Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [assembly]

A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.

1
vote
0answers
34 views

getting %localappdata% in asm

I have an old windows x86 application that no longer works properly since windows 8. This app creates files within its own folders for things like app settings. Unfortunately, Microsoft no longer ...
2
votes
0answers
71 views

Why is the process crashing after executing my injected payload?

I tried the following payload for APC injection in Windows. It gets executed successfully(pops up a MessageBox) but the process crashes after the execution of payload. What could be the possible ...
1
vote
2answers
66 views

Why there are two different shellcodes for bin/sh with much different syntax and which one is better to use? (x86)

I have found two shellcodes for spawning /bin/sh which are much different from each other. The second one is hardly ever found on the net, and it mostly comes up in reverse engineering websites: 1. "\...
2
votes
1answer
125 views

Converting Assembly x64 code to C

I have the following code: 0000000000400526 <main>: 400526: 55 push rbp 400527: 48 89 e5 mov rbp,rsp 40052a: 48 83 ec 20 sub ...
3
votes
1answer
168 views

How can I convert this assembly code (x64) to C?

I have the following assembly (x64) function: 400700: sub rsp,0x18 400704: mov QWORD PTR [rsp+0x8],rdi 400709: cmp QWORD PTR [rsp+0x8],0x0 40070f: jne 400718 <bar+0x18> 400711: mov eax,0x0 ...
1
vote
1answer
82 views

Figuring out what a segment of assembly code does

I have the following assembly code: 0000000000400711 <foo>: 400711: 55 push rbp 400712: 48 89 e5 mov rbp,rsp 400715: 48 89 7d e8 ...
0
votes
1answer
77 views

Analyze raw assembly using IDA Pro

I have a raw assembly dump i.e. .intel_syntax noprefix .bits 32 .global main main: push ebp ... And I know it's Intel x86 and the original function was most likely written in C. Now the ...
0
votes
1answer
156 views

What does this assembly language program output?

I have been struggling with this for a long time. I have the following assembly language code: .intel_syntax noprefix .bits 32 .global asm0 asm0: push ebp mov ebp,esp mov eax,DWORD ...
-1
votes
1answer
52 views

How can I decompile the CC2650 .hex file to C?

I want to decompile it to C, or at least assembly the CC2650 hex file (Bluetooth Low Energy Sensor Tag), that provide TI. My goal is to know the specific way used by CC2650 to generate the LTK. I'll ...
1
vote
1answer
29 views

Explanation of SBB instruction

I have this Asm from a book that suppose to do a Boolean cast: rax := rax ? 1 : 0 1. neg rax 2. sbb rax,rax 3. neg rax But as i understand this code and the instructions (below), this ...
4
votes
1answer
83 views

Need help identifying main processor for Roland synthesizer

I desperately need help figuring out the ic chips in this unit so I can view the firmware in ida pro. So the unit is a roland gr-55 guitar synthesizer and i'm trying to disassemble the firmware into ...
1
vote
2answers
54 views

.NET assembly IDA PRO, using LDSTR IL op code, how to patch a string?

I'm trying to patch a string. So right now I'm trying to replace instruction LDSTR with LDSTR "mystring"; however, I have been unsuccessful. After assembling the LDSTR op code, I don't quite ...
0
votes
0answers
24 views

Compare / highlight differences between 2 .dll files [duplicate]

so I have 2 .dlls and I was thinking if it's possible to easily compare/highlight the things that are different between the two with IDA or anything else you have in mind that could make that job ...
1
vote
2answers
66 views

Getting opcode Length , How to

I am apparently not very good with assembly as I am novice to somethings! Hence i wanted to make a question again. Now i got this from here to make something like a LDE (Length Disassembly Engine) ...
4
votes
4answers
424 views

Calculation of jmp address through subtraction

I don't get why the two addresses of the functions are subtracted in order to get the jump destination. mov eax, [ebp+func1] sub eax, [ebp+func2] sub eax, 5 mov [ebp+var_4], eax Which ...
2
votes
1answer
42 views

Correct my understanding on a basic allocation memory

Here is the function If I understand correctly: There is a buffer of size 256 bytes created (malloc) in this buffer, the first 32 bits are set to 0 (because dword designates 32bits size) the next 32 ...
1
vote
1answer
75 views

VirtualProtect failed to revert protections on mrdata section of ntdll, why?

i perform a loop in assembly where i am parsing the sections of ntdll change their memory permissions with VirtualProtect and then revert them back to their original permissions. the code looks like ...
1
vote
1answer
53 views

Need Advice for the purposes of learning [closed]

I would really like to make a multiplayer mod for Fallout 4, I know how to program and i have a basic understanding of how to get opcodes and read/write to those. Now what i don't understand is how to ...
5
votes
4answers
1k views

Purpose of test eax,eax after a strcmp

This is my first program i am trying to reverse and my intro to this field. The C program will test if two strings match, and it will printf() a message for each occasion. This is what the reversed ...
4
votes
2answers
85 views

How does the XADD instruction modify the Zero Flag?

I've come across a set of instructions using lock xadd which I'm guessing came from one of the C++ smart pointer templates. (It's been a very long time since I coded C++ so I'm not sure which). lea ...
0
votes
0answers
60 views

Capstone in reverse mode

I am using capstone in python in order to dissassemble binary instructions. Is there a way to work in the reverse mode ? I mean typing some asm instructions and ask capstone (in python) to generate ...
2
votes
1answer
69 views

Why do we need to know the address of shellcode?

I have read many articles regarding the buffer overflow exploit. Everywhere its written as follow. "It's difficult to know the starting address of the shellcode" Why do we need to know the address ...
2
votes
1answer
79 views

What does this magic number do? [duplicate]

I've opened a 64 bit DLL file in IDA. One function has this pseudocode: unsigned __int64 output; ULONG input; output = (unsigned __int64)(input * (unsigned __int128)0xE38E38E38E38E38Fui64 >> 64)...
-3
votes
1answer
48 views

Change value of an IF condition found in IDA

so I have the .idb file of an executeable I want to modify. In the IDB file, I found this code And I basically want to change 4111006 to 1006 in that IF condition. however, when I press TAB to go to ...
1
vote
1answer
55 views

Is there any way to call function instead of breakpoint, when certain memory area is accessed or register value is matched?

I am studying assembly and hooking. I know how to hook x86 assembly now. so if any thread goes to certain address which is overwritten with my code, it automatically returns to my function. I think ...
2
votes
3answers
167 views

What does ds mean in mov instruction?

I am reversing a 32-bits ELF executable. I see something like: mov al, byte ptr ds:xxxxx xxxxx is an absolute address. What is the meaning of ds here?
1
vote
1answer
63 views

Generate this assembly from a c program

I want to generate this assembly code: mov ecx, <absolute address of func1> call ecx How can I write and compile C code which generates this code?
0
votes
2answers
109 views

How to interpret disassembled MIPS code?

I have disassembled MIPS binary with raw opcodes. How to interpret, for example, these lines: Disassembly of section .data: 00000000 <.data>: ... ... f864: 30a5ffff sd ra,-23248(...
0
votes
1answer
42 views

How to breakpoint atached process with ida when move on

In IDA pro, there is an option to attach to a process using the WinDbg backend. When I want is to see the process' control flow when the IDA attaches to it. The only way (that I know) to see the ...
1
vote
1answer
35 views

What are these LOAD segments in an assembly ELF64?

I wrote the following (fasm) assembly program: format ELF64 executable segment readable executable include 'io.inc' include 'unistd64.inc' entry main main: mov rdi, msg call print call ...
3
votes
1answer
130 views

Understanding Program Arguments on the Stack in Assembly

To self-teach myself reverse engineering, I am writing small C programs and reversing them in order to understands how the compiler sees my code. However, I am having quite tough time understanding ...
-3
votes
1answer
75 views

How does array indexing works at the assembly level?

Can anyone give me an example to understand how array indexing is working in assembly. For example, in C: char s[1000]; for (int = 0; i < 5; i++) { s[i] = i; } And, in x86 assembly: add ...
3
votes
1answer
263 views

Moving integer to xmm register

I was looking at a game code, and I saw the following: 0x171 mov [rbp-30],r12w .... 0x210 movups xmm0,[rbp-30] I am pretty sure that r12 is an integer here (equals 5). So, is it moving an ...
14
votes
3answers
4k views

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

I don't know whether this is a silly question, but I couldn't find any answer. With the evolution of CPU architecture, register size was extended, from 8, to 16, 32, and eventually 64-bit. I was ...
-1
votes
1answer
67 views

index of array in assembly? [duplicate]

In the following picture the line i want to mention is: mov [esp+eax*4+0Ch], edx Here eax is the index in the array. But, where is the address of the array to access? what does mean this line of ...
-2
votes
1answer
70 views

Understand help me array in assembly? [duplicate]

Can anyone explain the following code as it's an array in assembly. I can't understand can you help me to figure it out line by line. Thanks Q.1) what does the 401024 & 40102E line does ?
1
vote
1answer
85 views

Visual Win32 (UI) style?

what is the following image is about ? Is it design using win32 (UI) ? the following image contains functions are being output from a DLL. Can you help me to understand. Suggest me anything which ...
5
votes
1answer
1k views

Is IDA pulling my leg - or can REX.W sometimes not be determined in static analysis?

NB: I normally dabble with disassembly (i.e. mnemonics) and only ever look at the raw opcodes when I can't avoid it. I have the following line of disassembly of a Windows x64 kernel mode driver, ...
-2
votes
1answer
89 views

x86 Assembly Data Types [closed]

For the code below can anyone help with these questions? xor eax, eax mov ecx, 5 lea edi, [edx] rep stosd mov al, 0xFF stosw stosb stosb How many times does the 'stosd' operation run? Why? If edx ...
3
votes
2answers
47 views

How do you look for a a particular value at address in IDA

So, I was trying to load some binary and in the main function, I saw instructions such as mov edi, [esi+1Ch] ... lea eax, [esi+18h] So, what are these values at [esi+1Ch] and [esi+18h]. How do ...
3
votes
1answer
53 views

ARM Thumb2 register usage

I am reversing ARM Thumb2 code. I am looking for a table that shows which registers are used to pass arguments to functions, and which registers must be saved after the function ends. By the way, if ...
2
votes
1answer
130 views

Patching a program in memory at a certain point of time

I'm using OllyDbg to patch a value and I need to patch a certain value when the program gets mapped in memory, how can I do this? I don't want to patch the value in file, but only in memory after the ...
0
votes
3answers
167 views

Explain struct access in assembly?

I am having trouble understanding working with structs in assembly from disassembly. can you please explain the code below. Disassembly below: Source code:
0
votes
1answer
97 views

Help me to understand disassembly MFC or Win32

I am trying to reverse engineer an application. I don't understand is this MFC framework. Should i learn MFC to understand the following code. or is it Win32 code developing. But how Win32 works with ...
1
vote
1answer
99 views

help me to understand array?

Question #1 is the lea edx, [esp+24] start of array ? and eax, [esp+140] index? then whats add eax, edx doing here and this source code mean ? can you please explain? I am confused about array ...
1
vote
2answers
247 views

How to assemble and inject an instruction with GDB?

GDB has a x/i command (and also disassemble) which allows to view the instructions at a given address. How can we do the reverse – assemble an instruction and write to a given address?
1
vote
1answer
84 views

Confuse with MOVZX

I'm trying to reverse engineer an app. I can't understand some instructions: EBP-4h=>Self EBP-8h=>OptionData ... mov eax, [ebp+var_4] movzx eax, byte ptr [eax+1Ch] // (1) mov edx,...
0
votes
1answer
83 views

Reversing: DeviceIoControl return value

While reverse engineering a windows executable I found the DeviceIoControl function, and i'm trying to figure out the correct inputs so it does not return a zero, it get's the [ebp+hDevice] from the ...
-1
votes
1answer
55 views

Is there an ida plugin that disassemble in visual c inline assembly (visual studio)?

I have a question... Is there an ida plugin that disassemble the file in visual studio inline assembly? I found this https://github.com/binrapt/ida but when I load it in ida, it complains about "No ...