Questions tagged [assembly]
A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.
-1
votes
1answer
79 views
Can anyone please explain the following dissasembly codes?
Disassembly:
0: 31 c9 xor ecx,ecx
2: f7 e1 mul ecx
4: 51 push ecx
5: 68 2f 2f 73 68 push 0x68732f2f
a: 68 2f 62 69 ...
1
vote
2answers
51 views
Calculation with not defined variables?
I am new to reverse engineering and try to solve a crackme with radare2.
My problem is understanding of the following lines:
| 0x000007a9 c745b8000000. mov dword [var_48h], 0
| ...
1
vote
2answers
88 views
Jump in the middle trick
I'm reversing a program that "hides" some instructions using the jump in the middle trick. This trick is a jump to a middle of an instruction, whereas the real address actually contains another opcode....
0
votes
1answer
56 views
What is this assembly code, fld qword ptr code here doing? Also, how do I store my own value?
I was reverse engineering a game using cheat engine and trying to trace where my health gets reduced.
Basically the health gets stored in the stack and then pops out for displaying on the screen. ...
1
vote
1answer
61 views
Understand the CPU cycles of x86 instruction bsr/bsf
I am on the hook to analysis some "timing channels" of some x86 binary code. I am posting one question to comprehend bsf/bsr opcode.
So high-levelly, these two opcodes can be modeled as a "loop", ...
1
vote
0answers
22 views
Set Breakpoint on ActiveX Property Being Set (No Symbols)
A program is loading an VB6 based ActiveX control that has several property, for example ConnectionString.
The application is dynamically generating the values it provides at runtime, so it is not ...
3
votes
2answers
137 views
Which operators use sal, shl, sar or shr
Which operators in C language would result in assembly commands such as sal, shl, sar or shr for example?
0
votes
1answer
70 views
How to detect md5 and sha256?
I use FindCrypt2 Ida plugin but it detect md4 and not md5 , and not detect sha256.
How can I detect md5 in assembly?
How can I detect sha256 in assembly?
thanks
0
votes
1answer
71 views
why code at .rodata executes [closed]
How come the following code executes if buf* is @ rodata segment ?
#include <stdio.h>
char *buf[] = {
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\
\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\...
1
vote
0answers
37 views
How can a segfault happen during the libc exit call on Linux?
I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge.
While testing, I have noticed ...
0
votes
1answer
42 views
Calculate LEA operand
I have those opcodes on 64 bits:
48 8D 35 45 CE FF FF >>> lea rsi, [rip - 0x31bb].
How can I get the 0x31bb value from those opcodes and how can I know if I have a + sign or a - sign ...
1
vote
0answers
51 views
Help understanding ARM Assembly example code - loops, set flags and code mnemonics
This is the example code:
_start:
LDR r0, =n
LDR r0, [r0]
LDR r1, =array1
MOV r2, #0
LDR r4, =array2
loop:
LDR r3, [r1], #4
CMP r3, #58
BGT a_point
CMP r3, #47
BLT a_point
SUB r3, r3, #0x30
STR r3, [...
0
votes
1answer
84 views
How do I go about overriding a function internally defined in a binary on Linux?
To be specific, I cannot recompile this binary, nor do I have access to the sourcecode.
The functions are not defined within a shared library.
So, how can I go about changing a function, or ...
0
votes
1answer
133 views
How int3 looks like in C
This is assembly code that can catch debugger with int 3 :
MOV ECX, ExceptionHandler
MOV DWORD PTR FS:[0], ExceptionHandler
INT3
///there is debugger!!!
ExceptionHandler:
////no ...
-1
votes
1answer
71 views
Understanding assembly code: “mov dword” and “mov qword” in main.c
I have just converted this piece of code in assembly:
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char** argv) {
return (1);
}
Here are my questions:
Once you push ...
-1
votes
1answer
106 views
how should i change an instruction to NOP in IDA?
I am new with IDA assembler and i used to work with hopper app.
the problem is i can't change instruction in IDA from something like CBNZ to NOP.
is there any button to do this? i can't find anything ...
0
votes
2answers
122 views
How to identify base64 encode/decode in assembly
How to identify in assembly base 64 encode/decode with Ida. Is there any magic constant that I can search? Or maybe a plugin that find that?
FindCrypt2 Ida plugin not find that
0
votes
1answer
117 views
Meaning of cmp byte ptr [EBP-9], 0
Looking to find the meaning of this statement. From what I understand its comparing 0 with value of EBP register - 9, but I don't understand what the byte ptr does.
1
vote
2answers
123 views
Lots of mov instructions into ebp+offset - What is happening?
While learning RE I have come across this large segment of instructions that contains a majority of mov [ebp+offset], value instructions. I believe that ebp + offset are local variables? I think? ...
6
votes
1answer
280 views
Simplifying assembly
I'm analysing some binary trace, it's pretty much obfuscated. What I need to do is to understand work flow of its alghoritms. However I cannot find any reliable tool which would help me with that.
I ...
1
vote
1answer
46 views
Explenation about opcode and operand
I need an explanation about the term "opcode". I have found this :
An opcode is binary or hex value of the machine instruction in the cpu
instruction set.
If I understand correctly the ...
1
vote
1answer
76 views
What purpose of MOVZX EAX,AX after MOVZX EAX, WORD PTR [RBP+ADDR.SA_DATA]?
I thought it was strange when I was looking at the code below. The first instruction clearly has completed the task of data transfer and expansion into 16 bits. Why is there a "mov Eax,ax" in the ...
-1
votes
1answer
220 views
How to convert assembly to pseudo code? [closed]
I have the following assembly. I don't know how to follow assembly. I was wondering if there is a way to convert assembly to a human readable pseudo code or better yet C code:
init:
mov eax, [ebp+...
2
votes
1answer
91 views
Call instruction changed while running
While debugging and reverse-engineering my exe, I have found a very weird thing.
call ds:GetModuleFileNameA
This call instruction is formed with below hex bytes in IDA.
FF 15 24 C0 41 00
(I think ...
0
votes
1answer
62 views
Linux Assembly Syscall
I'm learning how to write shellcode by using Linux system call "execve" to spawn a shell with root access privilege.
Here i found a shellcode online:
http://shell-storm.org/shellcode/files/shellcode-...
1
vote
1answer
245 views
What does fs and gs registers provide in Linux?
In a 64 bit ELF binary I found it mainly uses fs register to get some values. How can I know which value it wants to access? I'm familiar with that NT kernel uses fs and gs register for TEB structure ...
1
vote
0answers
42 views
Is there a way to modify number of reads/writes to/from a memory address?
I haven't had any luck researching this, so I thought I would inquire here!
Let's assume I have found a memory address housing a value of interest. Using a program like Cheat Engine, I look for ...
1
vote
1answer
163 views
Is this a good way to get past anti-debugging measures?
This program I am analyzing is full of anti-debugging. It won't even run if most debuggers are loaded before I start the app.
I tried using IDA to static analyze it, but it was written in a OOP ...
12
votes
2answers
3k views
What kind of code would produce this assemby with loads of jump statements?
00EE16CC . E9 DFBB0000 JMP BinFile.00EED2B0
00EE16D1 . E9 64AF0000 JMP <JMP.&MSVCP140D.?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@>
00EE16D6 . E9 15DB0000 JMP BinFile....
-2
votes
1answer
104 views
Can someone please help me reverse engineer this assembly code to C please! [closed]
I am really bad at understanding assembly code and the way it works. I have little problems given to me in Assembly code and I have to reverse engineer it to C, but I have been doing really bad job at ...
3
votes
1answer
365 views
XCHG RAX, RAX: 0x09, what does this code do and how does it work?
Given the following short assembly snippet:
shr rax, 3
adc rax, 0
I worked this out a bit:
We know SHR sets the CF with the last bit shifted.
We know ADC dest, 0 is just adding the CF.
So ...
4
votes
1answer
215 views
Need help understanding a complex mathematical password checking function?
Below is a complex pseudocode for a mathematical problem which attempts to check if a password entered is correct or not.
Previous Analysis Done:
Data is arranged in the form of 3x3 Matrix with i,j ...
5
votes
2answers
658 views
How many registers does an x86_64 CPU actually have?
I am currently learning reverse engineering and am studying the flags register.
I had in my mind that rflags was just another name for one of the 16 general purpose registers, for example rax or rbx.
...
1
vote
0answers
40 views
getting %localappdata% in asm
I have an old windows x86 application that no longer works properly since windows 8. This app creates files within its own folders for things like app settings. Unfortunately, Microsoft no longer ...
2
votes
1answer
143 views
Why is the process crashing after executing my injected payload?
I tried the following payload for APC injection in Windows.
It gets executed successfully(pops up a MessageBox) but the process crashes after the execution of payload.
What could be the possible ...
1
vote
2answers
128 views
Why there are two different shellcodes for bin/sh with much different syntax and which one is better to use? (x86)
I have found two shellcodes for spawning /bin/sh which are much different from each other. The second one is hardly ever found on the net, and it mostly comes up in reverse engineering websites:
1. "\...
2
votes
1answer
241 views
Converting Assembly x64 code to C
I have the following code:
0000000000400526 <main>:
400526: 55 push rbp
400527: 48 89 e5 mov rbp,rsp
40052a: 48 83 ec 20 sub ...
3
votes
1answer
216 views
How can I convert this assembly code (x64) to C?
I have the following assembly (x64) function:
400700: sub rsp,0x18
400704: mov QWORD PTR [rsp+0x8],rdi
400709: cmp QWORD PTR [rsp+0x8],0x0
40070f: jne 400718 <bar+0x18>
400711: mov eax,0x0
...
1
vote
1answer
103 views
Figuring out what a segment of assembly code does
I have the following assembly code:
0000000000400711 <foo>:
400711: 55 push rbp
400712: 48 89 e5 mov rbp,rsp
400715: 48 89 7d e8 ...
0
votes
1answer
135 views
Analyze raw assembly using IDA Pro
I have a raw assembly dump i.e.
.intel_syntax noprefix
.bits 32
.global main
main:
push ebp
...
And I know it's Intel x86 and the original function was most likely written in C. Now the ...
0
votes
1answer
482 views
What does this assembly language program output?
I have been struggling with this for a long time. I have the following assembly language code:
.intel_syntax noprefix
.bits 32
.global asm0
asm0:
push ebp
mov ebp,esp
mov eax,DWORD ...
-1
votes
1answer
97 views
How can I decompile the CC2650 .hex file to C?
I want to decompile it to C, or at least assembly the CC2650 hex file (Bluetooth Low Energy Sensor Tag), that provide TI.
My goal is to know the specific way used by CC2650 to generate the LTK.
I'll ...
1
vote
1answer
52 views
Explanation of SBB instruction
I have this Asm from a book that suppose to do a Boolean cast: rax := rax ? 1 : 0
1. neg rax
2. sbb rax,rax
3. neg rax
But as i understand this code and the instructions (below), this ...
4
votes
1answer
174 views
Need help identifying main processor for Roland synthesizer
I desperately need help figuring out the ic chips in this unit so I can view the firmware in ida pro.
So the unit is a roland gr-55 guitar synthesizer and i'm trying to disassemble the firmware into ...
1
vote
2answers
196 views
.NET assembly IDA PRO, using LDSTR IL op code, how to patch a string?
I'm trying to patch a string. So right now I'm trying to replace instruction LDSTR with LDSTR "mystring"; however, I have been unsuccessful. After assembling the LDSTR op code, I don't quite ...
1
vote
2answers
141 views
Getting opcode Length , How to
I am apparently not very good with assembly as I am novice to somethings! Hence i wanted to make a question again.
Now i got this from here to make something like a LDE (Length Disassembly Engine) ...
4
votes
4answers
867 views
Calculation of jmp address through subtraction
I don't get why the two addresses of the functions are subtracted in order to get the jump destination.
mov eax, [ebp+func1]
sub eax, [ebp+func2]
sub eax, 5
mov [ebp+var_4], eax
Which ...
2
votes
1answer
45 views
Correct my understanding on a basic allocation memory
Here is the function
If I understand correctly:
There is a buffer of size 256 bytes created (malloc)
in this buffer, the first 32 bits are set to 0 (because dword designates 32bits size)
the next 32 ...
1
vote
1answer
117 views
VirtualProtect failed to revert protections on mrdata section of ntdll, why?
i perform a loop in assembly where i am parsing the sections of ntdll change their memory permissions with VirtualProtect and then revert them back to their original permissions. the code looks like ...
