Questions tagged [assembly]

A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.

Filter by
Sorted by
Tagged with
1 vote
1 answer
22 views

Mov instruction from a pointed location at the beginning of a program

I am trying to learn how to read assembly code. So far I have understood the basic instructions. Now I am trying to see if I can understand a dissassembly from a linked executable. So this is an ...
user avatar
  • 123
1 vote
1 answer
39 views

Understanding disassembly information from Visual Studio's dumpbin and GNU's objdump

I usually write my code on Windows, and there are two different types of development environments, each providing their own tools to view the assembly code of an object file(*.obj) or executable (*....
user avatar
  • 123
1 vote
1 answer
93 views

help with Ghidra and rewriting assembly

I'm learning reversing and for that i use Ghidra. There is program i'm trying to modify so i can recompile it and make it work. I have a code that ghidra decompile like this: data=function(4) Going ...
user avatar
1 vote
1 answer
72 views

C instruction causing an address shift

I am trying to recreate a segment of assembly back into the C code. Below is the progress I've made so far, but I'm getting stumped on a specific section. 00000000000010049 <mysteryFunc>: ...
user avatar
0 votes
1 answer
98 views

How to get Assembly source from Bin file?

I have a binary file which is coded in assembly x86 and compiled with nasm. I used command nasm file.asm -f bin -o file.bin to compile it with nasm. I deleted the source code from disk long time ago, ...
user avatar
0 votes
1 answer
67 views

Crackmes challenge not validating all answers

I am playing with this crackme. The executable takes a numerical input (e.g., 123) and adds all the numbers. The total must be 50. However, I noticed that not all inputs adding up to 50 are validated. ...
user avatar
0 votes
0 answers
51 views

x64dbg placing a on write breakpoint on a dynamic allocated address

I am currently trying to reverse the registration scheme of a crackme. I found the jump instruction that decides if the title of the program says “registered” or “unregistered” by simply searching for ...
user avatar
0 votes
1 answer
134 views

What is xmmword in IDA Pro?

Probably a silly question. What's the xmmword means in IDA Pro?
user avatar
0 votes
1 answer
85 views

IDA - What LOC means in assembly?

I have this piece of assembly: .text:0041B322 xor eax, eax .text:0041B324 mov al, byte ptr [ebp+v13] .text:0041B327 cmp eax, 1 .text:0041B32A jz loc_41B37D .text:0041B330 xor eax, ...
user avatar
0 votes
0 answers
34 views

How to see where the heap is in IDA and how to see the segments for a process using non-source debugging

As in the title. I may be wrong about this but when using non-source debugging, all data coming from outside the source seems to be named debugxxx in the segments tab. .Rodata should be marked as ...
user avatar
  • 115
0 votes
1 answer
79 views

What's DD ? In IDA Pro

I'm new to reverse engineering with IDA. If dd is short for data, double-word, is a 32-bit value. It shows ? How do I identify the value stored in dword_140007674?
user avatar
  • 1
1 vote
1 answer
77 views

IDA API: obtain operand size prefix (x64)

I am trying to tell apart the following two instructions: 8D 02 lea eax, [rdx] // auxfix = 0x1810 67 8D 02 lea eax, [edx] // auxfix = 0x810 The only difference is in the insn_t....
user avatar
1 vote
1 answer
69 views

How to locate memory address in register $esp

000011d9 <main>: 11d9: 8d 4c 24 04 lea 0x4(%esp),%ecx 11dd: 83 e4 f0 and $0xfffffff0,%esp 11e0: ff 71 fc push -0x4(%ecx) 11e3: ...
user avatar
1 vote
2 answers
110 views

What arguments are passed into a CALL instruction?

While reverse enginnering a simple C program for training, I asked myself what was the point of those lines : LAB_001006b5 XREF[1]: ...
user avatar
  • 23
1 vote
1 answer
66 views

How to interpret memory dumps?

I'm pretty new to reverse engineering, and I decided to pick up https://microcorruption.com/ CTF to understand a bit more. The following code is from the tutorial section. In a disassembled file, we ...
user avatar
1 vote
1 answer
52 views

How to use SHL/SAL, LEA and Add for arithmetic operations

I'm having problem computing the following arithmetic questions using SHL/SAL, LEA and ADD, and hoping someone can help explain or find the best ways to apply those: Multiply a variable by 24 ...
user avatar
0 votes
1 answer
115 views

What is the meaning of jmp dword ptr off_XXXXXXXX + 8 in IDA?

What is the meaning of this kind of jmp instruction in x86 assembly in IDA? Does it mean that we should jump to the address [6CA2E9B0] + 8 or [6CA2E9B0+8]? When I follow that off_XXX, I get to the ...
user avatar
  • 1
0 votes
0 answers
49 views

Which encryption returns 192 hash value it means 96 in bytes?

I am reversing an APK and there is a signature that needs to be found. The function from where the signature is generated is present in the .so file. I did small debugging. While doing it, the ...
user avatar
1 vote
1 answer
49 views

ARM/THUMB assembly mismatch between binaries causes crash

I am trying to play around with an app for Android and every time I try to call a function (lua_gettop() from the Lua 5.1 library) from the app's address space, it hits me with ILL_ILLOPC. I made sure ...
user avatar
  • 11
0 votes
0 answers
40 views

stack explanation from https://revers.engineering/applied-re-the-stack/

I've been reading [1] (By Daax Rynd) to get an understanding the stack and at around the 12th page, I'm a bit stumped by how the value 60 from sub rsp, 60 was arrived at. [Note, all code and quotes ...
user avatar
  • 125
0 votes
0 answers
86 views

How to resolve illegal instruction for this ARM stack exploitation?

Summary I am trying to write a stack overflow exploit for ARM Cortex-A72 running Raspberry Pi OS (32-bit). Because of my choice of OS, I am restricted to the ARMv7 (32-bit) instruction set. I have ...
user avatar
1 vote
2 answers
175 views

is there a tool to decompile old exe to C?

I follow the free software implementation of OpenRCT2 from the beggining (when it was in other repository). And the first commits are a bunch of C files, these files has a lot of asm blocks of code ...
user avatar
1 vote
1 answer
30 views

what is metaData of assemblies and what is used for

hi there I hope you doing well lately, I have searched about ildasm and how to protect my DLLs from reverse engineering, so I found some great open source projects (ConfuseEx..), it works when I tried ...
user avatar
3 votes
2 answers
157 views

Why does the "MOV DWORD PTR ds:0xdeadbeef" instruction dereference the 0xdeadbeef address?

I'm reverse engineering a binary and I'm confused, because my theoretical knowledge is currently clashing with what's actually happening. I thought that this instruction writes the value 0xdeadbeef ...
user avatar
1 vote
1 answer
220 views

How to import x86asm into Ghidra?

I have some assembly code as a .txt file (i.e. a list of the instructions, stuff like this): 00000003 E8D001 call 0x1d6 00000006 A08000 mov al,[0x80] 00000009 0C00 ...
user avatar
1 vote
1 answer
46 views

How To Access Predefined Class Attributes From IDA Pro After Loading The Binary Without Debugger Attached To Process [closed]

I have this class with constructor offsets and attributes: public class example { // Fields public float Attribute_1 = 1.5f; // 0x8 public int Attribute_2 = 102 ; // 0xC // RVA: ...
user avatar
  • 21
1 vote
1 answer
113 views

A tutorial or docs to unpack a custom packed PE

I am facing an odd situation. I have a licensed game that's doing odd actions on the system. I isolated it as I could and observed the behavior both network and so forth, and I suspect it's a custom-...
user avatar
  • 11
0 votes
1 answer
83 views

ADDS(operations with S suffix) -Arm

This question was asked before here but in the answers I did get what i was looking for. Consider this: ADDS R0 RO R1 As far as I know to update the cpsr flags a subtraction has to be made. So after ...
user avatar
  • 62
1 vote
0 answers
47 views

failed to trigger packer's loader by overwritting the entry of rela.dyn on aarch64

I have implemented packer of x86_64 shared library. Briefly, a loader is injected to a shared library, and the rela.dyn entry is modified such that it points to the address of the loader. Once the ...
user avatar
  • 71
1 vote
1 answer
56 views

.data segment seems to contain code?

I have recently been trying to improve my skills on reverse engineering. So, I opened C:/Windows/System32/DriverStore/FileRepository/xboxgip.inf_amd64_90ed6b3fdc759a5b/devauthe.sys in IDA. While ...
user avatar
  • 13
0 votes
2 answers
104 views

What is the data on the start of .rdata segment?

I've been doing some reverse engineering lately trying to improve my skills and came across the following bytes on the start of .rdata segment. Filename: C:/cygwin64/bin/xkbcomp.exe Bytes: 70 D3 FD FF ...
user avatar
  • 13
2 votes
1 answer
99 views

Useless instructions in a compiled getter

This is the second time I see this kind of function today : .text:00000000000010B0 sub_10B0 proc near ; CODE XREF: sub_1120:loc_1143↓p .text:00000000000010B0 lea ...
user avatar
5 votes
1 answer
129 views

How to reverse engineer a setjmp/longjmp sequence?

I'm trying to reverse engineer the GNU libc x86 (32 bit) setjmp / longjmp (re a vuln which may allow arbitrary overwrite of the jmp_buf env. There's a great writeup of the musl setjmp but I can find ...
user avatar
0 votes
0 answers
84 views

Starting out with reverse engineering. What assembly is disassembled code

I am new to reverse engineering and want to analyze my own exe/dll files. I took a look at nasm and masm and so far I have the feeling that this is unnecessary for me to learn in detail because it ...
user avatar
  • 101
1 vote
1 answer
86 views

How to step into an invoked method from a DotNet DLL in dnSpy?

I've been analyzing a malware written in C# using dnSpy. It loaded a dotnet assembly DLL from its Resources: I tried stepping into InvokeMember function, but could not go further when hitting this ...
user avatar
0 votes
1 answer
214 views

Translate ASM code x86 32 bits in C

I have a exercise which i can't resolve it, and i need help. If anyone can help me it would be great. I have the next ASM code in x86 32 bits which i need to translate in C language: Dump of assembler ...
user avatar
  • 1
0 votes
1 answer
44 views

Branching in arm assembly

This is an example assembly code: function0() 0x0.mov r0, #1 0x8.mov r1, #20 0x10.mov r2, #6 0x18.cmp r1, #16 0x20.b function1 function1() 0x28.cmp r0, #1 0x30.b functionX functionX(...
user avatar
  • 62
2 votes
1 answer
74 views

When would a program normally transfer data between memory and coprocessor?

In the analysis of an ARM binary, when would one normally encounter transfer operations between memory and a coprocessor? These are encoded as the LDC and STC operators. Would it be common for ...
user avatar
  • 123
0 votes
2 answers
65 views

Not Understanding the FU540 Boot Process

I'm reading the manual for the SiFive FU540-C000 trying to understand the boot process, and I'm not making sense of the initial steps after power on. I'm using MSEL = 1111 based on the recommendation ...
user avatar
1 vote
0 answers
59 views

I have a dos file/database that i need to extract into MS Excel or My Sql

I have a dos file/database(decades old) that I need to extract into MS Excel or My SQL. I am using a MacBook. The file appears to have no extension. The file type I can see when I do "get info&...
user avatar
2 votes
1 answer
73 views

What C++ construct could emit such Watcom C++ 10.5 assembler listing?

Based on the assembler listings, a C++ object is locally allocated on the stack without constructing the object in the caller routine and the callee takes the address to the allocated stack space and ...
user avatar
  • 23
0 votes
1 answer
48 views

How does this function take the argument if its not pushed into the stack?

I dont understand how does the function take the argument without pushing push ebp mov ebp, esp and esp, 0FFFFFFF0h sub esp, 20h mov [esp+20h+var_20], offset aEnterX ; "Enter X:" call _puts
user avatar
1 vote
3 answers
354 views

TEST instruction and ZF flag

In the part 07 of lena151 RE tutorial, we arrive to these instructions: AL = 0 TEST AL,AL JNZ ... And notice: Because of the JNZ, AL must be different from zero when arriving here to be registered. ...
user avatar
  • 69
-1 votes
1 answer
59 views

How to find bugs in a modern desktop application with reverse enginnering?

I would like to clarify the context for the question: I have studied different types of exploiting but all the studies I have carried out were with command line programs and with functions that I ...
user avatar
  • 9
1 vote
0 answers
97 views

Confusing objdump with data as code

I am trying to confuse objdump to solve the first exercise of chapter 6 in Practical Binary Analysis. Admittedly I am super weak with inline assembler but I made a best-effort attempt and tried to get ...
user avatar
  • 111
0 votes
0 answers
94 views

What kind of code creates this function call pattern?

While using WinDbg: u/uf to disassemble functions in ntoskrnl.exe there are functions that are used in system calls and exception handling that have these weird function call patterns and I can't ...
user avatar
5 votes
1 answer
196 views

Would hiring a RE service be worth it?

Before I clarify my question, I will explain the project I'm working on, and what I've done so far so there will be a better understanding of what I'm trying to do. I'm trying to modify the UI of a ...
user avatar
2 votes
2 answers
220 views

MIPS assembly to C code

I think I'm really brain-dead and am not really sure what to do next, but I am trying to manually convert assembly code to a C program. It's not really working, but I'm not sure what is wrong. I would ...
user avatar
1 vote
1 answer
87 views

Reversing bit rotations

so I have a question regarding the assembly instructions ror and rol: Is it possible to properly reverse them? So assuming I have something like ROR EDX, 0x4 and know the contents of EDX after ...
user avatar
2 votes
2 answers
290 views

Is decompilation significantly more limited when performed on handwritten assembly?

I understand C language decompilers are designed to decompile code produced by a C compiler, and that such decompilers have a lot of limitations and sometimes are actually wrong (in the sense that ...
user avatar
  • 125

1
2 3 4 5
15