Skip to main content

Questions tagged [assembly]

A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.

Filter by
Sorted by
Tagged with
12 votes
3 answers
2k views

Why is JMP used with CALL?

I am trying to analyze an old malware sample in OllyDbg. It has instruction of the format CALL <JMP.&KERNEL32.SetUnhandledExceptionFilter> I am not an expert in Assembly. I know that CALL ...
TheRookierLearner's user avatar
5 votes
2 answers
4k views

How do you attach to a child process using IDAPro?

The code that I'm analyzing calls fork and I was wondering if there was a way to trace the child process that is created. I've looked in The IDAPro Book and there's nothing on the topic (if there is I ...
user avatar
6 votes
2 answers
23k views

Disassemble, edit and re-assembly iOS ipa apps

I'm trying to get jailbreak statistics for a University project related to security in mobile devices. My purpose is to disassemble, add a sample code and re-assemble to obtain a runnable iOS app ...
swoken's user avatar
  • 63
19 votes
1 answer
33k views

What does the assembly instruction 'REPNE SCAS BYTE PTR ES:[EDI]'?

I disassembled a file with OllyDbg and it had the following instruction: REPNE SCAS BYTE PTR ES:[EDI] What does that exactly mean ?
aclowkay's user avatar
  • 423
8 votes
1 answer
4k views

Getting IDAPro to analyse part of memory as PE-File

I am using Qemu with its internal GDB server to attach IDA Pro to an instance of Windows 8 x64. There are some problems to solve, because when I am connecting to the GDB server, I am just seeing a ...
defragger's user avatar
  • 536
2 votes
1 answer
584 views

Find out decrypted body of Polymorphic malware

I want to decrypt a polymorphic malware. In polymorphic malware there must be a decryption routine which will decrypt virus code and then execute it. I want to get this pair of encrypted code and its ...
user1744108's user avatar
3 votes
1 answer
1k views

What is this assembly code doing with the command line arguments [duplicate]

I know something is happening with the command line arguments but I don't know what. Can someone walk me through this code? 0x401050 <main>: push %ebp 0x401051 <main+1>: ...
duder's user avatar
  • 81
4 votes
1 answer
2k views

Understanding assembly loop

I am having trouble understanding how this code knows when to stop looping. I am supposed to figure out what values are put into %edi. But I can't figure out how many times it loops. 0x40106e ...
duder's user avatar
  • 81
4 votes
2 answers
4k views

What does `jz $+2` do? (jump if zero to dollar plus two)

What does the dollar symbol mean in jz $+2 (This is IDA output.)
heinrich5991's user avatar
4 votes
2 answers
686 views

Which version of assembly does OllyDbg disassemble binary to?

So I understand that there are many assemblers such as MASM, FASM, NASM, etc. But which version is the disassembler in OllyDbg and Cheat Engine?
user2492's user avatar
3 votes
1 answer
2k views

Modifying step value that affects xmm# float value

I don't have much experience with assembly and I am trying to change a step value that changes a final value, these are the opcodes that I am working with and this is how they are set: movss xmm0,[...
Shadow's user avatar
  • 131
2 votes
2 answers
432 views

Change RadASM hotkey and add middle mouse click hotkey

I am trying to modify RadASM so that Ctrl+W will close the tab, instead of Ctrl+F4, and also make it so that if you middle mouse click the tab, it will close. The context menu for a tab is just a copy ...
Sean Heiss's user avatar
5 votes
2 answers
1k views

OllyDBG's disassembled syntax and c-equivalent

This is probably a pretty simple question as I'm not too used to how the syntax looks for OllyDBG's disassembler. Does this following assembler statement: MOV EAX, DWORD PTR [ESI + 14] Be roughly ...
lfxgroove's user avatar
  • 369
8 votes
2 answers
4k views

NOP instruction

I have recently learned that nop instruction is actually xchg eax, eax... what it does is basically exchanges eax with itself. As far as CPU goes, does the exchange actually happen?
Cream Cracker's user avatar
3 votes
0 answers
325 views

IDA Pro Symbian Debugger 'general OS related' Error [closed]

I am using remote symbian: c5-03 (Application TRK 3.2.7 for all S60 5.0 devices with production images). However, whenever I start the debugger, I get this error: general OS-related error What went ...
Sam Fisher's user avatar
3 votes
1 answer
376 views

What type of data structure is it?

I have the following data: .data:004305FC word_4305FC dw 1583h .data:004305FC .data:004305FE word_4305FE dw 35B6h ....
PSS's user avatar
  • 3,088
10 votes
3 answers
5k views

Why does the function pointer get overwritten even though is declared before the vulnerable buffer?

I am working on io-wargames for fun right now, level3: I do understand why there is a stack-overflow in this code (strlen(argv[1])), but what I don't understand is why it overflows the function ...
0x90's user avatar
  • 677
4 votes
1 answer
383 views

Take A Snippet of Assembly and Make All Side Effects Explicit?

I came across a small function whose only side effects were to modify the state of some processor flags. When I decompiled this function using the Hex Rays decompiler, I simply got an empty function, ...
user2142's user avatar
  • 1,537
16 votes
1 answer
6k views

IDA EBP variable offset

Let's take a look of how IDA displays address of local variable. For instance: MOV EAX, [EBP + var_4] As we all know as far as local variables go, they are located at lower addresses of EBP. Though,...
PSS's user avatar
  • 3,088
6 votes
1 answer
733 views

What could this sequence of assembly instructions possibly mean?

I have recently came across the following sequence of assembly instructions. call ds:WSAStartup push ecx push edi mov ecx, 69E65AC4h mov edi, 2776452Ah pop edi pop ecx jmp ...
PSS's user avatar
  • 3,088
45 votes
4 answers
23k views

convert this x86 ASM to C?

How could this 32-bit x86 assembly be written in C? loc_536FB0: mov cl, [eax] cmp cl, ' ' jb short loc_536FBC cmp cl, ',' jnz short loc_536FBF loc_536FBC: mov byte ptr [eax], ' ' loc_536FBF mov cl, ...
user1365830's user avatar
87 votes
3 answers
133k views

How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?

I try to understand the process of memory segmentation for the i386 and amd64 architectures on Linux. It seems that this is heavily related to the segment registers %fs, %gs, %cs, %ss, %ds, %es. Can ...
perror's user avatar
  • 19.1k
13 votes
2 answers
14k views

Better explanation of different x86 CALL variations

Hoping to get a better explanation of x86 call instruction. I sort of understand the call near and call far. But I don't fully understand the segment part. A little insight into my main problem, I am ...
k0ng0's user avatar
  • 501
6 votes
1 answer
4k views

What does %reg:value mean in ATT assembly?

When I disassemble a function, I encounter from time to time an expression of the form %reg:value. Typically, I encounter this syntax when I activate the canaries in GCC (-fstack-protector), as in the ...
perror's user avatar
  • 19.1k
10 votes
2 answers
915 views

What does the text in angle brackets refer to (From objdump)

I constantly see the text (<perror@plt+0x2008e0>) as seen in the snippet below, but I am not sure if its making a call to perror of if the disassembler was having issues. Since it would be odd ...
RC1140's user avatar
  • 200
10 votes
3 answers
1k views

Trying to reverse engineer C code that is 64bit assembly

This is the code I am looking at 0x0000000000401048 <+70>: mov 0x401ba0(,%rax,4),%eax This is an array of 15 integers. Just wondering how I can access indices 0 to 15 in gdb Thanks
user avatar
27 votes
3 answers
4k views

Why are special tools required to ascertain the differences between two related binary code files?

How comes that text diffing tools like diff, kdiff3 or even more complex ones usually fail at highlighting the differences between two disassemblies in textual form - in particular two related binary ...
0xC0000022L's user avatar
  • 10.9k
37 votes
5 answers
8k views

Why would a program contain a call instruction targetting the address immediately following that instruction?

While reversing a 32bit Mach-O binary with Hopper, I noticed this peculiar method. The instruction on 0x0000e506 seems to be calling an address right below the instruction. What would be the reason ...
Daniel Sloof's user avatar
22 votes
3 answers
6k views

Anti-debug techniques on Unix platforms?

I am trying to scan all possible techniques to disrupt the usage of a debugger on a Unix platform (ie POSIX and a bit more). I am thinking about techniques such as the PTRACE test at the beginning of ...
perror's user avatar
  • 19.1k
35 votes
7 answers
11k views

What hints in machine code can point me to the compiler which was used to generate it?

When I am looking at the machine code of an application, are there hints and patterns I can discern from the generated machine code which would indicate which compiler (and possibly version) was used ...
WilliamKF's user avatar
  • 937
28 votes
8 answers
5k views

How are x86 CPU instructions encoded?

I'm writing a small utility library for hooking functions at run time. I need to find out the length of the first few instructions because I don't want to assume anything or require the developer to ...
Henry Heikkinen's user avatar
25 votes
7 answers
7k views

How is a structure located within a disassembled program?

I took a basic 40-hr Reverse Engineering course a few summers ago. While teaching us to use IDAPro, the instructor demonstrated, rather quickly and without explaining much, how to label certain ...
Ken Bellows's user avatar

1
13 14 15 16
17