Questions tagged [assembly]
A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.
563
questions
1
vote
1answer
21 views
Strange vtable setup in constructor disassembly
In a program I'm trying to recover data structures I've discovered the following strange (ARM) disassembly code:
func_1:
ldr r1, =vtable_base
str r1, [r0] ;r0 always contains ...
0
votes
1answer
36 views
Why doesn't alloca_probe follow x64 calling convention?
I was practising reverse engineering on some Windows x64 applications when I came across this function:
call alloca_probe
This alloca_probe function has some strange implementation:
EAX is used as ...
0
votes
2answers
45 views
Stack-Smashing Protection error message
Here is a very ugly c program:
#include <stdio.h>
#include <string.h>
int main(int argc, char *argv[])
{
char buffer[10];
memcpy(buffer,argv[1],strlen(argv[1]));
printf("%...
1
vote
1answer
59 views
Entry point of a program
im new to assembly and reverse engineering, i have a question regarding to how the address work.
I examined the entry point of a program using varies PE tools, the result is 0x00043b33, but when i ...
0
votes
0answers
76 views
What is, and why, “byte[ ] + number” in this IDA pseudocode?
This is a decompile of an .so file, so it originated from C or C++. Can you kindly try to explain to me what this does?
How would one rewrite this into readable code? I don't mind any programming ...
0
votes
0answers
48 views
Why is U-Boot changing this bit marked as “DO NOT CHANGE”?
While reverse engineering very early hardware initialization code of an old S3C6410 based tablet, I came across an instruction that changes a bit that the user manual (relevant info on pg. 3-50) ...
0
votes
2answers
57 views
How to Calculate ds Pointer
How do I calculate the location of the string in this sample located at offset 0x1CAD8?
The instruction at 0x140001A97 in the sample is:
0x140001A97 F2 0F1005 39C60100 movsd xmm0, qword [rip + ...
0
votes
2answers
38 views
Error when changing push 0 to push function
Hi I am sort of new to ida pro even though I've used a lot but when I push a function where a 0 used to be it gives me sp-analysis failure
I've searched for a fix for a while to no avail
help would ...
0
votes
1answer
56 views
What do square brackets do in IDA's pseudocode representation?
I've been a bit stumped recently on my decomp work. I've not dealt with C in depth nor have I dealt with IDA's pseudocode system very much at all. I understand asm, but because of how IDA merges ...
1
vote
2answers
145 views
Local variables and addition not shown in Ghidra
I am having some troubles with my learning of Assembly and reverse engineering. Specifically, I am learning about Global vs Local variables. For Global variables I have managed to get insights in ...
2
votes
1answer
247 views
Simple C program disassembled with Ghidra
I am trying to figure out what is going on with my simple example programs, when I disassemble them with Ghidra. I am not sure whether this is some strange Ghidra behaviour or something that is set by ...
-1
votes
1answer
162 views
What is the following assembly code doing? [closed]
str fp,[sp, -4]!
add fp, sp, #0
sub sp, sp, #12
str r0, [fp, #-8]
str r1 [fp, #-12]
L5:
ldr r3, [fp, #-8]
ldrb r3, [r3]
cmp r3, #0
beq .L2
ldr r3, [fp, #-12]
ldrb r3, [r3]
cmp r3, #0
beq .L2
ldr r3, [...
1
vote
1answer
54 views
Understanding operand forms
9(%rax, %rdx): What happens here? Is 9 the offset? and do you add the two registers together?
I'm reading Randal E. Bryant and David R. O'Hallaran's "Computer Systems - A programmer's Persepctive"
...
0
votes
1answer
38 views
How is `va_list` implemented in Assembler level on ARMv7 Android?
I need to extract all arguments from CallStaticObjectMethodV JNI call on ARMv7 Android at Assembler level.
Can anyone advice how is va_list implemented on low level in ARMv7 Android?
2
votes
4answers
169 views
Understanding RE output of a simple C++ program
I am trying to learn RE and I decided to explore this field by reverse engineering a simple C++ program, which I post here:
SIMPLE C++ PROGRAM
#include <iostream>
int main()
{
int value;
...
0
votes
1answer
134 views
Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking?
So i was trying to hook the ZwQuerySystemInformation or NtZwQuerySystemInformation using IAT, but i found out that these are not inside the IAT inside the memory nor in the PE file
but maybe i am not ...
0
votes
0answers
26 views
Generate pseudo code not available for some binaries in IDA Pro
I'm using IDA Pro to disassemble binaries. For some binaries, the Generate Pseudo Code option is available and works fine. However, on other binaries (using possibly a different compiler toolchain) ...
1
vote
1answer
76 views
Using IDA Pro, How can I just “edit” values, Rather than patching Offsets,
Im a part of the iOSGods community, and they make lots of cheats, but they dont really do the best at teching other people how to do that.
Those people never reply to my help support topics on ...
0
votes
0answers
59 views
Reverse engineering complex GUI desktop application
I have an old program written in WinDev which connects to a HFSQL local database. Unfortunately, the developer of this app is unavailable, and I need access to the DB. the program folder contains ...
2
votes
1answer
114 views
Generating disassembly from raw Infineon Tricore 1971 binary
Is IDA the best disassembler for a raw Tricore TC1791 (or similar) binary? I see there are several others floating around.
Which programs are going to give us the most complete ASM from a raw binary? ...
3
votes
2answers
310 views
What is the purpose of consecutive ADC instructions to a single register?
To clarify, I understand how ADC works. It's the same as a regular ADD but with an extra 1 if the Carry Flag was set.
Its use in the snippet below makes perfect sense to me since an overflow is most ...
0
votes
1answer
71 views
How to identify/extract relevant assembly from a binary?
Say I was interested in reverse engineering a specific process in a large binary, say how Google Chrome parses XML, what are some general approaches to identifying the instructions that the program ...
0
votes
0answers
86 views
What does mean cs:Memory on IDA pro? [duplicate]
I don't understand the meaning of cs: Memory.
Please help me.
2
votes
1answer
191 views
Can Ghidra do backward symbolic execution?
I am searching for a tool which can do backwards symbolic execution on x86 binaries. More specifically, I would like to give the tool a program state(PC value + registers + memory content) and have it ...
3
votes
2answers
209 views
How to use the book “Reverse Engineering for Beginners” by Yurichev?
I just finished skimming the book Art of Assembly by Randall Hyde.
So now to get my feet wet in assembly/reverse engineering reading, I started the book Reverse Engineering for Beginners. The thing ...
0
votes
0answers
41 views
0
votes
1answer
51 views
How to remove line? [Help with CTF]
Hi!
So, the program print me a Flag length is 32. As I understand call strlen convert my flag to string of length. So, I want to remove that part call strlen or somehow avoid it (maybe I'm not right ...
1
vote
1answer
41 views
How to determine target of far call in Windows 3 16-bit protected mode binary
I'm attempting to patch an old 16-bit windows 3 new executable binary which is in protected mode. It's a simple setup executable. Additionally, I'm doing this disassembly on linux and I've used ...
1
vote
1answer
165 views
Change instruction test eax, eax to text eax, 1
I'm trying to change an instruction in assembly. Try with test eax, eax to test eax, 1. I try modify the opcodes.
For example opcode of test eax, eax: 85c0
Try to understand why is 85c0 with this ...
1
vote
3answers
256 views
Cyber security student wanting to start learning reverse engineering [duplicate]
I'm really interested in learning reverse engineering. Especially in regards to malware. Any help is much appreciated
What should I learn before I start to learn reverse engineering?
Is learning C/...
1
vote
1answer
53 views
Find Reference To Resource String In Windows 3.1 16-bit DLL with IDA Pro
Experimenting Visual Basic 4 in DosBox + Windows 3.1 running on Windows 10. While I have installed SHARE.exe from MS-DOS 6.22 and it seems to run OK, it still fails to detect it.
The error I get is : ...
1
vote
1answer
150 views
How to pass param to execve to execute cat a file in x64 Asm? [closed]
I want execve("/bin/cat",["/bin/cat","/test/file"],NULL).
Here is my asm
xor %rdx, %rdx
push %rdx
sub $0x16, %rsp
movb $0x2f, 7(%rsp)
movl $0x2f6e6962, 8(%rsp)
movl $0x746163, 12(%rsp)
leaq 7(%rsp)...
1
vote
0answers
64 views
Dump the value of register into file
I've reverse engineering little game on windows 32bit.
I found a string in executable which was interesting for me (it is a board game and this string represents the fact that somebody made a move ...
1
vote
1answer
44 views
Reversing AND / shift instructions used in succession
I'm working on reversing some assembly code, and have worked it up into some pseudo code to start off with a reverse attempt. The function performs a kind of encryption on the data passed in, and I'm ...
0
votes
1answer
77 views
ACCESS_VIOLATION when attaching a debugger
I'm debugging a software and it hits access violation on wcslen function under debugger but runs normally without it.
First I thought It had some anti-debug trick, but I could not found any ...
1
vote
0answers
48 views
Reproduce compilation (ASM) output for library detection - identifying compiler, version & options used
I want to reverse a stripped x86 sample that uses a static library.
So far I could identify the library itself and narrow the version of the library used.
Now I want to use Ghidra's Function ID ...
2
votes
0answers
58 views
Determine what architecture a piece of shellcode targets
After some personal research I didn't find any possible way or a paper to explain how to determine what architecture a given piece of shellcode may targets. The only obvious way I found would be to ...
1
vote
1answer
112 views
Unexpected SEGFAULT when there's apparently nothing that would cause it
This is a from a CTF problem I'm working on. Hopefully it's appropriate to ask this question here.
Above is the GDB output when the segfault goes off. movaps is the offending instruction, meaning ...
0
votes
0answers
53 views
Possibility of converting Powershell to a lower level language
Is it possible to convert a Powershell script to ILAsm or another low level assembly language?
0
votes
1answer
61 views
ASCII strings not showing up in CPU in OllyDbg, but rather in dump
I'm pretty much new to the Reverse Engineering and assembly language. I've watched some videos about OllyDbg and cracking serial numbers in programs and I got interested in them and I want to learn ...
0
votes
1answer
50 views
Hex editing a program to change variable types
For starters guys please don't get mad at me because I really googled this question for a while and couldn't find a satisfying answer. Also if I'm asking an idiotic question, I apologize beforehand.
...
1
vote
0answers
119 views
How to embed PYZ.-00.pyz_extracted folder with entry .py file to generate exe file?
I have decompiled exe using pyextractor script and generated
these files:
PYZ-00.pyz
PYZ-00.pyz_extracted
gui
pyi_rth_tkinter
pyi_rth_multiprocessing
pyi_rth_pkgres
pyi_rth_win32comgenpy
...
0
votes
1answer
103 views
What does ds mean?
When debugging with x64dbg I sometimes see mov ss:[address] 0xAA, I know that this means: move 0xAA into memory at specified address.
But what does
mov ds:[address] 0xAA
mean?
3
votes
2answers
129 views
x86 shellcode leads to segmentation fault
I want to execute execve("/bin/dash", &"/bin/dash", NULL) on Ubuntu 64 bit with the following 32 bit shellcode:
global _start
_start:
xor eax, eax ; set eax = 0 to push a null without using ...
1
vote
0answers
48 views
IDA Pro how debug constant function returning different results?
The code below is executed with the parameters (0, 4, 0) , the first 0 being an int pointer casted to an int, and these are the same every time. After execution, a 3 digit number string is returned/...
0
votes
1answer
96 views
IDA pro - strange switch statement
I use IDA pro and along the analysis I try to understand the following function.
There is a simple switch case but it appears that all the 13 switch branches do the EXACT same thing.
Am I missing ...
2
votes
0answers
27 views
How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled?
How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled?
Context is curiosity.
I'm aware that Docker in the ...
0
votes
0answers
67 views
How to make proper stubs with Exception Handlers?
I'm trying to hook a function to output all its parameters. The hook itself works fine, but the stub somehow crashes the program. I thinks its related to the Exception Handler at the beginning of the ...
1
vote
1answer
698 views
C# Changing method body in runtime
I am trying to change a part in a third party library, it has a bug, however, there are no fixes and source code is not available as well.
At first, I tried to modify IL Opcodes directly by ...
4
votes
1answer
144 views
Reverse engineering a compression algorithm to decompress ASCII text (LZ-variant?)
Reposted from StackOverflow as is.
I'm trying to decompress a very long text block from an ARMv5t powered Gameboy Advance ROM, which was compressed using some kind of custom LZ-esque compression ...
