Questions tagged [assembly]
A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.
0
votes
1answer
29 views
ACCESS_VIOLATION when attaching a debugger
I'm debugging a software and it hits access violation on wcslen function under debugger but runs normally without it.
First I thought It had some anti-debug trick, but I could not found any ...
1
vote
0answers
25 views
Reproduce compilation (ASM) output for library detection - identifying compiler, version & options used
I want to reverse a stripped x86 sample that uses a static library.
So far I could identify the library itself and narrow the version of the library used.
Now I want to use Ghidra's Function ID ...
1
vote
0answers
44 views
Determine what architecture a piece of shellcode targets
After some personal research I didn't find any possible way or a paper to explain how to determine what architecture a given piece of shellcode may targets. The only obvious way I found would be to ...
1
vote
1answer
42 views
Unexpected SEGFAULT when there's apparently nothing that would cause it
This is a from a CTF problem I'm working on. Hopefully it's appropriate to ask this question here.
Above is the GDB output when the segfault goes off. movaps is the offending instruction, meaning ...
0
votes
0answers
47 views
Possibility of converting Powershell to a lower level language
Is it possible to convert a Powershell script to ILAsm or another low level assembly language?
0
votes
1answer
42 views
ASCII strings not showing up in CPU in OllyDbg, but rather in dump
I'm pretty much new to the Reverse Engineering and assembly language. I've watched some videos about OllyDbg and cracking serial numbers in programs and I got interested in them and I want to learn ...
0
votes
1answer
39 views
Hex editing a program to change variable types
For starters guys please don't get mad at me because I really googled this question for a while and couldn't find a satisfying answer. Also if I'm asking an idiotic question, I apologize beforehand.
...
1
vote
0answers
27 views
How to embed PYZ.-00.pyz_extracted folder with entry .py file to generate exe file?
I have decompiled exe using pyextractor script and generated
these files:
PYZ-00.pyz
PYZ-00.pyz_extracted
gui
pyi_rth_tkinter
pyi_rth_multiprocessing
pyi_rth_pkgres
pyi_rth_win32comgenpy
...
0
votes
1answer
57 views
What does ds mean?
When debugging with x64dbg I sometimes see mov ss:[address] 0xAA, I know that this means: move 0xAA into memory at specified address.
But what does
mov ds:[address] 0xAA
mean?
3
votes
1answer
77 views
x86 shellcode leads to segmentation fault
I want to execute execve("/bin/dash", &"/bin/dash", NULL) on Ubuntu 64 bit with the following 32 bit shellcode:
global _start
_start:
xor eax, eax ; set eax = 0 to push a null without using ...
1
vote
0answers
32 views
IDA Pro how debug constant function returning different results?
The code below is executed with the parameters (0, 4, 0) , the first 0 being an int pointer casted to an int, and these are the same every time. After execution, a 3 digit number string is returned/...
0
votes
1answer
81 views
IDA pro - strange switch statement
I use IDA pro and along the analysis I try to understand the following function.
There is a simple switch case but it appears that all the 13 switch branches do the EXACT same thing.
Am I missing ...
2
votes
0answers
19 views
How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled?
How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled?
Context is curiosity.
I'm aware that Docker in the ...
0
votes
0answers
29 views
How to make proper stubs with Exception Handlers?
I'm trying to hook a function to output all its parameters. The hook itself works fine, but the stub somehow crashes the program. I thinks its related to the Exception Handler at the beginning of the ...
1
vote
1answer
172 views
C# Changing method body in runtime
I am trying to change a part in a third party library, it has a bug, however, there are no fixes and source code is not available as well.
At first, I tried to modify IL Opcodes directly by ...
4
votes
1answer
130 views
Reverse engineering a compression algorithm to decompress ASCII text (LZ-variant?)
Reposted from StackOverflow as is.
I'm trying to decompress a very long text block from an ARMv5t powered Gameboy Advance ROM, which was compressed using some kind of custom LZ-esque compression ...
0
votes
0answers
46 views
Any way to edit an ELF binary without hex? [duplicate]
So, this is a noob question, I am a complete beginner in this field, so sorry if I'm wasting your time in any way.
I wanted to know, if there is a way to edit an ELF binary without using a hex editor....
0
votes
2answers
293 views
What's happening in the assembly main function?
I'm currently inspecting a 32-bit malware executable in a WinXP VM using IDA Pro (free version). I don't understand what's happening in the main function here.
Where should I set the breakpoints (...
1
vote
2answers
87 views
segmentation fault at `mov byte [esi+7], al`
Section .text
global _start
_start:
jmp short GoToCall
shellcode:
pop esi
xor eax, eax
mov byte [esi+7], al
lea ...
0
votes
1answer
69 views
exit() syscall within shellcode not working
int main()
{
char shellcode[] = "\xbb\x00\x00\x00\x00\xb8\x01\x00\x00\x00\xcd\x80";
int *ret;
ret = (int *)&ret + 2;
(*ret) = (int)shellcode;
}
I tried to run the above shellcode ...
0
votes
0answers
19 views
SIGBUS when trying to trace functions?
I am working on a crackme (Mach-O, mac app).
Now, the app itself is weird and I honestly don't really know where to start. There are multiple threads and the main function doesn't really tell me ...
0
votes
1answer
81 views
What is this assembly doing?
I wrote a very basic crackme to learn how assembly works.
Even though I wrote it myself, I am having some trouble understanding a few pieces of the assembly:
What I know up to now is: [rbp+rax+...
0
votes
2answers
270 views
How the CMP instruction uses condition flags?
I am trying to figure out the behavior of conditional jumps (JE/JNE, JZ/JNZ) in the x86 instruction set familly.
Which condition flags CMP instruction sets and how, if the result is equal and if it ...
0
votes
1answer
111 views
How does the x86 instruction, call 135b<__x86.get_pc_thunk.ax> work?
I think the below instruction is used for position independent code. Could anyone please help me understand how it works?
call 135b<__x86.get_pc_thunk.ax>
What are the use of the below ...
0
votes
1answer
118 views
x86-64 CALL opcode + disassembly
Working a basic buffer overflow on a 64bit system and putting together some basic shellcode. The main program does a call to puts@plt. When I disassemble main in gdb, the opcodes show as:
e8 6b fe ff ...
0
votes
1answer
50 views
Is it possible to change a signed byte to an int in compiled assembly code?
I'm trying to mess around with an old game and I want to reposition a UI element.
I found the address of where the x and y position get set (It's set to an X position of 90 and a Y position of 358) ...
0
votes
2answers
66 views
IDA Pro not undefining assembly?
I am not sure if IDA is working correctly or not.
I have the instructions
call $+5
pop edi
If I understand this correctly, the program will jump forward, skipping some junk interpreted as ...
0
votes
1answer
69 views
Why Ida pseudo-code translate test as AND?
In IDA when disassembling a x86 EXE file there is a line
test byte ptr [ebp+XXX], cl
Before this line cl has a value of 0x11
The Hex-Rays decompiler plugin translates it as if (v10 &0x11).
Why ...
1
vote
1answer
221 views
Recommended way to modify assembler instructions in IDA
What is the easiest way (or is there any) to modify an instruction
inside a binary opened inside IDA and save the changes to the original?
Is there a builtin assembler who's output I can place at a ...
0
votes
2answers
70 views
Bitwise operation between byte and 1?
I am having some trouble understanding what this is doing.
This is the commented pseudocode.
mightGetUserInput(&std::__1::cin, &userInput) ; this fills the buffer with the user input, ...
1
vote
2answers
59 views
What is this assembly in the `__common` section doing?
I have stumbled upon this:
public _oret
__common:0000000100018000 _oret:
__common:0000000100018000 sub [rdi+4Fh], al
__common:0000000100018003 db 4Fh
__common:...
0
votes
0answers
28 views
How to generate .TEXT only asm output in IDM?
So I tried to do File -> Produce File -> Create ASM File. There are lots of dd stuff that I don't want. So now, what I need is, either an android app where I can view that .asm file ...
1
vote
1answer
98 views
why saved rip changed by push？
I am doing a reverse homework. see the following pictures:
as can be seen from this picture, before call push touch3, "saved rip" is at 0x5561dca8, which is equal to the current rsp(0x5561dca8).
...
1
vote
1answer
68 views
(CTF) Speed up assembly by hooking to an static function
For a CTF I have a fairly slow recursive function. I just need to cached the previous results in a dictionary and get them instead. I did it but had to reverse engineer the code. I was wondering if ...
0
votes
1answer
62 views
Executing CMP DS:[] by inline assembly inline hooks
I need to execute some instructions of library I'm using (ws2_32.dll) inside my C code, but I have a problem with a simple cmp instruction.
Followed by IDA, this instruction is:
cmp off_41AE7048, ...
0
votes
1answer
64 views
Switching from seg to text in IDA-View
actually i don't know where the problem but i will describe it
I am trying to analyse the firmware of a router and i could extract it and i got these files
libxmlapi.so
libhttpapi.so
libcfmapi.so
...
-2
votes
1answer
101 views
Can anyone please explain the following dissasembly codes?
Disassembly:
0: 31 c9 xor ecx,ecx
2: f7 e1 mul ecx
4: 51 push ecx
5: 68 2f 2f 73 68 push 0x68732f2f
a: 68 2f 62 69 ...
1
vote
2answers
61 views
Calculation with not defined variables?
I am new to reverse engineering and try to solve a crackme with radare2.
My problem is understanding of the following lines:
| 0x000007a9 c745b8000000. mov dword [var_48h], 0
| ...
1
vote
2answers
151 views
Jump in the middle trick
I'm reversing a program that "hides" some instructions using the jump in the middle trick. This trick is a jump to a middle of an instruction, whereas the real address actually contains another opcode....
0
votes
1answer
173 views
What is this assembly code, fld qword ptr code here doing? Also, how do I store my own value?
I was reverse engineering a game using cheat engine and trying to trace where my health gets reduced.
Basically the health gets stored in the stack and then pops out for displaying on the screen. ...
1
vote
1answer
155 views
Understand the CPU cycles of x86 instruction bsr/bsf
I am on the hook to analysis some "timing channels" of some x86 binary code. I am posting one question to comprehend bsf/bsr opcode.
So high-levelly, these two opcodes can be modeled as a "loop", ...
1
vote
0answers
31 views
Set Breakpoint on ActiveX Property Being Set (No Symbols)
A program is loading an VB6 based ActiveX control that has several property, for example ConnectionString.
The application is dynamically generating the values it provides at runtime, so it is not ...
4
votes
2answers
335 views
Which operators use sal, shl, sar or shr
Which operators in C language would result in assembly commands such as sal, shl, sar or shr for example?
0
votes
1answer
120 views
How to detect md5 and sha256?
I use FindCrypt2 Ida plugin but it detect md4 and not md5 , and not detect sha256.
How can I detect md5 in assembly?
How can I detect sha256 in assembly?
thanks
0
votes
1answer
90 views
why code at .rodata executes [closed]
How come the following code executes if buf* is @ rodata segment ?
#include <stdio.h>
char *buf[] = {
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\
\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\...
1
vote
0answers
57 views
How can a segfault happen during the libc exit call on Linux?
I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge.
While testing, I have noticed ...
0
votes
1answer
52 views
Calculate LEA operand
I have those opcodes on 64 bits:
48 8D 35 45 CE FF FF >>> lea rsi, [rip - 0x31bb].
How can I get the 0x31bb value from those opcodes and how can I know if I have a + sign or a - sign ...
1
vote
0answers
66 views
Help understanding ARM Assembly example code - loops, set flags and code mnemonics
This is the example code:
_start:
LDR r0, =n
LDR r0, [r0]
LDR r1, =array1
MOV r2, #0
LDR r4, =array2
loop:
LDR r3, [r1], #4
CMP r3, #58
BGT a_point
CMP r3, #47
BLT a_point
SUB r3, r3, #0x30
STR r3, [...
0
votes
1answer
95 views
How do I go about overriding a function internally defined in a binary on Linux?
To be specific, I cannot recompile this binary, nor do I have access to the sourcecode.
The functions are not defined within a shared library.
So, how can I go about changing a function, or ...
0
votes
1answer
162 views
How int3 looks like in C
This is assembly code that can catch debugger with int 3 :
MOV ECX, ExceptionHandler
MOV DWORD PTR FS:[0], ExceptionHandler
INT3
///there is debugger!!!
ExceptionHandler:
////no ...
