Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [assembly]

A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.

1
vote
1answer
57 views

Need Advice for the purposes of learning [closed]

I would really like to make a multiplayer mod for Fallout 4, I know how to program and i have a basic understanding of how to get opcodes and read/write to those. Now what i don't understand is how to ...
5
votes
4answers
3k views

Purpose of test eax,eax after a strcmp

This is my first program i am trying to reverse and my intro to this field. The C program will test if two strings match, and it will printf() a message for each occasion. This is what the reversed ...
4
votes
2answers
177 views

How does the XADD instruction modify the Zero Flag?

I've come across a set of instructions using lock xadd which I'm guessing came from one of the C++ smart pointer templates. (It's been a very long time since I coded C++ so I'm not sure which). lea ...
0
votes
0answers
67 views

Capstone in reverse mode

I am using capstone in python in order to dissassemble binary instructions. Is there a way to work in the reverse mode ? I mean typing some asm instructions and ask capstone (in python) to generate ...
2
votes
1answer
79 views

Why do we need to know the address of shellcode?

I have read many articles regarding the buffer overflow exploit. Everywhere its written as follow. "It's difficult to know the starting address of the shellcode" Why do we need to know the address ...
2
votes
1answer
148 views

What does this magic number do? [duplicate]

I've opened a 64 bit DLL file in IDA. One function has this pseudocode: unsigned __int64 output; ULONG input; output = (unsigned __int64)(input * (unsigned __int128)0xE38E38E38E38E38Fui64 >> 64)...
-3
votes
1answer
86 views

Change value of an IF condition found in IDA

so I have the .idb file of an executeable I want to modify. In the IDB file, I found this code And I basically want to change 4111006 to 1006 in that IF condition. however, when I press TAB to go to ...
1
vote
1answer
59 views

Is there any way to call function instead of breakpoint, when certain memory area is accessed or register value is matched?

I am studying assembly and hooking. I know how to hook x86 assembly now. so if any thread goes to certain address which is overwritten with my code, it automatically returns to my function. I think ...
2
votes
3answers
490 views

What does ds mean in mov instruction?

I am reversing a 32-bits ELF executable. I see something like: mov al, byte ptr ds:xxxxx xxxxx is an absolute address. What is the meaning of ds here?
1
vote
1answer
65 views

Generate this assembly from a c program

I want to generate this assembly code: mov ecx, <absolute address of func1> call ecx How can I write and compile C code which generates this code?
0
votes
2answers
181 views

How to interpret disassembled MIPS code?

I have disassembled MIPS binary with raw opcodes. How to interpret, for example, these lines: Disassembly of section .data: 00000000 <.data>: ... ... f864: 30a5ffff sd ra,-23248(...
0
votes
1answer
80 views

How to breakpoint atached process with ida when move on

In IDA pro, there is an option to attach to a process using the WinDbg backend. When I want is to see the process' control flow when the IDA attaches to it. The only way (that I know) to see the ...
1
vote
1answer
55 views

What are these LOAD segments in an assembly ELF64?

I wrote the following (fasm) assembly program: format ELF64 executable segment readable executable include 'io.inc' include 'unistd64.inc' entry main main: mov rdi, msg call print call ...
3
votes
1answer
558 views

Understanding Program Arguments on the Stack in Assembly

To self-teach myself reverse engineering, I am writing small C programs and reversing them in order to understands how the compiler sees my code. However, I am having quite tough time understanding ...
-3
votes
1answer
108 views

How does array indexing works at the assembly level?

Can anyone give me an example to understand how array indexing is working in assembly. For example, in C: char s[1000]; for (int = 0; i < 5; i++) { s[i] = i; } And, in x86 assembly: add ...
3
votes
1answer
815 views

Moving integer to xmm register

I was looking at a game code, and I saw the following: 0x171 mov [rbp-30],r12w .... 0x210 movups xmm0,[rbp-30] I am pretty sure that r12 is an integer here (equals 5). So, is it moving an ...
15
votes
3answers
5k views

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

I don't know whether this is a silly question, but I couldn't find any answer. With the evolution of CPU architecture, register size was extended, from 8, to 16, 32, and eventually 64-bit. I was ...
-1
votes
1answer
191 views

index of array in assembly? [duplicate]

In the following picture the line i want to mention is: mov [esp+eax*4+0Ch], edx Here eax is the index in the array. But, where is the address of the array to access? what does mean this line of ...
-2
votes
1answer
199 views

Understand help me array in assembly? [duplicate]

Can anyone explain the following code as it's an array in assembly. I can't understand can you help me to figure it out line by line. Thanks Q.1) what does the 401024 & 40102E line does ?
1
vote
1answer
87 views

Visual Win32 (UI) style?

what is the following image is about ? Is it design using win32 (UI) ? the following image contains functions are being output from a DLL. Can you help me to understand. Suggest me anything which ...
5
votes
1answer
1k views

Is IDA pulling my leg - or can REX.W sometimes not be determined in static analysis?

NB: I normally dabble with disassembly (i.e. mnemonics) and only ever look at the raw opcodes when I can't avoid it. I have the following line of disassembly of a Windows x64 kernel mode driver, ...
-2
votes
1answer
106 views

x86 Assembly Data Types [closed]

For the code below can anyone help with these questions? xor eax, eax mov ecx, 5 lea edi, [edx] rep stosd mov al, 0xFF stosw stosb stosb How many times does the 'stosd' operation run? Why? If edx ...
3
votes
2answers
69 views

How do you look for a a particular value at address in IDA

So, I was trying to load some binary and in the main function, I saw instructions such as mov edi, [esi+1Ch] ... lea eax, [esi+18h] So, what are these values at [esi+1Ch] and [esi+18h]. How do ...
3
votes
2answers
81 views

ARM Thumb2 register usage

I am reversing ARM Thumb2 code. I am looking for a table that shows which registers are used to pass arguments to functions, and which registers must be saved after the function ends. By the way, if ...
2
votes
1answer
143 views

Patching a program in memory at a certain point of time

I'm using OllyDbg to patch a value and I need to patch a certain value when the program gets mapped in memory, how can I do this? I don't want to patch the value in file, but only in memory after the ...
0
votes
3answers
264 views

Explain struct access in assembly?

I am having trouble understanding working with structs in assembly from disassembly. can you please explain the code below. Disassembly below: Source code:
0
votes
1answer
148 views

Help me to understand disassembly MFC or Win32

I am trying to reverse engineer an application. I don't understand is this MFC framework. Should i learn MFC to understand the following code. or is it Win32 code developing. But how Win32 works with ...
1
vote
1answer
106 views

help me to understand array?

Question #1 is the lea edx, [esp+24] start of array ? and eax, [esp+140] index? then whats add eax, edx doing here and this source code mean ? can you please explain? I am confused about array ...
1
vote
2answers
590 views

How to assemble and inject an instruction with GDB?

GDB has a x/i command (and also disassemble) which allows to view the instructions at a given address. How can we do the reverse – assemble an instruction and write to a given address?
1
vote
1answer
214 views

Confuse with MOVZX

I'm trying to reverse engineer an app. I can't understand some instructions: EBP-4h=>Self EBP-8h=>OptionData ... mov eax, [ebp+var_4] movzx eax, byte ptr [eax+1Ch] // (1) mov edx,...
0
votes
1answer
103 views

Reversing: DeviceIoControl return value

While reverse engineering a windows executable I found the DeviceIoControl function, and i'm trying to figure out the correct inputs so it does not return a zero, it get's the [ebp+hDevice] from the ...
-1
votes
1answer
66 views

Is there an ida plugin that disassemble in visual c inline assembly (visual studio)?

I have a question... Is there an ida plugin that disassemble the file in visual studio inline assembly? I found this https://github.com/binrapt/ida but when I load it in ida, it complains about "No ...
1
vote
1answer
302 views

IDA 7.0 (freeware) auto-analysis gets stuck in a loop

I am trying to create a graph so that I can visualize the flow of a particular function in a game that I am interested in. I was initially using Cheat Engine to follow the flow of the function, but ...
0
votes
2answers
461 views

SAR Instruction

sar eax, 6 ... sar eax, 0x1f This arithmetic shift operation confuses me. Understand that it's taking the value of eax in hex then shifting it to the right by 6 and the same for the next operation by ...
1
vote
1answer
357 views

NASM, MASM, Intel, AT&T' syntax?

I see word NASM, MASM, Intel, AT&T. I am confused between them. Is it different types of assembly?
0
votes
1answer
178 views

how to understand branch arm instruction

I have this instruction F6F700B8 I know that it b #-0xA000 but how I can understand from F6F700B8 that is b #-0xA000 ? . When I tried to translate it on http://armconverter.com/hextoarm/ I get B.W #...
5
votes
1answer
376 views

Why do many imported functions jump to addresses that do not contain instructions?

I am learning to analyze binaries using radare2 and have been confused about what occurs within imported functions. In the binary below, titled Lab2B, I statically disassembled the binary and then ...
0
votes
1answer
50 views

Reading params of a text engine function amd86_64

I'm starting to learn amd86_64 calling convention and how it calls params and clean the stack but the concept hasn't sunk in yet, so i would like to get a help reading the params as this might clear ...
4
votes
2answers
197 views

General x86 to C tips?

I'm currently trying to finish an assignment for one of my classes that requires a sequence of ten Hexadecimal numbers for it not to blow up. The task is to find these numbers and input them in the ...
-1
votes
0answers
87 views

C code extraction from binary code

I have binary file from microcontroller MPC5674F - 32bit Power Architecture, e200z7 core. When I open it with hex redactor I see C headers, which I would like to unpack. Tried to open file with IDA ...
0
votes
2answers
401 views

Need help with reverse engineering camera-related information in a video game

I've posited a similar question over on the Game Development StackExchange, but I'm going to refine it, elaborate, and piecemeal a more R.E.-specific context with the hope that someone out there has ...
0
votes
0answers
106 views

x32dbg can't find instruction in ntdll.dll that ollydbg can

I've launched a binary (vulnserver.exe) on Windows Vista (32bits) and successfully crashed it. I am now trying to find a specific offset in ntdll.dll where I can perform a jmp ESP. Here is what I do :...
1
vote
3answers
349 views

Question relating to learning Assembly through CTF challenges

I've just started to dip into Assembly for CTF reversing challenges, and am having a great time. A loop structure in the current challenge I'm working on has me stumped, however - hoping someone can ...
1
vote
2answers
708 views

What does XREF mean?

I have been learning about the x86 assembly language by analyzing a binary using radare2 that is stored on a Intel 80386 machine. When I have been analyzing functions on the binary, I noticed that "...
-1
votes
1answer
55 views

Understanding what is represented by function pointers to a block of hex

I'm working on a disassembly project for my class where I'm trying to bypass a license check, but when I throw the executable into Binary Ninja this is what I see: And when I look at those pointers, ...
1
vote
2answers
175 views

Printing bytecode in bytes given a string of assembly?

Megabeets determined in this answer that depending on asm.bits Radare may show either lea edx, [0x80490c8] (asm.bits=32) lea edx, [rip + 0x80490c8] (asm.bits=64) If I want to see what the ...
3
votes
2answers
2k views

Disassembly shows `LEA` with RIP?

When I disassemble this instruction using pad on Radare I get an LEA with rip [0x00000000]> pad 8d 15 c8 90 04 08 lea edx, [rip + 0x80490c8] I got this instruction from this post here I'm ...
2
votes
2answers
183 views

Can I provide bytes to Radare to be disassembled?

Let's say I want to check this guys work. He says that he is getting 8d 15 c8 90 04 08 lea 0x80490c8,%edx ba c8 90 04 08 mov $0x80490c8,%edx Is there an easy way with Radare to ...
-2
votes
2answers
321 views

How can I export only the mnemonics from objdump (or any other program)?

I want to do an analysis with the mnemonics. I can export everything to text but I only need the last column. Any idea on how can I solve this? In other words of this output of objdump (objdump -d ...