Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [assembly]

A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.

2
votes
2answers
207 views

Is this a good way to get past anti-debugging measures?

This program I am analyzing is full of anti-debugging. It won't even run if most debuggers are loaded before I start the app. I tried using IDA to static analyze it, but it was written in a OOP ...
-1
votes
1answer
72 views

Is there an ida plugin that disassemble in visual c inline assembly (visual studio)?

I have a question... Is there an ida plugin that disassemble the file in visual studio inline assembly? I found this https://github.com/binrapt/ida but when I load it in ida, it complains about "No ...
6
votes
0answers
1k views

Anti debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can i bypass that?

So im debugging this process which has a lot of anti debugging techniques in it, and i faced something new which i dont know how to bypass yet. Changing the code dynamically causes exceptions to ...
5
votes
0answers
159 views

What is the pictured x86 technique/area called?

I've been reverse-engineering Windows PE files and I've discovered this pattern used quite often, making it a little more difficult to follow API calls. First, I'll go to the file's imports and then I ...
4
votes
0answers
79 views

Reconstructing Assembly Truth Map

So I recently read [1] which evaluates several disassemblers. The truth/test binaries are generated by the SPEC CPU 2006 Benchmark suite. The authors provide detailed build instructions for the ELF ...
4
votes
0answers
544 views

GNU Assembler - Tricore - how to set origin?

I have a compiled Tricore binary that I am patching. By creating a .asm file from IDA Pro of a function and reformatting it, I can get it to reassemble faithfully apart from call (relative) and jump (...
2
votes
0answers
14 views

How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled?

How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled? Context is curiosity. I'm aware that Docker in the ...
2
votes
0answers
77 views

How to track events of any software

Softwares use libraries (sdl, wxwidgets, gtk etc.) that handle events. as keystroke and mouse. I have a software that when clicking on a button, an annoying noise is reproduced how do I find the ...
2
votes
0answers
2k views

Can IDA generate C code for ASM assembly wihtout the binary

Lets say I have this picture of some assembly: Now I know how to manual tranform this assembly into C code because it is small but is it possible for IDA to convert this into C code? Ideally I would ...
1
vote
0answers
23 views

IDA Pro how debug constant function returning different results?

The code below is executed with the parameters (0, 4, 0) , the first 0 being an int pointer casted to an int, and these are the same every time. After execution, a 3 digit number string is returned/...
1
vote
0answers
28 views

Set Breakpoint on ActiveX Property Being Set (No Symbols)

A program is loading an VB6 based ActiveX control that has several property, for example ConnectionString. The application is dynamically generating the values it provides at runtime, so it is not ...
1
vote
0answers
48 views

How can a segfault happen during the libc exit call on Linux?

I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge. While testing, I have noticed ...
1
vote
0answers
61 views

Help understanding ARM Assembly example code - loops, set flags and code mnemonics

This is the example code: _start: LDR r0, =n LDR r0, [r0] LDR r1, =array1 MOV r2, #0 LDR r4, =array2 loop: LDR r3, [r1], #4 CMP r3, #58 BGT a_point CMP r3, #47 BLT a_point SUB r3, r3, #0x30 STR r3, [...
1
vote
0answers
43 views

Is there a way to modify number of reads/writes to/from a memory address?

I haven't had any luck researching this, so I thought I would inquire here! Let's assume I have found a memory address housing a value of interest. Using a program like Cheat Engine, I look for ...
1
vote
0answers
41 views

getting %localappdata% in asm

I have an old windows x86 application that no longer works properly since windows 8. This app creates files within its own folders for things like app settings. Unfortunately, Microsoft no longer ...
1
vote
0answers
492 views

Reverse Intel hex to programming code

I have a file in the Intel hex format, which was taken of from a pic16F1705 chip. I need to find a way to disassemble it into some form of human friendly programming language in order to make some ...
1
vote
0answers
180 views

Stack buffer overflow SIGSEGV help

I've been going at this for a couple of days now working through trial and error but I can't seem to pinpoint exactly why I'm still getting a SIGSEGV. Here's the stdout of me stepping through the ...
1
vote
0answers
176 views

X64 ASSEMBLY - Cannot run compiled and linked raw shellcode in Windows

After using metasploit's windows/x64/meterpreter/reverse_tcp shellcode on my windows 10 machine (with AVs turned off), I decided to try to create a hand-made polymorphic, null-free and custom-encoded ...
1
vote
0answers
197 views

Get instruction bytes in JIT mode, Intel Pin

I have an INS object in the instrumentation function, and I wish to get the actual bytes used to code this instruction. Looking at the INS functions, the closest I found was a function to disassemble ...
1
vote
0answers
1k views

How to get opcodes for assembly using ppc processor (IDAPython)

In IDAPython, you can obtain the corresponding opcodes for a assembly instruction using the Assemble(ea, line) function. Here is an example using a PE-file / x86 processor type: Python>Assemble(...
1
vote
0answers
565 views

Why does calling the original function from my hook fail?

I am trying to retrieve text from another program. I used Ollydbg to find the address for the function I need to hook to get the info. I used EasyHook to inject the code below. The hook works fine ...
1
vote
0answers
593 views

Shellcode alignment problem

I am trying some CTF style challenges where I have to write shellcode in x86_64 targeting Linux. In the later challenges, the code grows a lot. I now have a large array of bytes I cannot use directly ...
1
vote
0answers
499 views

Define new code section in assembly code to compile ELF binary

I defined a new code section in my assembly program, which is going to be compiled into 32-bit ELF binary, on x86. I use the linker scripts to assign a specified address for this new code section, it ...
1
vote
0answers
241 views

Weird instruction identified on disassembler produced assembly code

Test is on x86 32bit Linux, Ubuntu 12.04, GCC 4.6.3 objdump 2.22 Basically when I use gcc to produce assembly code of function foo like this: gcc -S foo.c -O2 At the end of function foo, I can get ...
0
votes
0answers
16 views

Intel prefixes instructions, checking optimisations problems

I wanted to learn more on ptrace's functions with x86_64 binaries, disassembling instructions. The goal is to check if a byte is one of instructions prefixes. I found some information in the Intel® ...
0
votes
0answers
46 views

IDA pro - strange switch statement

I use IDA pro and along the analysis I try to understand the following function. There is a simple switch case but it appears that all the 13 switch branches do the EXACT same thing. Am I missing ...
0
votes
0answers
23 views

How to make proper stubs with Exception Handlers?

I'm trying to hook a function to output all its parameters. The hook itself works fine, but the stub somehow crashes the program. I thinks its related to the Exception Handler at the beginning of the ...
0
votes
0answers
14 views

SIGBUS when trying to trace functions?

I am working on a crackme (Mach-O, mac app). Now, the app itself is weird and I honestly don't really know where to start. There are multiple threads and the main function doesn't really tell me ...
0
votes
0answers
24 views

How to generate .TEXT only asm output in IDM?

So I tried to do File -> Produce File -> Create ASM File. There are lots of dd stuff that I don't want. So now, what I need is, either an android app where I can view that .asm file ...
0
votes
0answers
71 views

Capstone in reverse mode

I am using capstone in python in order to dissassemble binary instructions. Is there a way to work in the reverse mode ? I mean typing some asm instructions and ask capstone (in python) to generate ...
0
votes
0answers
179 views

How to pass Obfuscated Elf binary to gcc optimization end

Currently I have a 2000+Line function to reverse engineer with many redundancies and appears to be obfuscated. It their a way to pass to pass this binary to gcc or clang to reassemble it and optimize ...
0
votes
0answers
526 views

Getting “Access violation executing location” error

I am trying to execute this assembly function. But after calling Test_init function, I am getting "Access violation executing location" error at line "add esp,4". sub_402110 proc near ; ...
0
votes
0answers
231 views

Weird self-modify instruction

Trying to finding the main caller of a series of nested function I ended in a switch table (or at least ollydbg says it's so) of address: DD address1 DD address2 DD myfunction DD adress4 .. AND SO ON ...