Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [assembly]

A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.

1
vote
2answers
88 views

Jump in the middle trick

I'm reversing a program that "hides" some instructions using the jump in the middle trick. This trick is a jump to a middle of an instruction, whereas the real address actually contains another opcode....
1
vote
1answer
163 views

Is this a good way to get past anti-debugging measures?

This program I am analyzing is full of anti-debugging. It won't even run if most debuggers are loaded before I start the app. I tried using IDA to static analyze it, but it was written in a OOP ...
-1
votes
1answer
66 views

Is there an ida plugin that disassemble in visual c inline assembly (visual studio)?

I have a question... Is there an ida plugin that disassemble the file in visual studio inline assembly? I found this https://github.com/binrapt/ida but when I load it in ida, it complains about "No ...
6
votes
0answers
1k views

Anti debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can i bypass that?

So im debugging this process which has a lot of anti debugging techniques in it, and i faced something new which i dont know how to bypass yet. Changing the code dynamically causes exceptions to ...
5
votes
0answers
153 views

What is the pictured x86 technique/area called?

I've been reverse-engineering Windows PE files and I've discovered this pattern used quite often, making it a little more difficult to follow API calls. First, I'll go to the file's imports and then I ...
4
votes
0answers
79 views

Reconstructing Assembly Truth Map

So I recently read [1] which evaluates several disassemblers. The truth/test binaries are generated by the SPEC CPU 2006 Benchmark suite. The authors provide detailed build instructions for the ELF ...
4
votes
0answers
509 views

GNU Assembler - Tricore - how to set origin?

I have a compiled Tricore binary that I am patching. By creating a .asm file from IDA Pro of a function and reformatting it, I can get it to reassemble faithfully apart from call (relative) and jump (...
2
votes
0answers
76 views

How to track events of any software

Softwares use libraries (sdl, wxwidgets, gtk etc.) that handle events. as keystroke and mouse. I have a software that when clicking on a button, an annoying noise is reproduced how do I find the ...
2
votes
0answers
1k views

Can IDA generate C code for ASM assembly wihtout the binary

Lets say I have this picture of some assembly: Now I know how to manual tranform this assembly into C code because it is small but is it possible for IDA to convert this into C code? Ideally I would ...
1
vote
0answers
22 views

Set Breakpoint on ActiveX Property Being Set (No Symbols)

A program is loading an VB6 based ActiveX control that has several property, for example ConnectionString. The application is dynamically generating the values it provides at runtime, so it is not ...
1
vote
0answers
37 views

How can a segfault happen during the libc exit call on Linux?

I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge. While testing, I have noticed ...
1
vote
0answers
51 views

Help understanding ARM Assembly example code - loops, set flags and code mnemonics

This is the example code: _start: LDR r0, =n LDR r0, [r0] LDR r1, =array1 MOV r2, #0 LDR r4, =array2 loop: LDR r3, [r1], #4 CMP r3, #58 BGT a_point CMP r3, #47 BLT a_point SUB r3, r3, #0x30 STR r3, [...
1
vote
0answers
42 views

Is there a way to modify number of reads/writes to/from a memory address?

I haven't had any luck researching this, so I thought I would inquire here! Let's assume I have found a memory address housing a value of interest. Using a program like Cheat Engine, I look for ...
1
vote
0answers
40 views

getting %localappdata% in asm

I have an old windows x86 application that no longer works properly since windows 8. This app creates files within its own folders for things like app settings. Unfortunately, Microsoft no longer ...
1
vote
0answers
434 views

Reverse Intel hex to programming code

I have a file in the Intel hex format, which was taken of from a pic16F1705 chip. I need to find a way to disassemble it into some form of human friendly programming language in order to make some ...
1
vote
0answers
169 views

Stack buffer overflow SIGSEGV help

I've been going at this for a couple of days now working through trial and error but I can't seem to pinpoint exactly why I'm still getting a SIGSEGV. Here's the stdout of me stepping through the ...
1
vote
0answers
174 views

X64 ASSEMBLY - Cannot run compiled and linked raw shellcode in Windows

After using metasploit's windows/x64/meterpreter/reverse_tcp shellcode on my windows 10 machine (with AVs turned off), I decided to try to create a hand-made polymorphic, null-free and custom-encoded ...
1
vote
0answers
194 views

Get instruction bytes in JIT mode, Intel Pin

I have an INS object in the instrumentation function, and I wish to get the actual bytes used to code this instruction. Looking at the INS functions, the closest I found was a function to disassemble ...
1
vote
0answers
1k views

How to get opcodes for assembly using ppc processor (IDAPython)

In IDAPython, you can obtain the corresponding opcodes for a assembly instruction using the Assemble(ea, line) function. Here is an example using a PE-file / x86 processor type: Python>Assemble(...
1
vote
0answers
561 views

Why does calling the original function from my hook fail?

I am trying to retrieve text from another program. I used Ollydbg to find the address for the function I need to hook to get the info. I used EasyHook to inject the code below. The hook works fine ...
1
vote
0answers
546 views

Shellcode alignment problem

I am trying some CTF style challenges where I have to write shellcode in x86_64 targeting Linux. In the later challenges, the code grows a lot. I now have a large array of bytes I cannot use directly ...
1
vote
0answers
486 views

Define new code section in assembly code to compile ELF binary

I defined a new code section in my assembly program, which is going to be compiled into 32-bit ELF binary, on x86. I use the linker scripts to assign a specified address for this new code section, it ...
1
vote
0answers
238 views

Weird instruction identified on disassembler produced assembly code

Test is on x86 32bit Linux, Ubuntu 12.04, GCC 4.6.3 objdump 2.22 Basically when I use gcc to produce assembly code of function foo like this: gcc -S foo.c -O2 At the end of function foo, I can get ...
0
votes
0answers
67 views

Capstone in reverse mode

I am using capstone in python in order to dissassemble binary instructions. Is there a way to work in the reverse mode ? I mean typing some asm instructions and ask capstone (in python) to generate ...
0
votes
0answers
106 views

x32dbg can't find instruction in ntdll.dll that ollydbg can

I've launched a binary (vulnserver.exe) on Windows Vista (32bits) and successfully crashed it. I am now trying to find a specific offset in ntdll.dll where I can perform a jmp ESP. Here is what I do :...
0
votes
0answers
179 views

Reversing an APK to replicate API, X-Request-Sign5

I have been reverse engineering an APK in order to create a Desktop client for an app (just for fun to improve my analytical/programming skills). I have, however, hit a snag. Most requests sent to ...
0
votes
0answers
277 views

Dereference and Mov without changing registers

I'm trying to modify a PE in order to do in-line patching. Now I want to move 4 Byte to a location which is pointed by an address. Imagine I used this instruction : MOV DWORD PTR DS:[22FFC4],...
0
votes
0answers
268 views

Finding source files from dll

I've been given an Excel model who's back-end has been written in c++ and linked via a dll file. The project file directory has the following structure: model | | - excel-model.xlsb | - excel-...
0
votes
0answers
616 views

How to access this offset location with GDB?

I am reversing an Intel ELF64 file on Linux and encountered the following snippet which appears to be performing a stack integrity check. 0x400cbd <main+463>: mov rdi,QWORD PTR [rbp-...
0
votes
0answers
65 views

What is the best way to determine what part of game code determines time step?

I'd like to alter the way time step works on a game (in order for it to work at a normal game speed at different FPS values (I know it may add bugs)). I have access to the PPC assembly of it or Cheat ...
0
votes
0answers
189 views

Removing code signature from Mac binary executable using objective c

How to remove code signature from a mac binary executable using objective C. I came across this question here. It shows a way to remove code signature of mac binary executable using terminal but I'm ...
0
votes
0answers
109 views

NSArray arrayWIthObjects: count: , where the objects are in 128-bit registers

Given the following assembly code on a 64-bit machine: movq xmm1, CFString_ptr; // moves the CFString_ptr to the low quadword of xmm1 and zeros the high quadword of xmm1 If, in objective-c, this 128-...
0
votes
0answers
173 views

How to pass Obfuscated Elf binary to gcc optimization end

Currently I have a 2000+Line function to reverse engineer with many redundancies and appears to be obfuscated. It their a way to pass to pass this binary to gcc or clang to reassemble it and optimize ...
0
votes
0answers
89 views

Garbage value after Stack frame allocation?

Can anyone explain me why do these garbage values present on stack? Below is the disassembly view of the binary. Let me know in case you need the corresponding C source code. So basically I'm not ...
0
votes
0answers
512 views

Getting “Access violation executing location” error

I am trying to execute this assembly function. But after calling Test_init function, I am getting "Access violation executing location" error at line "add esp,4". sub_402110 proc near ; ...
0
votes
0answers
223 views

Weird self-modify instruction

Trying to finding the main caller of a series of nested function I ended in a switch table (or at least ollydbg says it's so) of address: DD address1 DD address2 DD myfunction DD adress4 .. AND SO ON ...
-1
votes
0answers
87 views

C code extraction from binary code

I have binary file from microcontroller MPC5674F - 32bit Power Architecture, e200z7 core. When I open it with hex redactor I see C headers, which I would like to unpack. Tried to open file with IDA ...
-1
votes
0answers
165 views

Finding reference to plain text string (in executable) in IDA or ollydbg

what is the best (or: what is a way) to find the code assembly line referencing a text string that I can find in plain text in the executable? I want to debug it in IDA or ollydbg, but for the love ...
-1
votes
0answers
162 views

Assembly loop to c++

I am trying to figure out the value stored in %edi throughout each loop iteration: 0x40106e movl $0x2b, 0xffffffdc(%ebp) 0x401075 movl $0x31, 0xffffffe4(%ebp) 0x40107c movl $0x74,...
-1
votes
0answers
133 views

IDA Pro Calling Codecave crashes program

I have a simple program written in C++: #include <Windows.h> #include <iostream> using namespace std; void test() { cout << "This is simple test!" << endl; } int main() {...