Skip to main content

Questions tagged [assembly]

A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.

Filter by
Sorted by
Tagged with
87 votes
3 answers
133k views

How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?

I try to understand the process of memory segmentation for the i386 and amd64 architectures on Linux. It seems that this is heavily related to the segment registers %fs, %gs, %cs, %ss, %ds, %es. Can ...
perror's user avatar
  • 19.1k
45 votes
4 answers
23k views

convert this x86 ASM to C?

How could this 32-bit x86 assembly be written in C? loc_536FB0: mov cl, [eax] cmp cl, ' ' jb short loc_536FBC cmp cl, ',' jnz short loc_536FBF loc_536FBC: mov byte ptr [eax], ' ' loc_536FBF mov cl, ...
user1365830's user avatar
37 votes
5 answers
8k views

Why would a program contain a call instruction targetting the address immediately following that instruction?

While reversing a 32bit Mach-O binary with Hopper, I noticed this peculiar method. The instruction on 0x0000e506 seems to be calling an address right below the instruction. What would be the reason ...
Daniel Sloof's user avatar
35 votes
7 answers
11k views

What hints in machine code can point me to the compiler which was used to generate it?

When I am looking at the machine code of an application, are there hints and patterns I can discern from the generated machine code which would indicate which compiler (and possibly version) was used ...
WilliamKF's user avatar
  • 937
30 votes
1 answer
58k views

What does mov qword ptr ds:[rax+18], r8 mean?

mov qword ptr ds:[rax+18], r8 In the above code, where are we copying the value of r8 register into? I know that ds means data segment which is a segment in memory, but what does exactly [rax+18] ...
FreeMind's user avatar
  • 639
28 votes
8 answers
5k views

How are x86 CPU instructions encoded?

I'm writing a small utility library for hooking functions at run time. I need to find out the length of the first few instructions because I don't want to assume anything or require the developer to ...
Henry Heikkinen's user avatar
27 votes
3 answers
4k views

Why are special tools required to ascertain the differences between two related binary code files?

How comes that text diffing tools like diff, kdiff3 or even more complex ones usually fail at highlighting the differences between two disassemblies in textual form - in particular two related binary ...
0xC0000022L's user avatar
  • 10.9k
25 votes
7 answers
7k views

How is a structure located within a disassembled program?

I took a basic 40-hr Reverse Engineering course a few summers ago. While teaching us to use IDAPro, the instructor demonstrated, rather quickly and without explaining much, how to label certain ...
Ken Bellows's user avatar
24 votes
1 answer
10k views

How to use sysenter under Linux?

I would like to know what are the different ways to perform a system call in x86 assembler under Linux. But, with no cheating, only assembler must be used (i.e. compilation with gcc must be done with -...
perror's user avatar
  • 19.1k
23 votes
4 answers
4k views

Knowledge about CPU hardware

Recently, I have taken the computer organization course that explains in the logic gate level how a CPU works and etc... Up until now I have been treating the CPU as a black box that runs assembly ...
user4906231's user avatar
22 votes
3 answers
6k views

Anti-debug techniques on Unix platforms?

I am trying to scan all possible techniques to disrupt the usage of a debugger on a Unix platform (ie POSIX and a bit more). I am thinking about techniques such as the PTRACE test at the beginning of ...
perror's user avatar
  • 19.1k
19 votes
3 answers
16k views

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

I don't know whether this is a silly question, but I couldn't find any answer. With the evolution of CPU architecture, register size was extended, from 8, to 16, 32, and eventually 64-bit. I was ...
Yuriko's user avatar
  • 295
18 votes
1 answer
33k views

What does the assembly instruction 'REPNE SCAS BYTE PTR ES:[EDI]'?

I disassembled a file with OllyDbg and it had the following instruction: REPNE SCAS BYTE PTR ES:[EDI] What does that exactly mean ?
aclowkay's user avatar
  • 413
16 votes
3 answers
9k views

Purpose of OR EAX,0xFFFFFFFF

I have read the assembly line OR EAX, 0xFFFFFFFF and in the register EAX the program has stored a string. I have problems to understand how we can make a comparison with a string and a value like ...
user3097712's user avatar
  • 1,541
16 votes
1 answer
6k views

IDA EBP variable offset

Let's take a look of how IDA displays address of local variable. For instance: MOV EAX, [EBP + var_4] As we all know as far as local variables go, they are located at lower addresses of EBP. Though,...
PSS's user avatar
  • 3,088
15 votes
4 answers
36k views

Purpose of test eax,eax after a strcmp

This is my first program i am trying to reverse and my intro to this field. The C program will test if two strings match, and it will printf() a message for each occasion. This is what the reversed ...
user1584421's user avatar
14 votes
1 answer
60k views

What does the `TEST` instruction do

I'm having trouble understanding the TEST instruction and its use. I'm looking at the following code at the end of a loop 0040A3D1 A9 00010181 TEST EAX,81010100 0040A3D6 74 E8 ...
Marek's user avatar
  • 147
13 votes
2 answers
14k views

Better explanation of different x86 CALL variations

Hoping to get a better explanation of x86 call instruction. I sort of understand the call near and call far. But I don't fully understand the segment part. A little insight into my main problem, I am ...
k0ng0's user avatar
  • 501
12 votes
2 answers
3k views

What kind of code would produce this assemby with loads of jump statements?

00EE16CC . E9 DFBB0000 JMP BinFile.00EED2B0 00EE16D1 . E9 64AF0000 JMP <JMP.&MSVCP140D.?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@> 00EE16D6 . E9 15DB0000 JMP BinFile....
GoldenWest's user avatar
12 votes
3 answers
14k views

ARMv8 (AArch64, ARM64) opcodes list

I'm sorry for such as questions where answer would seem to be easily searched in google... Some time ago I have seen table/list of ARMv8 instructions with opcodes and it was perfect, but I lost link. ...
Olvin Roght's user avatar
12 votes
3 answers
2k views

Why is JMP used with CALL?

I am trying to analyze an old malware sample in OllyDbg. It has instruction of the format CALL <JMP.&KERNEL32.SetUnhandledExceptionFilter> I am not an expert in Assembly. I know that CALL ...
TheRookierLearner's user avatar
12 votes
2 answers
18k views

How many registers does an x86_64 CPU actually have?

I am currently learning reverse engineering and am studying the flags register. I had in my mind that rflags was just another name for one of the 16 general purpose registers, for example rax or rbx. ...
rubberband876's user avatar
12 votes
3 answers
15k views

How to detect thumb mode in ARM disassembly?

I try to build a small disassembler for ARM, and I would like to know how do objdump manage to sort out the normal mode instructions (32-bits instruction wide) from the thumb mode instructions (16-...
perror's user avatar
  • 19.1k
11 votes
1 answer
884 views

Randomly picking up a x86 register for an instruction

I came around a piece of malware which i am analyzing and have found that it uses some kind of math to randomly selecting a register for a specific instruction Which i don't understand how this ...
RCECoder's user avatar
  • 314
11 votes
2 answers
4k views

Why did Intel chose 90h machine code for their NOP instruction instead of a 0?

Probably just a historical question, if anyone knows.
c00000fd's user avatar
  • 1,691
10 votes
3 answers
1k views

Trying to reverse engineer C code that is 64bit assembly

This is the code I am looking at 0x0000000000401048 <+70>: mov 0x401ba0(,%rax,4),%eax This is an array of 15 integers. Just wondering how I can access indices 0 to 15 in gdb Thanks
user avatar
10 votes
3 answers
5k views

Why does the function pointer get overwritten even though is declared before the vulnerable buffer?

I am working on io-wargames for fun right now, level3: I do understand why there is a stack-overflow in this code (strlen(argv[1])), but what I don't understand is why it overflows the function ...
0x90's user avatar
  • 677
10 votes
2 answers
21k views

ARM64 syscalls table

I wonder if there some syscall table for Linux ARM64 architecture? I found syscall table for Linux ARM32 and many other architectures, but the problem still exists. Does anyone know where can I find ...
merrychap's user avatar
  • 103
10 votes
2 answers
8k views

How to bypass ZwContinue?

During an analysis, I have found a call to ZwContinue. The executable file first gets the address of ntdll.NtContinue and stores it in the EAX register. After I step over the following assembly line, ...
user3097712's user avatar
  • 1,541
10 votes
3 answers
18k views

Reverse engineer Android native code

I am looking for an reverse engineering tool or a way to decompile the existing android native code to an human understandable format rather than Assembly language. Can anyone please suggest me as i ...
msk's user avatar
  • 109
10 votes
2 answers
911 views

What does the text in angle brackets refer to (From objdump)

I constantly see the text (<perror@plt+0x2008e0>) as seen in the snippet below, but I am not sure if its making a call to perror of if the disassembler was having issues. Since it would be odd ...
RC1140's user avatar
  • 200
10 votes
2 answers
2k views

How to do static analysis to identify pointer from concrete value in assembly?

So basically I am writing some code to do analysis work on disassembled assembly code. I am trapped in this issue for a while, here is an simple example of a disassembled asm code by objdump, ...
lllllllllllll's user avatar
10 votes
1 answer
2k views

Mapping an external module's source code to assembly - extracting information from source code

The situation is the following: I'm reversing an application, In which I found a lot of functions that belongs to the OpenSSL library. Since I have the source code for this module, I was wondering if ...
Dominik Antal's user avatar
10 votes
1 answer
3k views

Anti-debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can I bypass that?

I'm debugging this process which has a lot of anti debugging techniques in it, and I faced something new which I don't know how to bypass yet. Changing the code dynamically causes exceptions to occur ...
0xAK's user avatar
  • 668
9 votes
4 answers
10k views

What is the difference between MOV and LEA in example?

Looking at an assembly code snippet I see: lea rax, [rbp-0x50] Which tells me that the rax register now points to whatever value is in rbp-hex(50). Question. Would I achieve the same result doing ...
user3732445's user avatar
9 votes
3 answers
39k views

How does the ldr instruction work on ARM?

ldr r0, #0x28 What is the ldr instruction ? Does it load a string from some offset? How can I find the string/value that is actually loaded ?
ldr's user avatar
  • 99
9 votes
2 answers
5k views

Where is ntdll.dll?

I am trying to get the base address of ntdll.dll over the PEB. So, what I did was to dump the PEB (d fs:[30]). Then, I tried to get to PEB_LDR_DATA over the offset 0xC. Over the offset 0x1C of ...
Dirk's user avatar
  • 443
9 votes
1 answer
543 views

How to convert this one-liner asm to C

I want to convert this to C: SHR CL,1 rECX is the name of the (32bit unsigned int)register variable. It should be simple, but I can't figure out the proper pointer magic :/
user3590's user avatar
  • 101
9 votes
1 answer
6k views

Where ES/GS/FS are pointing to?

As far as I know those segments are extra or general. But at which part of program memory they are actually pointing? If I undestand it correctly DS is poining at entry point of Dump, SS stands for ...
erexo's user avatar
  • 273
9 votes
1 answer
9k views

What does a C++ class look like in assembly

I am planning to do some reverse engineering on an application that was written in a object oriented way. And now I'm kind of curious what a C++ class would look like in assembly. I already found out ...
Forivin's user avatar
  • 209
8 votes
3 answers
6k views

Batch disassembling DLL and EXE files?

In %SYSTEMROOT%, there are about 2000 DLL and EXE files. I am looking into reverse engineering some of them which are dependencies of other applications. However, what I would preferably want is ...
bytecode77's user avatar
8 votes
1 answer
11k views

Reverse Engineering of a packet encryption function of a game

I am trying to make a game server emulator for a specific MMORPG (Perfect World). I know the basics of how the network of the game works and the structure for some packets, but they all are encrypted, ...
Renan Moura's user avatar
8 votes
2 answers
4k views

NOP instruction

I have recently learned that nop instruction is actually xchg eax, eax... what it does is basically exchanges eax with itself. As far as CPU goes, does the exchange actually happen?
Cream Cracker's user avatar
8 votes
2 answers
4k views

How to retrieve native asm code from .NET mixed mode dll file?

This is seriously one question I couldn't find the answer to anywhere on Google.com When I mean mixed mode I mean .NET application which has unmanaged and managed code together. I used tools .NET ...
SSpoke's user avatar
  • 759
8 votes
2 answers
3k views

How to deal with Static Memory Allocation while modifying an executable?

I'm not new to StackExchange, but I'm quite new to reverse engineering, so please be patient with me! :P At present I'm dealing with an executable that I would like to modify a little bit, for ...
Zarathos's user avatar
  • 185
8 votes
1 answer
4k views

Getting IDAPro to analyse part of memory as PE-File

I am using Qemu with its internal GDB server to attach IDA Pro to an instance of Windows 8 x64. There are some problems to solve, because when I am connecting to the GDB server, I am just seeing a ...
defragger's user avatar
  • 536
7 votes
2 answers
6k views

Which operators use sal, shl, sar or shr

Which operators in C language would result in assembly commands such as sal, shl, sar or shr for example?
PaHa's user avatar
  • 145
7 votes
1 answer
1k views

understanding the stack

I have de-assembled a x86 application use ida, it generates the following code .text:1084FF10 push ebp .text:1084FF11 mov ebp, esp .text:1084FF13 ...
upton's user avatar
  • 226
7 votes
2 answers
6k views

How to retrieve assembly from a raw memory dump?

I have a running memory dump saved as a raw binary file. This isn't a standalone executable - it's literally just a snapshot of running memory. I'm looking for a tool that will help me identify ...
Runcible's user avatar
  • 181
7 votes
1 answer
4k views

How to recover the exception info from .gcc_except_table and .eh_handle sections?

For C++ program with try catch defined, when using g++ to compile it into assembly code (test is on x86 32bit Linux, g++ 4.6.3) g++ -S cppexcept.cc A specified section called .gcc_except_table is ...
lllllllllllll's user avatar

1
2 3 4 5
17