Questions tagged [assembly]

A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.

Filter by
Sorted by
Tagged with
0
votes
0answers
6 views

I cannot access files on my removable drive

I cannot access files on my removable drive but there is a 'readme' txt that says my files are encrypted. files changed type to 'OPQZ'. please advise
0
votes
1answer
37 views

“check:” keyword in Ghidra

I have disassembled the crackme0x06 challenge (http://security.cs.rpi.edu/courses/binexp-spring2015 inside challenges.zip). It's an ELF 32bit unstripped binary. The decompiled C code using Ghidra ...
2
votes
1answer
65 views

Why is there no call to strcpy in assembly?

I try to better understand assembly and currently playing around with some compiled c snippets. I have the following snippet: #include <stdio.h> #include <string.h> int main() { char ...
4
votes
1answer
73 views

Is it possible to modify a movss or xmm# in Assembly using Cheat Engine?

Im using cheat engine as a beginner to getting into Disassembly and Hacking, and I want to know how to modify an address/pointer (not really sure how to term it) thats using a movss [...],xmm#? ...
0
votes
1answer
60 views

xor eax,3 why does the input change the way it does?

I am new to reverse engineering and I am trying to figure out exactly what xor is doing in this little program. I know if I put any number other than 0 I get a xor eax,3 so if I put in 1 I get 2 if I ...
0
votes
2answers
94 views

GDB hangs when I try to run and debug a binary

When I type gdb a.out and then run inside the gdb itself I get stuck on the empty line: jericho-laptop:exploit.education jericho$ gdb a.out GNU gdb (GDB) 9.1 ... Reading symbols from a.out... (No ...
4
votes
3answers
217 views

What is the difference between MOV and LEA in example?

Looking at an assembly code snippet I see: lea rax, [rbp-0x50] Which tells me that the rax register now points to whatever value is in rbp-hex(50). Question. Would I achieve the same result doing ...
2
votes
1answer
80 views

Help understanding MOVSXD

I've tried reading the documentation but the functionality of this instruction is still cloudy to me. For an example, I would like to know what is stored in RDX after these instructions: mov edx, ...
0
votes
1answer
58 views

How to calculate Opcode Length from Ollydbg

Suppose I reverse a dll, and searching for a Function, say for instance Send(), I have reversed the ws2_32.dll now How Can i calculate the number of bytes from there to know that i need 5 bytes of ...
1
vote
1answer
83 views

Adding a static variable to Windows DLL

I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls. I ...
1
vote
1answer
93 views

Shellcode not working correctly

I wrote a small program in assembly which is supposed to print "AAAA". It works fine when I run it directly, but when I run it as a shellcode in a c program, it doesn't work. Please help. Here is the ...
1
vote
1answer
163 views

Understanding ghidra disassembly

I'm kind of new to assembly and ghidra as a tool. I have a question about the meaning of this line Mov dword PTR [ESP] => local_70 , eax I get we are moving eax into the left side but I'm not ...
0
votes
1answer
40 views

Can relative offsets in instructions like call and jmp change after recompiling the same code, or running it in another computer?

So lets say we want to use some instructions as signature for a malware, and it includes some call instructions or jmp instructions, now as far as i have seen they always contain relative offset as ...
0
votes
0answers
42 views

Performing Buffer overflow in Linux

I have buffer overflow in a program i check(it is an array of pointers, and i can overflow the data in the first pointer), but the data i can write is not on the stack, it is on a space the system ...
1
vote
2answers
119 views

High-level langage decompiler on WIndows

So I have been using Binary ninja and I was wondering if there was any other tool except IDA or any binary ninja plugin that would transform assembly code into high level code, I already tried binja-...
0
votes
2answers
99 views

Byte-patch a JMP

I have an address and I want to byte-patch it because there is a JMP that I want to block. But when I NOP it, the game just crash because it corrupt the function. So, I don't know what to do for block ...
0
votes
0answers
53 views

How to detect the language of an assembly code? How radare does it?

I've opened an executable in Radare2 (on Cutter) and it says that it was written in C language. Is it just a guess or there is a good way to find in which language a binary was written?
5
votes
3answers
482 views

ARMv8 (AArch64, ARM64) opcodes list

I'm sorry for such as questions where answer would seem to be easily searched in google... Some time ago I have seen table/list of ARMv8 instructions with opcodes and it was perfect, but I lost link. ...
0
votes
1answer
94 views

LDR specifier combination UXTW

Sorry, if this question seems stupid, but I am new in arm64 and next 2 assembly lines seriously damaged my brain: LDR W0, [X30,W0,UXTW#2] ADD X30, X30, W0,UXTW I have readed ...
1
vote
1answer
63 views

Is there a handy assembly to mock app conversion tool?

It might be too silly of a question, but here you go. Suppose you have some software that contains a tricky nested assembly sequence (like this one) you try to reverse engineer. brain*[pen&paper] ...
0
votes
0answers
61 views

Why does this execve shellcode work with this argv?

I wrote the following program in fasm, and am using Evan's Debugger on Ubuntu to debug it: format ELF64 executable 3 segment readable executable entry $ mov rbp, rsp sub rsp, 32 mov rax, 'this a t' ...
0
votes
0answers
29 views

Reading float value within delphi binary

I have a Delphi program that I am trying to read data from. the data is stored in a TEIDataWindow, this particular snippet of code comes from the update method. the data is presented in the form of an ...
2
votes
2answers
187 views

Static analysis obfuscated code

I'm reversing a code that is heavily obfuscated. It uses opaque predicates, call stack tampering, junk code and control flow flattering. Call stack tampering uses indirect branches (push register / ...
2
votes
1answer
56 views

Finding the correct input of an executable to print out the flag. IDA 7

I'm trying to understand the behaviour of the code below so I can determine what input will trigger the "YOU DID IT !~!" string (at the end of the program instructions): .text:00C21034 Buf= byte ptr -...
3
votes
1answer
77 views

CreateTimerQueueTimer arguments differs from WinAPI

I was reading a man page about CreateTimerQueueTimer. BOOL CreateTimerQueueTimer( PHANDLE phNewTimer, HANDLE TimerQueue, WAITORTIMERCALLBACK Callback, PVOID ...
2
votes
1answer
111 views

change compare function in assembly and .exe stopped working x64dbg

I'm trying to bypass (crack) a very old software that require license in order to unlock all the features i was digging in the lines with a little bit of knowledge in assembly and i found the line ...
2
votes
1answer
170 views

bypass license of very old software, Access violation (C0000005) x32dbg

I'm trying to bypass the license of a very old software that i was using many years ago, now, the company of that software is closed and i can't get a license so, with a little bit of knowledge in ...
2
votes
1answer
36 views

CMP ecx with DAT_

So I encountered this bit of assembly code: cmp dword ptr [ECX + 0x24c], DAT_007c6bc0 It's comparing ECX + 0x24c with DAT_007c6bc0. If they are not equal, it will just return from the function. I ...
3
votes
0answers
54 views

Uniden FW Hacking

I recently purchased a Uniden Radio Scanner (BCD325P2). I looked at the Windows FW Update App in dnSpy, then pulled the FW bin directly. FCC Parts List gets me R5F5631BCDFP#V0, which appears to be a ...
1
vote
2answers
324 views

Why Windows Defender is not able to get rid of this trojan?

Every time I start my PC, Windows Defender shows a notification saying that the virus Trojan:Win32/Ceprolad.A was deleted, which means indeed that it wasn't, as most antivirus I've tried these days (...
0
votes
1answer
72 views

How to Modify CBZ Branch in ARM64?

If I want after running the CBZ W0, loc_C5C8 command Run to the ADRP X8,#selRef_curent_version@PAGE command regardless of the condition (in picture), what should I do?
0
votes
0answers
35 views

is it possible to write the first byte at the entry point of a process dll module?

Hello so my problem is kind of weird .. im trying to write memory using this : WriteProcessMemory(intptr pHandle, intptr lpBaseAddr, byte[] lpBuffer, uint nSize, int lpNbrOfBytesWritten); have a ...
2
votes
1answer
88 views

What are some useful strategies for understanding undocumented assembly language?

What are some useful strategies for tackling a list of undocumented assembly language instructions? Even as someone who writes assembly code, I find it to be challenging at times to understand someone ...
2
votes
1answer
89 views

How can I objdump the assembler code of dynamically linked functions in a dynamically linked executable?

Compiling a minimal C++ program: g++ -g -Wall -Wextra -std=c++17 -o prog main.cpp int main() { } Performing an objdump -C -D prog of all sections I am given the following output: prog: file ...
0
votes
0answers
44 views

Setting struct according to offset relative to struct base

I would like to know whether it's possible to define a struct according to offsets from base in Hopper. Assuming there is a register in the assembly code, that I believe it represent the instance ...
0
votes
0answers
68 views

jmp to 4 byte address in shellcode

I'm playing around with the PE header and the Import Address Table. I wrote a dummy program that calls MessageBoxA with some retard parameters. After successfully replacing the MessageBoxA function ...
0
votes
1answer
44 views

OllyDbg: Constant does not fit into operand

I'm trying to assemble this instruction: I'm not being able to do it.. When I test with MOV AX,55000 I get this error: I tested before in Cheat Engine, and this is working as AOB injection: MOV AX,#...
3
votes
3answers
214 views

Strange vtable setup in constructor disassembly

In a program I'm trying to recover data structures I've discovered the following strange (ARM) disassembly code: ctor_1: ldr r1, =vtable_base str r1, [r0] ;r0 always contains ...
0
votes
1answer
56 views

Why doesn't alloca_probe follow x64 calling convention?

I was practising reverse engineering on some Windows x64 applications when I came across this function: call alloca_probe This alloca_probe function has some strange implementation: EAX is used as ...
3
votes
3answers
96 views

Stack-Smashing Protection error message

Here is a very ugly C program: #include <stdio.h> #include <string.h> int main(int argc, char *argv[]) { char buffer[10]; memcpy(buffer,argv[1],strlen(argv[1])); printf("%...
1
vote
1answer
107 views

Entry point of a program

im new to assembly and reverse engineering, i have a question regarding to how the address work. I examined the entry point of a program using varies PE tools, the result is 0x00043b33, but when i ...
0
votes
2answers
112 views

IDA Pro, replace exit() with continue;

This is the function: loc_BA060: ; status xor edi, edi call _exit How can one replace exit with continue?
0
votes
1answer
111 views

What is, and why, “byte[ ] + number” in this IDA pseudocode?

This is a decompile of an .so file, so it originated from C or C++. Can you kindly try to explain to me what this does? How would one rewrite this into readable code? I don't mind any programming ...
0
votes
0answers
65 views

Why is U-Boot changing this bit marked as “DO NOT CHANGE”?

While reverse engineering very early hardware initialization code of an old S3C6410 based tablet, I came across an instruction that changes a bit that the user manual (relevant info on pg. 3-50) ...
0
votes
2answers
63 views

How to Calculate ds Pointer

How do I calculate the location of the string in this sample located at offset 0x1CAD8? The instruction at 0x140001A97 in the sample is: 0x140001A97 F2 0F1005 39C60100 movsd xmm0, qword [rip + ...
0
votes
2answers
49 views

Error when changing push 0 to push function

Hi I am sort of new to ida pro even though I've used a lot but when I push a function where a 0 used to be it gives me sp-analysis failure I've searched for a fix for a while to no avail help would ...
0
votes
1answer
89 views

What do square brackets do in IDA's pseudocode representation?

I've been a bit stumped recently on my decomp work. I've not dealt with C in depth nor have I dealt with IDA's pseudocode system very much at all. I understand asm, but because of how IDA merges ...
1
vote
2answers
572 views

Local variables and addition not shown in Ghidra

I am having some troubles with my learning of Assembly and reverse engineering. Specifically, I am learning about Global vs Local variables. For Global variables I have managed to get insights in ...
2
votes
1answer
941 views

Simple C program disassembled with Ghidra

I am trying to figure out what is going on with my simple example programs, when I disassemble them with Ghidra. I am not sure whether this is some strange Ghidra behaviour or something that is set by ...
-1
votes
1answer
186 views

What is the following assembly code doing? [closed]

str fp,[sp, -4]! add fp, sp, #0 sub sp, sp, #12 str r0, [fp, #-8] str r1 [fp, #-12] L5: ldr r3, [fp, #-8] ldrb r3, [r3] cmp r3, #0 beq .L2 ldr r3, [fp, #-12] ldrb r3, [r3] cmp r3, #0 beq .L2 ldr r3, [...

1
2 3 4 5
12