Questions tagged [assembly]
A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.
1
vote
0answers
23 views
IDA Pro how debug constant function returning different results?
The code below is executed with the parameters (0, 4, 0) , the first 0 being an int pointer casted to an int, and these are the same every time. After execution, a 3 digit number string is returned/...
0
votes
0answers
48 views
IDA pro - strange switch statement
I use IDA pro and along the analysis I try to understand the following function.
There is a simple switch case but it appears that all the 13 switch branches do the EXACT same thing.
Am I missing ...
2
votes
0answers
15 views
How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled?
How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled?
Context is curiosity.
I'm aware that Docker in the ...
0
votes
0answers
24 views
How to make proper stubs with Exception Handlers?
I'm trying to hook a function to output all its parameters. The hook itself works fine, but the stub somehow crashes the program. I thinks its related to the Exception Handler at the beginning of the ...
1
vote
1answer
91 views
C# Changing method body in runtime
I am trying to change a part in a third party library, it has a bug, however, there are no fixes and source code is not available as well.
At first, I tried to modify IL Opcodes directly by ...
4
votes
1answer
113 views
Reverse engineering a compression algorithm to decompress ASCII text (LZ-variant?)
Reposted from StackOverflow as is.
I'm trying to decompress a very long text block from an ARMv5t powered Gameboy Advance ROM, which was compressed using some kind of custom LZ-esque compression ...
0
votes
0answers
44 views
Any way to edit an ELF binary without hex? [duplicate]
So, this is a noob question, I am a complete beginner in this field, so sorry if I'm wasting your time in any way.
I wanted to know, if there is a way to edit an ELF binary without using a hex editor....
0
votes
2answers
259 views
What's happening in the assembly main function?
I'm currently inspecting a 32-bit malware executable in a WinXP VM using IDA Pro (free version). I don't understand what's happening in the main function here.
Where should I set the breakpoints (...
1
vote
2answers
64 views
segmentation fault at `mov byte [esi+7], al`
Section .text
global _start
_start:
jmp short GoToCall
shellcode:
pop esi
xor eax, eax
mov byte [esi+7], al
lea ...
0
votes
1answer
58 views
exit() syscall within shellcode not working
int main()
{
char shellcode[] = "\xbb\x00\x00\x00\x00\xb8\x01\x00\x00\x00\xcd\x80";
int *ret;
ret = (int *)&ret + 2;
(*ret) = (int)shellcode;
}
I tried to run the above shellcode ...
0
votes
0answers
14 views
SIGBUS when trying to trace functions?
I am working on a crackme (Mach-O, mac app).
Now, the app itself is weird and I honestly don't really know where to start. There are multiple threads and the main function doesn't really tell me ...
0
votes
1answer
76 views
What is this assembly doing?
I wrote a very basic crackme to learn how assembly works.
Even though I wrote it myself, I am having some trouble understanding a few pieces of the assembly:
What I know up to now is: [rbp+rax+...
0
votes
2answers
141 views
How the CMP instruction uses condition flags?
I am trying to figure out the behavior of conditional jumps (JE/JNE, JZ/JNZ) in the x86 instruction set familly.
Which condition flags CMP instruction sets and how, if the result is equal and if it ...
0
votes
1answer
59 views
How does the x86 instruction, call 135b<__x86.get_pc_thunk.ax> work?
I think the below instruction is used for position independent code. Could anyone please help me understand how it works?
call 135b<__x86.get_pc_thunk.ax>
What are the use of the below ...
0
votes
1answer
60 views
x86-64 CALL opcode + disassembly
Working a basic buffer overflow on a 64bit system and putting together some basic shellcode. The main program does a call to puts@plt. When I disassemble main in gdb, the opcodes show as:
e8 6b fe ff ...
0
votes
1answer
47 views
Is it possible to change a signed byte to an int in compiled assembly code?
I'm trying to mess around with an old game and I want to reposition a UI element.
I found the address of where the x and y position get set (It's set to an X position of 90 and a Y position of 358) ...
0
votes
2answers
54 views
IDA Pro not undefining assembly?
I am not sure if IDA is working correctly or not.
I have the instructions
call $+5
pop edi
If I understand this correctly, the program will jump forward, skipping some junk interpreted as ...
0
votes
1answer
61 views
Why Ida pseudo-code translate test as AND?
In IDA when disassembling a x86 EXE file there is a line
test byte ptr [ebp+XXX], cl
Before this line cl has a value of 0x11
The Hex-Rays decompiler plugin translates it as if (v10 &0x11).
Why ...
1
vote
2answers
91 views
Recommended way to modify assembler instructions in IDA
What is the easiest way (or is there any) to modify an instruction
inside a binary opened inside IDA and save the changes to the original?
Is there a builtin assembler who's output I can place at a ...
0
votes
2answers
69 views
Bitwise operation between byte and 1?
I am having some trouble understanding what this is doing.
This is the commented pseudocode.
mightGetUserInput(&std::__1::cin, &userInput) ; this fills the buffer with the user input, ...
1
vote
2answers
57 views
What is this assembly in the `__common` section doing?
I have stumbled upon this:
public _oret
__common:0000000100018000 _oret:
__common:0000000100018000 sub [rdi+4Fh], al
__common:0000000100018003 db 4Fh
__common:...
0
votes
0answers
24 views
How to generate .TEXT only asm output in IDM?
So I tried to do File -> Produce File -> Create ASM File. There are lots of dd stuff that I don't want. So now, what I need is, either an android app where I can view that .asm file ...
1
vote
1answer
70 views
why saved rip changed by push？
I am doing a reverse homework. see the following pictures:
as can be seen from this picture, before call push touch3, "saved rip" is at 0x5561dca8, which is equal to the current rsp(0x5561dca8).
...
1
vote
1answer
61 views
(CTF) Speed up assembly by hooking to an static function
For a CTF I have a fairly slow recursive function. I just need to cached the previous results in a dictionary and get them instead. I did it but had to reverse engineer the code. I was wondering if ...
0
votes
1answer
51 views
Executing CMP DS:[] by inline assembly inline hooks
I need to execute some instructions of library I'm using (ws2_32.dll) inside my C code, but I have a problem with a simple cmp instruction.
Followed by IDA, this instruction is:
cmp off_41AE7048, ...
0
votes
1answer
60 views
Switching from seg to text in IDA-View
actually i don't know where the problem but i will describe it
I am trying to analyse the firmware of a router and i could extract it and i got these files
libxmlapi.so
libhttpapi.so
libcfmapi.so
...
-2
votes
1answer
99 views
Can anyone please explain the following dissasembly codes?
Disassembly:
0: 31 c9 xor ecx,ecx
2: f7 e1 mul ecx
4: 51 push ecx
5: 68 2f 2f 73 68 push 0x68732f2f
a: 68 2f 62 69 ...
1
vote
2answers
58 views
Calculation with not defined variables?
I am new to reverse engineering and try to solve a crackme with radare2.
My problem is understanding of the following lines:
| 0x000007a9 c745b8000000. mov dword [var_48h], 0
| ...
1
vote
2answers
120 views
Jump in the middle trick
I'm reversing a program that "hides" some instructions using the jump in the middle trick. This trick is a jump to a middle of an instruction, whereas the real address actually contains another opcode....
0
votes
1answer
112 views
What is this assembly code, fld qword ptr code here doing? Also, how do I store my own value?
I was reverse engineering a game using cheat engine and trying to trace where my health gets reduced.
Basically the health gets stored in the stack and then pops out for displaying on the screen. ...
1
vote
1answer
109 views
Understand the CPU cycles of x86 instruction bsr/bsf
I am on the hook to analysis some "timing channels" of some x86 binary code. I am posting one question to comprehend bsf/bsr opcode.
So high-levelly, these two opcodes can be modeled as a "loop", ...
1
vote
0answers
28 views
Set Breakpoint on ActiveX Property Being Set (No Symbols)
A program is loading an VB6 based ActiveX control that has several property, for example ConnectionString.
The application is dynamically generating the values it provides at runtime, so it is not ...
4
votes
2answers
240 views
Which operators use sal, shl, sar or shr
Which operators in C language would result in assembly commands such as sal, shl, sar or shr for example?
0
votes
1answer
94 views
How to detect md5 and sha256?
I use FindCrypt2 Ida plugin but it detect md4 and not md5 , and not detect sha256.
How can I detect md5 in assembly?
How can I detect sha256 in assembly?
thanks
0
votes
1answer
84 views
why code at .rodata executes [closed]
How come the following code executes if buf* is @ rodata segment ?
#include <stdio.h>
char *buf[] = {
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\
\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\...
1
vote
0answers
49 views
How can a segfault happen during the libc exit call on Linux?
I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge.
While testing, I have noticed ...
0
votes
1answer
48 views
Calculate LEA operand
I have those opcodes on 64 bits:
48 8D 35 45 CE FF FF >>> lea rsi, [rip - 0x31bb].
How can I get the 0x31bb value from those opcodes and how can I know if I have a + sign or a - sign ...
1
vote
0answers
62 views
Help understanding ARM Assembly example code - loops, set flags and code mnemonics
This is the example code:
_start:
LDR r0, =n
LDR r0, [r0]
LDR r1, =array1
MOV r2, #0
LDR r4, =array2
loop:
LDR r3, [r1], #4
CMP r3, #58
BGT a_point
CMP r3, #47
BLT a_point
SUB r3, r3, #0x30
STR r3, [...
0
votes
1answer
92 views
How do I go about overriding a function internally defined in a binary on Linux?
To be specific, I cannot recompile this binary, nor do I have access to the sourcecode.
The functions are not defined within a shared library.
So, how can I go about changing a function, or ...
0
votes
1answer
149 views
How int3 looks like in C
This is assembly code that can catch debugger with int 3 :
MOV ECX, ExceptionHandler
MOV DWORD PTR FS:[0], ExceptionHandler
INT3
///there is debugger!!!
ExceptionHandler:
////no ...
-1
votes
1answer
151 views
Understanding assembly code: “mov dword” and “mov qword” in main.c
I have just converted this piece of code in assembly:
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char** argv) {
return (1);
}
Here are my questions:
Once you push ...
-1
votes
1answer
293 views
how should i change an instruction to NOP in IDA?
I am new with IDA assembler and i used to work with hopper app.
the problem is i can't change instruction in IDA from something like CBNZ to NOP.
is there any button to do this? i can't find anything ...
0
votes
2answers
194 views
How to identify base64 encode/decode in assembly
How to identify in assembly base 64 encode/decode with Ida. Is there any magic constant that I can search? Or maybe a plugin that find that?
FindCrypt2 Ida plugin not find that
0
votes
1answer
429 views
Meaning of cmp byte ptr [EBP-9], 0
Looking to find the meaning of this statement. From what I understand its comparing 0 with value of EBP register - 9, but I don't understand what the byte ptr does.
1
vote
2answers
143 views
Lots of mov instructions into ebp+offset - What is happening?
While learning RE I have come across this large segment of instructions that contains a majority of mov [ebp+offset], value instructions. I believe that ebp + offset are local variables? I think? ...
6
votes
1answer
315 views
Simplifying assembly
I'm analysing some binary trace, it's pretty much obfuscated. What I need to do is to understand work flow of its alghoritms. However I cannot find any reliable tool which would help me with that.
I ...
1
vote
1answer
52 views
Explenation about opcode and operand
I need an explanation about the term "opcode". I have found this :
An opcode is binary or hex value of the machine instruction in the cpu
instruction set.
If I understand correctly the ...
1
vote
1answer
116 views
What purpose of MOVZX EAX,AX after MOVZX EAX, WORD PTR [RBP+ADDR.SA_DATA]?
I thought it was strange when I was looking at the code below. The first instruction clearly has completed the task of data transfer and expansion into 16 bits. Why is there a "mov Eax,ax" in the ...
-1
votes
1answer
442 views
How to convert assembly to pseudo code? [closed]
I have the following assembly. I don't know how to follow assembly. I was wondering if there is a way to convert assembly to a human readable pseudo code or better yet C code:
init:
mov eax, [ebp+...
2
votes
1answer
98 views
Call instruction changed while running
While debugging and reverse-engineering my exe, I have found a very weird thing.
call ds:GetModuleFileNameA
This call instruction is formed with below hex bytes in IDA.
FF 15 24 C0 41 00
(I think ...
