Questions tagged [assembly]
A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.
699
questions
0
votes
1answer
25 views
Not Understanding the FU540 Boot Process
I'm reading the manual for the SiFive FU540-C000 trying to understand the boot process, and I'm not making sense of the initial steps after power on.
I'm using MSEL = 1111 based on the recommendation ...
1
vote
0answers
54 views
I have a dos file/database that i need to extract into MS Excel or My Sql
I have a dos file/database(decades old) that I need to extract into MS Excel or My SQL.
I am using a MacBook.
The file appears to have no extension.
The file type I can see when I do "get info&...
2
votes
1answer
62 views
What C++ construct could emit such Watcom C++ 10.5 assembler listing?
Based on the assembler listings, a C++ object is locally allocated on the stack without constructing the object in the caller routine and the callee takes the address to the allocated stack space and ...
0
votes
1answer
43 views
How does this function take the argument if its not pushed into the stack?
I dont understand how does the function take the argument without pushing
push ebp
mov ebp, esp
and esp, 0FFFFFFF0h
sub esp, 20h
mov [esp+20h+var_20], offset aEnterX ; "Enter X:"
call _puts
1
vote
3answers
92 views
TEST instruction and ZF flag
In the part 07 of lena151 RE tutorial, we arrive to these instructions:
AL = 0
TEST AL,AL
JNZ ...
And notice:
Because of the JNZ, AL must be different from zero when arriving here to be registered.
...
-1
votes
1answer
51 views
How to find bugs in a modern desktop application with reverse enginnering?
I would like to clarify the context for the question: I have studied different types of exploiting but all the studies I have carried out were with command line programs and with functions that I ...
0
votes
0answers
47 views
Confusing objdump with data as code
I am trying to confuse objdump to solve the first exercise of chapter 6 in Practical Binary Analysis. Admittedly I am super weak with inline assembler but I made a best-effort attempt and tried to get ...
0
votes
0answers
90 views
What kind of code creates this function call pattern?
While using WinDbg: u/uf to disassemble functions in ntoskrnl.exe there are functions that are used in system calls and exception handling that have these weird function call patterns and I can't ...
5
votes
1answer
176 views
Would hiring a RE service be worth it?
Before I clarify my question, I will explain the project I'm working on, and what I've done so far so there will be a better understanding of what I'm trying to do. I'm trying to modify the UI of a ...
0
votes
1answer
107 views
MIPS assembly to C code
I think I'm really brain-dead and am not really sure what to do next, but I am trying to manually convert assembly code to a C program. It's not really working, but I'm not sure what is wrong. I would ...
1
vote
1answer
42 views
Reversing bit rotations
so I have a question regarding the assembly instructions ror and rol:
Is it possible to properly reverse them?
So assuming I have something like
ROR EDX, 0x4
and know the contents of EDX after ...
2
votes
2answers
254 views
Is decompilation significantly more limited when performed on handwritten assembly?
I understand C language decompilers are designed to decompile code produced by a C compiler, and that such decompilers have a lot of limitations and sometimes are actually wrong (in the sense that ...
1
vote
0answers
103 views
C# Console Application can't load file or assembly, but needs a dll which doesn't exists?
I have a strange error. I created for testing purposes a normal Console Application and run my own Tracer which is written with the help of Mono.Cecil on this application. I embedd a Stopwatch at the ...
1
vote
0answers
44 views
RE on firmware images that seem to use weak encryption/obfuscation. Robot vacuum
I have been playing with some robot vacuums that utilize very basic navigation, and I am wanting to play around with my own provisioning along with adding a Rpi to augment features.
These vacuums are ...
0
votes
1answer
72 views
Understanding the basics of Reverse Engineering a segment of code
Currently trying to understand the following code and what it is doing.
mov eax, 1
test eax, eax
jz loc_411503
mov esi, esp
call ds:_kbhit
cmp esi, esp
call sub_411159
test ...
-1
votes
1answer
103 views
what do these assembly code doing?
I tried to reverse engineer an apk app, and it was loading a native code. I have observed that the app was using the native code like this
public static String v = sUQWWyTBEs().toString().substring(32,...
1
vote
1answer
97 views
Can the return value of this function be determined with static analysis?
I have an assignment and i tried solving it. However i can't seem to solve it, despite double checking everything and investing multiple hours.
My task is to reverse engineer the following functions ...
0
votes
0answers
58 views
Assembly to C decompiler
I need an assembly to C decompiler, I tried this one https://onlinedisassembler.com/odaweb/ but my code looks like this:
#include <p16F887.inc>
cblock 0x20
Delay1 ; Assign an ...
1
vote
1answer
60 views
IDA Pro - How to remove multi-line bit definitions for register
I've just started reversing some microcontroller code and have the RAM, ROM, and SFR (Special Function Registers) segments set up. I've selected my processor architecture and it has named most of the ...
1
vote
0answers
51 views
Trying to call the Exit Shellcode in a c program
#include<stdio.h>
#include<stdint.h>
char shellcode[] = "\xb8\x3c\x00\x00\x00"
"\xbf\x14\x00\x00\x00"
"\x0f\x05";
int ...
2
votes
2answers
80 views
Changing value of parameter with gdb
I have a file named exploit.c inside which:
#include <stdbool.h>
#include <stdio.h>
const char y1 = 'a';
const char y2 = 'b';
const char y3 = 'x';
const char y4 = 'y';
const char y5 = 'i';...
0
votes
0answers
27 views
Can't figure out the type of hash
I know that SHA-1 is a cryptographic hash and it takes 20-byte and this is an example of it 64C1F7689B32D9805C5A1D5DABF3EAD31446B80C
The problem is with iirc,
I'm working in a small project, and ...
0
votes
1answer
39 views
troublesome stack frame setup
I have a function with the first few instructions defined as follows:
sub rsp, 0x80
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x58], rsi
mov qword [rbp + 0x50], rbx
mov qword [rbp + 0x70], rcx
mov ...
1
vote
1answer
103 views
GDB inserting breakpoint cause Segmentation Fault
I was trying to play around with gdb, and I'm especially interest in seeing how the Procedural Linkage Table(PLT) and the Global Offset Table (GOT) interact with each other. So I set some breakpoints ...
1
vote
1answer
34 views
Help understanding ARM Cortex-M4 SBC instruction
Page 88 of the ARM Cortex-M4 Generic User Guide says "The SBC instruction subtracts the value of Operand2 from the value in Rn. If the carry flag is CLEAR, the result is reduced by one." Why ...
0
votes
0answers
41 views
Access violation writing location
I am currently playing with C# and detours/trampolines using a library I found here:
https://github.com/xcvd/Detours
I am attempting to hook a known function in a game and then call the original ...
0
votes
1answer
81 views
Do Stack frames grow upwards?
I am currently learning RE and I came upon this piece of code which made me question whether stack frames grow upward:
0x080483f4 <main+0>: push ebp
0x080483f5 <main+1>: mov ...
0
votes
1answer
34 views
Objdump -S without assembly
I compiled my c source code and got an elf.
I use "objdump -Sl" but don't need the assembly instructions.
Is there a way to use objdump without the assembly part (or other tool)?
for example,...
2
votes
1answer
132 views
Help with LDR, LDRD and STR instructions
The Cortex™-M3 Devices Generic User Guide explains the instruction LDRD R8, R9, [R3, #0x20] as "Load R8 from a word 8 bytes above the address in R3, and load R9 from a word 9 bytes above the ...
0
votes
1answer
76 views
Why compiler is doing this?
While I was disassembling my own C code for practice I saw an interesting point which I want to share with you guys and needs to know the answer as I always get from here. Now, the interesting point ...
0
votes
0answers
48 views
Disassembly a win Linux file
I have a file that has a compiled assembly code and being loaded into javascript code for execution.
How can I “inspect” the file? I am aware of tools like immunity debugger or ollydbg but I am not ...
0
votes
0answers
19 views
radare2 can't see error/signal messages
I'm in visual mode on the debug screen. I'm stepping through some function code with the 'F7' shortcut key, when I hit a part of the code that yields an error or some kind of message, the message text ...
0
votes
1answer
64 views
Is the code like this reverse able? (from Assembly - UnityScript)
i try to reverse this code but cant figure it out what is this number mean or how to call it...
1
vote
2answers
102 views
Why eax is assigned to 'variable looked' like addresses
#include <stdio.h>
int main() {
int number1, number2, sum;
printf("Enter two integers: ");
scanf("%d %d", &number1, &number2);
sum = number1 + ...
1
vote
1answer
87 views
How do you build a virtual machine to interpret machine code?
How does the parser parse the machine code? Does it go byte by byte? How does it know how many bytes to read when parsing an instruction? Does it have some sorts of tables of bytes to translate the ...
2
votes
2answers
82 views
How to test and debug x86 Assembly exceptions in NASM?
I have seen all the exception "IDs" in the Intel Manuals, and just came across sandpile's exception guide, which actually shows some hexcodes. For example, "divide by zero error":
...
1
vote
1answer
150 views
How to write these 4 example x86 assembly instructions in opcodes, according to the Intel docs?
Okay so I have been studying Chapter 2 of Volume 2 of the Intel Manuals.
I have as best an understanding as I can get of the ModR/M byte, the REX byte, the SIB byte, and the general instruction ...
0
votes
1answer
62 views
How to simplify a function "calling itself's reference"
I encounter often a function calling itself (in the pseudo code) such as:
result = (**(__int64 (__fastcall ***)(volatile signed __int32 *))lambda)(lambda);
Since the disassembly is call qword ptr [...
4
votes
1answer
186 views
Find Decryption algorithm of an encryption algorithm
I recently work on an algorithm that encrypt some data with 8 byte length.
I worked hard and I successful to get this algorithm, but I need decryption of this algorithm.
How I can invert it?
I guess ...
0
votes
1answer
135 views
Best way to protect source code of exe that being loaded by Assembly.Load method
I am protecting an exe that being loaded by Assembly.Load... This makes everything difficult because most obfuscators causing it to not work properly or not load at all. I used confuserEx Ameteurz ...
1
vote
0answers
44 views
Adding my own assembly code to x64 .exe
I have assembly code like this:
142cccc0c c7 43 18 MOV dword ptr [RBX + 0x18],0x4000
00 40 00 00
142cccc13 e8 a8 79 CALL FUN_141a845c0 ...
0
votes
1answer
54 views
Assuming x is a number smaller than 0xff what happens to x after the assignment LOBYTE(x)=x-1?
I understand that LOBYTE is an IDA macro for retrieving the lower byte of a variable. My question is what is the difference between the result of x=x-1 and LOBYTE(x)=x-1 when x is smaller than or ...
0
votes
1answer
67 views
Link decompiled C code to Assembly (retdec decompiled object into C code, but with many errors, i found the kill switch which i need to edit)
I am using retdec to decompile a piece of software. It has a "kill switch" to detect if it's being run in an untrusted environment, in the decompiled code it just a simple
if (env_untrusted()...
1
vote
1answer
111 views
What do the following AARCH64 LDR and STR instructions do exactly?
The following instructions are part of a IDA's disassembly of an AARCH64 binary. While it is fairly obvious that the # represent pure numbers and the [] probably refer to the memory address referred ...
0
votes
1answer
113 views
How JNE work in Ollydbg?
I have a question about JNE.
I use ollydbg and ReverseMe tutorial.
In JNE condition, the zero flag is equal to 1. and it mean the arithmetic result is zero. Right?
The Z=1 meaning the condition is ...
1
vote
3answers
299 views
What are my options to add instructions to a binary?
I am fairly new to reversing so apologies in advance if any terminology is incorrect.
I am currently using ghidra on windows to look at the instructions/decompilation of a binary and I am looking to ...
1
vote
0answers
55 views
Is there a meaning to the test instruction if it isnt followed by a conditional jump?
Pasting a snippet of code I found inside a malware sample.
0040F695 push ecx
0040F696 lea ecx,dword ptr ss:[esp+8]
0040F69A sub ecx,1000
0040F6A0 sub ...
1
vote
1answer
196 views
Why does decompiling a C++ using Snowman yield some full variable names and some obfuscated ones?
I decompiled a C++ exe file using Snowman, hoping to see if it was malware or not (Although, honestly, I have no clue how to continue that - The file is really large, and the decompilation mostly ...
1
vote
1answer
241 views
Finding Ropper/ROPgadget offsets in Ghidra disassembly
How is the offsets returned from ROP gadget finders related to the files they come from? For example, if the ROP gadget finder says that a certain gadget is at offset 0x0002ae74 in libuClibc.0.9.3.so ...
0
votes
0answers
42 views
Remapping Branch Instructions After Obfuscation
Recently I've been working on a project. I've already got a hint for a problem that I had here: (Garbage Assembly Code Generationat at random offsets)
however, the accepted answer's solution doesn't ...
