Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [assembly]

A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.

2
votes
2answers
209 views

Is this a good way to get past anti-debugging measures?

This program I am analyzing is full of anti-debugging. It won't even run if most debuggers are loaded before I start the app. I tried using IDA to static analyze it, but it was written in a OOP ...
5
votes
2answers
2k views

ARM64 syscalls table

I wonder if there some syscall table for Linux ARM64 architecture? I found syscall table for Linux ARM32 and many other architectures, but the problem still exists. Does anyone know where can I find ...
1
vote
0answers
23 views

IDA Pro how debug constant function returning different results?

The code below is executed with the parameters (0, 4, 0) , the first 0 being an int pointer casted to an int, and these are the same every time. After execution, a 3 digit number string is returned/...
0
votes
0answers
48 views

IDA pro - strange switch statement

I use IDA pro and along the analysis I try to understand the following function. There is a simple switch case but it appears that all the 13 switch branches do the EXACT same thing. Am I missing ...
2
votes
0answers
16 views

How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled?

How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled? Context is curiosity. I'm aware that Docker in the ...
0
votes
0answers
24 views

How to make proper stubs with Exception Handlers?

I'm trying to hook a function to output all its parameters. The hook itself works fine, but the stub somehow crashes the program. I thinks its related to the Exception Handler at the beginning of the ...
1
vote
1answer
91 views

C# Changing method body in runtime

I am trying to change a part in a third party library, it has a bug, however, there are no fixes and source code is not available as well. At first, I tried to modify IL Opcodes directly by ...
1
vote
3answers
324 views

How to get pointer from byte code

I have been doing pointer scans on a game when new versions come out as the structure changes to update memory structure offsets. I decided to attempt to use signature scanning to attempt to make my ...
0
votes
2answers
259 views

What's happening in the assembly main function?

I'm currently inspecting a 32-bit malware executable in a WinXP VM using IDA Pro (free version). I don't understand what's happening in the main function here. Where should I set the breakpoints (...
0
votes
2answers
143 views

How the CMP instruction uses condition flags?

I am trying to figure out the behavior of conditional jumps (JE/JNE, JZ/JNZ) in the x86 instruction set familly. Which condition flags CMP instruction sets and how, if the result is equal and if it ...
4
votes
1answer
113 views

Reverse engineering a compression algorithm to decompress ASCII text (LZ-variant?)

Reposted from StackOverflow as is. I'm trying to decompress a very long text block from an ARMv5t powered Gameboy Advance ROM, which was compressed using some kind of custom LZ-esque compression ...
0
votes
0answers
44 views

Any way to edit an ELF binary without hex? [duplicate]

So, this is a noob question, I am a complete beginner in this field, so sorry if I'm wasting your time in any way. I wanted to know, if there is a way to edit an ELF binary without using a hex editor....
1
vote
2answers
64 views

segmentation fault at `mov byte [esi+7], al`

Section .text global _start _start: jmp short GoToCall shellcode: pop esi xor eax, eax mov byte [esi+7], al lea ...
0
votes
1answer
58 views

exit() syscall within shellcode not working

int main() { char shellcode[] = "\xbb\x00\x00\x00\x00\xb8\x01\x00\x00\x00\xcd\x80"; int *ret; ret = (int *)&ret + 2; (*ret) = (int)shellcode; } I tried to run the above shellcode ...
0
votes
1answer
59 views

How does the x86 instruction, call 135b<__x86.get_pc_thunk.ax> work?

I think the below instruction is used for position independent code. Could anyone please help me understand how it works? call 135b<__x86.get_pc_thunk.ax> What are the use of the below ...
0
votes
0answers
14 views

SIGBUS when trying to trace functions?

I am working on a crackme (Mach-O, mac app). Now, the app itself is weird and I honestly don't really know where to start. There are multiple threads and the main function doesn't really tell me ...
0
votes
1answer
76 views

What is this assembly doing?

I wrote a very basic crackme to learn how assembly works. Even though I wrote it myself, I am having some trouble understanding a few pieces of the assembly: What I know up to now is: [rbp+rax+...
0
votes
1answer
60 views

x86-64 CALL opcode + disassembly

Working a basic buffer overflow on a 64bit system and putting together some basic shellcode. The main program does a call to puts@plt. When I disassemble main in gdb, the opcodes show as: e8 6b fe ff ...
0
votes
1answer
47 views

Is it possible to change a signed byte to an int in compiled assembly code?

I'm trying to mess around with an old game and I want to reposition a UI element. I found the address of where the x and y position get set (It's set to an X position of 90 and a Y position of 358) ...
0
votes
1answer
61 views

Why Ida pseudo-code translate test as AND?

In IDA when disassembling a x86 EXE file there is a line test byte ptr [ebp+XXX], cl Before this line cl has a value of 0x11 The Hex-Rays decompiler plugin translates it as if (v10 &0x11). Why ...
1
vote
1answer
72 views

why saved rip changed by push?

I am doing a reverse homework. see the following pictures: as can be seen from this picture, before call push touch3, "saved rip" is at 0x5561dca8, which is equal to the current rsp(0x5561dca8). ...
0
votes
2answers
55 views

IDA Pro not undefining assembly?

I am not sure if IDA is working correctly or not. I have the instructions call $+5 pop edi If I understand this correctly, the program will jump forward, skipping some junk interpreted as ...
1
vote
2answers
91 views

Recommended way to modify assembler instructions in IDA

What is the easiest way (or is there any) to modify an instruction inside a binary opened inside IDA and save the changes to the original? Is there a builtin assembler who's output I can place at a ...
0
votes
2answers
69 views

Bitwise operation between byte and 1?

I am having some trouble understanding what this is doing. This is the commented pseudocode. mightGetUserInput(&std::__1::cin, &userInput) ; this fills the buffer with the user input, ...
1
vote
2answers
57 views

What is this assembly in the `__common` section doing?

I have stumbled upon this: public _oret __common:0000000100018000 _oret: __common:0000000100018000 sub [rdi+4Fh], al __common:0000000100018003 db 4Fh __common:...
0
votes
0answers
24 views

How to generate .TEXT only asm output in IDM?

So I tried to do File -> Produce File -> Create ASM File. There are lots of dd stuff that I don't want. So now, what I need is, either an android app where I can view that .asm file ...
1
vote
1answer
61 views

(CTF) Speed up assembly by hooking to an static function

For a CTF I have a fairly slow recursive function. I just need to cached the previous results in a dictionary and get them instead. I did it but had to reverse engineer the code. I was wondering if ...
0
votes
1answer
51 views

Executing CMP DS:[] by inline assembly inline hooks

I need to execute some instructions of library I'm using (ws2_32.dll) inside my C code, but I have a problem with a simple cmp instruction. Followed by IDA, this instruction is: cmp off_41AE7048, ...
0
votes
1answer
60 views

Switching from seg to text in IDA-View

actually i don't know where the problem but i will describe it I am trying to analyse the firmware of a router and i could extract it and i got these files libxmlapi.so libhttpapi.so libcfmapi.so ...
-2
votes
1answer
99 views

Can anyone please explain the following dissasembly codes?

Disassembly: 0: 31 c9 xor ecx,ecx 2: f7 e1 mul ecx 4: 51 push ecx 5: 68 2f 2f 73 68 push 0x68732f2f a: 68 2f 62 69 ...
4
votes
2answers
242 views

Which operators use sal, shl, sar or shr

Which operators in C language would result in assembly commands such as sal, shl, sar or shr for example?
1
vote
2answers
120 views

Jump in the middle trick

I'm reversing a program that "hides" some instructions using the jump in the middle trick. This trick is a jump to a middle of an instruction, whereas the real address actually contains another opcode....
1
vote
2answers
58 views

Calculation with not defined variables?

I am new to reverse engineering and try to solve a crackme with radare2. My problem is understanding of the following lines: | 0x000007a9 c745b8000000. mov dword [var_48h], 0 | ...
1
vote
3answers
4k views

Is OR EAX, EAX as If-Statement possible?

I have the following question: Could it be that OR EAX, EAX represents a if statement? The reason why I ask is, I have read the following in an assembly code: .... OR EAX, EAX JNZ funct.A ..... ...
2
votes
3answers
2k views

How does the ldr instruction work on ARM?

ldr r0, #0x28 What does thw ldr instruction ? Does it load a string from some offset? How can I find the string/value that is actually loaded ?
0
votes
1answer
112 views

What is this assembly code, fld qword ptr code here doing? Also, how do I store my own value?

I was reverse engineering a game using cheat engine and trying to trace where my health gets reduced. Basically the health gets stored in the stack and then pops out for displaying on the screen. ...
1
vote
2answers
143 views

Lots of mov instructions into ebp+offset - What is happening?

While learning RE I have come across this large segment of instructions that contains a majority of mov [ebp+offset], value instructions. I believe that ebp + offset are local variables? I think? ...
1
vote
1answer
110 views

Understand the CPU cycles of x86 instruction bsr/bsf

I am on the hook to analysis some "timing channels" of some x86 binary code. I am posting one question to comprehend bsf/bsr opcode. So high-levelly, these two opcodes can be modeled as a "loop", ...
1
vote
0answers
28 views

Set Breakpoint on ActiveX Property Being Set (No Symbols)

A program is loading an VB6 based ActiveX control that has several property, for example ConnectionString. The application is dynamically generating the values it provides at runtime, so it is not ...
0
votes
1answer
94 views

How to detect md5 and sha256?

I use FindCrypt2 Ida plugin but it detect md4 and not md5 , and not detect sha256. How can I detect md5 in assembly? How can I detect sha256 in assembly? thanks
0
votes
1answer
84 views

why code at .rodata executes [closed]

How come the following code executes if buf* is @ rodata segment ? #include <stdio.h> char *buf[] = { "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\ \x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\...
1
vote
0answers
50 views

How can a segfault happen during the libc exit call on Linux?

I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge. While testing, I have noticed ...
0
votes
1answer
92 views

How do I go about overriding a function internally defined in a binary on Linux?

To be specific, I cannot recompile this binary, nor do I have access to the sourcecode. The functions are not defined within a shared library. So, how can I go about changing a function, or ...
0
votes
1answer
48 views

Calculate LEA operand

I have those opcodes on 64 bits: 48 8D 35 45 CE FF FF >>> lea rsi, [rip - 0x31bb]. How can I get the 0x31bb value from those opcodes and how can I know if I have a + sign or a - sign ...
1
vote
0answers
62 views

Help understanding ARM Assembly example code - loops, set flags and code mnemonics

This is the example code: _start: LDR r0, =n LDR r0, [r0] LDR r1, =array1 MOV r2, #0 LDR r4, =array2 loop: LDR r3, [r1], #4 CMP r3, #58 BGT a_point CMP r3, #47 BLT a_point SUB r3, r3, #0x30 STR r3, [...
6
votes
1answer
315 views

Simplifying assembly

I'm analysing some binary trace, it's pretty much obfuscated. What I need to do is to understand work flow of its alghoritms. However I cannot find any reliable tool which would help me with that. I ...
0
votes
1answer
149 views

How int3 looks like in C

This is assembly code that can catch debugger with int 3 : MOV ECX, ExceptionHandler MOV DWORD PTR FS:[0], ExceptionHandler INT3 ///there is debugger!!! ExceptionHandler: ////no ...
-1
votes
1answer
294 views

how should i change an instruction to NOP in IDA?

I am new with IDA assembler and i used to work with hopper app. the problem is i can't change instruction in IDA from something like CBNZ to NOP. is there any button to do this? i can't find anything ...
-1
votes
1answer
152 views

Understanding assembly code: “mov dword” and “mov qword” in main.c

I have just converted this piece of code in assembly: #include <stdio.h> #include <stdlib.h> int main(int argc, char** argv) { return (1); } Here are my questions: Once you push ...
0
votes
2answers
195 views

How to identify base64 encode/decode in assembly

How to identify in assembly base 64 encode/decode with Ida. Is there any magic constant that I can search? Or maybe a plugin that find that? FindCrypt2 Ida plugin not find that