Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [assembly]

A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.

1
vote
2answers
87 views

How can I deal with exception handler in Visual C/C++ inline assembly?

I have disassembled a function in IDA Pro and I want to compile it into my project in visual c inline assembly... I'm still a newbie, so let me apologize if I don't use the right terminology...(I'm ...
4
votes
2answers
1k views

Why are there absolute jmps in disassembly of position independent code?

I'm playing around with Hopper and am looking at the disassembly of a binary that otool reports as having the PIE flag. It's my understanding that as a result, the executable base address will be ...
0
votes
1answer
222 views

Is there a way to see all “values” in memory?

In a program I'm working on, a variable is set using a memory address: mov r9, [0x0000000000472C10] Is this the equivalent? (forgive the python code): value = 55 <---- value at memory address ...
0
votes
1answer
255 views

How ida choose arm Thumb/Thumb2

I load binary file to ida and choose arm cpu. How can I see if ida choose on arm/arm Thumb2 / arm Thumb? and how can I change it? Bytes translate is depend witch arm is it(arm/arm Thumb2 / arm ...
0
votes
1answer
374 views

How to View the Address Referenced by QWORD PTR

I'm following a tutorial to get a better understanding of how things are passed around through stack frames, but they're working on a x86 system and I'm on x64. when they've reached the step sub ...
0
votes
3answers
2k views

What is an immediate value?

I just read this post. What does mean an "immediate value" ? Is there any string/ascii there? How can I find this value on the binary file? I have the same code and when I search on 0x28 address I ...
2
votes
3answers
2k views

How does the ldr instruction work on ARM?

ldr r0, #0x28 What does thw ldr instruction ? Does it load a string from some offset? How can I find the string/value that is actually loaded ?
0
votes
2answers
525 views

Get original .dll file from .dmp?

I was wondering if you could get the dll saved into your hard drive from the respective .dmp file. Also if not, is it possible to fully get the asm code from the same .dmp file in addition to it .data/...
0
votes
0answers
179 views

Reversing an APK to replicate API, X-Request-Sign5

I have been reverse engineering an APK in order to create a Desktop client for an app (just for fun to improve my analytical/programming skills). I have, however, hit a snag. Most requests sent to ...
5
votes
2answers
245 views

Tutorial or resource for understanding obscure Assembly idioms?

Assembly seems to have lots of tricks. Set a register to zero (xor reg, reg) Extend the stack by only four bytes (push/pop ecx) Setting a regiseter to -1 (OR reg -1) Mulitiplying by powers of two ...
0
votes
1answer
74 views

Where are the arguments to this D3D11CreateDeviceAndSwapchain call stored in x64?

I have been trying to reverse a singleplayer x64 game to learn about reversing games. My problem is that I am trying to trace the arguments from a D3D11CreateDeviceAndSwapchain call and as far as I ...
-1
votes
1answer
126 views

What does this line of assembly do ? how am i to interpret it?

ive started studying reverse engineering, and in a binary i am trying to reverse i stumbled upon an unusual(to me) line of assembly in IDA PRO. and it looks like this .text:00000000008A1C21 ...
6
votes
1answer
445 views

How does this EB F2 x86 instruction work?

In the following code snippet, the EB F2 instruction is causing execution to jump back up to the line indicated by the arrow. How is this the case given that there is no address supplied to EB and the ...
0
votes
1answer
95 views

AT&T - Does assembly code return whatever is in %eax by default?

I have the following AT&T assembly code: movl 12(%ebp),%eax cmpl %eax,8(%ebp) jle L7 movl 8(%ebp),%eax L7: leave I'm supposed to "transpose"(??) it to C code. I actually just have to ...
-1
votes
2answers
346 views

extract opcodes using radare

When we have many binaries, there is a python base solution for disassemble and extract opcodes from binaries in IDA program. Is there any or similar solution to disassemble binaries for Radare2?
4
votes
3answers
461 views

REPL for x86 assembly? [closed]

New to assembly here. Most dynamic languages have REPLs these days and they're great. I really want a tool like that for x86. Is there any thing open source on the table? Even if it's compiling ...
-1
votes
0answers
165 views

Finding reference to plain text string (in executable) in IDA or ollydbg

what is the best (or: what is a way) to find the code assembly line referencing a text string that I can find in plain text in the executable? I want to debug it in IDA or ollydbg, but for the love ...
0
votes
0answers
277 views

Dereference and Mov without changing registers

I'm trying to modify a PE in order to do in-line patching. Now I want to move 4 Byte to a location which is pointed by an address. Imagine I used this instruction : MOV DWORD PTR DS:[22FFC4],...
1
vote
2answers
1k views

scanf return value

Looking this snippet of code I can't figure out where is stored the return value of the scanf() function. EDIT: From man page, scanf() return an int value representing the number of input items ...
1
vote
0answers
434 views

Reverse Intel hex to programming code

I have a file in the Intel hex format, which was taken of from a pic16F1705 chip. I need to find a way to disassemble it into some form of human friendly programming language in order to make some ...
5
votes
2answers
300 views

Flare-ON#3: Problem understanding some parts in the program

I was trying the flare on challenge. When trying the challenge#3 I got into some trouble and could not solve it. After looking into solutions wrote by other I now do know how the program works, but i ...
4
votes
1answer
729 views

Stack buffer size is different between C and ASM

Given that function: void vuln( char * arg ) { char buf[256]; strcpy(buf, arg); } Disassembled in: 0x0804842b 55 push ebp ...
4
votes
2answers
143 views

Avatao R3v3rs3 2

I found this platform and its course path into Reverse Engineering. Although very easy (at first) I'm kinda stuck in this binary n.2. Binary looks pretty easy and straightforward, but I can't figure ...
-2
votes
1answer
155 views

how to represent -1 in assembly?

Question: You are given eax = 0x1. Could you set eax to zero using only one add instruction ? Answer: add %eax, 0xffffffff Why is that ?
1
vote
0answers
169 views

Stack buffer overflow SIGSEGV help

I've been going at this for a couple of days now working through trial and error but I can't seem to pinpoint exactly why I'm still getting a SIGSEGV. Here's the stdout of me stepping through the ...
1
vote
1answer
111 views

Assembly output too complicated

This is a probably a very basic question, please bear with me. I'm starting to get into reverse engineering following this pdf I found online: https://beginners.re/ I am, however, stuck at the very ...
0
votes
1answer
803 views

What does this assembly instruction do?

push %rbp mov %rsp,%rbp mov %rdi,-0x18(%rbp) mov %rsi,-0x20(%rbp) mov -0x18(%rbp),%rax mov (%rax),%eax mov %eax,-0x4(%rbp) mov -0x20(%rbp),%rax mov (%rax),%edx mov -0x18(%...
3
votes
2answers
1k views

ARM64 syscalls table

I wonder if there some syscall table for Linux ARM64 architecture? I found syscall table for Linux ARM32 and many other architectures, but the problem still exists. Does anyone know where can I find ...
5
votes
3answers
1k views

Batch disassembling DLL and EXE files?

In %SYSTEMROOT%, there are about 2000 DLL and EXE files. I am looking into reverse engineering some of them which are dependencies of other applications. However, what I would preferably want is ...
-1
votes
1answer
739 views

What does test bl al, bl al mean? [closed]

In a website I`ve seen a command like this: test bl al, bl al jz 0xaddress What does this mean? Does this belong to a specific compiler to generate such these assembly codes?
-1
votes
1answer
258 views

Shells CTF segfault - wrong address

PicoCTF 2017 Shells I have a binary and source: #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/mman.h> #define AMOUNT_OF_STUFF 10 //TODO: Ask IT ...
-1
votes
1answer
59 views

where the variable and it's size are stored inside windows executabe file?

i am beginner in reverse engineering. i want to understand where the variables and it's size are stored inside an windows executable file. somehow i can able to find the values of variables i ...
1
vote
2answers
400 views

how data types and variables are converted to machine code?

I know that every x86 instruction has an opcode for that, but I don't know how data types and variables are converted to machine code. So I tried to figure out. I wrote a simple C program and ...
0
votes
1answer
313 views

ARM ELF Obfuscation [closed]

Metamorphic is a technique to obfuscate a binary and change the opcode sequence and create new samples with same functionality. In my case, I have some elf binary of ARM processor type and their ...
0
votes
1answer
226 views

How to build a 32-bit DLL in pure assembly

This is the code I've managed to build so far to implement DLLSkeleton.dll: http://archive.org/download/lowlevelDLL32_try0000/x86_WinAPI_ASM_PE_EXE_Skeleton32--v2017-07-26.zip I'm trying to make a ...
3
votes
1answer
128 views

Why does this function calls offset move when I restart windows

Every time I restart windows it breaks the patch I've made to an executable where I've called a function from the dll user32.dll. Currently the offset for the function call resides at 0x76E3CDB4, but ...
4
votes
2answers
441 views

Dealing with instructions that are accessed by multiple pieces of data

So to gain more experience with reversing, I am currently trying to write an external hack for a video game called Borderlands 2. I've been using cheat engine to scan for addresses of instructions ...
2
votes
0answers
76 views

How to track events of any software

Softwares use libraries (sdl, wxwidgets, gtk etc.) that handle events. as keystroke and mouse. I have a software that when clicking on a button, an annoying noise is reproduced how do I find the ...
4
votes
1answer
859 views

x86 ASM question about hexadecimal numbers and how to transfer them

So I am wondering why I cannot do this mov eax, ffffffffh but I can do this: mov eax, 0ffffffffh Could anybody explain please? In this case, I am using the Flat Assembler but I think this is not ...
1
vote
1answer
96 views

possible to get reference assembly address in file for special memory address?

Hello I try to learn reverse engineering, so i use from process hacker to view dynamic strings in the process's memory... (more info) i get something like this : Address Length Result --------------...
2
votes
3answers
602 views

Building a control flow graph from machine code

I want to write my own soft, that can disassemble code, and turn it into conrol flow graph. Now i know the basics of graph theory, but i don't get where i should start, do i need to basically keep the ...
0
votes
0answers
268 views

Finding source files from dll

I've been given an Excel model who's back-end has been written in c++ and linked via a dll file. The project file directory has the following structure: model | | - excel-model.xlsb | - excel-...
3
votes
1answer
122 views

There is any way to see the subroutine local variables values and who actually access them?

I know that it exists gdb, but i'm talking about windows, i would like know if there is any way to see who access to current stackframe of a specified variable on an X subroutine... i've tried using ...
0
votes
0answers
616 views

How to access this offset location with GDB?

I am reversing an Intel ELF64 file on Linux and encountered the following snippet which appears to be performing a stack integrity check. 0x400cbd <main+463>: mov rdi,QWORD PTR [rbp-...
3
votes
2answers
2k views

How to edit and modify a class with ILSpy + Reflexil

In the Maxsea.SmartDesktop.dll, I want to edit and modify class b1g. There is this in : if (isCrackedResult != null && isCrackedResult.IsCracked) and I want to modify for this : if (...
1
vote
1answer
164 views

Understanding ARM64 Obj-C Prolog

I'm trying to understand the differences between the following function prologs of a number of obj-c function decompilations. I know they store variables for the caller to use when the function ...
3
votes
1answer
203 views

What kind of assembly language construct is this?

I am reversing an ELF64 executable created on AMD X86-64. I encountered this line near the end of the file and am puzzled to its meaning: nop WORD PTR cs:[rax+rax*1+0x0] In this case rax contains ...
4
votes
2answers
1k views

How do I approach this CTF Debugging Program?

I have an ELF executable I'm working on (got it from a previous CTF competition). The executable simply asks for a password, and then it prints out "congrats". The code snippets and my annotations ...
4
votes
1answer
488 views

Where ES/GS/FS are pointing to?

As far as I know those segments are extra or general. But at which part of program memory they are actually pointing? If I undestand it correctly DS is poining at entry point of Dump, SS stands for ...
4
votes
1answer
143 views

Weird looking assembly-code bunch

I am currently analysing some crackme with Olly and IDA. Initially it was packed. I managed to find the OEP (a JMP soon after POPAD and right before a bunch of nulls): 0040E978 . 53 ...