Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [assembly]

A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.

8
votes
1answer
1k views

Mapping an external module's source code to assembly - extracting information from source code

The situation is the following: I'm reversing an application, In which I found a lot of functions that belongs to the OpenSSL library. Since I have the source code for this module, I was wondering if ...
57
votes
3answers
83k views

How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?

I try to understand the process of memory segmentation for the i386 and amd64 architectures on Linux. It seems that this is heavily related to the segment registers %fs, %gs, %cs, %ss, %ds, %es. Can ...
34
votes
7answers
10k views

What hints in machine code can point me to the compiler which was used to generate it?

When I am looking at the machine code of an application, are there hints and patterns I can discern from the generated machine code which would indicate which compiler (and possibly version) was used ...
7
votes
2answers
4k views

How to bypass ZwContinue?

During an analysis, I have found a call to ZwContinue. The executable file first gets the address of ntdll.NtContinue and stores it in the EAX register. After I step over the following assembly line, ...
1
vote
1answer
12k views

What does mov qword ptr ds:[rax+18], r8 mean?

mov qword ptr ds:[rax+18], r8 In the above code, where are we copying the value of r8 register into? I know that ds means data segment which is a segment in memory, but what does exactly [rax+18] ...
4
votes
1answer
729 views

Stack buffer size is different between C and ASM

Given that function: void vuln( char * arg ) { char buf[256]; strcpy(buf, arg); } Disassembled in: 0x0804842b 55 push ebp ...
9
votes
3answers
2k views

Why is JMP used with CALL?

I am trying to analyze an old malware sample in OllyDbg. It has instruction of the format CALL <JMP.&KERNEL32.SetUnhandledExceptionFilter> I am not an expert in Assembly. I know that CALL ...
6
votes
1answer
5k views

Reverse Engineering of a packet encryption function of a game

I am trying to make a game server emulator for a specific MMORPG (Perfect World). I know the basics of how the network of the game works and the structure for some packets, but they all are encrypted, ...
3
votes
2answers
2k views

Disassembly shows `LEA` with RIP?

When I disassemble this instruction using pad on Radare I get an LEA with rip [0x00000000]> pad 8d 15 c8 90 04 08 lea edx, [rip + 0x80490c8] I got this instruction from this post here I'm ...
6
votes
1answer
2k views

How to recover the exception info from .gcc_except_table and .eh_handle sections?

For C++ program with try catch defined, when using g++ to compile it into assembly code (test is on x86 32bit Linux, g++ 4.6.3) g++ -S cppexcept.cc A specified section called .gcc_except_table is ...
4
votes
2answers
1k views

Assembly Code - GCC optimized vs not

I want to learn more about how GCC optimizes C programs. I have did a disas of a random function both optimized and unoptimized and I want to look at some of the differences. Off the top of my head, ...
3
votes
1answer
410 views

Computing subtracted stack space for a function manually

Lets assume this function frame : How to calculate and check if subtracted stack space by line 3 is 58h ?: sub esp, 58h And this is the code, the compiler is also Dev C++: #include <stdio.h> ...
1
vote
2answers
267 views

3 questions on assembly - syntax, meaning, and equivalent in high level code (eg C++)

For the following example, using x86 code in AT&T format: xor $0x20, (%eax) and $0x20, %ah or $0x20, %dh dec (%edi) dec %si dec %sp dec %bp My understanding: Line 1: takes value in %eax and ...
-1
votes
1answer
193 views

index of array in assembly? [duplicate]

In the following picture the line i want to mention is: mov [esp+eax*4+0Ch], edx Here eax is the index in the array. But, where is the address of the array to access? what does mean this line of ...
-3
votes
1answer
108 views

How does array indexing works at the assembly level?

Can anyone give me an example to understand how array indexing is working in assembly. For example, in C: char s[1000]; for (int = 0; i < 5; i++) { s[i] = i; } And, in x86 assembly: add ...
37
votes
3answers
20k views

convert this x86 ASM to C?

How could this 32-bit x86 assembly be written in C? loc_536FB0: mov cl, [eax] cmp cl, ' ' jb short loc_536FBC cmp cl, ',' jnz short loc_536FBF loc_536FBC: mov byte ptr [eax], ' ' loc_536FBF mov cl, ...
25
votes
2answers
3k views

Why are special tools required to ascertain the differences between two related binary code files?

How comes that text diffing tools like diff, kdiff3 or even more complex ones usually fail at highlighting the differences between two disassemblies in textual form - in particular two related binary ...
19
votes
1answer
6k views

How to use sysenter under Linux?

I would like to know what are the different ways to perform a system call in x86 assembler under Linux. But, with no cheating, only assembler must be used (i.e. compilation with gcc must be done with -...
5
votes
3answers
3k views

Is learning assembly enough to become a malware analyst? [closed]

I am a C/C++ developer and I have started learning assembly language programming with the goal to become a malware analyst. I know it is not enough to just know how to read assembly to become a ...
14
votes
3answers
4k views

Purpose of OR EAX,0xFFFFFFFF

I have read the assembly line OR EAX, 0xFFFFFFFF and in the register EAX the program has stored a string. I have problems to understand how we can make a comparison with a string and a value like ...
10
votes
2answers
1k views

How to do static analysis to identify pointer from concrete value in assembly?

So basically I am writing some code to do analysis work on disassembled assembly code. I am trapped in this issue for a while, here is an simple example of a disassembled asm code by objdump, ...
-1
votes
1answer
46k views

Translate ASSEMBLY to C [closed]

How to translate code assembly to C?? I am very poor in assembly code. EG: mov dword ptr [ebp+data], 612E2F47h mov dword ptr [ebp+data+4], 5B2A451Ch mov dword ptr [ebp+data+8], 6E6B5E18h ...
8
votes
2answers
3k views

Where is ntdll.dll?

I am trying to get the base address of ntdll.dll over the PEB. So, what I did was to dump the PEB (d fs:[30]). Then, I tried to get to PEB_LDR_DATA over the offset 0xC. Over the offset 0x1C of ...
3
votes
1answer
806 views

Good foundation for reverse engineering malware

I have been intrigued by reverse engineering recently and just finished Paul Carter's PC Assembly Language book (http://pacman128.github.io/static/pcasm-book.pdf) which was a great primer for x86. My ...
7
votes
2answers
3k views

How to deal with Static Memory Allocation while modifying an executable?

I'm not new to StackExchange, but I'm quite new to reverse engineering, so please be patient with me! :P At present I'm dealing with an executable that I would like to modify a little bit, for ...
6
votes
0answers
1k views

Anti debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can i bypass that?

So im debugging this process which has a lot of anti debugging techniques in it, and i faced something new which i dont know how to bypass yet. Changing the code dynamically causes exceptions to ...
5
votes
1answer
420 views

How to Make .text Section in Assembly Writeable for Win7-64 EXE

I have a basic XOR decoder that functions perfectly in Linux, but when I try to move it over to an exe in windows, it fails. I am leaving this question open for historical reference since the issue ...
4
votes
4answers
956 views

Why addresses of variable on stack are not consecutive?

The code below is generated by gcc from a simple scanf program. My question is that Why these 3 addresses of variables are not consecutive when allocated? If not, when could I speculate the number ...
4
votes
1answer
498 views

mov ecx, arg - How to replicate in C++?

I frequently see code formatted like this: push arg push arg (...) mov ecx, arg call function If I need to call that function in Assembly, it's fine. But since I know how to consistently get the ...
4
votes
2answers
394 views

ASM working as is, but not in a C program

I have this piece of ASM: section .text global _start _start: xor eax, eax push eax ; 0 to finish the /bin//sh string push 0x68732f2f ; //sh push 0x6e69622f ; /bin ...
2
votes
2answers
1k views

Generating call graph for assembly instructions

I'm writing a tool and I need to generate the callgraph for assembly instructions. But I do not know how to exactly generate call graph from assembly instruction. Do you have any idea? To clarify, I ...
2
votes
3answers
2k views

How does the ldr instruction work on ARM?

ldr r0, #0x28 What does thw ldr instruction ? Does it load a string from some offset? How can I find the string/value that is actually loaded ?
1
vote
2answers
125 views

Real-time changes of executable on IDE/Assembler

I'm new on this, sorry for bad usage of terms or overextending an explanation. I'm learning code languages and the way I found to bring it to my world so I can learn it better was coding for/with ...
0
votes
2answers
569 views

Working Linux assembly XOR Encoder/Decoder Failing on Windows

Should I be able to extract shellcode from a basic (tested and working) Win7-64 message box app and place the extracted shellcode into a tested and working assembly language encoder/decoder and expect ...
2
votes
2answers
183 views

Can I provide bytes to Radare to be disassembled?

Let's say I want to check this guys work. He says that he is getting 8d 15 c8 90 04 08 lea 0x80490c8,%edx ba c8 90 04 08 mov $0x80490c8,%edx Is there an easy way with Radare to ...
2
votes
3answers
602 views

Building a control flow graph from machine code

I want to write my own soft, that can disassemble code, and turn it into conrol flow graph. Now i know the basics of graph theory, but i don't get where i should start, do i need to basically keep the ...
2
votes
1answer
712 views

Stepping through ARM firmware image

I have a binary firmware image with a routine that I find hard to understand. I want to step through this encryption routine step by step so I can better understand it. I was able to obtain all the ...
1
vote
2answers
1k views

Convert IDA listings to assembly without using IDA non-free

I'm currently working with a huge set of IDA Pro listings (~1TiB). For a project I need to perform analyses on the mnemonics and operands on a subroutine level. Therefor I want to convert the IDA ...
1
vote
1answer
387 views

What is all this code for?

In order to be able to effectively reverse assembly one needs to understand how different compilers work, and what are the common code generation patterns. If you do not know them, you spent much more ...
1
vote
1answer
110 views

Failure at finding the value of the dereferenced pointer

000007FEEC55CF58| 48 8D 0D F1 A7 0B 00 | lea rcx,qword ptr ds:[7FEEC617750] | ;7FEEC617750:"500117367" I see the above line in the ollyDBG which has the value of "500117367" according to the comment ...
1
vote
1answer
110 views

3 questions on Assembly - meaning of code, Decompilation in Linux, Higher level perspective,

Following the question here (3 questions on assembly - syntax, meaning, and equivalent in high level code (eg C++)), I would like to know for the same x86 code in AT&T syntax: xor $0x20, (%eax) ...
1
vote
2answers
400 views

how data types and variables are converted to machine code?

I know that every x86 instruction has an opcode for that, but I don't know how data types and variables are converted to machine code. So I tried to figure out. I wrote a simple C program and ...
0
votes
3answers
2k views

What is an immediate value?

I just read this post. What does mean an "immediate value" ? Is there any string/ascii there? How can I find this value on the binary file? I have the same code and when I search on 0x28 address I ...
0
votes
2answers
1k views

How can I export only the opcodes from objdump (or any other program)

I have multiple malware files, I want to do an analysis with the opcodes. Im able to export everything to text but I only need the middle column. Any idea on how can I solve this? In other words of ...
0
votes
1answer
706 views

Why int 21h/ ah=0Ah doesn't work in emu86 [closed]

I've written a simple code to get a student information like name and ID, but in the code when I want to get input the interrupt doesn't work I mean int 21h/ah=0Ah It pauses when the interrupt is ...
-1
votes
1answer
1k views

How to convert assembly to C code [closed]

Is there an easy to convert assembly (ARM) to C code?