Questions tagged [assembly]
A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.
1
vote
0answers
34 views
getting %localappdata% in asm
I have an old windows x86 application that no longer works properly since windows 8. This app creates files within its own folders for things like app settings. Unfortunately, Microsoft no longer ...
2
votes
0answers
71 views
Why is the process crashing after executing my injected payload?
I tried the following payload for APC injection in Windows.
It gets executed successfully(pops up a MessageBox) but the process crashes after the execution of payload.
What could be the possible ...
1
vote
2answers
66 views
Why there are two different shellcodes for bin/sh with much different syntax and which one is better to use? (x86)
I have found two shellcodes for spawning /bin/sh which are much different from each other. The second one is hardly ever found on the net, and it mostly comes up in reverse engineering websites:
1. "\...
2
votes
1answer
125 views
Converting Assembly x64 code to C
I have the following code:
0000000000400526 <main>:
400526: 55 push rbp
400527: 48 89 e5 mov rbp,rsp
40052a: 48 83 ec 20 sub ...
3
votes
1answer
168 views
How can I convert this assembly code (x64) to C?
I have the following assembly (x64) function:
400700: sub rsp,0x18
400704: mov QWORD PTR [rsp+0x8],rdi
400709: cmp QWORD PTR [rsp+0x8],0x0
40070f: jne 400718 <bar+0x18>
400711: mov eax,0x0
...
1
vote
1answer
82 views
Figuring out what a segment of assembly code does
I have the following assembly code:
0000000000400711 <foo>:
400711: 55 push rbp
400712: 48 89 e5 mov rbp,rsp
400715: 48 89 7d e8 ...
0
votes
1answer
77 views
Analyze raw assembly using IDA Pro
I have a raw assembly dump i.e.
.intel_syntax noprefix
.bits 32
.global main
main:
push ebp
...
And I know it's Intel x86 and the original function was most likely written in C. Now the ...
0
votes
1answer
156 views
What does this assembly language program output?
I have been struggling with this for a long time. I have the following assembly language code:
.intel_syntax noprefix
.bits 32
.global asm0
asm0:
push ebp
mov ebp,esp
mov eax,DWORD ...
-1
votes
1answer
52 views
How can I decompile the CC2650 .hex file to C?
I want to decompile it to C, or at least assembly the CC2650 hex file (Bluetooth Low Energy Sensor Tag), that provide TI.
My goal is to know the specific way used by CC2650 to generate the LTK.
I'll ...
1
vote
1answer
29 views
Explanation of SBB instruction
I have this Asm from a book that suppose to do a Boolean cast: rax := rax ? 1 : 0
1. neg rax
2. sbb rax,rax
3. neg rax
But as i understand this code and the instructions (below), this ...
4
votes
1answer
83 views
Need help identifying main processor for Roland synthesizer
I desperately need help figuring out the ic chips in this unit so I can view the firmware in ida pro.
So the unit is a roland gr-55 guitar synthesizer and i'm trying to disassemble the firmware into ...
1
vote
2answers
54 views
.NET assembly IDA PRO, using LDSTR IL op code, how to patch a string?
I'm trying to patch a string. So right now I'm trying to replace instruction LDSTR with LDSTR "mystring"; however, I have been unsuccessful. After assembling the LDSTR op code, I don't quite ...
0
votes
0answers
24 views
Compare / highlight differences between 2 .dll files [duplicate]
so I have 2 .dlls and I was thinking if it's possible to easily compare/highlight the things that are different between the two with IDA or anything else you have in mind that could make that job ...
1
vote
2answers
66 views
Getting opcode Length , How to
I am apparently not very good with assembly as I am novice to somethings! Hence i wanted to make a question again.
Now i got this from here to make something like a LDE (Length Disassembly Engine) ...
4
votes
4answers
424 views
Calculation of jmp address through subtraction
I don't get why the two addresses of the functions are subtracted in order to get the jump destination.
mov eax, [ebp+func1]
sub eax, [ebp+func2]
sub eax, 5
mov [ebp+var_4], eax
Which ...
2
votes
1answer
42 views
Correct my understanding on a basic allocation memory
Here is the function
If I understand correctly:
There is a buffer of size 256 bytes created (malloc)
in this buffer, the first 32 bits are set to 0 (because dword designates 32bits size)
the next 32 ...
1
vote
1answer
75 views
VirtualProtect failed to revert protections on mrdata section of ntdll, why?
i perform a loop in assembly where i am parsing the sections of ntdll change their memory permissions with VirtualProtect and then revert them back to their original permissions. the code looks like ...
1
vote
1answer
53 views
Need Advice for the purposes of learning [closed]
I would really like to make a multiplayer mod for Fallout 4, I know how to program and i have a basic understanding of how to get opcodes and read/write to those. Now what i don't understand is how to ...
5
votes
4answers
1k views
Purpose of test eax,eax after a strcmp
This is my first program i am trying to reverse and my intro to this field.
The C program will test if two strings match, and it will printf() a message for each occasion.
This is what the reversed ...
4
votes
2answers
85 views
How does the XADD instruction modify the Zero Flag?
I've come across a set of instructions using lock xadd which I'm guessing came from one of the C++ smart pointer templates. (It's been a very long time since I coded C++ so I'm not sure which).
lea ...
0
votes
0answers
60 views
Capstone in reverse mode
I am using capstone in python in order to dissassemble binary instructions.
Is there a way to work in the reverse mode ? I mean typing some asm instructions and ask capstone (in python) to generate ...
2
votes
1answer
69 views
Why do we need to know the address of shellcode?
I have read many articles regarding the buffer overflow exploit. Everywhere its written as follow.
"It's difficult to know the starting address of the shellcode"
Why do we need to know the address ...
2
votes
1answer
79 views
What does this magic number do? [duplicate]
I've opened a 64 bit DLL file in IDA. One function has this pseudocode:
unsigned __int64 output;
ULONG input;
output = (unsigned __int64)(input * (unsigned __int128)0xE38E38E38E38E38Fui64 >> 64)...
-3
votes
1answer
48 views
Change value of an IF condition found in IDA
so I have the .idb file of an executeable I want to modify.
In the IDB file, I found this code
And I basically want to change 4111006 to 1006 in that IF condition.
however, when I press TAB to go to ...
1
vote
1answer
55 views
Is there any way to call function instead of breakpoint, when certain memory area is accessed or register value is matched?
I am studying assembly and hooking.
I know how to hook x86 assembly now.
so if any thread goes to certain address which is overwritten with my code, it automatically returns to my function.
I think ...
2
votes
3answers
167 views
What does ds mean in mov instruction?
I am reversing a 32-bits ELF executable.
I see something like:
mov al, byte ptr ds:xxxxx
xxxxx is an absolute address.
What is the meaning of ds here?
1
vote
1answer
63 views
Generate this assembly from a c program
I want to generate this assembly code:
mov ecx, <absolute address of func1>
call ecx
How can I write and compile C code which generates this code?
0
votes
2answers
109 views
How to interpret disassembled MIPS code?
I have disassembled MIPS binary with raw opcodes. How to interpret, for example, these lines:
Disassembly of section .data:
00000000 <.data>:
... ...
f864: 30a5ffff sd ra,-23248(...
0
votes
1answer
42 views
How to breakpoint atached process with ida when move on
In IDA pro, there is an option to attach to a process using the WinDbg backend.
When I want is to see the process' control flow when the IDA attaches to it.
The only way (that I know) to see the ...
1
vote
1answer
35 views
What are these LOAD segments in an assembly ELF64?
I wrote the following (fasm) assembly program:
format ELF64 executable
segment readable executable
include 'io.inc'
include 'unistd64.inc'
entry main
main:
mov rdi, msg
call print
call ...
3
votes
1answer
130 views
Understanding Program Arguments on the Stack in Assembly
To self-teach myself reverse engineering, I am writing small C programs and reversing them in order to understands how the compiler sees my code. However, I am having quite tough time understanding ...
-3
votes
1answer
75 views
How does array indexing works at the assembly level?
Can anyone give me an example to understand how array indexing is working in assembly.
For example, in C:
char s[1000];
for (int = 0; i < 5; i++)
{
s[i] = i;
}
And, in x86 assembly:
add ...
3
votes
1answer
263 views
Moving integer to xmm register
I was looking at a game code, and I saw the following:
0x171 mov [rbp-30],r12w
....
0x210 movups xmm0,[rbp-30]
I am pretty sure that r12 is an integer here (equals 5). So, is it moving an ...
14
votes
3answers
4k views
Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?
I don't know whether this is a silly question, but I couldn't find any answer.
With the evolution of CPU architecture, register size was extended, from 8, to 16, 32, and eventually 64-bit. I was ...
-1
votes
1answer
67 views
index of array in assembly? [duplicate]
In the following picture the line i want to mention is:
mov [esp+eax*4+0Ch], edx
Here eax is the index in the array. But, where is the address of the array to access?
what does mean this line of ...
-2
votes
1answer
70 views
Understand help me array in assembly? [duplicate]
Can anyone explain the following code as it's an array in assembly.
I can't understand can you help me to figure it out line by line.
Thanks
Q.1) what does the 401024 & 40102E line does ?
1
vote
1answer
85 views
Visual Win32 (UI) style?
what is the following image is about ? Is it design using win32 (UI) ?
the following image contains functions are being output from a DLL.
Can you help me to understand.
Suggest me anything which ...
5
votes
1answer
1k views
Is IDA pulling my leg - or can REX.W sometimes not be determined in static analysis?
NB: I normally dabble with disassembly (i.e. mnemonics) and only ever look at the raw opcodes when I can't avoid it.
I have the following line of disassembly of a Windows x64 kernel mode driver, ...
-2
votes
1answer
89 views
x86 Assembly Data Types [closed]
For the code below can anyone help with these questions?
xor eax, eax
mov ecx, 5
lea edi, [edx]
rep stosd
mov al, 0xFF
stosw
stosb
stosb
How many times does the 'stosd' operation run? Why?
If edx ...
3
votes
2answers
47 views
How do you look for a a particular value at address in IDA
So, I was trying to load some binary and in the main function, I saw instructions such as
mov edi, [esi+1Ch]
...
lea eax, [esi+18h]
So, what are these values at [esi+1Ch] and [esi+18h]. How do ...
3
votes
1answer
53 views
ARM Thumb2 register usage
I am reversing ARM Thumb2 code.
I am looking for a table that shows which registers are used to pass arguments to functions, and which registers must be saved after the function ends.
By the way, if ...
2
votes
1answer
130 views
Patching a program in memory at a certain point of time
I'm using OllyDbg to patch a value and I need to patch a certain value when the program gets mapped in memory, how can I do this? I don't want to patch the value in file, but only in memory after the ...
0
votes
3answers
167 views
Explain struct access in assembly?
I am having trouble understanding working with structs in assembly from disassembly.
can you please explain the code below. Disassembly below:
Source code:
0
votes
1answer
97 views
Help me to understand disassembly MFC or Win32
I am trying to reverse engineer an application. I don't understand is this MFC framework.
Should i learn MFC to understand the following code.
or is it Win32 code developing. But how Win32 works with ...
1
vote
1answer
99 views
help me to understand array?
Question #1 is the lea edx, [esp+24] start of array ? and eax, [esp+140] index?
then whats add eax, edx doing here and this source code mean ? can you please explain?
I am confused about array ...
1
vote
2answers
247 views
How to assemble and inject an instruction with GDB?
GDB has a x/i command (and also disassemble) which allows to view the instructions at a given address.
How can we do the reverse – assemble an instruction and write to a given address?
1
vote
1answer
84 views
Confuse with MOVZX
I'm trying to reverse engineer an app. I can't understand some instructions:
EBP-4h=>Self
EBP-8h=>OptionData
...
mov eax, [ebp+var_4]
movzx eax, byte ptr [eax+1Ch] // (1)
mov edx,...
0
votes
1answer
83 views
Reversing: DeviceIoControl return value
While reverse engineering a windows executable I found the DeviceIoControl function, and i'm trying to figure out the correct inputs so it does not return a zero, it get's the [ebp+hDevice] from the ...
-1
votes
1answer
55 views
Is there an ida plugin that disassemble in visual c inline assembly (visual studio)?
I have a question... Is there an ida plugin that disassemble the file in visual studio inline assembly? I found this https://github.com/binrapt/ida but when I load it in ida, it complains about "No ...
