Questions tagged [assembly]
A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.
586
questions
0
votes
0answers
27 views
Baremetal Programming on Smart Phones
After doing a little baremetal programming on TI AM3358 which is an ARM Cortex-A processor available on beaglebone black, Now I am curious to know is that possible on smart phones as they also have ...
0
votes
0answers
43 views
How to detect the language of an assembly code? How radare does it?
I've opened an executable in Radare2 (on Cutter) and it says that it was written in C language. Is it just a guess or there is a good way to find in which language a binary was written?
4
votes
3answers
269 views
ARMv8 (AArch64, ARM64) opcodes list
I'm sorry for such as questions where answer would seem to be easily searched in google...
Some time ago I have seen table/list of ARMv8 instructions with opcodes and it was perfect, but I lost link. ...
0
votes
1answer
45 views
LDR specifier combination UXTW
Sorry, if this question seems stupid, but I am new in arm64 and next 2 assembly lines seriously damaged my brain:
LDR W0, [X30,W0,UXTW#2]
ADD X30, X30, W0,UXTW
I have readed ...
1
vote
1answer
55 views
Is there a handy assembly to mock app conversion tool?
It might be too silly of a question, but here you go.
Suppose you have some software that contains a tricky nested assembly sequence (like this one) you try to reverse engineer. brain*[pen&paper] ...
0
votes
0answers
60 views
Why does this execve shellcode work with this argv?
I wrote the following program in fasm, and am using Evan's Debugger on Ubuntu to debug it:
format ELF64 executable 3
segment readable executable
entry $
mov rbp, rsp
sub rsp, 32
mov rax, 'this a t'
...
0
votes
0answers
25 views
Reading float value within delphi binary
I have a Delphi program that I am trying to read data from. the data is stored in a TEIDataWindow, this particular snippet of code comes from the update method. the data is presented in the form of an ...
2
votes
2answers
163 views
Static analysis obfuscated code
I'm reversing a code that is heavily obfuscated. It uses opaque predicates, call stack tampering, junk code and control flow flattering.
Call stack tampering uses indirect branches (push register / ...
2
votes
1answer
49 views
Finding the correct input of an executable to print out the flag. IDA 7
I'm trying to understand the behaviour of the code below so I can determine what input will trigger the "YOU DID IT !~!" string (at the end of the program instructions):
.text:00C21034 Buf= byte ptr -...
3
votes
1answer
47 views
CreateTimerQueueTimer arguments differs from WinAPI
I was reading a man page about CreateTimerQueueTimer.
BOOL CreateTimerQueueTimer(
PHANDLE phNewTimer,
HANDLE TimerQueue,
WAITORTIMERCALLBACK Callback,
PVOID ...
2
votes
1answer
94 views
change compare function in assembly and .exe stopped working x64dbg
I'm trying to bypass (crack) a very old software that require license in order to unlock all the features
i was digging in the lines with a little bit of knowledge in assembly
and i found the line ...
2
votes
1answer
138 views
bypass license of very old software, Access violation (C0000005) x32dbg
I'm trying to bypass the license of a very old software that i was using many years ago, now, the company of that software is closed and i can't get a license
so, with a little bit of knowledge in ...
2
votes
1answer
34 views
CMP ecx with DAT_
So I encountered this bit of assembly code:
cmp dword ptr [ECX + 0x24c], DAT_007c6bc0
It's comparing ECX + 0x24c with DAT_007c6bc0. If they are not equal, it will just return from the function.
I ...
3
votes
0answers
50 views
Uniden FW Hacking
I recently purchased a Uniden Radio Scanner (BCD325P2). I looked at the Windows FW Update App in dnSpy, then pulled the FW bin directly.
FCC Parts List gets me R5F5631BCDFP#V0, which appears to be a ...
1
vote
2answers
187 views
Why Windows Defender is not able to get rid of this trojan?
Every time I start my PC, Windows Defender shows a notification saying that the virus Trojan:Win32/Ceprolad.A was deleted, which means indeed that it wasn't, as most antivirus I've tried these days (...
0
votes
1answer
56 views
How to Modify CBZ Branch in ARM64?
If I want after running the CBZ W0, loc_C5C8 command
Run to the ADRP X8,#selRef_curent_version@PAGE command
regardless of the condition (in picture), what should I do?
0
votes
0answers
35 views
is it possible to write the first byte at the entry point of a process dll module?
Hello
so my problem is kind of weird ..
im trying to write memory using this :
WriteProcessMemory(intptr pHandle, intptr lpBaseAddr, byte[] lpBuffer, uint nSize, int lpNbrOfBytesWritten);
have a ...
2
votes
1answer
81 views
What are some useful strategies for understanding undocumented assembly language?
What are some useful strategies for tackling a list of undocumented assembly language instructions? Even as someone who writes assembly code, I find it to be challenging at times to understand someone ...
2
votes
1answer
60 views
How can I objdump the assembler code of dynamically linked functions in a dynamically linked executable?
Compiling a minimal C++ program:
g++ -g -Wall -Wextra -std=c++17 -o prog main.cpp
int main()
{
}
Performing an objdump -C -D prog of all sections I am given the following output:
prog: file ...
0
votes
0answers
42 views
Setting struct according to offset relative to struct base
I would like to know whether it's possible to define a struct according to offsets from base in Hopper.
Assuming there is a register in the assembly code, that I believe it represent the instance ...
0
votes
0answers
66 views
jmp to 4 byte address in shellcode
I'm playing around with the PE header and the Import Address Table. I wrote a dummy program that calls MessageBoxA with some retard parameters. After successfully replacing the MessageBoxA function ...
0
votes
1answer
32 views
OllyDbg: Constant does not fit into operand
I'm trying to assemble this instruction:
I'm not being able to do it..
When I test with MOV AX,55000 I get this error:
I tested before in Cheat Engine, and this is working as AOB injection: MOV AX,#...
3
votes
3answers
192 views
Strange vtable setup in constructor disassembly
In a program I'm trying to recover data structures I've discovered the following strange (ARM) disassembly code:
ctor_1:
ldr r1, =vtable_base
str r1, [r0] ;r0 always contains ...
0
votes
1answer
45 views
Why doesn't alloca_probe follow x64 calling convention?
I was practising reverse engineering on some Windows x64 applications when I came across this function:
call alloca_probe
This alloca_probe function has some strange implementation:
EAX is used as ...
3
votes
3answers
87 views
Stack-Smashing Protection error message
Here is a very ugly C program:
#include <stdio.h>
#include <string.h>
int main(int argc, char *argv[])
{
char buffer[10];
memcpy(buffer,argv[1],strlen(argv[1]));
printf("%...
1
vote
1answer
79 views
Entry point of a program
im new to assembly and reverse engineering, i have a question regarding to how the address work.
I examined the entry point of a program using varies PE tools, the result is 0x00043b33, but when i ...
0
votes
2answers
106 views
IDA Pro, replace exit() with continue;
This is the function:
loc_BA060: ; status
xor edi, edi
call _exit
How can one replace exit with continue?
0
votes
1answer
103 views
What is, and why, “byte[ ] + number” in this IDA pseudocode?
This is a decompile of an .so file, so it originated from C or C++. Can you kindly try to explain to me what this does?
How would one rewrite this into readable code? I don't mind any programming ...
0
votes
0answers
55 views
Why is U-Boot changing this bit marked as “DO NOT CHANGE”?
While reverse engineering very early hardware initialization code of an old S3C6410 based tablet, I came across an instruction that changes a bit that the user manual (relevant info on pg. 3-50) ...
0
votes
2answers
61 views
How to Calculate ds Pointer
How do I calculate the location of the string in this sample located at offset 0x1CAD8?
The instruction at 0x140001A97 in the sample is:
0x140001A97 F2 0F1005 39C60100 movsd xmm0, qword [rip + ...
0
votes
2answers
43 views
Error when changing push 0 to push function
Hi I am sort of new to ida pro even though I've used a lot but when I push a function where a 0 used to be it gives me sp-analysis failure
I've searched for a fix for a while to no avail
help would ...
0
votes
1answer
73 views
What do square brackets do in IDA's pseudocode representation?
I've been a bit stumped recently on my decomp work. I've not dealt with C in depth nor have I dealt with IDA's pseudocode system very much at all. I understand asm, but because of how IDA merges ...
1
vote
2answers
328 views
Local variables and addition not shown in Ghidra
I am having some troubles with my learning of Assembly and reverse engineering. Specifically, I am learning about Global vs Local variables. For Global variables I have managed to get insights in ...
2
votes
1answer
532 views
Simple C program disassembled with Ghidra
I am trying to figure out what is going on with my simple example programs, when I disassemble them with Ghidra. I am not sure whether this is some strange Ghidra behaviour or something that is set by ...
-1
votes
1answer
173 views
What is the following assembly code doing? [closed]
str fp,[sp, -4]!
add fp, sp, #0
sub sp, sp, #12
str r0, [fp, #-8]
str r1 [fp, #-12]
L5:
ldr r3, [fp, #-8]
ldrb r3, [r3]
cmp r3, #0
beq .L2
ldr r3, [fp, #-12]
ldrb r3, [r3]
cmp r3, #0
beq .L2
ldr r3, [...
1
vote
1answer
62 views
Understanding operand forms
9(%rax, %rdx): What happens here? Is 9 the offset? and do you add the two registers together?
I'm reading Randal E. Bryant and David R. O'Hallaran's "Computer Systems - A programmer's Persepctive"
...
0
votes
1answer
44 views
How is `va_list` implemented in Assembler level on ARMv7 Android?
I need to extract all arguments from CallStaticObjectMethodV JNI call on ARMv7 Android at Assembler level.
Can anyone advice how is va_list implemented on low level in ARMv7 Android?
2
votes
4answers
185 views
Understanding RE output of a simple C++ program
I am trying to learn RE and I decided to explore this field by reverse engineering a simple C++ program, which I post here:
SIMPLE C++ PROGRAM
#include <iostream>
int main()
{
int value;
...
0
votes
1answer
185 views
Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking?
So i was trying to hook the ZwQuerySystemInformation or NtZwQuerySystemInformation using IAT, but i found out that these are not inside the IAT inside the memory nor in the PE file
but maybe i am not ...
0
votes
0answers
31 views
Generate pseudo code not available for some binaries in IDA Pro
I'm using IDA Pro to disassemble binaries. For some binaries, the Generate Pseudo Code option is available and works fine. However, on other binaries (using possibly a different compiler toolchain) ...
1
vote
1answer
176 views
Using IDA Pro, How can I just “edit” values, Rather than patching Offsets,
Im a part of the iOSGods community, and they make lots of cheats, but they dont really do the best at teching other people how to do that.
Those people never reply to my help support topics on ...
0
votes
0answers
71 views
Reverse engineering complex GUI desktop application
I have an old program written in WinDev which connects to a HFSQL local database. Unfortunately, the developer of this app is unavailable, and I need access to the DB. the program folder contains ...
2
votes
1answer
215 views
Generating disassembly from raw Infineon Tricore 1971 binary
Is IDA the best disassembler for a raw Tricore TC1791 (or similar) binary? I see there are several others floating around.
Which programs are going to give us the most complete ASM from a raw binary? ...
3
votes
2answers
329 views
What is the purpose of consecutive ADC instructions to a single register?
To clarify, I understand how ADC works. It's the same as a regular ADD but with an extra 1 if the Carry Flag was set.
Its use in the snippet below makes perfect sense to me since an overflow is most ...
0
votes
1answer
74 views
How to identify/extract relevant assembly from a binary?
Say I was interested in reverse engineering a specific process in a large binary, say how Google Chrome parses XML, what are some general approaches to identifying the instructions that the program ...
0
votes
0answers
155 views
What does mean cs:Memory on IDA pro? [duplicate]
I don't understand the meaning of cs: Memory.
Please help me.
2
votes
1answer
246 views
Can Ghidra do backward symbolic execution?
I am searching for a tool which can do backwards symbolic execution on x86 binaries. More specifically, I would like to give the tool a program state(PC value + registers + memory content) and have it ...
3
votes
2answers
230 views
How to use the book “Reverse Engineering for Beginners” by Yurichev?
I just finished skimming the book Art of Assembly by Randall Hyde.
So now to get my feet wet in assembly/reverse engineering reading, I started the book Reverse Engineering for Beginners. The thing ...
0
votes
0answers
47 views
0
votes
1answer
52 views
How to remove line? [Help with CTF]
Hi!
So, the program print me a Flag length is 32. As I understand call strlen convert my flag to string of length. So, I want to remove that part call strlen or somehow avoid it (maybe I'm not right ...
