Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [assembly]

A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.

5
votes
2answers
1k views

OllyDBG's disassembled syntax and c-equivalent

This is probably a pretty simple question as I'm not too used to how the syntax looks for OllyDBG's disassembler. Does this following assembler statement: MOV EAX, DWORD PTR [ESI + 14] Be roughly ...
6
votes
2answers
2k views

NOP instruction

I have recently learned that nop instruction is actually xchg eax, eax... what it does is basically exchanges eax with itself. As far as CPU goes, does the exchange actually happen?
3
votes
0answers
285 views

IDA Pro Symbian Debugger 'general OS related' Error [closed]

I am using remote symbian: c5-03 (Application TRK 3.2.7 for all S60 5.0 devices with production images). However, whenever I start the debugger, I get this error: general OS-related error What went ...
3
votes
1answer
342 views

What type of data structure is it?

I have the following data: .data:004305FC word_4305FC dw 1583h .data:004305FC .data:004305FE word_4305FE dw 35B6h ....
9
votes
3answers
3k views

Why does the function pointer get overwritten even though is declared before the vulnerable buffer?

I am working on io-wargames for fun right now, level3: I do understand why there is a stack-overflow in this code (strlen(argv[1])), but what I don't understand is why it overflows the function ...
3
votes
1answer
304 views

Take A Snippet of Assembly and Make All Side Effects Explicit?

I came across a small function whose only side effects were to modify the state of some processor flags. When I decompiled this function using the Hex Rays decompiler, I simply got an empty function, ...
15
votes
1answer
4k views

IDA EBP variable offset

Let's take a look of how IDA displays address of local variable. For instance: MOV EAX, [EBP + var_4] As we all know as far as local variables go, they are located at lower addresses of EBP. Though,...
5
votes
1answer
627 views

What could this sequence of assembly instructions possibly mean?

I have recently came across the following sequence of assembly instructions. call ds:WSAStartup push ecx push edi mov ecx, 69E65AC4h mov edi, 2776452Ah pop edi pop ecx jmp ...
38
votes
3answers
20k views

convert this x86 ASM to C?

How could this 32-bit x86 assembly be written in C? loc_536FB0: mov cl, [eax] cmp cl, ' ' jb short loc_536FBC cmp cl, ',' jnz short loc_536FBF loc_536FBC: mov byte ptr [eax], ' ' loc_536FBF mov cl, ...
60
votes
3answers
87k views

How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?

I try to understand the process of memory segmentation for the i386 and amd64 architectures on Linux. It seems that this is heavily related to the segment registers %fs, %gs, %cs, %ss, %ds, %es. Can ...
9
votes
2answers
10k views

Better explanation of different x86 CALL variations

Hoping to get a better explanation of x86 call instruction. I sort of understand the call near and call far. But I don't fully understand the segment part. A little insight into my main problem, I am ...
6
votes
1answer
3k views

What does %reg:value mean in ATT assembly?

When I disassemble a function, I encounter from time to time an expression of the form %reg:value. Typically, I encounter this syntax when I activate the canaries in GCC (-fstack-protector), as in the ...
9
votes
2answers
576 views

What does the text in angle brackets refer to (From objdump)

I constantly see the text (<perror@plt+0x2008e0>) as seen in the snippet below, but I am not sure if its making a call to perror of if the disassembler was having issues. Since it would be odd ...
8
votes
3answers
1k views

Trying to reverse engineer C code that is 64bit assembly

This is the code I am looking at 0x0000000000401048 <+70>: mov 0x401ba0(,%rax,4),%eax This is an array of 15 integers. Just wondering how I can access indices 0 to 15 in gdb Thanks
26
votes
2answers
3k views

Why are special tools required to ascertain the differences between two related binary code files?

How comes that text diffing tools like diff, kdiff3 or even more complex ones usually fail at highlighting the differences between two disassemblies in textual form - in particular two related binary ...
34
votes
5answers
4k views

What is the reason for this method to call itself?

While reversing a 32bit Mach-O binary with Hopper, I noticed this peculiar method. The instruction on 0x0000e506 seems to be calling an address right below the instruction. What would be the reason ...
18
votes
2answers
3k views

Anti-debug techniques on Unix platforms?

I am trying to scan all possible techniques to disrupt the usage of a debugger on a Unix platform (ie POSIX and a bit more). I am thinking about techniques such as the PTRACE test at the beginning of ...
34
votes
7answers
10k views

What hints in machine code can point me to the compiler which was used to generate it?

When I am looking at the machine code of an application, are there hints and patterns I can discern from the generated machine code which would indicate which compiler (and possibly version) was used ...
21
votes
7answers
3k views

How are x86 CPU instructions encoded?

I'm writing a small utility library for hooking functions at run time. I need to find out the length of the first few instructions because I don't want to assume anything or require the developer to ...
20
votes
7answers
5k views

How is a structure located within a disassembled program?

I took a basic 40-hr Reverse Engineering course a few summers ago. While teaching us to use IDAPro, the instructor demonstrated, rather quickly and without explaining much, how to label certain ...