Questions tagged [assembly]
A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.
738
questions
0
votes
0
answers
15
views
X32dbg Stepping through assembly, seems to get stuck on one line and not progress forward, even though the application continues to progress forward
I'm using x32dbg. Stepping through assembly, I get to the following instructions:
'''76B7CC12 | 8B4C24 54 | mov ecx,dword ptr ss:[esp+54] |'''
If I continue to step through ...
1
vote
1
answer
38
views
STATUS_PRIVILEGED_INSTRUCTION 0xc0000096 from kernel mode code?
Running a kernel driver I wrote. The driver includes:
mov rax, cr0
btr rax, 10h
mov cr0, rax
to clear WP bit in cr0. Curiously the last instruction faults and causes a bluescreen, ...
- 51
2
votes
1
answer
58
views
Is there any way to understand if a raw binary firmware is Cortex-M or not?
I have a list of firmwares, and I should filter just the Cortex-M type. Is there any automated way that I can distinguish them from other ARM firmwares?
I have some ideas like Interrupt vector Table (...
- 21
0
votes
0
answers
34
views
How to find the fifth function argument on stack in windbg?
I know that in x64, the first 4 arguments are passed by RCX, RDX, r8, r9. The rest arguments are pushed on stack. In x64, rsp serves as base pointer(prolog) and frame pointer(epilog) and save value ...
0
votes
1
answer
47
views
How do i loop this CreateThread call in Assembly to get 4 threads instead of only one?
Knowledge in C++ Assembly and some reverse engineering experience
0
votes
0
answers
30
views
Tuning motor temperature
I have a DC motor, running in two modes, slow and fast. I will need to run the motor in FAST mode only. The motor is already running for 10 years. The motor experiences variable load.
According to the ...
0
votes
1
answer
51
views
Reversing Games like Manfred dis
I've looked at as many resources on Manfred and Manfred's work
I've watched the DEFCON 25 Live talk about what he hacked.
Here
I've also looked, listened and read the dark net diaries Part One -
...
- 3
0
votes
1
answer
29
views
PowerPC disassembly with libopcodes
I want to disassemble Wii game executable binaries in C, which use the broadway microprocessor and unfortunately the only disassembler I am aware that I can use is libopcodes.
I am following this ...
- 11
1
vote
0
answers
66
views
Assemby reverse engineering
I'm new to assembly and need some help understanding what this program does. This program takes a username and serial. If the combination is correct, it prints the magic words.
I need to write a ...
- 11
1
vote
0
answers
36
views
Why output is disabled in console when using int3?
I am using NASM(2.15) assembler to generate code. But I am unable to figure out why it does not show output in the console(windows system) when using int3 - software breakpoint, it only shows output ...
- 301
0
votes
1
answer
130
views
Crackme assistance - unknown function [closed]
i have a problem about a crackme that my friend sent me for a bet. I solved most of it but i am stuck with this function. I can't even understand what the function is trying to do. Please help.
images ...
- 1
6
votes
4
answers
3k
views
Do I have to learn computer architecture for underestanding or doing reverse engineering?
I am completely noob in reverse engineering, and I've just started to learn it.
Now I have this question in my mind, that does a reverse engineer use any computer architecture knowledge for doing his/...
- 63
1
vote
2
answers
171
views
What does MOV RAX,qword ptr FS:[0x28] mean?
I'm trying to understand what MOV RAX,qword ptr FS:[0x28] means. I get that FS:[0x28] is a stack canary. If my understanding is correct the data from RAX gets copied by MOV. Then there's a comma which ...
- 11
0
votes
1
answer
39
views
Displacement size (disp_size) of x86 instructions
Given the opcode 80 3d 1d b0 09 00 00.
The corresponding capstone instruction is
<CsInsn 0x66a4 [803d1db0090000]: cmp byte ptr [rip + 0x9b01d], 0>
and has the following properties (c_i being ...
- 1,456
0
votes
1
answer
99
views
Missing mnemonics '??' in Ghidra Assembly Code
I was just trying to google and search for "??" Ghidra with no luck.
I am trying to understand what the following questions mean in this Binary (meant for SuperH2 SH-2 processor) which is ...
1
vote
1
answer
78
views
What is j__ftol2_sse_excpt in IDA?
I was inspecting the c-pseudocode for a PE executable in IDA.
I found some function called j__ftol2_sse_excpt()
When I open that function I see that the function is calling another function named ...
- 19
1
vote
1
answer
65
views
Why is JMP ESP required in buffer overflow?
I was reading this article by Hackers Grimoire on Windows buffer overflow attacks.
The article made sense, except for the part where the author searched for a DLL (.dll) file which contained a JMP ESP ...
- 113
3
votes
1
answer
70
views
What is the outcome of mov on non bracket memory locations?
I am having problems distinguishing whether the address is loaded or the content from the address. Please help me clarify.
1. mov [rsp+78h+arg_0], rsi
2. mov rsi, cs:qword_1F39B60
3. mov [...
- 35
0
votes
1
answer
72
views
What is libm_sse2_sin_precise() and how to find it's parameters in IDA?
I'm new to reverse engineering with IDA.
I've found libm_sse2_sin_precise while inspecting c-pseudocode for some Win32 executable.
I tried clicking that function but the executable requires the DLLs.
...
- 1
3
votes
0
answers
252
views
Lifting x86 machine code to LLVM IR
I would like to translate a simple x86_64 machine code into LLVM IR, which can be later analyzed. For my particular use case, I need to be able to work with just instructions and opcodes directly, and ...
- 31
1
vote
0
answers
59
views
What change to the source code would produce an LT compare rather than an OLT compare in MIPS assembly?
I need some help reverse engineering a function in MIPS assembly. It was compiled for the PlayStation 2's EmotionEngine CPU. My goal is to produce a matching decomp of the function; it is the proof-of-...
- 11
0
votes
1
answer
78
views
Hex editing an IP address of a different length
I am performing some Windows malware research on a rogue AV software called SpySheriff (password: infected). I want to edit the IP address within the PE (.exe) file to change it to my honeypot IP ...
- 113
2
votes
1
answer
69
views
Mov instruction from a pointed location at the beginning of a program
I am trying to learn how to read assembly code. So far I have understood the basic instructions. Now I am trying to see if I can understand a dissassembly from a linked executable. So this is an ...
- 143
2
votes
1
answer
163
views
Understanding disassembly information from Visual Studio's dumpbin and GNU's objdump
I usually write my code on Windows, and there are two different types of development environments, each providing their own tools to view the assembly code of an object file(*.obj) or executable (*....
- 143
1
vote
1
answer
188
views
Help with Ghidra and rewriting assembly
I'm learning reversing and for that I use Ghidra.
There is program I'm trying to modify so I can recompile it and make it work.
I have a code that ghidra decompile like this: data=function(4)
Going ...
1
vote
1
answer
78
views
C instruction causing an address shift
I am trying to recreate a segment of assembly back into the C code. Below is the progress I've made so far, but I'm getting stumped on a specific section.
00000000000010049 <mysteryFunc>:
...
- 13
0
votes
1
answer
392
views
How to get Assembly source from Bin file?
I have a binary file which is coded in assembly x86 and compiled with nasm. I used command
nasm file.asm -f bin -o file.bin
to compile it with nasm.
I deleted the source code from disk long time ago, ...
- 19
0
votes
1
answer
82
views
Crackmes challenge not validating all answers
I am playing with this crackme. The executable takes a numerical input (e.g., 123) and adds all the numbers. The total must be 50. However, I noticed that not all inputs adding up to 50 are validated. ...
0
votes
0
answers
68
views
x64dbg placing a on write breakpoint on a dynamic allocated address
I am currently trying to reverse the registration scheme of a crackme. I found the jump instruction that decides if the title of the program says “registered” or “unregistered” by simply searching for ...
- 1
0
votes
1
answer
465
views
0
votes
1
answer
224
views
IDA - What LOC means in assembly?
I have this piece of assembly:
.text:0041B322 xor eax, eax
.text:0041B324 mov al, byte ptr [ebp+v13]
.text:0041B327 cmp eax, 1
.text:0041B32A jz loc_41B37D
.text:0041B330 xor eax, ...
- 135
0
votes
0
answers
65
views
How to see where the heap is in IDA and how to see the segments for a process using non-source debugging
As in the title. I may be wrong about this but when using non-source debugging, all data coming from outside the source seems to be named debugxxx in the segments tab. .Rodata should be marked as ...
- 115
0
votes
1
answer
185
views
What's DD ? In IDA Pro
I'm new to reverse engineering with IDA.
If dd is short for data, double-word, is a 32-bit value. It shows ?
How do I identify the value stored in dword_140007674?
- 1
1
vote
1
answer
81
views
IDA API: obtain operand size prefix (x64)
I am trying to tell apart the following two instructions:
8D 02 lea eax, [rdx] // auxfix = 0x1810
67 8D 02 lea eax, [edx] // auxfix = 0x810
The only difference is in the insn_t....
- 383
1
vote
1
answer
122
views
How to locate memory address in register $esp
000011d9 <main>:
11d9: 8d 4c 24 04 lea 0x4(%esp),%ecx
11dd: 83 e4 f0 and $0xfffffff0,%esp
11e0: ff 71 fc push -0x4(%ecx)
11e3: ...
- 11
1
vote
2
answers
146
views
What arguments are passed into a CALL instruction?
While reverse enginnering a simple C program for training, I asked myself what was the point of those lines :
LAB_001006b5 XREF[1]: ...
- 23
1
vote
1
answer
118
views
How to interpret memory dumps?
I'm pretty new to reverse engineering, and I decided to pick up https://microcorruption.com/ CTF to understand a bit more. The following code is from the tutorial section.
In a disassembled file, we ...
- 11
1
vote
1
answer
129
views
How to use SHL/SAL, LEA and Add for arithmetic operations
I'm having problem computing the following arithmetic questions using SHL/SAL, LEA and ADD, and hoping someone can help explain or find the best ways to apply those:
Multiply a variable by 24
...
- 11
0
votes
1
answer
278
views
What is the meaning of jmp dword ptr off_XXXXXXXX + 8 in IDA?
What is the meaning of this kind of jmp instruction in x86 assembly in IDA?
Does it mean that we should jump to the address [6CA2E9B0] + 8 or [6CA2E9B0+8]?
When I follow that off_XXX, I get to the ...
- 1
0
votes
0
answers
59
views
Which encryption returns 192 hash value it means 96 in bytes?
I am reversing an APK and there is a signature that needs to be found.
The function from where the signature is generated is present in the .so file.
I did small debugging. While doing it, the ...
1
vote
1
answer
66
views
ARM/THUMB assembly mismatch between binaries causes crash
I am trying to play around with an app for Android and every time I try to call a function (lua_gettop() from the Lua 5.1 library) from the app's address space, it hits me with ILL_ILLOPC.
I made sure ...
- 11
0
votes
0
answers
41
views
stack explanation from https://revers.engineering/applied-re-the-stack/
I've been reading [1] (By Daax Rynd) to get an understanding the stack and at around the 12th page, I'm a bit stumped by how the value 60 from sub rsp, 60 was arrived at.
[Note, all code and quotes ...
- 135
0
votes
0
answers
208
views
How to resolve illegal instruction for this ARM stack exploitation?
Summary
I am trying to write a stack overflow exploit for ARM Cortex-A72 running
Raspberry Pi OS (32-bit). Because of my choice of OS, I am restricted to
the ARMv7 (32-bit) instruction set.
I have ...
1
vote
2
answers
323
views
is there a tool to decompile old exe to C?
I follow the free software implementation of OpenRCT2 from the beggining (when it was in other repository).
And the first commits are a bunch of C files, these files has a lot of asm blocks of code ...
- 111
1
vote
1
answer
38
views
what is metaData of assemblies and what is used for
hi there I hope you doing well
lately, I have searched about ildasm and how to protect my DLLs from reverse engineering,
so I found some great open source projects (ConfuseEx..), it works when I tried ...
3
votes
2
answers
382
views
Why does the "MOV DWORD PTR ds:0xdeadbeef" instruction dereference the 0xdeadbeef address?
I'm reverse engineering a binary and I'm confused, because my theoretical knowledge is currently clashing with what's actually happening.
I thought that this instruction writes the value 0xdeadbeef ...
- 229
1
vote
1
answer
334
views
How to import x86asm into Ghidra?
I have some assembly code as a .txt file (i.e. a list of the instructions, stuff like this):
00000003 E8D001 call 0x1d6
00000006 A08000 mov al,[0x80]
00000009 0C00 ...
- 13
1
vote
1
answer
53
views
How To Access Predefined Class Attributes From IDA Pro After Loading The Binary Without Debugger Attached To Process [closed]
I have this class with constructor offsets and attributes:
public class example
{
// Fields
public float Attribute_1 = 1.5f; // 0x8
public int Attribute_2 = 102 ; // 0xC
// RVA: ...
- 21
1
vote
1
answer
161
views
A tutorial or docs to unpack a custom packed PE
I am facing an odd situation. I have a licensed game that's doing odd actions on the system. I isolated it as I could and observed the behavior both network and so forth, and I suspect it's a custom-...
- 11
0
votes
1
answer
96
views
ADDS(operations with S suffix) -Arm
This question was asked before here but in the answers I did get what i was looking for.
Consider this:
ADDS R0 RO R1
As far as I know to update the cpsr flags a subtraction has to be made. So after ...
- 144