Questions tagged [assembly]

A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.

Filter by
Sorted by
Tagged with
1
vote
0answers
27 views

Means of different call label formats in IDA [duplicate]

What is of different label formats of call instruction means in IDA? Like: call Cla$ENABEL call ds:Cla$PushString call ds:GETNAME@Folosososososos Thanks
8
votes
1answer
1k views

Mapping an external module's source code to assembly - extracting information from source code

The situation is the following: I'm reversing an application, In which I found a lot of functions that belongs to the OpenSSL library. Since I have the source code for this module, I was wondering if ...
4
votes
1answer
286 views

What does this Generate_Key_IV assembler routine?

I want to decompress some files, and found some information on how. Apparently they are encrypted with AES 128 in CFB mode, and sometimes compressed using ZLIB. Each file's key and IV is supposedly ...
4
votes
0answers
426 views

What does this multi mov instruction do? [closed]

I came across the following multi mov instruction: mov eax, 1, 2, 3 What does this instruction do? Where can I find the correct documentation for this instruction?
20
votes
1answer
6k views

How to use sysenter under Linux?

I would like to know what are the different ways to perform a system call in x86 assembler under Linux. But, with no cheating, only assembler must be used (i.e. compilation with gcc must be done with -...
9
votes
3answers
2k views

Why is JMP used with CALL?

I am trying to analyze an old malware sample in OllyDbg. It has instruction of the format CALL <JMP.&KERNEL32.SetUnhandledExceptionFilter> I am not an expert in Assembly. I know that CALL ...
4
votes
2answers
3k views

How do you attach to a child process using IDAPro?

The code that I'm analyzing calls fork and I was wondering if there was a way to trace the child process that is created. I've looked in The IDAPro Book and there's nothing on the topic (if there is I ...
4
votes
2answers
14k views

Disassemble, edit and re-assembly iOS ipa apps

I'm trying to get jailbreak statistics for a University project related to security in mobile devices. My purpose is to disassemble, add a sample code and re-assemble to obtain a runnable iOS app ...
15
votes
1answer
19k views

What does the assembly instruction 'REPNE SCAS BYTE PTR ES:[EDI]'?

I disassembled a file with OllyDbg and it had the following instruction: REPNE SCAS BYTE PTR ES:[EDI] What does that exactly mean ?
7
votes
1answer
3k views

Getting IDAPro to analyse part of memory as PE-File

I am using Qemu with its internal GDB server to attach IDA Pro to an instance of Windows 8 x64. There are some problems to solve, because when I am connecting to the GDB server, I am just seeing a ...
1
vote
1answer
527 views

Find out decrypted body of Polymorphic malware

I want to decrypt a polymorphic malware. In polymorphic malware there must be a decryption routine which will decrypt virus code and then execute it. I want to get this pair of encrypted code and its ...
2
votes
1answer
962 views

What is this assembly code doing with the command line arguments [duplicate]

I know something is happening with the command line arguments but I don't know what. Can someone walk me through this code? 0x401050 <main>: push %ebp 0x401051 <main+1>: ...
3
votes
1answer
1k views

Understanding assembly loop

I am having trouble understanding how this code knows when to stop looping. I am supposed to figure out what values are put into %edi. But I can't figure out how many times it loops. 0x40106e ...
3
votes
2answers
2k views

What does `jz $+2` do? (jump if zero to dollar plus two)

What does the dollar symbol mean in jz $+2 (This is IDA output.)
4
votes
2answers
625 views

Which version of assembly does OllyDbg disassemble binary to?

So I understand that there are many assemblers such as MASM, FASM, NASM, etc. But which version is the disassembler in OllyDbg and Cheat Engine?
3
votes
1answer
2k views

Modifying step value that affects xmm# float value

I don't have much experience with assembly and I am trying to change a step value that changes a final value, these are the opcodes that I am working with and this is how they are set: movss xmm0,[...
2
votes
2answers
382 views

Change RadASM hotkey and add middle mouse click hotkey

I am trying to modify RadASM so that Ctrl+W will close the tab, instead of Ctrl+F4, and also make it so that if you middle mouse click the tab, it will close. The context menu for a tab is just a copy ...
5
votes
2answers
1k views

OllyDBG's disassembled syntax and c-equivalent

This is probably a pretty simple question as I'm not too used to how the syntax looks for OllyDBG's disassembler. Does this following assembler statement: MOV EAX, DWORD PTR [ESI + 14] Be roughly ...
6
votes
2answers
2k views

NOP instruction

I have recently learned that nop instruction is actually xchg eax, eax... what it does is basically exchanges eax with itself. As far as CPU goes, does the exchange actually happen?
3
votes
0answers
289 views

IDA Pro Symbian Debugger 'general OS related' Error [closed]

I am using remote symbian: c5-03 (Application TRK 3.2.7 for all S60 5.0 devices with production images). However, whenever I start the debugger, I get this error: general OS-related error What went ...
3
votes
1answer
345 views

What type of data structure is it?

I have the following data: .data:004305FC word_4305FC dw 1583h .data:004305FC .data:004305FE word_4305FE dw 35B6h ....
9
votes
3answers
3k views

Why does the function pointer get overwritten even though is declared before the vulnerable buffer?

I am working on io-wargames for fun right now, level3: I do understand why there is a stack-overflow in this code (strlen(argv[1])), but what I don't understand is why it overflows the function ...
3
votes
1answer
310 views

Take A Snippet of Assembly and Make All Side Effects Explicit?

I came across a small function whose only side effects were to modify the state of some processor flags. When I decompiled this function using the Hex Rays decompiler, I simply got an empty function, ...
15
votes
1answer
4k views

IDA EBP variable offset

Let's take a look of how IDA displays address of local variable. For instance: MOV EAX, [EBP + var_4] As we all know as far as local variables go, they are located at lower addresses of EBP. Though,...
5
votes
1answer
632 views

What could this sequence of assembly instructions possibly mean?

I have recently came across the following sequence of assembly instructions. call ds:WSAStartup push ecx push edi mov ecx, 69E65AC4h mov edi, 2776452Ah pop edi pop ecx jmp ...
38
votes
3answers
20k views

convert this x86 ASM to C?

How could this 32-bit x86 assembly be written in C? loc_536FB0: mov cl, [eax] cmp cl, ' ' jb short loc_536FBC cmp cl, ',' jnz short loc_536FBF loc_536FBC: mov byte ptr [eax], ' ' loc_536FBF mov cl, ...
60
votes
3answers
90k views

How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?

I try to understand the process of memory segmentation for the i386 and amd64 architectures on Linux. It seems that this is heavily related to the segment registers %fs, %gs, %cs, %ss, %ds, %es. Can ...
9
votes
2answers
11k views

Better explanation of different x86 CALL variations

Hoping to get a better explanation of x86 call instruction. I sort of understand the call near and call far. But I don't fully understand the segment part. A little insight into my main problem, I am ...
6
votes
1answer
3k views

What does %reg:value mean in ATT assembly?

When I disassemble a function, I encounter from time to time an expression of the form %reg:value. Typically, I encounter this syntax when I activate the canaries in GCC (-fstack-protector), as in the ...
9
votes
2answers
590 views

What does the text in angle brackets refer to (From objdump)

I constantly see the text (<perror@plt+0x2008e0>) as seen in the snippet below, but I am not sure if its making a call to perror of if the disassembler was having issues. Since it would be odd ...
8
votes
3answers
1k views

Trying to reverse engineer C code that is 64bit assembly

This is the code I am looking at 0x0000000000401048 <+70>: mov 0x401ba0(,%rax,4),%eax This is an array of 15 integers. Just wondering how I can access indices 0 to 15 in gdb Thanks
26
votes
2answers
3k views

Why are special tools required to ascertain the differences between two related binary code files?

How comes that text diffing tools like diff, kdiff3 or even more complex ones usually fail at highlighting the differences between two disassemblies in textual form - in particular two related binary ...
34
votes
5answers
5k views

What is the reason for this method to call itself?

While reversing a 32bit Mach-O binary with Hopper, I noticed this peculiar method. The instruction on 0x0000e506 seems to be calling an address right below the instruction. What would be the reason ...
18
votes
2answers
3k views

Anti-debug techniques on Unix platforms?

I am trying to scan all possible techniques to disrupt the usage of a debugger on a Unix platform (ie POSIX and a bit more). I am thinking about techniques such as the PTRACE test at the beginning of ...
34
votes
7answers
10k views

What hints in machine code can point me to the compiler which was used to generate it?

When I am looking at the machine code of an application, are there hints and patterns I can discern from the generated machine code which would indicate which compiler (and possibly version) was used ...
21
votes
7answers
4k views

How are x86 CPU instructions encoded?

I'm writing a small utility library for hooking functions at run time. I need to find out the length of the first few instructions because I don't want to assume anything or require the developer to ...
20
votes
7answers
5k views

How is a structure located within a disassembled program?

I took a basic 40-hr Reverse Engineering course a few summers ago. While teaching us to use IDAPro, the instructor demonstrated, rather quickly and without explaining much, how to label certain ...