Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [assembly]

A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.

0
votes
1answer
2k views

ARM: understanding MSR/MRS instructions

While reversing a bootloader, i have a lot of msr/mrs instructions, but i cannot find in the arm documentation the meaning of the parameters. For example in IDA i have things like : MSR #...
4
votes
1answer
1k views

xor eax, eax in x64

I have following code: sub rsp, 40 ; 00000028H lea rcx, OFFSET FLAT:$SG4237 call printf xor eax, eax add rsp, 40 ; 00000028H ret 0 Why there is xor eax, eax , ...
1
vote
2answers
254 views

How to get pointer from byte code

I have been doing pointer scans on a game when new versions come out as the structure changes to update memory structure offsets. I decided to attempt to use signature scanning to attempt to make my ...
3
votes
2answers
399 views

Legal risks of retro engineering a 19 years old game

I am quite new to retro-reverse-engineering, and I am concerned about my current hobby. Months ago I started to reverse a 19 year old commercial game, no longer on sale (for ages), and not supported (...
4
votes
0answers
509 views

GNU Assembler - Tricore - how to set origin?

I have a compiled Tricore binary that I am patching. By creating a .asm file from IDA Pro of a function and reformatting it, I can get it to reassemble faithfully apart from call (relative) and jump (...
-2
votes
1answer
1k views

Make this function return true

Sorry, I'm quite new to assembly, and I'm trying to make the code bellow return true: .text:1000E3E0 ; =============== S U B R O U T I N E ======================================= .text:1000E3E0 .text:...
1
vote
1answer
508 views

Assembly and C++

I'm trying to learn Reverse Engineering, at this time I compile C++ code without any optimization and see the correspond assembly in IDA's disassembler, but there are some parts of the code, where I ...
-3
votes
1answer
638 views

How should i read this assembly? [closed]

how should I read this and what does it do? .text:00400526 (main): .text:00400526 55 push %rbp .text:00400527 48 89 e5 mov %rsp,%rbp .text:...
1
vote
1answer
592 views

How do I denote and use JMP /5 in byte code

I'm on the OSX platform working with x86_64. I've worked out how to do near jumps with the E9 byte code directive where my relative addresses have 4 bytes (teamed up with RIP) Now I have an instance ...
3
votes
1answer
459 views

Writing own custome syscall/int 0x80 on x64 system

Is there a way to write my own syscall/int 0x80 without using them? So, normally it goes like setup registers ... syscall or int 0x80 and I am interested in doing this without syscall/int 0x80 ...
3
votes
0answers
288 views

Using __kernel_vsyscall on x64 linux machine [closed]

I am trying to use __kernel_vsyscall instead of syscall/int 80 on linux x64. I have read that it can be done on Intel chips (I have one), but i can't find how can one do it. I have x32 version: int ...
-1
votes
1answer
719 views

How ret know where eip is saved?

I'm learning assembly and I have one question. Example: int main() { foo(a); } int foo (x) { return 0; } when the foo function returns to main the ret instruction is executed. How does the ...
0
votes
1answer
232 views

Change of offset in instruction?

I am learning assembly and injections at the moment. Therefore I wrote a little program which simply prints out a hardcoded string. If I attach ollydbg to that I can inspect the executable I ...
0
votes
3answers
284 views

What exactly is this piece of assembly code doing?

This assembly is for Intel x86-64 bit, seems to be too baffling to me. How come the jz instruction jump to a non-instruction (0x400AC9)? How come the call invokes a non-existing address? For curious ...
0
votes
2answers
151 views

Issues rewriting portions of DOS app's assembly

I am working on editing an old DOS program's assembly, but I'm running into some odd issues. I'm using IDA Pro 6.4 and a hex editor to patch. I'm code-caving the new data by removing old stuff never ...
1
vote
0answers
194 views

Get instruction bytes in JIT mode, Intel Pin

I have an INS object in the instrumentation function, and I wish to get the actual bytes used to code this instruction. Looking at the INS functions, the closest I found was a function to disassemble ...
-1
votes
0answers
133 views

IDA Pro Calling Codecave crashes program

I have a simple program written in C++: #include <Windows.h> #include <iostream> using namespace std; void test() { cout << "This is simple test!" << endl; } int main() {...
1
vote
2answers
628 views

C/C++ to Assembly language

Is there any book or articles related to how C/C++ code is converted to assembly language, I mean common patterns for a specific compiler, etc?
1
vote
1answer
513 views

C++ to assembly, GCC vs CL

I have following C++ code: int main(){ int a = 1; double d = 1.2; return 0; } and get the following assembly using GCC 6.2 -m32: main: lea ecx, [esp+4] and esp, -8 ...
0
votes
1answer
2k views

x86 sbb with same register as first and second operand

I am analyzing a sequence of x86 instructions, and become confused with the following code: 135328495: sbb edx, edx 135328497: neg edx 135328499: test edx, edx 135328503: jz 0x810f31c I understand ...
1
vote
2answers
1k views

Translating x86-64 assembly to C

I'm trying to convert x86-64 assembly into C code, but am still unsure about some of the lines. This is the assembly code: .... pushq %rbp movq %rsp, %rbp subq $20, %rsp movl %edi, -...
0
votes
2answers
244 views

dynamic memory allocation

For dynamic memory allocation in C/C++ int main(){ MessageBox(0,"crackname","",0); int * ptr = new int[50]; int * ptr2 = new int[50]; ptr[0] = 0x75; ptr[1] = 0x65; (*ptr) +1 = 0x75; ...
-1
votes
1answer
166 views

What syntax does OllyDbg follow in its dissassembly window?

I have some understanding of Assembly after reading some tutorials and a few chapters from the "PC Assembly Book". Right now, I am trying to understand the instructions I see in OllyDbg, but it seems ...
-1
votes
2answers
105 views

*(lpCmd + somenumber)

include int WinMain(HINSTANCE hlnst,HINSTANCE hPrev, LPSTR lpCmd,int nShow){ MessageBox(0,"Insert argument","",0); int i = 0; for(i ; *(lpCmd+i) ; i++ ){ } if(!(i=*(...
4
votes
1answer
266 views

move with sign extension in c code

I'm quite confused with the movsx(move with sign extension) I'm trying to convert assembly code to C. but stuck with movsx part. this is the code I got so far. #include <stdio.h> #...
3
votes
1answer
806 views

Good foundation for reverse engineering malware

I have been intrigued by reverse engineering recently and just finished Paul Carter's PC Assembly Language book (http://pacman128.github.io/static/pcasm-book.pdf) which was a great primer for x86. My ...
3
votes
1answer
489 views

Identify and/or reverse compression algorithm

I have a program that read some proprietary files that are compressed. I managed to debug the program and extract the algorithm that decompress the data and use it on my software without any issue. ...
0
votes
1answer
111 views

Possible to hook an address and directly write to it?

I am reversing a game for fun and currently use this function to manipulate the Y coordinate: void __declspec(naked) hookYCoordASM() { __asm { mov eax, valueY mov [esi + 0x7C], ...
0
votes
1answer
157 views

What does byte_407030[ecx] mean?

I came across the following instruction in IDA: movsx edx, byte_407030[ecx] byte_407030 is 25h. Is it trying to access some memory location? I know that ecx is storing a counter in a for loop.
2
votes
2answers
518 views

ARM assembly: Strange instruction pattern (endless loop?)

I noticed a strange instruction pattern. First the value of PC is moved into LR and then a register value is moved into PC. Here some examples: .text:00001488 MOV LR, PC ....
2
votes
1answer
419 views

Reverse Engineering Windows kernel routines

Problem I'm trying to reverse engineer some Windows kernel routines on a Windows 7 x86 (Home Basic) VM with kd. I have already reversed KeInitializeDpc by disassambling it. The problem with ...
2
votes
2answers
3k views

What is *(_BYTE *), __usercall, eax and edi [closed]

I am trying to understand some algorithm of how the thing works. Here is the function I got from decompiling my executable with Hey Rays. I want to run this function to see the result and then ...
3
votes
1answer
615 views

Is it possible to hook CPU instructions without severe performance impact?

I have been working on some unpackers, and I noticed that at their end, they mostly use this: mov edx, [ebp+oep] call edx ; now, you're at the OEP of the original binary Or this: mov ecx, [ebp+oep] ...
3
votes
1answer
893 views

Getting Access Violation when patching a program

I'm very very newbie in assembly / ollydbg / reverse engineering. I'm totally lost with this error. I have created a simple program in Delphi, just to explore in ollydbg. Here is the program's code: ...
2
votes
1answer
712 views

Stepping through ARM firmware image

I have a binary firmware image with a routine that I find hard to understand. I want to step through this encryption routine step by step so I can better understand it. I was able to obtain all the ...
1
vote
1answer
566 views

How to multiply an SSE float with a hardcoded value using MULSS?

I have the following line of code in a game: movss xmm0,[eax+000000F0] It basically loads the float speed of the current speed category into the XMM0 register. I already made a jump to an empty code ...
1
vote
1answer
2k views

Understanding assembly Hello World

I'm studying x86 architecture and assembly in order to have the bases for studying reversing and exploit development. I'm following a course on opensecuritytraining.info. I see a Hello World example:...
0
votes
2answers
219 views

Call instruction - preceding ?@_ in references?

Seems to be a question of no importance, but I'm just curious: Is there a deeper meaning of the preceeding (single/double) ?-marks, @-signs or __ underscores in these different call instructions? ...
0
votes
2answers
221 views

Understanding FCOMP instruction and extracted value from address operand

I'm trying to reverse engineer an application made in vb6. At a certain point it compares an input number to a constant number, my goal here is to extract that number, now i found where the comparison ...
0
votes
1answer
430 views

Converting assembly function to c

I have the following function in assembly, and i'm trying to convert it to c. the function accept 2 parameters, the first one is char* and the second is the int this is the assembly code: 71D3C400 ...
2
votes
1answer
1k views

what means this lines in assembly program (compile from c)?

I have code in C: int a() { char string[100]; } When I compile this I get code in assembly: a: push rbp mov rbp, rsp sub rsp, 112 mov rax, QWORD PTR fs:40 <---- mov ...
0
votes
1answer
572 views

Inline assembly does not compile [closed]

I am currently learning how to hook some functions, and I simply want to insert this simple inline assembly: __asm { CMP [ebp + 8], 1 JNZ short 01311723 jmp [jmpBackAddy] } But Visual ...
0
votes
1answer
296 views

How can I read the assembly instructions of a C program from C#?

I want to be able to do what an ordinary disassembler does—list the assembler instructions of an arbitrary executable—but from C#. It would consist, for instance, of finding a specific instruction ...
1
vote
2answers
1k views

Convert IDA listings to assembly without using IDA non-free

I'm currently working with a huge set of IDA Pro listings (~1TiB). For a project I need to perform analyses on the mnemonics and operands on a subroutine level. Therefor I want to convert the IDA ...
0
votes
1answer
637 views

How to list parameter of function from IDA Pro? [duplicate]

I want to list parameter of function for analysis. Can I list the parameter of function using IDA Pro or IDAPython ?
2
votes
1answer
32 views

Reversing assembler DCD directive list into a c++ variable

For example we have assembler variable "foo" defined as: .text:00001078 foo DCD 0xffffffff, 0xffffeeee How it(variable foo) would look like in c++(or whatever higher lang)???
1
vote
1answer
750 views

Injected instructions hit `bad instruction` exception

In the following code, I injected my own instructions to modify third param of sprintf() function, but the process stopped at EXC_BAD_INSTRUCTION. Can anybody tell me what happened in my code? ...
0
votes
0answers
109 views

NSArray arrayWIthObjects: count: , where the objects are in 128-bit registers

Given the following assembly code on a 64-bit machine: movq xmm1, CFString_ptr; // moves the CFString_ptr to the low quadword of xmm1 and zeros the high quadword of xmm1 If, in objective-c, this 128-...
0
votes
1answer
430 views

Arm Assembly: LDRH instruction to C

I've been reversing an asm checksum code for the last days, and I've managed to understand how it completly works, except for one instruction; ldrh The info I've been able to found says that it's ...