Questions tagged [assembly]
A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.
655
questions
0
votes
0answers
25 views
Binary bomb lab, can't find starting number and having problem recognizing pattern
The following is the assembly dump of a binary bomb from bomb lab Basically, you have to come up with a 6 number sequence to defuse the bomb, however, I am having trouble finding the first number and ...
1
vote
1answer
65 views
How do you recommend going for applying minor changes in an executable through a dll?
My choice of words in the title might be poor, I apologize: english is not my primary language and I have no idea how to word it better.
I have a game executable to which I applied several changes, ...
1
vote
1answer
58 views
Why is the offset 16 bits?
I was told that segment:offset pairs were used to represent 20 bits. The segment is 4 bit shifted, and the value plus the offset becomes the physical address. I don't have to worry anymore at 32-bit ...
0
votes
2answers
109 views
how to use class member function defined in a exe within a dll
I have an executable (.exe) containing some classes and functions definition and plan on using those functions from within a DLL, although I know to call a regular C style function using calling ...
0
votes
0answers
49 views
Reverse Engineer Slack Workspace
Is there any Slack workspace for Reverse Engineer experts?
I wanna to communicating other people who work in this issue.
I am thankful if you know this workspace and invite me.
0
votes
2answers
77 views
find cheat engine pointers in ghidra
I find a pointer of my health so a function would have made the pointer and put the health in it (tell me if I'm wrong) how do I look for the function?
1
vote
2answers
41 views
How to extract port number from shellcode
I saw this shellcode and when they use the connect function they pass the port number 4444:
set_address:
push byte 0x05 ; retry counter
push 0x0100007F ; host 127.0.0.1
push ...
1
vote
1answer
75 views
Help understanding x64 TEST instruction
I have read that TEST does a bitwise and on the two arguments. I have also read that jz and je are both equivalent, and jump if the zero flag is set. So here's the problem I'm struggling with. ...
1
vote
1answer
44 views
Where are the intel manual x86-16?
I was studying the code for x86-16 operating systems(como DOS),with a desassembler, but I can't find the intel manual on the intel website:
Searching on google, only unofficial sources.
Perhaps the ...
0
votes
2answers
69 views
ASM Debuggers that visualize the stack (beginner friendly)
(Cross-posted from Stack Overflow)
Are there any debuggers that constantly show a visual of the stack and where everything is within it? For example, taking some random image:
I use gdb for most ...
0
votes
1answer
27 views
How to calculate value inside stack segment (SS)
I have an assembly row which the following information:
EBP = 006FFB50
SS = 002B
When I looked on this row:
mov eax,dword ptr ss:[ebp+8]
I assumed that EBP + 8 = 006FFB50 + 8 = 006FFB58.
But ...
0
votes
0answers
25 views
How to change value at a memory address?
I am solving Micro Corruption CTF (msp430 assembly)
How can I put the value 0x3c4f inside address 0x439c (r15 from Register state)? When cmp instruction executes, we want the value at memory address ...
0
votes
0answers
19 views
Memory Corruption CTF: How to enter null character in user prompted input?
I was solving memory corruption CTF
In the picture you see a memory dump. I solve the problem when the string stored at addresses 2400, 2401... 2407 (in assembly it compares 8 memory addresses ...
0
votes
3answers
127 views
How to find if a function is using registers as parameters?
The disassembly of the function Winload!CmpFindNlsData whose prototype I'm trying to construct
00893c10 8bff mov edi,edi
00893c12 55 push ebp
00893c13 8bec ...
0
votes
1answer
48 views
Need help to understand this assembly for fibonacci seq
I understand the assembly properly. I am just confused about variable 'b' and 'c'. It looks like b is stored at 12(%ebp). I conclude this from cmp 12(%ebp), %eax. If you look at func_8048516, it is ...
1
vote
2answers
94 views
how to does this instruction work: `mov qword ptr [rbp-0x30], 0x4020c5`
The following is the code snippet (shown partially) I have:
q = strrchr(resolved, '/'); /* given /home/misha/docs.txt, q now pts to the last slash */
if (q != NULL) {
p = q + 1; ...
2
votes
2answers
235 views
Getting the algorithm used inside this .so file
I'v been trying to reverse-engineer a BLE "Smartlock" to open it using Python instead of the App that it came with.
I progressed quite far with disassembling the SDK they provide, ...
0
votes
1answer
61 views
What is physical address on a pe reader?
What is physical address on a Pe file? I had search on the microsoft website article about pe files and don't have found anything.
1
vote
1answer
80 views
Trying to reverse engineer CmpFindNlsData of winload
I have a basic understanding of assembly language and I'm unable to perfectly define the algorithm of winload!CmpFindNlsData looking at the disassembly. Basically I need to understand how NLS data is ...
0
votes
1answer
34 views
what means “ilegal use of registers”?
I read pe program using a Pe Reader to view all sections, the .text section starts is "0x0001000":
What is in the pe program reader:
And is this what i see on the debugguer :
0
votes
1answer
65 views
What should I learn in order to reverse elf64 binary files
I'm a little confused. I am using a Linux based system (Ubuntu), 64-bit. and I want to start and reverse 64elf binary files, but there is a lot of things I want to know before. just to be clear, If I ...
1
vote
1answer
99 views
I want to insert instructions but don't have enough space to do so
Sorry if it is a very basic question/bad place to ask/for my bad english.
I'm using Ghidra to patch instructions inside the binary of a game. Most of the time I could find some undefined bytes ...
1
vote
0answers
32 views
Statically injecting translated NASM assembly into existing ELF binary
I'm trying to statically patching ELF binaries in order to incorporate code that can help provide run-time protection.
In an effort to save time writing and debugging assembly, I took the following no-...
0
votes
1answer
90 views
How can I modify these?
So I'm onto something interesting, I asked the less direct way but failed to meet the requirements in terms of explanation
So here it is, how would I go about editing these the same way I would go ...
0
votes
0answers
44 views
Change value of memory in a debugger?
So I got this app loaded in x64, there is a function, let's say
"HeatGainedPerShot", which is basically the value which an object gains everytime it fires,
Such a value would normally exist ...
0
votes
0answers
116 views
Reversing a bootloader code (MIPS)
I'm trying to reverse a bootloader code extracted from raw memory dump of data modem. I think I extracted it correctly.
Bootloader size 32768 bytes. Device use BCM3382 CPU (MIPS32) big-endian(?), eCos ...
2
votes
0answers
75 views
Devirtualization
I've recently become pretty fascinated with virtualization and retrieving original code from a randomly generated byte code, such as protectors like VMProtect/etc. But I can not get a grasp on how it ...
0
votes
1answer
78 views
how could i follow a system call from a dll -> kernel driver syscall
basically i would like to follow (system calls / internal calls) that basically lands in the kernel i would like for example to debug a specific dll ex : ntdll.dll and follow it to (NtXXX) function ...
0
votes
0answers
50 views
strange results with IDA (some function different Pseudo Code)
After show the pseudo code in IDA I see different results:
The function 4436C0 show different pseudo code.
For example:
result = sub_4376C0("vvcbb3.wav",v8,0);
and
result = sub_4376C0((int)...
1
vote
1answer
114 views
How do disassemblers work?
I have 2 questions regarding this, but feel free to elaborate more if you want to, I'm really interested in this topic:
Do they really just read byte by byte until they get a valid instruction? How ...
0
votes
2answers
58 views
Where do arguments 5 and 6 go in this Microsoft x64 function call?
I'm disassembling a working-as-expected compiled C program (MS/Windows x64, MinGW gcc 10.1.0). In the main function, I have the following call which passes 6 arguments to the function DotProduct:
...
/...
0
votes
0answers
24 views
Trace files on disc to addresses in memory
Right now I am trying to dynamically create new NPCs for a multiplayer mod I am working on for a video game. The enemies are tied to level data and will always be the same enemies when you begin the ...
2
votes
1answer
119 views
dll injection (assembly code)
I need some tip to undrestand what is the best way to execute external code from DLL or command line.
I like to add the force feedback support to different games that not support it.
I can write a DLL ...
1
vote
0answers
112 views
Unable to start file “..\ntoskrnl.exe” in ollydbg [What can I do?]
Ollydbg isn't allowing me to open the executable ntoskrnl. I think im missing something but I don't know what it is (Windows 7, Ollydbg10.0,200)
1
vote
0answers
26 views
What numeric properties are used in this Unsigned Integer (64bit) -> Floating Vector (128bit) conversion?
Recently I came across the following set of vector instructions:
movq xmm0, rcx
punpckldq xmm0, 0x4530000043300000
subpd xmm0, 0x4330000000000000
haddpd xmm0, xmm0
The only sensible ...
0
votes
1answer
51 views
Disassemble scanf storage register
I am trying to understand scanf function a have 3 question regarding it.
this is c file:
#include <stdio.h>
#include <stdlib.h>
int main(){
int x;
printf("Enter X:\n");
scanf(...
0
votes
1answer
198 views
Extracting Assembly line code from an executable in Ghidra
I'm using Ghidra to reverse engineer an EXE file and save its assembly line code only. Does Ghidra have any function or scripts which exports the assembly line code? I don't want to manually copy the ...
1
vote
1answer
36 views
Are there some assemblers or disassemblers that allow dw/defw etc directives with specified endianness?
I've been working with reverse engineering tape image and disk image formats and the files and filesystems they contain.
It struck me that sometimes there are data fields that are not in the same ...
0
votes
1answer
642 views
What does 'test al, al' mean?
I'm trying to reverse engineer a program and i found the following instruction:
test al, al
je label
what does these two instruction do ? Can someone explain please ?
2
votes
2answers
227 views
Dealing with obfuscated PUSH PUSH RET instructions
I wanted to run an app on a VM but there are PUSH PUSH RETs stopping me from looking at their anti VM code. There is a messagebox when I run it on a VM. I set a breakpoint at MessageBoxA and it gets ...
1
vote
1answer
39 views
Disassembly to reassembly - 80960: Invalid Scale Factor
I'm disassembling a game which runs on an Intel i960 processor. My disassembly is at a point I would like to try to reassemble it from an IDA Pro generated ASM file. The ASM file needs slight ...
0
votes
1answer
46 views
dereferencing structure members
I am reading a book on reversing and I am curious about one of the assembly snippet i have read in it.
There is a simple disassembly of the function RtlNumberGenericTableElements and it looks like ...
-1
votes
1answer
50 views
Can I traverse the entire WORD array of 4 elements with QWORD PTR?
I want to change values of all WORD array of 4 elements by one step using QWORD PTR
mov ebx, OFFSET arr ; arr is WORD of 1,2,3,4
xor qword ptr [ebx], 8000800080008000h ; I get error of constant ...
1
vote
1answer
61 views
How's this code able to make use of the stack?
I am trying to reverse engineer software to extend its functionality as expected of me. So I don't have the source code with me. Anyways, I am used to seeing codes that start like the one below, and ...
-2
votes
1answer
254 views
Debug and crack .NET executable PE
First of all, i'm trying to learn reverse engineering for testing my codes and that's all and i'm not stupid enough to do illegal things with my knowledge so please don't give me legal advises.
I'm ...
1
vote
1answer
66 views
IDA Pro: How to change segment register value
For a specific Android library that I have loaded into IDA, I want to switch the THUMB/ARM mode to ARM, no matter the consequences that this is going to have to the code. Is there a way to efficiently ...
0
votes
1answer
70 views
Why there are only 8 hexa memory digits while my RAM is 16G
I'm totally new to reverse engineering, when I start debugging my c program with radare2, and start showing assembly, I found that addresses are only 8 hexa digits, which means 16^8 = 4294967296 ...
0
votes
0answers
11 views
Tool for navigating native assembler code and memory hex for interpreted languages like VBA
Complete newbie to this area and I have limited experience writing code in low level languages so I'm not familiar with the debugging techniques, but bear with me:). I'm trying to understand the ...
0
votes
0answers
53 views
Shellcode doesn't match OllyDbg
I have created a simple program that is susceptible to a buffer overflow using strcat(buffer1, buffer2). I have successfully overflowed into the EIP and have placed an address located in NTDLL which ...
0
votes
0answers
53 views
Force gcc to use more complex instructions
I am reverse engineering a piece of assembly. I am trying to write the equivalent code in C, however, when I compile my code, gcc prefers to use simple instructions instead of the complex ones that ...
