR_val = 12 ;UBRR sets baud, 12 = 19200baud at 4 MHz .def char = r17 ; Register to hold a character ...
0
votes
0answers
53 views

Binary bomb lab, can't find starting number and having problem recognizing pattern

The following is the assembly dump of a binary bomb from bomb lab Basically, you have to come up with a 6 number sequence to defuse the bomb, however, I am having trouble finding the first number and ...
1
vote
1answer
72 views

How do you recommend going for applying minor changes in an executable through a dll?

My choice of words in the title might be poor, I apologize: english is not my primary language and I have no idea how to word it better. I have a game executable to which I applied several changes, ...
1
vote
1answer
64 views

Why is the offset 16 bits?

I was told that segment:offset pairs were used to represent 20 bits. The segment is 4 bit shifted, and the value plus the offset becomes the physical address. I don't have to worry anymore at 32-bit ...
0
votes
2answers
155 views

how to use class member function defined in a exe within a dll

I have an executable (.exe) containing some classes and functions definition and plan on using those functions from within a DLL, although I know to call a regular C style function using calling ...
0
votes
0answers
60 views

Reverse Engineer Slack Workspace

Is there any Slack workspace for Reverse Engineer experts? I wanna to communicating other people who work in this issue. I am thankful if you know this workspace and invite me.
1
vote
2answers
168 views

find cheat engine pointers in ghidra

I find a pointer of my health so a function would have made the pointer and put the health in it (tell me if I'm wrong) how do I look for the function?
1
vote
2answers
50 views

How to extract port number from shellcode

I saw this shellcode and when they use the connect function they pass the port number 4444: set_address: push byte 0x05 ; retry counter push 0x0100007F ; host 127.0.0.1 push ...
1
vote
1answer
83 views

Help understanding x64 TEST instruction

I have read that TEST does a bitwise and on the two arguments. I have also read that jz and je are both equivalent, and jump if the zero flag is set. So here's the problem I'm struggling with. ...
1
vote
1answer
48 views

Where are the intel manual x86-16?

I was studying the code for x86-16 operating systems(como DOS),with a desassembler, but I can't find the intel manual on the intel website: Searching on google, only unofficial sources. Perhaps the ...
0
votes
2answers
77 views

ASM Debuggers that visualize the stack (beginner friendly)

(Cross-posted from Stack Overflow) Are there any debuggers that constantly show a visual of the stack and where everything is within it? For example, taking some random image: I use gdb for most ...
0
votes
1answer
31 views

How to calculate value inside stack segment (SS)

I have an assembly row which the following information: EBP = 006FFB50 SS = 002B When I looked on this row: mov eax,dword ptr ss:[ebp+8] I assumed that EBP + 8 = 006FFB50 + 8 = 006FFB58. But ...
0
votes
0answers
47 views

How to change value at a memory address?

I am solving Memory Corruption CTF (msp430 assembly) How can I put the value 0x3c4f inside address 0x439c (r15 from Register state)? When cmp instruction executes, we want the value at memory address ...
0
votes
0answers
22 views

Memory Corruption CTF: How to enter null character in user prompted input?

I was solving memory corruption CTF In the picture you see a memory dump. I solve the problem when the string stored at addresses 2400, 2401... 2407 (in assembly it compares 8 memory addresses ...
0
votes
3answers
170 views

How to find if a function is using registers as parameters?

The disassembly of the function Winload!CmpFindNlsData whose prototype I'm trying to construct 00893c10 8bff mov edi,edi 00893c12 55 push ebp 00893c13 8bec ...
0
votes
1answer
48 views

Need help to understand this assembly for fibonacci seq

I understand the assembly properly. I am just confused about variable 'b' and 'c'. It looks like b is stored at 12(%ebp). I conclude this from cmp 12(%ebp), %eax. If you look at func_8048516, it is ...
1
vote
2answers
157 views

how to does this instruction work: `mov qword ptr [rbp-0x30], 0x4020c5`

The following is the code snippet (shown partially) I have: q = strrchr(resolved, '/'); /* given /home/misha/docs.txt, q now pts to the last slash */ if (q != NULL) { p = q + 1; ...
2
votes
2answers
252 views

Getting the algorithm used inside this .so file

I'v been trying to reverse-engineer a BLE "Smartlock" to open it using Python instead of the App that it came with. I progressed quite far with disassembling the SDK they provide, ...
0
votes
1answer
71 views

What is physical address on a pe reader?

What is physical address on a Pe file? I had search on the microsoft website article about pe files and don't have found anything.
1
vote
1answer
84 views

Trying to reverse engineer CmpFindNlsData of winload

I have a basic understanding of assembly language and I'm unable to perfectly define the algorithm of winload!CmpFindNlsData looking at the disassembly. Basically I need to understand how NLS data is ...
0
votes
1answer
37 views

what means “ilegal use of registers”?

I read pe program using a Pe Reader to view all sections, the .text section starts is "0x0001000": What is in the pe program reader: And is this what i see on the debugguer :
0
votes
2answers
99 views

What should I learn in order to reverse elf64 binary files

I'm a little confused. I am using a Linux based system (Ubuntu), 64-bit. and I want to start and reverse 64elf binary files, but there is a lot of things I want to know before. just to be clear, If I ...
1
vote
1answer
153 views

I want to insert instructions but don't have enough space to do so

Sorry if it is a very basic question/bad place to ask/for my bad english. I'm using Ghidra to patch instructions inside the binary of a game. Most of the time I could find some undefined bytes ...
1
vote
0answers
36 views

Statically injecting translated NASM assembly into existing ELF binary

I'm trying to statically patching ELF binaries in order to incorporate code that can help provide run-time protection. In an effort to save time writing and debugging assembly, I took the following no-...
0
votes
1answer
91 views

How can I modify these?

So I'm onto something interesting, I asked the less direct way but failed to meet the requirements in terms of explanation So here it is, how would I go about editing these the same way I would go ...
0
votes
0answers
46 views

Change value of memory in a debugger?

So I got this app loaded in x64, there is a function, let's say "HeatGainedPerShot", which is basically the value which an object gains everytime it fires, Such a value would normally exist ...
0
votes
0answers
135 views

Reversing a bootloader code (MIPS)

I'm trying to reverse a bootloader code extracted from raw memory dump of data modem. I think I extracted it correctly. Bootloader size 32768 bytes. Device use BCM3382 CPU (MIPS32) big-endian(?), eCos ...
2
votes
0answers
93 views

Devirtualization

I've recently become pretty fascinated with virtualization and retrieving original code from a randomly generated byte code, such as protectors like VMProtect/etc. But I can not get a grasp on how it ...
1
vote
1answer
97 views

how could i follow a system call from a dll -> kernel driver syscall

basically i would like to follow (system calls / internal calls) that basically lands in the kernel i would like for example to debug a specific dll ex : ntdll.dll and follow it to (NtXXX) function ...
0
votes
0answers
51 views

strange results with IDA (some function different Pseudo Code)

After show the pseudo code in IDA I see different results: The function 4436C0 show different pseudo code. For example: result = sub_4376C0("vvcbb3.wav",v8,0); and result = sub_4376C0((int)...
1
vote
1answer
117 views

How do disassemblers work?

I have 2 questions regarding this, but feel free to elaborate more if you want to, I'm really interested in this topic: Do they really just read byte by byte until they get a valid instruction? How ...
0
votes
2answers
63 views

Where do arguments 5 and 6 go in this Microsoft x64 function call?

I'm disassembling a working-as-expected compiled C program (MS/Windows x64, MinGW gcc 10.1.0). In the main function, I have the following call which passes 6 arguments to the function DotProduct: ... /...
0
votes
0answers
24 views

Trace files on disc to addresses in memory

Right now I am trying to dynamically create new NPCs for a multiplayer mod I am working on for a video game. The enemies are tied to level data and will always be the same enemies when you begin the ...
2
votes
1answer
144 views

dll injection (assembly code)

I need some tip to undrestand what is the best way to execute external code from DLL or command line. I like to add the force feedback support to different games that not support it. I can write a DLL ...
1
vote
0answers
349 views

Unable to start file “..\ntoskrnl.exe” in ollydbg [What can I do?]

Ollydbg isn't allowing me to open the executable ntoskrnl. I think im missing something but I don't know what it is (Windows 7, Ollydbg10.0,200)
2
votes
1answer
63 views

What numeric properties are used in this Unsigned Integer (64bit) -> Floating Vector (128bit) conversion?

Recently I came across the following set of vector instructions: movq xmm0, rcx punpckldq xmm0, 0x4530000043300000 subpd xmm0, 0x4330000000000000 haddpd xmm0, xmm0 The only sensible ...
1
vote
1answer
105 views

Disassemble scanf storage register

I am trying to understand scanf function a have 3 question regarding it. this is c file: #include <stdio.h> #include <stdlib.h> int main(){ int x; printf("Enter X:\n"); scanf(...

1
2 3 4 5
14