Skip to main content

Questions tagged [assembly]

A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.

Filter by
Sorted by
Tagged with
0 votes
0 answers
56 views

Ida large structure problem in pseudo

Solved myself thnx for nothing
1 vote
1 answer
820 views

How to run exe program loaded into IDA Pro or Ghidra

I'm new to reverse engineering, just learning. After the exe program is loaded into IDA or Ghidra, how do I run the exe program that loaded into IDA/Ghidra? so I can interact with the exe program? and ...
0 votes
1 answer
39 views

struggle with Decrypt Byte Array with a key of unity game using il2cpp

So i'm trying to reverse an unity game using il2cpp to get the assets of it. After some reverse stuff i found that the asset's (especially here the png image) byte array get encrypted with a key and i ...
0 votes
1 answer
156 views

Is DOS Assembly Hexadecimal Different To Modern Hex Editor Hexadecimal?

I am trying to find the correct Data Segment, corresponding to a certain File in a 16bit DOS Game. The Assembly Instructions for the Decompiled .exe File in IDA Pro Version 5, I am looking at. I was ...
0 votes
1 answer
100 views

Cracking cryptographic function with radare2

I want to reverse engineer an android game, found a method public static byte[] MNNOPKMJMFP(byte[] AFFEPNLBIIC, byte[] OENOGNMAMPO, byte[] GLLEHJKGIBK) { } Names are obfuscated, i know that this is a ...
0 votes
2 answers
1k views

How do I go about overriding a function internally defined in a binary on Linux?

To be specific, I cannot recompile this binary, nor do I have access to the sourcecode. The functions are not defined within a shared library. So, how can I go about changing a function, or ...
0 votes
1 answer
57 views

Offset addressing

I’m writing a C-SKY (CK803S) processor module for IDA Pro, and a question arose about offsets in transitions, small ones are fine, but long ones lead to nowhere, from the documentation: in code I ...
0 votes
1 answer
78 views

X64DBG Conditional Breakpoint on Specific Opcode?

Is there any way to break on specific opcode in X64DBG? For example i want to break on start of a function which is 55 | push ebp 8BEC | mov ebp,esp can i set a breakpoint like opcode == 0x00EC8B55? ...
37 votes
5 answers
8k views

Why would a program contain a call instruction targetting the address immediately following that instruction?

While reversing a 32bit Mach-O binary with Hopper, I noticed this peculiar method. The instruction on 0x0000e506 seems to be calling an address right below the instruction. What would be the reason ...
2 votes
1 answer
439 views

Best way to protect source code of exe that being loaded by Assembly.Load method

I am protecting an exe that being loaded by Assembly.Load... This makes everything difficult because most obfuscators causing it to not work properly or not load at all. I used confuserEx Ameteurz ...
4 votes
2 answers
2k views

How do you look for a a particular value at address in IDA

So, I was trying to load some binary and in the main function, I saw instructions such as mov edi, [esi+1Ch] ... lea eax, [esi+18h] So, what are these values at [esi+1Ch] and [esi+18h]. How do ...
4 votes
2 answers
1k views

How to bypass anti debugger? IDA Pro

Im new to reverse engineering and doing a crackme that requires me to make a keygen, yes i know making a keygen isn't a beginner task however im stuborn, i am trying to debug the program to understand ...
0 votes
0 answers
102 views

Searching for a byte pattern and then hooking all instances of it using frida on iOS

I'm using a frida script to scan for a certain byte pattern when I launch an iOS app. I can log each offset and confirm these are correct by also printing out the instructions at those locations and ...
1 vote
1 answer
120 views

how to diassemble an .obj file

I'm new to programming and recently studying an ancient DOS assembly program written for 80186 and assembled with MASM. There are some .obj files that I want to open and take a look. I tried obj2asm....
2 votes
1 answer
1k views

Found a way to make any program run with the discrete Nvidia dGPU. But I need a little help to finish implementing the injection

Nvidia Optimus is a major thorn in my side. I just bought a new laptop that is using this on-the-fly gpu switching crap. This means that unless an application starts by querying the GPU for 3D tech or ...
3 votes
4 answers
555 views

Reverse Engineering CTF help

I am having trouble figuring out this microcorruption challenge in the link below: https://microcorruption.com/debugger/Halifax Basically, the 0x7f interrupt has been disabled so I must reenable it ...
0 votes
0 answers
37 views

how to set a BP on button in SunAwtCanvas in x96dbg

I'm trying to debug a program in x96dbg that I think this is written in Matlab. There is no string related to buttons or something interesting. Then I go to Handles tab to find buttons and set break ...
0 votes
0 answers
44 views

Address arithmetic in Ida Pro

Can someone tell more about address arithmetic in Ida? I were looking for assembly instructions and saw this LDR R0, =(byte_255914C - 0xC63D50) I understood right that in r0 will be an address which ...
0 votes
1 answer
129 views

Mnemonic suffixes for x86-64 assembly for AT&T syntax

I'm trying to understand suffixes used for the AT&T syntax for the x64 assembly used for instruction mnemonics. For regular cases: 'b', // 8_bit 'w', // 16_bit 'l', // 32_bit 'q', /...
3 votes
1 answer
966 views

What is the meaning of jmp dword ptr off_XXXXXXXX + 8 in IDA?

What is the meaning of this kind of jmp instruction in x86 assembly in IDA? Does it mean that we should jump to the address [6CA2E9B0] + 8 or [6CA2E9B0+8]? When I follow that off_XXX, I get to the ...
11 votes
2 answers
4k views

Why did Intel chose 90h machine code for their NOP instruction instead of a 0?

Probably just a historical question, if anyone knows.
1 vote
0 answers
94 views

DOS .exe File Decompiled in Cutter Program Showing Different Than In IDA Pro

I am having an issue when using the Cutter Reverse Engineering Program, Here is a Segment of Decompiled Assembly, in Cutter :- at 0000:4ed5 in the picture I posted the .string line of text is there, ...
2 votes
2 answers
115 views

Keystone rust bindings error when assembling "syscall; ret" shellcode

I'm working on a project related to Process Injection for learning Rust. I have to inject shellcode at some points and use the Keystone engine for assembling shellcode from source. I detected that the ...
0 votes
0 answers
21 views

What guidelines and/or tools exist that facilitate the analysis of a program in assembly language for PIC-Microchip?

What tools exist that facilitate the interpretation of a program written in assembly language of a PIC-Microchip, appealing to the construction, for example, of a flowchart and then recoding it in ...
0 votes
0 answers
48 views

Convert hex chars string to int

For example we have chars buffer with hex value: char * buff = {"e000"}; //this is our hex value in eax - input for Get_Val(). Then there is function Get_Val() - converts hex (string) to ...
0 votes
1 answer
46 views

Assembler OR operation

Is this asm code: or unknown_byte_0004AAA7, 1 dseg05:000C7FDC unknown_byte_0004AAA7 db 0 equivalent to this C++ code below? bool unknown_byte_0004AAA7 = 0; unknown_byte_0004AAA7 = ...
0 votes
2 answers
72 views

MS DOS development - Interrupt controller

cseg01:0005229A mov dx, 21h ; '!' cseg01:0005229E in al, dx ; Interrupt controller, 8259A. cseg01:0005229F or al, 1 cseg01:...
1 vote
1 answer
137 views

What means this code?

cseg01:00020DB8 mov eax, offset screen_with_height cseg01:00045704 mov dword ptr [eax+0Ah], 0 cseg01:0004570B call sub_466F8 ; call some proc ...
0 votes
0 answers
35 views

Reverse engineering JCALG/LZ?? compression

I think this is related to this this question, but the consts in the example code don't exist in mine, so maybe it's a different level of compression, but I am unsure. Can anyone provide me the right ...
2 votes
0 answers
141 views

Trying To Understand DOS Game Assembly Instructions

I am trying to understand assembly language instructions, for a DOS Game. I have looked at the following Link :- https://atrevida.comprenica.com/atrtut07.html reading about how VGA Graphics work in ...
0 votes
0 answers
137 views

from executable to assembly source code?

let's say i have an ".exe program" and i want to disassemble it and get "disassembled code" . my question is => can i maintain and organize that "disassembled code" ...
0 votes
1 answer
99 views

Assembly for malware analysis

I know we have some architectures for assembly language. But I wanna know this: I need learn x86 assembly ? , or arm assembly ? , or both ? , or others ?.. Please help me , what should I learn?
2 votes
0 answers
431 views

How to hack fan control speed?

So I recently bought a new laptop (Acer Aspire A315-57g) on which I found that the cooling solution wasn't optimal, and I decided that I want more RPMs from my fan. However, I wasn't able to find a ...
2 votes
0 answers
292 views

Help Needed With Finding Image Data In DOS Game File

I have been analysing, an File called FW190AS.PAC from a 16 Bit Game called Secret Weapons Of The Luftwaffe, in a Hex Editor, the Bytes are displayed in Little Endian format. My aim with this game, is ...
3 votes
0 answers
90 views

Is it legal in the US to reverse engineer a product and then share the CAD for free to whoever needs it?

First some background. I have this 3D printer that sucks, is pretty expensive, and unreliable. Whenever you need a spare part, the manufacturer sells you the entire kit! I needed a thermistor and they ...
5 votes
1 answer
266 views

Would hiring a RE service be worth it?

Before I clarify my question, I will explain the project I'm working on, and what I've done so far so there will be a better understanding of what I'm trying to do. I'm trying to modify the UI of a ...
1 vote
1 answer
168 views

How can i remove dead code and opaque predicates?

I have the following problem on my agenda: There is an obfuscated .exe (this is a virus that I am investigating) in addition to having an MBA, etc. bullshit, he has Opaque predicates and dead code, I ...
1 vote
0 answers
140 views

Reversing Assembly to C

I've read the open letter addressing students asking for help with their homework and I agree with it, therefore I will try to be less of a pain in the *** ;) I need to reverse the x86-64 (AT&T) ...
7 votes
2 answers
15k views

What is the meaning of kernel32.BaseThreadInitThunk?

I tried to analyze a program in assembly using ollydbg. In the first line I have the following: MOV EAX, DWORD PTR FS:[0] In the register window, I've got the information: EAX 7570EE0A kernel32....
2 votes
1 answer
100 views

other than x32dbg, is there a more friendly way to check functions, their args and their return values on runtime?

atm I'm using ida and x32dbg, when I find a function that interests me, I set a breakpoint on x32dbg, however, I'm not good enough at assembly to know everything from a function just from looking at ...
1 vote
1 answer
149 views

How do i loop this CreateThread call in Assembly to get 4 threads instead of only one?

Knowledge in C++ Assembly and some reverse engineering experience
4 votes
3 answers
1k views

PDP-11 pure executable - version 16

PDP-11 pure executable reverse engineering: Dont have access to Ida pro. Ollydbg, Immunity doesnt open it. radare2 with MIPS, a lots of errors. file: # file lightning-tp.b lightning-tp.b: PDP-...
3 votes
1 answer
259 views

How can you tell where an assembly function ends?

Finding the start of a function is sometimes obvious - for example if some part of the code has a call foo then foo must be a function. But what about finding the end of a function? I realize tools ...
22 votes
3 answers
6k views

Anti-debug techniques on Unix platforms?

I am trying to scan all possible techniques to disrupt the usage of a debugger on a Unix platform (ie POSIX and a bit more). I am thinking about techniques such as the PTRACE test at the beginning of ...
1 vote
1 answer
236 views

Where is the XOR operation?

I am doing TryHackMe REloaded room, level 3. When I got stuck I followed this tutorial which mentions an XOR by 7 operation being performed on a string, however I cannot see it anywhere. Where is it ...
4 votes
1 answer
913 views

Change string value when string is in a RAM address x64 c++ program

I'm new to reverse engineering. I'm simply trying to change the value of a string in x64dbg, of a program I make myself in VS (It's a c++ program, and is VERY simple; it just prints a string, and two ...
3 votes
1 answer
94 views

Reverse engineer a blackbox function operating on single or double precision floats for emulation

I own and run a NEC VectorEngine 10C which is a PCIe accelerator running a proprietary ISA which has many fun instructions among them is VRSQRT which computes an approximation of the inverse ...
2 votes
1 answer
70 views

why some functions push data before the prologue

i am a newbie in the world of RE , i start to explorer a main entry of a classic game from 90's and i start to see something confuse me as a newbie this main entry function start with pushing stuff to ...
2 votes
1 answer
245 views

What are the prerequisite knowledge needed to start solving crackmes?

I started by reading a book on C language and then moved on to "Programming From Ground Up," which teaches basic programming in x86. School just ended, I'm working on cracking a game called ...
2 votes
1 answer
156 views

Ghidra Shows Structure Strange

I am new to assembly. When I was disassembling some code, I encounter some strange instruction here. The instruction shows that (RBP + -0x40) is equal to local_48, however at the beginning of the code,...

1
2 3 4 5
17