Questions tagged [assembly]
A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.
665
questions
1
vote
0answers
29 views
Adding my own assembly code to x64 .exe
I have assembly code like this:
142cccc0c c7 43 18 MOV dword ptr [RBX + 0x18],0x4000
00 40 00 00
142cccc13 e8 a8 79 CALL FUN_141a845c0 ...
0
votes
1answer
42 views
Assuming x is a number smaller than 0xff what happens to x after the assignment LOBYTE(x)=x-1?
I understand that LOBYTE is an IDA macro for retrieving the lower byte of a variable. My question is what is the difference between the result of x=x-1 and LOBYTE(x)=x-1 when x is smaller than or ...
1
vote
1answer
35 views
Link decompiled C code to Assembly (retdec decompiled object into C code, but with many errors, i found the kill switch which i need to edit)
I am using retdec to decompile a piece of software. It has a "kill switch" to detect if it's being run in an untrusted environment, in the decompiled code it just a simple
if (env_untrusted()...
1
vote
1answer
29 views
What do the following AARCH64 LDR and STR instructions do exactly?
The following instructions are part of a IDA's disassembly of an AARCH64 binary. While it is fairly obvious that the # represent pure numbers and the [] probably refer to the memory address referred ...
0
votes
1answer
45 views
How JNE work in Ollydbg?
I have a question about JNE.
I use ollydbg and ReverseMe tutorial.
In JNE condition, the zero flag is equal to 1. and it mean the arithmetic result is zero. Right?
The Z=1 meaning the condition is ...
2
votes
1answer
53 views
What are my options to add instructions to a binary?
I am fairly new to reversing so apologies in advance if any terminology is incorrect.
I am currently using ghidra on windows to look at the instructions/decompilation of a binary and I am looking to ...
1
vote
0answers
54 views
Is there a meaning to the test instruction if it isnt followed by a conditional jump?
Pasting a snippet of code I found inside a malware sample.
0040F695 push ecx
0040F696 lea ecx,dword ptr ss:[esp+8]
0040F69A sub ecx,1000
0040F6A0 sub ...
1
vote
1answer
58 views
Why does decompiling a C++ using Snowman yield some full variable names and some obfuscated ones?
I decompiled a C++ exe file using Snowman, hoping to see if it was malware or not (Although, honestly, I have no clue how to continue that - The file is really large, and the decompilation mostly ...
1
vote
1answer
78 views
Finding Ropper/ROPgadget offsets in Ghidra disassembly
How is the offsets returned from ROP gadget finders related to the files they come from? For example, if the ROP gadget finder says that a certain gadget is at offset 0x0002ae74 in libuClibc.0.9.3.so ...
0
votes
0answers
33 views
Remapping Branch Instructions After Obfuscation
Recently I've been working on a project. I've already got a hint for a problem that I had here: (Garbage Assembly Code Generationat at random offsets)
however, the accepted answer's solution doesn't ...
2
votes
0answers
53 views
Where to start with reversing a custom JavaScript VM?
I have recently ran into the most heavy JavaScript obfuscation I've seen. It is using a custom VM to execute bytecodes. I have never dealt with such obfuscation, and I am wondering where I can start ...
0
votes
1answer
57 views
Converting rep movsd to to C without memcpy
So I am currently in the stages of creating binexact version of functions in decompiled code. I noticed that in this function the rep movsd is called and logically this is translated as Qmemcpy/memcpy ...
1
vote
1answer
74 views
Garbage Assembly Code Generationat at random offsets
Recently I've been working on a project. The main purpose of the project is to generated statically undetectable PE samples. Where each time one generates a PE sample, each generated sample is going ...
0
votes
1answer
74 views
I am translating some assembly code into C
I am translating some assembly code into C, and I need some help with a part of it:
.equ UBRR_val = 12 ;UBRR sets baud, 12 = 19200baud at 4 MHz
.def char = r17 ; Register to hold a character
...
0
votes
0answers
53 views
Binary bomb lab, can't find starting number and having problem recognizing pattern
The following is the assembly dump of a binary bomb from bomb lab Basically, you have to come up with a 6 number sequence to defuse the bomb, however, I am having trouble finding the first number and ...
1
vote
1answer
72 views
How do you recommend going for applying minor changes in an executable through a dll?
My choice of words in the title might be poor, I apologize: english is not my primary language and I have no idea how to word it better.
I have a game executable to which I applied several changes, ...
1
vote
1answer
64 views
Why is the offset 16 bits?
I was told that segment:offset pairs were used to represent 20 bits. The segment is 4 bit shifted, and the value plus the offset becomes the physical address. I don't have to worry anymore at 32-bit ...
0
votes
2answers
155 views
how to use class member function defined in a exe within a dll
I have an executable (.exe) containing some classes and functions definition and plan on using those functions from within a DLL, although I know to call a regular C style function using calling ...
0
votes
0answers
60 views
Reverse Engineer Slack Workspace
Is there any Slack workspace for Reverse Engineer experts?
I wanna to communicating other people who work in this issue.
I am thankful if you know this workspace and invite me.
1
vote
2answers
168 views
find cheat engine pointers in ghidra
I find a pointer of my health so a function would have made the pointer and put the health in it (tell me if I'm wrong) how do I look for the function?
1
vote
2answers
50 views
How to extract port number from shellcode
I saw this shellcode and when they use the connect function they pass the port number 4444:
set_address:
push byte 0x05 ; retry counter
push 0x0100007F ; host 127.0.0.1
push ...
1
vote
1answer
83 views
Help understanding x64 TEST instruction
I have read that TEST does a bitwise and on the two arguments. I have also read that jz and je are both equivalent, and jump if the zero flag is set. So here's the problem I'm struggling with. ...
1
vote
1answer
48 views
Where are the intel manual x86-16?
I was studying the code for x86-16 operating systems(como DOS),with a desassembler, but I can't find the intel manual on the intel website:
Searching on google, only unofficial sources.
Perhaps the ...
0
votes
2answers
77 views
ASM Debuggers that visualize the stack (beginner friendly)
(Cross-posted from Stack Overflow)
Are there any debuggers that constantly show a visual of the stack and where everything is within it? For example, taking some random image:
I use gdb for most ...
0
votes
1answer
31 views
How to calculate value inside stack segment (SS)
I have an assembly row which the following information:
EBP = 006FFB50
SS = 002B
When I looked on this row:
mov eax,dword ptr ss:[ebp+8]
I assumed that EBP + 8 = 006FFB50 + 8 = 006FFB58.
But ...
0
votes
0answers
47 views
How to change value at a memory address?
I am solving Memory Corruption CTF (msp430 assembly)
How can I put the value 0x3c4f inside address 0x439c (r15 from Register state)? When cmp instruction executes, we want the value at memory address ...
0
votes
0answers
22 views
Memory Corruption CTF: How to enter null character in user prompted input?
I was solving memory corruption CTF
In the picture you see a memory dump. I solve the problem when the string stored at addresses 2400, 2401... 2407 (in assembly it compares 8 memory addresses ...
0
votes
3answers
170 views
How to find if a function is using registers as parameters?
The disassembly of the function Winload!CmpFindNlsData whose prototype I'm trying to construct
00893c10 8bff mov edi,edi
00893c12 55 push ebp
00893c13 8bec ...
0
votes
1answer
48 views
Need help to understand this assembly for fibonacci seq
I understand the assembly properly. I am just confused about variable 'b' and 'c'. It looks like b is stored at 12(%ebp). I conclude this from cmp 12(%ebp), %eax. If you look at func_8048516, it is ...
1
vote
2answers
157 views
how to does this instruction work: `mov qword ptr [rbp-0x30], 0x4020c5`
The following is the code snippet (shown partially) I have:
q = strrchr(resolved, '/'); /* given /home/misha/docs.txt, q now pts to the last slash */
if (q != NULL) {
p = q + 1; ...
2
votes
2answers
252 views
Getting the algorithm used inside this .so file
I'v been trying to reverse-engineer a BLE "Smartlock" to open it using Python instead of the App that it came with.
I progressed quite far with disassembling the SDK they provide, ...
0
votes
1answer
71 views
What is physical address on a pe reader?
What is physical address on a Pe file? I had search on the microsoft website article about pe files and don't have found anything.
1
vote
1answer
84 views
Trying to reverse engineer CmpFindNlsData of winload
I have a basic understanding of assembly language and I'm unable to perfectly define the algorithm of winload!CmpFindNlsData looking at the disassembly. Basically I need to understand how NLS data is ...
0
votes
1answer
37 views
what means “ilegal use of registers”?
I read pe program using a Pe Reader to view all sections, the .text section starts is "0x0001000":
What is in the pe program reader:
And is this what i see on the debugguer :
0
votes
2answers
99 views
What should I learn in order to reverse elf64 binary files
I'm a little confused. I am using a Linux based system (Ubuntu), 64-bit. and I want to start and reverse 64elf binary files, but there is a lot of things I want to know before. just to be clear, If I ...
1
vote
1answer
153 views
I want to insert instructions but don't have enough space to do so
Sorry if it is a very basic question/bad place to ask/for my bad english.
I'm using Ghidra to patch instructions inside the binary of a game. Most of the time I could find some undefined bytes ...
1
vote
0answers
36 views
Statically injecting translated NASM assembly into existing ELF binary
I'm trying to statically patching ELF binaries in order to incorporate code that can help provide run-time protection.
In an effort to save time writing and debugging assembly, I took the following no-...
0
votes
1answer
91 views
How can I modify these?
So I'm onto something interesting, I asked the less direct way but failed to meet the requirements in terms of explanation
So here it is, how would I go about editing these the same way I would go ...
0
votes
0answers
46 views
Change value of memory in a debugger?
So I got this app loaded in x64, there is a function, let's say
"HeatGainedPerShot", which is basically the value which an object gains everytime it fires,
Such a value would normally exist ...
0
votes
0answers
135 views
Reversing a bootloader code (MIPS)
I'm trying to reverse a bootloader code extracted from raw memory dump of data modem. I think I extracted it correctly.
Bootloader size 32768 bytes. Device use BCM3382 CPU (MIPS32) big-endian(?), eCos ...
2
votes
0answers
93 views
Devirtualization
I've recently become pretty fascinated with virtualization and retrieving original code from a randomly generated byte code, such as protectors like VMProtect/etc. But I can not get a grasp on how it ...
1
vote
1answer
97 views
how could i follow a system call from a dll -> kernel driver syscall
basically i would like to follow (system calls / internal calls) that basically lands in the kernel i would like for example to debug a specific dll ex : ntdll.dll and follow it to (NtXXX) function ...
0
votes
0answers
51 views
strange results with IDA (some function different Pseudo Code)
After show the pseudo code in IDA I see different results:
The function 4436C0 show different pseudo code.
For example:
result = sub_4376C0("vvcbb3.wav",v8,0);
and
result = sub_4376C0((int)...
1
vote
1answer
117 views
How do disassemblers work?
I have 2 questions regarding this, but feel free to elaborate more if you want to, I'm really interested in this topic:
Do they really just read byte by byte until they get a valid instruction? How ...
0
votes
2answers
63 views
Where do arguments 5 and 6 go in this Microsoft x64 function call?
I'm disassembling a working-as-expected compiled C program (MS/Windows x64, MinGW gcc 10.1.0). In the main function, I have the following call which passes 6 arguments to the function DotProduct:
...
/...
0
votes
0answers
24 views
Trace files on disc to addresses in memory
Right now I am trying to dynamically create new NPCs for a multiplayer mod I am working on for a video game. The enemies are tied to level data and will always be the same enemies when you begin the ...
2
votes
1answer
144 views
dll injection (assembly code)
I need some tip to undrestand what is the best way to execute external code from DLL or command line.
I like to add the force feedback support to different games that not support it.
I can write a DLL ...
1
vote
0answers
349 views
Unable to start file “..\ntoskrnl.exe” in ollydbg [What can I do?]
Ollydbg isn't allowing me to open the executable ntoskrnl. I think im missing something but I don't know what it is (Windows 7, Ollydbg10.0,200)
2
votes
1answer
63 views
What numeric properties are used in this Unsigned Integer (64bit) -> Floating Vector (128bit) conversion?
Recently I came across the following set of vector instructions:
movq xmm0, rcx
punpckldq xmm0, 0x4530000043300000
subpd xmm0, 0x4330000000000000
haddpd xmm0, xmm0
The only sensible ...
1
vote
1answer
105 views
Disassemble scanf storage register
I am trying to understand scanf function a have 3 question regarding it.
this is c file:
#include <stdio.h>
#include <stdlib.h>
int main(){
int x;
printf("Enter X:\n");
scanf(...
