Questions tagged [assembly]

A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.

Filter by
Sorted by
Tagged with
0
votes
0answers
37 views

Can someone unpack a themida 3 exe for me ( I will pay ) [closed]

I need someone who can unpack a themida 3 packed exe. You can reply here with your informations.
0
votes
1answer
30 views

troublesome stack frame setup

I have a function with the first few instructions defined as follows: sub rsp, 0x80 lea rbp, [rsp + 0x20] mov qword [rbp + 0x58], rsi mov qword [rbp + 0x50], rbx mov qword [rbp + 0x70], rcx mov ...
0
votes
0answers
72 views

the parameter of the function

i was given the following asm code: fx: push rbp mov rbp, rsp mov DWORD PTR [rbp-4], edi mov eax, DWORD PTR [rbp-4] sal eax, 3 cmp ...
0
votes
1answer
23 views

GDB inserting breakpoint cause Segmentation Fault

I was trying to play around with gdb, and I'm especially interest in seeing how the Procedural Linkage Table(PLT) and the Global Offset Table (GOT) interact with each other. So I set some breakpoints ...
1
vote
1answer
25 views

Help understanding ARM Cortex-M4 SBC instruction

Page 88 of the ARM Cortex-M4 Generic User Guide says "The SBC instruction subtracts the value of Operand2 from the value in Rn. If the carry flag is CLEAR, the result is reduced by one." Why ...
0
votes
0answers
29 views

Access violation writing location

I am currently playing with C# and detours/trampolines using a library I found here: https://github.com/xcvd/Detours I am attempting to hook a known function in a game and then call the original ...
0
votes
1answer
77 views

Do Stack frames grow upwards?

I am currently learning RE and I came upon this piece of code which made me question whether stack frames grow upward: 0x080483f4 <main+0>: push ebp 0x080483f5 <main+1>: mov ...
0
votes
1answer
28 views

Objdump -S without assembly

I compiled my c source code and got an elf. I use "objdump -Sl" but don't need the assembly instructions. Is there a way to use objdump without the assembly part (or other tool)? for example,...
2
votes
1answer
107 views

Help with LDR, LDRD and STR instructions

The Cortex™-M3 Devices Generic User Guide explains the instruction LDRD R8, R9, [R3, #0x20] as "Load R8 from a word 8 bytes above the address in R3, and load R9 from a word 9 bytes above the ...
0
votes
1answer
71 views

Why compiler is doing this?

While I was disassembling my own C code for practice I saw an interesting point which I want to share with you guys and needs to know the answer as I always get from here. Now, the interesting point ...
0
votes
0answers
48 views

Disassembly a win Linux file

I have a file that has a compiled assembly code and being loaded into javascript code for execution. How can I “inspect” the file? I am aware of tools like immunity debugger or ollydbg but I am not ...
0
votes
0answers
19 views

radare2 can't see error/signal messages

I'm in visual mode on the debug screen. I'm stepping through some function code with the 'F7' shortcut key, when I hit a part of the code that yields an error or some kind of message, the message text ...
0
votes
1answer
53 views

Is the code like this reverse able? (from Assembly - UnityScript)

i try to reverse this code but cant figure it out what is this number mean or how to call it...
1
vote
2answers
98 views

Why eax is assigned to 'variable looked' like addresses

#include <stdio.h> int main() { int number1, number2, sum; printf("Enter two integers: "); scanf("%d %d", &number1, &number2); sum = number1 + ...
1
vote
1answer
78 views

How do you build a virtual machine to interpret machine code?

How does the parser parse the machine code? Does it go byte by byte? How does it know how many bytes to read when parsing an instruction? Does it have some sorts of tables of bytes to translate the ...
2
votes
2answers
55 views

How to test and debug x86 Assembly exceptions in NASM?

I have seen all the exception "IDs" in the Intel Manuals, and just came across sandpile's exception guide, which actually shows some hexcodes. For example, "divide by zero error": ...
0
votes
1answer
97 views

How to write these 4 example x86 assembly instructions in opcodes, according to the Intel docs?

Okay so I have been studying Chapter 2 of Volume 2 of the Intel Manuals. I have as best an understanding as I can get of the ModR/M byte, the REX byte, the SIB byte, and the general instruction ...
0
votes
1answer
54 views

How to simplify a function “calling itself's reference”

I encounter often a function calling itself (in the pseudo code) such as: result = (**(__int64 (__fastcall ***)(volatile signed __int32 *))lambda)(lambda); Since the disassembly is call qword ptr [...
4
votes
1answer
178 views

Find Decryption algorithm of an encryption algorithm

I recently work on an algorithm that encrypt some data with 8 byte length. I worked hard and I successful to get this algorithm, but I need decryption of this algorithm. How I can invert it? I guess ...
0
votes
1answer
64 views

Best way to protect source code of exe that being loaded by Assembly.Load method

I am protecting an exe that being loaded by Assembly.Load... This makes everything difficult because most obfuscators causing it to not work properly or not load at all. I used confuserEx Ameteurz ...
1
vote
0answers
42 views

Adding my own assembly code to x64 .exe

I have assembly code like this: 142cccc0c c7 43 18 MOV dword ptr [RBX + 0x18],0x4000 00 40 00 00 142cccc13 e8 a8 79 CALL FUN_141a845c0 ...
0
votes
1answer
50 views

Assuming x is a number smaller than 0xff what happens to x after the assignment LOBYTE(x)=x-1?

I understand that LOBYTE is an IDA macro for retrieving the lower byte of a variable. My question is what is the difference between the result of x=x-1 and LOBYTE(x)=x-1 when x is smaller than or ...
0
votes
1answer
41 views

Link decompiled C code to Assembly (retdec decompiled object into C code, but with many errors, i found the kill switch which i need to edit)

I am using retdec to decompile a piece of software. It has a "kill switch" to detect if it's being run in an untrusted environment, in the decompiled code it just a simple if (env_untrusted()...
1
vote
1answer
48 views

What do the following AARCH64 LDR and STR instructions do exactly?

The following instructions are part of a IDA's disassembly of an AARCH64 binary. While it is fairly obvious that the # represent pure numbers and the [] probably refer to the memory address referred ...
0
votes
1answer
64 views

How JNE work in Ollydbg?

I have a question about JNE. I use ollydbg and ReverseMe tutorial. In JNE condition, the zero flag is equal to 1. and it mean the arithmetic result is zero. Right? The Z=1 meaning the condition is ...
1
vote
3answers
129 views

What are my options to add instructions to a binary?

I am fairly new to reversing so apologies in advance if any terminology is incorrect. I am currently using ghidra on windows to look at the instructions/decompilation of a binary and I am looking to ...
1
vote
0answers
55 views

Is there a meaning to the test instruction if it isnt followed by a conditional jump?

Pasting a snippet of code I found inside a malware sample. 0040F695 push ecx 0040F696 lea ecx,dword ptr ss:[esp+8] 0040F69A sub ecx,1000 0040F6A0 sub ...
1
vote
1answer
100 views

Why does decompiling a C++ using Snowman yield some full variable names and some obfuscated ones?

I decompiled a C++ exe file using Snowman, hoping to see if it was malware or not (Although, honestly, I have no clue how to continue that - The file is really large, and the decompilation mostly ...
1
vote
1answer
133 views

Finding Ropper/ROPgadget offsets in Ghidra disassembly

How is the offsets returned from ROP gadget finders related to the files they come from? For example, if the ROP gadget finder says that a certain gadget is at offset 0x0002ae74 in libuClibc.0.9.3.so ...
0
votes
0answers
37 views

Remapping Branch Instructions After Obfuscation

Recently I've been working on a project. I've already got a hint for a problem that I had here: (Garbage Assembly Code Generationat at random offsets) however, the accepted answer's solution doesn't ...
2
votes
0answers
65 views

Where to start with reversing a custom JavaScript VM?

I have recently ran into the most heavy JavaScript obfuscation I've seen. It is using a custom VM to execute bytecodes. I have never dealt with such obfuscation, and I am wondering where I can start ...
0
votes
1answer
68 views

Converting rep movsd to to C without memcpy

So I am currently in the stages of creating binexact version of functions in decompiled code. I noticed that in this function the rep movsd is called and logically this is translated as Qmemcpy/memcpy ...
2
votes
1answer
81 views

Garbage Assembly Code Generationat at random offsets

Recently I've been working on a project. The main purpose of the project is to generated statically undetectable PE samples. Where each time one generates a PE sample, each generated sample is going ...
0
votes
1answer
76 views

I am translating some assembly code into C

I am translating some assembly code into C, and I need some help with a part of it: .equ UBRR_val = 12 ;UBRR sets baud, 12 = 19200baud at 4 MHz .def char = r17 ; Register to hold a character ...
0
votes
0answers
131 views

Binary bomb lab, can't find starting number and having problem recognizing pattern

The following is the assembly dump of a binary bomb from bomb lab Basically, you have to come up with a 6 number sequence to defuse the bomb, however, I am having trouble finding the first number and ...
1
vote
1answer
73 views

How do you recommend going for applying minor changes in an executable through a dll?

My choice of words in the title might be poor, I apologize: english is not my primary language and I have no idea how to word it better. I have a game executable to which I applied several changes, ...
1
vote
1answer
66 views

Why is the offset 16 bits?

I was told that segment:offset pairs were used to represent 20 bits. The segment is 4 bit shifted, and the value plus the offset becomes the physical address. I don't have to worry anymore at 32-bit ...
0
votes
2answers
220 views

how to use class member function defined in a exe within a dll

I have an executable (.exe) containing some classes and functions definition and plan on using those functions from within a DLL, although I know to call a regular C style function using calling ...
0
votes
0answers
66 views

Reverse Engineer Slack Workspace

Is there any Slack workspace for Reverse Engineer experts? I wanna to communicating other people who work in this issue. I am thankful if you know this workspace and invite me.
1
vote
2answers
295 views

find cheat engine pointers in ghidra

I find a pointer of my health so a function would have made the pointer and put the health in it (tell me if I'm wrong) how do I look for the function?
1
vote
2answers
51 views

How to extract port number from shellcode

I saw this shellcode and when they use the connect function they pass the port number 4444: set_address: push byte 0x05 ; retry counter push 0x0100007F ; host 127.0.0.1 push ...
1
vote
1answer
94 views

Help understanding x64 TEST instruction

I have read that TEST does a bitwise and on the two arguments. I have also read that jz and je are both equivalent, and jump if the zero flag is set. So here's the problem I'm struggling with. ...
1
vote
1answer
53 views

Where are the intel manual x86-16?

I was studying the code for x86-16 operating systems(como DOS),with a desassembler, but I can't find the intel manual on the intel website: Searching on google, only unofficial sources. Perhaps the ...
0
votes
2answers
92 views

ASM Debuggers that visualize the stack (beginner friendly)

(Cross-posted from Stack Overflow) Are there any debuggers that constantly show a visual of the stack and where everything is within it? For example, taking some random image: I use gdb for most ...
0
votes
1answer
40 views

How to calculate value inside stack segment (SS)

I have an assembly row which the following information: EBP = 006FFB50 SS = 002B When I looked on this row: mov eax,dword ptr ss:[ebp+8] I assumed that EBP + 8 = 006FFB50 + 8 = 006FFB58. But ...
0
votes
0answers
53 views

How to change value at a memory address?

I am solving Memory Corruption CTF (msp430 assembly) How can I put the value 0x3c4f inside address 0x439c (r15 from Register state)? When cmp instruction executes, we want the value at memory address ...
0
votes
0answers
36 views

Memory Corruption CTF: How to enter null character in user prompted input?

I was solving memory corruption CTF In the picture you see a memory dump. I solve the problem when the string stored at addresses 2400, 2401... 2407 (in assembly it compares 8 memory addresses ...
0
votes
3answers
200 views

How to find if a function is using registers as parameters?

The disassembly of the function Winload!CmpFindNlsData whose prototype I'm trying to construct 00893c10 8bff mov edi,edi 00893c12 55 push ebp 00893c13 8bec ...
0
votes
1answer
49 views

Need help to understand this assembly for fibonacci seq

I understand the assembly properly. I am just confused about variable 'b' and 'c'. It looks like b is stored at 12(%ebp). I conclude this from cmp 12(%ebp), %eax. If you look at func_8048516, it is ...
2
votes
2answers
276 views

how to does this instruction work: `mov qword ptr [rbp-0x30], 0x4020c5`

The following is the code snippet (shown partially) I have: q = strrchr(resolved, '/'); /* given /home/misha/docs.txt, q now pts to the last slash */ if (q != NULL) { p = q + 1; ...

1
2 3 4 5
14