Questions tagged [assembly]
A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.
830
questions
0
votes
1
answer
140
views
Is DOS Assembly Hexadecimal Different To Modern Hex Editor Hexadecimal?
I am trying to find the correct Data Segment, corresponding to a certain File in a 16bit DOS Game.
The Assembly Instructions for the Decompiled .exe File in IDA Pro Version 5, I am looking at.
I was ...
0
votes
1
answer
97
views
Cracking cryptographic function with radare2
I want to reverse engineer an android game, found a method
public static byte[] MNNOPKMJMFP(byte[] AFFEPNLBIIC, byte[] OENOGNMAMPO, byte[] GLLEHJKGIBK) { }
Names are obfuscated, i know that this is a ...
0
votes
2
answers
893
views
How do I go about overriding a function internally defined in a binary on Linux?
To be specific, I cannot recompile this binary, nor do I have access to the sourcecode.
The functions are not defined within a shared library.
So, how can I go about changing a function, or ...
0
votes
1
answer
51
views
Offset addressing
I’m writing a C-SKY (CK803S) processor module for IDA Pro, and a question arose about offsets in transitions, small ones are fine, but long ones lead to nowhere, from the documentation:
in code I ...
0
votes
1
answer
70
views
X64DBG Conditional Breakpoint on Specific Opcode?
Is there any way to break on specific opcode in X64DBG?
For example i want to break on start of a function which is
55 | push ebp
8BEC | mov ebp,esp
can i set a breakpoint like opcode == 0x00EC8B55?
...
37
votes
5
answers
8k
views
Why would a program contain a call instruction targetting the address immediately following that instruction?
While reversing a 32bit Mach-O binary with Hopper, I noticed this peculiar method. The instruction on 0x0000e506 seems to be calling an address right below the instruction.
What would be the reason ...
2
votes
1
answer
432
views
Best way to protect source code of exe that being loaded by Assembly.Load method
I am protecting an exe that being loaded by Assembly.Load... This makes everything difficult because most obfuscators causing it to not work properly or not load at all. I used confuserEx Ameteurz ...
4
votes
2
answers
2k
views
How do you look for a a particular value at address in IDA
So, I was trying to load some binary and in the main function, I saw instructions such as
mov edi, [esi+1Ch]
...
lea eax, [esi+18h]
So, what are these values at [esi+1Ch] and [esi+18h]. How do ...
4
votes
2
answers
1k
views
How to bypass anti debugger? IDA Pro
Im new to reverse engineering and doing a crackme that requires me to make a keygen, yes i know making a keygen isn't a beginner task however im stuborn, i am trying to debug the program to understand ...
0
votes
0
answers
74
views
Searching for a byte pattern and then hooking all instances of it using frida on iOS
I'm using a frida script to scan for a certain byte pattern when I launch an iOS app.
I can log each offset and confirm these are correct by also printing out the instructions at those locations and ...
1
vote
1
answer
108
views
how to diassemble an .obj file
I'm new to programming and recently studying an ancient DOS assembly program written for 80186 and assembled with MASM. There are some .obj files that I want to open and take a look. I tried obj2asm....
2
votes
1
answer
1k
views
Found a way to make any program run with the discrete Nvidia dGPU. But I need a little help to finish implementing the injection
Nvidia Optimus is a major thorn in my side. I just bought a new laptop that is using this on-the-fly gpu switching crap. This means that unless an application starts by querying the GPU for 3D tech or ...
3
votes
4
answers
543
views
Reverse Engineering CTF help
I am having trouble figuring out this microcorruption challenge in the link below: https://microcorruption.com/debugger/Halifax
Basically, the 0x7f interrupt has been disabled so I must reenable it ...
0
votes
0
answers
34
views
how to set a BP on button in SunAwtCanvas in x96dbg
I'm trying to debug a program in x96dbg that I think this is written in Matlab. There is no string related to buttons or something interesting. Then I go to Handles tab to find buttons and set break ...
1
vote
1
answer
485
views
How to run exe program loaded into IDA Pro or Ghidra
I'm new to reverse engineering, just learning. After the exe program is loaded into IDA or Ghidra, how do I run the exe program that loaded into IDA/Ghidra? so I can interact with the exe program? and ...
0
votes
0
answers
44
views
Address arithmetic in Ida Pro
Can someone tell more about address arithmetic in Ida? I were looking for assembly instructions and saw this
LDR R0, =(byte_255914C - 0xC63D50)
I understood right that in r0 will be an address which ...
0
votes
1
answer
116
views
Mnemonic suffixes for x86-64 assembly for AT&T syntax
I'm trying to understand suffixes used for the AT&T syntax for the x64 assembly used for instruction mnemonics.
For regular cases:
'b', // 8_bit
'w', // 16_bit
'l', // 32_bit
'q', /...
3
votes
1
answer
922
views
What is the meaning of jmp dword ptr off_XXXXXXXX + 8 in IDA?
What is the meaning of this kind of jmp instruction in x86 assembly in IDA?
Does it mean that we should jump to the address [6CA2E9B0] + 8 or [6CA2E9B0+8]?
When I follow that off_XXX, I get to the ...
11
votes
2
answers
4k
views
Why did Intel chose 90h machine code for their NOP instruction instead of a 0?
Probably just a historical question, if anyone knows.
1
vote
0
answers
91
views
DOS .exe File Decompiled in Cutter Program Showing Different Than In IDA Pro
I am having an issue when using the Cutter Reverse Engineering Program,
Here is a Segment of Decompiled Assembly, in Cutter :-
at 0000:4ed5 in the picture I posted the .string line of text is there, ...
2
votes
2
answers
111
views
Keystone rust bindings error when assembling "syscall; ret" shellcode
I'm working on a project related to Process Injection for learning Rust. I have to inject shellcode at some points and use the Keystone engine for assembling shellcode from source.
I detected that the ...
0
votes
0
answers
20
views
What guidelines and/or tools exist that facilitate the analysis of a program in assembly language for PIC-Microchip?
What tools exist that facilitate the interpretation of a program written in assembly language of a PIC-Microchip, appealing to the construction, for example, of a flowchart and then recoding it in ...
0
votes
0
answers
48
views
Convert hex chars string to int
For example we have chars buffer with hex value:
char * buff = {"e000"}; //this is our hex value in eax - input for Get_Val().
Then there is function Get_Val() - converts hex (string) to ...
0
votes
1
answer
45
views
Assembler OR operation
Is this asm code:
or unknown_byte_0004AAA7, 1
dseg05:000C7FDC unknown_byte_0004AAA7 db 0
equivalent to this C++ code below?
bool unknown_byte_0004AAA7 = 0;
unknown_byte_0004AAA7 = ...
0
votes
2
answers
71
views
MS DOS development - Interrupt controller
cseg01:0005229A mov dx, 21h ; '!'
cseg01:0005229E in al, dx ; Interrupt controller, 8259A.
cseg01:0005229F or al, 1
cseg01:...
1
vote
1
answer
134
views
What means this code?
cseg01:00020DB8 mov eax, offset screen_with_height
cseg01:00045704 mov dword ptr [eax+0Ah], 0
cseg01:0004570B call sub_466F8 ; call some proc
...
0
votes
0
answers
34
views
Reverse engineering JCALG/LZ?? compression
I think this is related to this this question, but the consts in the example code don't exist in mine, so maybe it's a different level of compression, but I am unsure.
Can anyone provide me the right ...
2
votes
0
answers
138
views
Trying To Understand DOS Game Assembly Instructions
I am trying to understand assembly language instructions, for a DOS Game.
I have looked at the following Link :- https://atrevida.comprenica.com/atrtut07.html
reading about how VGA Graphics work in ...
0
votes
0
answers
126
views
from executable to assembly source code?
let's say i have an ".exe program" and i want to disassemble it and get "disassembled code" .
my question is => can i maintain and organize that "disassembled code" ...
0
votes
1
answer
96
views
Assembly for malware analysis
I know we have some architectures for assembly language. But I wanna know this: I need learn x86 assembly ? , or arm assembly ? , or both ? , or others ?..
Please help me , what should I learn?
2
votes
0
answers
416
views
How to hack fan control speed?
So I recently bought a new laptop (Acer Aspire A315-57g) on which I found that the cooling solution wasn't optimal, and I decided that I want more RPMs from my fan. However, I wasn't able to find a ...
2
votes
0
answers
291
views
Help Needed With Finding Image Data In DOS Game File
I have been analysing, an File called FW190AS.PAC from a 16 Bit Game called Secret Weapons Of The Luftwaffe, in a Hex Editor, the Bytes are displayed in Little Endian format. My aim with this game, is ...
3
votes
0
answers
87
views
Is it legal in the US to reverse engineer a product and then share the CAD for free to whoever needs it?
First some background.
I have this 3D printer that sucks, is pretty expensive, and unreliable. Whenever you need a spare part, the manufacturer sells you the entire kit! I needed a thermistor and they ...
5
votes
1
answer
265
views
Would hiring a RE service be worth it?
Before I clarify my question, I will explain the project I'm working on, and what I've done so far so there will be a better understanding of what I'm trying to do. I'm trying to modify the UI of a ...
1
vote
1
answer
139
views
How can i remove dead code and opaque predicates?
I have the following problem on my agenda: There is an obfuscated .exe (this is a virus that I am investigating) in addition to having an MBA, etc. bullshit, he has Opaque predicates and dead code, I ...
1
vote
0
answers
133
views
Reversing Assembly to C
I've read the open letter addressing students asking for help with their homework and I agree with it, therefore I will try to be less of a pain in the *** ;)
I need to reverse the x86-64 (AT&T) ...
7
votes
2
answers
15k
views
What is the meaning of kernel32.BaseThreadInitThunk?
I tried to analyze a program in assembly using ollydbg. In the first line I have the following:
MOV EAX, DWORD PTR FS:[0]
In the register window, I've got the information:
EAX 7570EE0A kernel32....
2
votes
1
answer
94
views
other than x32dbg, is there a more friendly way to check functions, their args and their return values on runtime?
atm I'm using ida and x32dbg, when I find a function that interests me, I set a breakpoint on x32dbg, however, I'm not good enough at assembly to know everything from a function just from looking at ...
1
vote
1
answer
145
views
How do i loop this CreateThread call in Assembly to get 4 threads instead of only one?
Knowledge in C++ Assembly and some reverse engineering experience
4
votes
3
answers
1k
views
PDP-11 pure executable - version 16
PDP-11 pure executable reverse engineering:
Dont have access to Ida pro. Ollydbg, Immunity doesnt open it.
radare2 with MIPS, a lots of errors.
file:
# file lightning-tp.b
lightning-tp.b: PDP-...
3
votes
1
answer
216
views
How can you tell where an assembly function ends?
Finding the start of a function is sometimes obvious - for example if some part of the code has a call foo then foo must be a function.
But what about finding the end of a function? I realize tools ...
22
votes
3
answers
6k
views
Anti-debug techniques on Unix platforms?
I am trying to scan all possible techniques to disrupt the usage of a debugger on a Unix platform (ie POSIX and a bit more).
I am thinking about techniques such as the PTRACE test at the beginning of ...
1
vote
1
answer
223
views
Where is the XOR operation?
I am doing TryHackMe REloaded room, level 3.
When I got stuck I followed this tutorial which mentions an XOR by 7 operation being performed on a string, however I cannot see it anywhere.
Where is it ...
4
votes
1
answer
736
views
Change string value when string is in a RAM address x64 c++ program
I'm new to reverse engineering.
I'm simply trying to change the value of a string in x64dbg, of a program I make myself in VS
(It's a c++ program, and is VERY simple; it just prints a string, and two ...
3
votes
1
answer
92
views
Reverse engineer a blackbox function operating on single or double precision floats for emulation
I own and run a NEC VectorEngine 10C which is a PCIe accelerator running a proprietary ISA which has many fun instructions among them is VRSQRT which computes an approximation of the inverse ...
2
votes
1
answer
70
views
why some functions push data before the prologue
i am a newbie in the world of RE ,
i start to explorer a main entry of a classic game from 90's
and i start to see something confuse me as a newbie
this main entry function start with pushing stuff to ...
2
votes
1
answer
215
views
What are the prerequisite knowledge needed to start solving crackmes?
I started by reading a book on C language and then moved on to "Programming From Ground Up," which teaches basic programming in x86.
School just ended, I'm working on cracking a game called ...
2
votes
1
answer
154
views
Ghidra Shows Structure Strange
I am new to assembly. When I was disassembling some code, I encounter some strange instruction here. The instruction shows that (RBP + -0x40) is equal to local_48, however at the beginning of the code,...
8
votes
1
answer
6k
views
Where ES/GS/FS are pointing to?
As far as I know those segments are extra or general. But at which part of program memory they are actually pointing? If I undestand it correctly DS is poining at entry point of Dump, SS stands for ...
1
vote
1
answer
879
views
How to detect md5 and sha256?
I use FindCrypt2 Ida plugin but it detect md4 and not md5 , and not detect sha256.
How can I detect md5 in assembly?
How can I detect sha256 in assembly?
thanks