Questions tagged [assembly]
A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.
831
questions
87
votes
3
answers
133k
views
How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?
I try to understand the process of memory segmentation for the i386 and amd64 architectures on Linux. It seems that this is heavily related to the segment registers %fs, %gs, %cs, %ss, %ds, %es.
Can ...
- 19.1k
45
votes
4
answers
23k
views
convert this x86 ASM to C?
How could this 32-bit x86 assembly be written in C?
loc_536FB0:
mov cl, [eax]
cmp cl, ' '
jb short loc_536FBC
cmp cl, ','
jnz short loc_536FBF
loc_536FBC:
mov byte ptr [eax], ' '
loc_536FBF
mov cl, ...
- 563
37
votes
5
answers
8k
views
Why would a program contain a call instruction targetting the address immediately following that instruction?
While reversing a 32bit Mach-O binary with Hopper, I noticed this peculiar method. The instruction on 0x0000e506 seems to be calling an address right below the instruction.
What would be the reason ...
- 497
34
votes
7
answers
11k
views
What hints in machine code can point me to the compiler which was used to generate it?
When I am looking at the machine code of an application, are there hints and patterns I can discern from the generated machine code which would indicate which compiler (and possibly version) was used ...
- 927
30
votes
1
answer
57k
views
What does mov qword ptr ds:[rax+18], r8 mean?
mov qword ptr ds:[rax+18], r8
In the above code, where are we copying the value of r8 register into?
I know that ds means data segment which is a segment in memory, but what does exactly [rax+18] ...
- 639
27
votes
3
answers
4k
views
Why are special tools required to ascertain the differences between two related binary code files?
How comes that text diffing tools like diff, kdiff3 or even more complex ones usually fail at highlighting the differences between two disassemblies in textual form - in particular two related binary ...
- 10.9k
27
votes
8
answers
4k
views
How are x86 CPU instructions encoded?
I'm writing a small utility library for hooking functions at run time. I need to find out the length of the first few instructions because I don't want to assume anything or require the developer to ...
- 461
24
votes
7
answers
7k
views
How is a structure located within a disassembled program?
I took a basic 40-hr Reverse Engineering course a few summers ago. While teaching us to use IDAPro, the instructor demonstrated, rather quickly and without explaining much, how to label certain ...
- 343
24
votes
1
answer
10k
views
How to use sysenter under Linux?
I would like to know what are the different ways to perform a system
call in x86 assembler under Linux. But, with no cheating, only
assembler must be used (i.e. compilation with gcc must be done with
-...
- 19.1k
23
votes
4
answers
4k
views
Knowledge about CPU hardware
Recently, I have taken the computer organization course that explains in the logic gate level how a CPU works and etc...
Up until now I have been treating the CPU as a black box that runs assembly ...
- 331
22
votes
3
answers
6k
views
Anti-debug techniques on Unix platforms?
I am trying to scan all possible techniques to disrupt the usage of a debugger on a Unix platform (ie POSIX and a bit more).
I am thinking about techniques such as the PTRACE test at the beginning of ...
- 19.1k
19
votes
3
answers
15k
views
Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?
I don't know whether this is a silly question, but I couldn't find any answer.
With the evolution of CPU architecture, register size was extended, from 8, to 16, 32, and eventually 64-bit. I was ...
- 295
18
votes
1
answer
33k
views
What does the assembly instruction 'REPNE SCAS BYTE PTR ES:[EDI]'?
I disassembled a file with OllyDbg and it had the following instruction:
REPNE SCAS BYTE PTR ES:[EDI]
What does that exactly mean ?
- 413
16
votes
3
answers
9k
views
Purpose of OR EAX,0xFFFFFFFF
I have read the assembly line
OR EAX, 0xFFFFFFFF
and in the register EAX the program has stored a string. I have problems to understand how we can make a comparison with a string and a value like ...
- 1,541
16
votes
1
answer
6k
views
IDA EBP variable offset
Let's take a look of how IDA displays address of local variable. For instance:
MOV EAX, [EBP + var_4]
As we all know as far as local variables go, they are located at lower addresses of EBP.
Though,...
- 3,088
15
votes
4
answers
36k
views
Purpose of test eax,eax after a strcmp
This is my first program i am trying to reverse and my intro to this field.
The C program will test if two strings match, and it will printf() a message for each occasion.
This is what the reversed ...
- 253
14
votes
1
answer
59k
views
What does the `TEST` instruction do
I'm having trouble understanding the TEST instruction and its use. I'm looking at the following code at the end of a loop
0040A3D1 A9 00010181 TEST EAX,81010100
0040A3D6 74 E8 ...
- 147
13
votes
2
answers
14k
views
Better explanation of different x86 CALL variations
Hoping to get a better explanation of x86 call instruction. I sort of understand the call near and call far. But I don't fully understand the segment part. A little insight into my main problem, I am ...
- 491
12
votes
2
answers
3k
views
What kind of code would produce this assemby with loads of jump statements?
00EE16CC . E9 DFBB0000 JMP BinFile.00EED2B0
00EE16D1 . E9 64AF0000 JMP <JMP.&MSVCP140D.?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@>
00EE16D6 . E9 15DB0000 JMP BinFile....
- 135
12
votes
3
answers
14k
views
ARMv8 (AArch64, ARM64) opcodes list
I'm sorry for such as questions where answer would seem to be easily searched in google...
Some time ago I have seen table/list of ARMv8 instructions with opcodes and it was perfect, but I lost link. ...
- 355
12
votes
3
answers
2k
views
Why is JMP used with CALL?
I am trying to analyze an old malware sample in OllyDbg. It has instruction of the format CALL <JMP.&KERNEL32.SetUnhandledExceptionFilter>
I am not an expert in Assembly. I know that CALL ...
12
votes
2
answers
17k
views
How many registers does an x86_64 CPU actually have?
I am currently learning reverse engineering and am studying the flags register.
I had in my mind that rflags was just another name for one of the 16 general purpose registers, for example rax or rbx.
...
- 123
12
votes
3
answers
15k
views
How to detect thumb mode in ARM disassembly?
I try to build a small disassembler for ARM, and I would like to know how do objdump manage to sort out the normal mode instructions (32-bits instruction wide) from the thumb mode instructions (16-...
- 19.1k
11
votes
1
answer
884
views
Randomly picking up a x86 register for an instruction
I came around a piece of malware which i am analyzing and have found that it uses some kind of math to randomly selecting a register for a specific instruction
Which i don't understand how this ...
- 314
11
votes
2
answers
4k
views
Why did Intel chose 90h machine code for their NOP instruction instead of a 0?
Probably just a historical question, if anyone knows.
- 1,659
10
votes
3
answers
1k
views
Trying to reverse engineer C code that is 64bit assembly
This is the code I am looking at
0x0000000000401048 <+70>: mov 0x401ba0(,%rax,4),%eax
This is an array of 15 integers. Just wondering how I can access indices 0 to 15 in gdb
Thanks
user2303586
10
votes
3
answers
5k
views
Why does the function pointer get overwritten even though is declared before the vulnerable buffer?
I am working on io-wargames for fun right now, level3:
I do understand why there is a stack-overflow in this code (strlen(argv[1])), but what I don't understand is why it overflows the function ...
- 677
10
votes
2
answers
20k
views
ARM64 syscalls table
I wonder if there some syscall table for Linux ARM64 architecture?
I found syscall table for Linux ARM32 and many other architectures, but the problem still exists.
Does anyone know where can I find ...
- 103
10
votes
2
answers
7k
views
How to bypass ZwContinue?
During an analysis, I have found a call to ZwContinue. The executable file first gets the address of ntdll.NtContinue and stores it in the EAX register.
After I step over the following assembly line, ...
- 1,541
10
votes
3
answers
18k
views
Reverse engineer Android native code
I am looking for an reverse engineering tool or a way to decompile the existing android native code to an human understandable format rather than Assembly language. Can anyone please suggest me as i ...
- 109
10
votes
2
answers
906
views
What does the text in angle brackets refer to (From objdump)
I constantly see the text (<perror@plt+0x2008e0>) as seen in the snippet below, but I am not sure if its making a call to perror of if the disassembler was having issues. Since it would be odd ...
- 200
10
votes
2
answers
2k
views
How to do static analysis to identify pointer from concrete value in assembly?
So basically I am writing some code to do analysis work on disassembled assembly code.
I am trapped in this issue for a while, here is an simple example of a disassembled asm code by objdump, ...
- 2,485
10
votes
1
answer
2k
views
Mapping an external module's source code to assembly - extracting information from source code
The situation is the following:
I'm reversing an application, In which I found a lot of functions that belongs to the OpenSSL library. Since I have the source code for this module, I was wondering if ...
- 2,038
10
votes
1
answer
3k
views
Anti-debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can I bypass that?
I'm debugging this process which has a lot of anti debugging techniques in it, and I faced something new which I don't know how to bypass yet.
Changing the code dynamically causes exceptions to occur ...
- 668
9
votes
4
answers
9k
views
What is the difference between MOV and LEA in example?
Looking at an assembly code snippet I see:
lea rax, [rbp-0x50]
Which tells me that the rax register now points to whatever value is in rbp-hex(50).
Question. Would I achieve the same result doing ...
- 321
9
votes
2
answers
5k
views
Where is ntdll.dll?
I am trying to get the base address of ntdll.dll over the PEB. So, what I did was to dump the PEB (d fs:[30]). Then, I tried to get to PEB_LDR_DATA over the offset 0xC. Over the offset 0x1C of ...
- 443
9
votes
1
answer
543
views
How to convert this one-liner asm to C
I want to convert this to C:
SHR CL,1
rECX is the name of the (32bit unsigned int)register variable. It should be simple, but I can't figure out the proper pointer magic :/
- 101
9
votes
1
answer
9k
views
What does a C++ class look like in assembly
I am planning to do some reverse engineering on an application that was written in a object oriented way. And now I'm kind of curious what a C++ class would look like in assembly. I already found out ...
- 209
8
votes
3
answers
38k
views
How does the ldr instruction work on ARM?
ldr r0, #0x28
What is the ldr instruction ? Does it load a string from some offset?
How can I find the string/value that is actually loaded ?
- 89
8
votes
3
answers
5k
views
Batch disassembling DLL and EXE files?
In %SYSTEMROOT%, there are about 2000 DLL and EXE files. I am looking into reverse engineering some of them which are dependencies of other applications.
However, what I would preferably want is ...
- 203
8
votes
1
answer
6k
views
Where ES/GS/FS are pointing to?
As far as I know those segments are extra or general. But at which part of program memory they are actually pointing? If I undestand it correctly DS is poining at entry point of Dump, SS stands for ...
- 263
8
votes
1
answer
11k
views
Reverse Engineering of a packet encryption function of a game
I am trying to make a game server emulator for a specific MMORPG (Perfect World). I know the basics of how the network of the game works and the structure for some packets, but they all are encrypted, ...
- 81
8
votes
2
answers
4k
views
NOP instruction
I have recently learned that nop instruction is actually xchg eax, eax... what it does is basically exchanges eax with itself.
As far as CPU goes, does the exchange actually happen?
- 145
8
votes
2
answers
3k
views
How to retrieve native asm code from .NET mixed mode dll file?
This is seriously one question I couldn't find the answer to anywhere on Google.com
When I mean mixed mode I mean .NET application which has unmanaged and managed code together.
I used tools
.NET ...
- 759
8
votes
2
answers
3k
views
How to deal with Static Memory Allocation while modifying an executable?
I'm not new to StackExchange, but I'm quite new to reverse engineering, so please be patient with me! :P
At present I'm dealing with an executable that I would like to modify a little bit, for ...
- 185
8
votes
1
answer
4k
views
Getting IDAPro to analyse part of memory as PE-File
I am using Qemu with its internal GDB server to attach IDA Pro to an instance of Windows 8 x64.
There are some problems to solve, because when I am connecting to the GDB server, I am just seeing a ...
- 536
7
votes
2
answers
6k
views
Which operators use sal, shl, sar or shr
Which operators in C language would result in assembly commands such as sal, shl, sar or shr for example?
- 145
7
votes
2
answers
6k
views
How to retrieve assembly from a raw memory dump?
I have a running memory dump saved as a raw binary file. This isn't a standalone executable - it's literally just a snapshot of running memory.
I'm looking for a tool that will help me identify ...
- 181
7
votes
1
answer
1k
views
understanding the stack
I have de-assembled a x86 application use ida, it generates
the following code
.text:1084FF10 push ebp
.text:1084FF11 mov ebp, esp
.text:1084FF13 ...
- 226
7
votes
1
answer
4k
views
How to recover the exception info from .gcc_except_table and .eh_handle sections?
For C++ program with try catch defined, when using g++ to compile it into assembly code (test is on x86 32bit Linux, g++ 4.6.3)
g++ -S cppexcept.cc
A specified section called .gcc_except_table is ...
- 2,485