Skip to main content

Questions tagged [assembly]

A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction.

Filter by
Sorted by
Tagged with
2 votes
1 answer
960 views

What is a "far call" in an x86 or x86_64 cpu

I do not understand the usefulness of the "far call" instruction in a 86 CPU. On a 32 bits CPU for example each process has an addressing space of 4Gb (0x00000000 to 0xFFFFFFFF). There can ...
Bob5421's user avatar
  • 797
1 vote
0 answers
166 views

problem with hooking __usercall function and asm code

I need a hook function with the __usercall convention. I already hooked functions that were defined as __usercall and __userpurge, but this time it's __usercall with arguments that are also passed ...
user42122's user avatar
1 vote
0 answers
139 views

Reversing Assembly Code (ASM) to Extract Password (Pin)

I'm new to binary exploitation and CTF challenges. I need to solve a CTF challenge and find the flag. All the program does is display "Flag length is: 32". I've tried to analyze the file ...
Анатолий Городничий's user avatar
1 vote
0 answers
144 views

Can someone help to understand code disassembly by IDA?

Can someone help to understand code disassembly by IDA? Basically this use for calculate key from seed. Here I would like to understand the logic and also I would like to know what would be the output ...
jtro's user avatar
  • 11
1 vote
0 answers
122 views

X32dbg Stepping through assembly, seems to get stuck on one line and not progress forward, even though the application continues to progress forward

I'm using x32dbg. Stepping through assembly, I get to the following instructions: '''76B7CC12 | 8B4C24 54 | mov ecx,dword ptr ss:[esp+54] |''' If I continue to step through ...
RogueBotanist's user avatar
2 votes
1 answer
533 views

STATUS_PRIVILEGED_INSTRUCTION 0xc0000096 from kernel mode code?

Running a kernel driver I wrote. The driver includes: mov rax, cr0 btr rax, 10h mov cr0, rax to clear WP bit in cr0. Curiously the last instruction faults and causes a bluescreen, ...
EatingTechnobladesRemainsAt3am's user avatar
2 votes
1 answer
98 views

Is there any way to understand if a raw binary firmware is Cortex-M or not?

I have a list of firmwares, and I should filter just the Cortex-M type. Is there any automated way that I can distinguish them from other ARM firmwares? I have some ideas like Interrupt vector Table (...
eftekhar's user avatar
1 vote
0 answers
398 views

How to find the fifth function argument on stack in windbg?

I know that in x64, the first 4 arguments are passed by RCX, RDX, r8, r9. The rest arguments are pushed on stack. In x64, rsp serves as base pointer(prolog) and frame pointer(epilog) and save value ...
anonymous bear's user avatar
1 vote
1 answer
149 views

How do i loop this CreateThread call in Assembly to get 4 threads instead of only one?

Knowledge in C++ Assembly and some reverse engineering experience
Shark Laser's user avatar
1 vote
0 answers
35 views

Tuning motor temperature

I have a DC motor, running in two modes, slow and fast. I will need to run the motor in FAST mode only. The motor is already running for 10 years. The motor experiences variable load. According to the ...
Habib Anwari's user avatar
0 votes
1 answer
132 views

Reversing Games like Manfred dis

I've looked at as many resources on Manfred and Manfred's work I've watched the DEFCON 25 Live talk about what he hacked. Here I've also looked, listened and read the dark net diaries Part One - ...
Silence's user avatar
0 votes
1 answer
132 views

PowerPC disassembly with libopcodes

I want to disassemble Wii game executable binaries in C, which use the broadway microprocessor and unfortunately the only disassembler I am aware that I can use is libopcodes. I am following this ...
user19742600's user avatar
2 votes
0 answers
120 views

Assemby reverse engineering

I'm new to assembly and need some help understanding what this program does. This program takes a username and serial. If the combination is correct, it prints the magic words. I need to write a ...
TN_stud's user avatar
  • 21
2 votes
0 answers
69 views

​Why output is disabled in console when using int3?

​I am using NASM(2.15) assembler to generate code. But I am unable to figure out why it does not show output in the console(windows system) when using int3 - software breakpoint, it only shows output ...
Viktor's user avatar
  • 461
0 votes
1 answer
156 views

Crackme assistance - unknown function [closed]

i have a problem about a crackme that my friend sent me for a bet. I solved most of it but i am stuck with this function. I can't even understand what the function is trying to do. Please help. images ...
dxAhax's user avatar
  • 1
6 votes
4 answers
3k views

Do I have to learn computer architecture for underestanding or doing reverse engineering?

I am completely noob in reverse engineering, and I've just started to learn it. Now I have this question in my mind, that does a reverse engineer use any computer architecture knowledge for doing his/...
Sirius Black's user avatar
1 vote
2 answers
1k views

What does MOV RAX,qword ptr FS:[0x28] mean?

I'm trying to understand what MOV RAX,qword ptr FS:[0x28] means. I get that FS:[0x28] is a stack canary. If my understanding is correct the data from RAX gets copied by MOV. Then there's a comma which ...
greg5678's user avatar
0 votes
1 answer
79 views

Displacement size (disp_size) of x86 instructions

Given the opcode 80 3d 1d b0 09 00 00. The corresponding capstone instruction is <CsInsn 0x66a4 [803d1db0090000]: cmp byte ptr [rip + 0x9b01d], 0> and has the following properties (c_i being ...
langlauf.io's user avatar
  • 1,560
0 votes
1 answer
564 views

Missing mnemonics '??' in Ghidra Assembly Code

I was just trying to google and search for "??" Ghidra with no luck. I am trying to understand what the following questions mean in this Binary (meant for SuperH2 SH-2 processor) which is ...
Aeonitis's user avatar
  • 101
1 vote
1 answer
224 views

What is j__ftol2_sse_excpt in IDA?

I was inspecting the c-pseudocode for a PE executable in IDA. I found some function called j__ftol2_sse_excpt() When I open that function I see that the function is calling another function named ...
Galaxy226's user avatar
1 vote
1 answer
1k views

Why is JMP ESP required in buffer overflow?

I was reading this article by Hackers Grimoire on Windows buffer overflow attacks. The article made sense, except for the part where the author searched for a DLL (.dll) file which contained a JMP ESP ...
securityauditor's user avatar
3 votes
1 answer
123 views

What is the outcome of mov on non bracket memory locations?

I am having problems distinguishing whether the address is loaded or the content from the address. Please help me clarify. 1. mov [rsp+78h+arg_0], rsi 2. mov rsi, cs:qword_1F39B60 3. mov [...
Sawb's user avatar
  • 35
0 votes
1 answer
213 views

What is libm_sse2_sin_precise() and how to find it's parameters in IDA?

I'm new to reverse engineering with IDA. I've found libm_sse2_sin_precise while inspecting c-pseudocode for some Win32 executable. I tried clicking that function but the executable requires the DLLs. ...
DBYTES's user avatar
  • 1
5 votes
0 answers
1k views

Lifting x86 machine code to LLVM IR

I would like to translate a simple x86_64 machine code into LLVM IR, which can be later analyzed. For my particular use case, I need to be able to work with just instructions and opcodes directly, and ...
jgawr's user avatar
  • 51
1 vote
0 answers
103 views

What change to the source code would produce an LT compare rather than an OLT compare in MIPS assembly?

I need some help reverse engineering a function in MIPS assembly. It was compiled for the PlayStation 2's EmotionEngine CPU. My goal is to produce a matching decomp of the function; it is the proof-of-...
Zac's user avatar
  • 11
0 votes
1 answer
352 views

Hex editing an IP address of a different length

I am performing some Windows malware research on a rogue AV software called SpySheriff (password: infected). I want to edit the IP address within the PE (.exe) file to change it to my honeypot IP ...
securityauditor's user avatar
4 votes
1 answer
419 views

Can I get back an exe file from an .Asm formatted file disassembled with IDA?

I actually have a .asm formatted file. This file was certainly obtained by disassembling an original exe file with IDA and then save as an .asm file. Now I have this .asm and I would like to get back ...
roberto bruzzese's user avatar
2 votes
1 answer
315 views

Mov instruction from a pointed location at the beginning of a program

I am trying to learn how to read assembly code. So far I have understood the basic instructions. Now I am trying to see if I can understand a dissassembly from a linked executable. So this is an ...
S R Maiti's user avatar
  • 143
2 votes
1 answer
2k views

Understanding disassembly information from Visual Studio's dumpbin and GNU's objdump

I usually write my code on Windows, and there are two different types of development environments, each providing their own tools to view the assembly code of an object file(*.obj) or executable (*....
S R Maiti's user avatar
  • 143
1 vote
1 answer
1k views

Help with Ghidra and rewriting assembly

I'm learning reversing and for that I use Ghidra. There is program I'm trying to modify so I can recompile it and make it work. I have a code that ghidra decompile like this: data=function(4) Going ...
user avatar
1 vote
1 answer
140 views

C instruction causing an address shift

I am trying to recreate a segment of assembly back into the C code. Below is the progress I've made so far, but I'm getting stumped on a specific section. 00000000000010049 <mysteryFunc>: ...
enkrypted87's user avatar
0 votes
1 answer
4k views

How to get Assembly source from Bin file?

I have a binary file which is coded in assembly x86 and compiled with nasm. I used command nasm file.asm -f bin -o file.bin to compile it with nasm. I deleted the source code from disk long time ago, ...
Galaxy226's user avatar
0 votes
1 answer
114 views

Crackmes challenge not validating all answers

I am playing with this crackme. The executable takes a numerical input (e.g., 123) and adds all the numbers. The total must be 50. However, I noticed that not all inputs adding up to 50 are validated. ...
Ronald Rivera's user avatar
1 vote
0 answers
423 views

x64dbg placing a on write breakpoint on a dynamic allocated address

I am currently trying to reverse the registration scheme of a crackme. I found the jump instruction that decides if the title of the program says “registered” or “unregistered” by simply searching for ...
Gero B.'s user avatar
  • 11
2 votes
1 answer
2k views

What is xmmword in IDA Pro?

Probably a silly question. What's the xmmword means in IDA Pro?
Galaxy226's user avatar
0 votes
1 answer
1k views

IDA - What LOC means in assembly?

I have this piece of assembly: .text:0041B322 xor eax, eax .text:0041B324 mov al, byte ptr [ebp+v13] .text:0041B327 cmp eax, 1 .text:0041B32A jz loc_41B37D .text:0041B330 xor eax, ...
westman379's user avatar
0 votes
1 answer
761 views

What's DD ? In IDA Pro

I'm new to reverse engineering with IDA. If dd is short for data, double-word, is a 32-bit value. It shows ? How do I identify the value stored in dword_140007674?
Andrew's user avatar
  • 1
1 vote
1 answer
135 views

IDA API: obtain operand size prefix (x64)

I am trying to tell apart the following two instructions: 8D 02 lea eax, [rdx] // auxfix = 0x1810 67 8D 02 lea eax, [edx] // auxfix = 0x810 The only difference is in the insn_t....
bernd feinman's user avatar
1 vote
1 answer
449 views

How to locate memory address in register $esp

000011d9 <main>: 11d9: 8d 4c 24 04 lea 0x4(%esp),%ecx 11dd: 83 e4 f0 and $0xfffffff0,%esp 11e0: ff 71 fc push -0x4(%ecx) 11e3: ...
user40564's user avatar
1 vote
2 answers
386 views

What arguments are passed into a CALL instruction?

While reverse enginnering a simple C program for training, I asked myself what was the point of those lines : LAB_001006b5 XREF[1]: ...
maito's user avatar
  • 23
2 votes
1 answer
432 views

How to interpret memory dumps?

I'm pretty new to reverse engineering, and I decided to pick up https://microcorruption.com/ CTF to understand a bit more. The following code is from the tutorial section. In a disassembled file, we ...
wrongbyte's user avatar
  • 121
1 vote
1 answer
882 views

How to use SHL/SAL, LEA and Add for arithmetic operations

I'm having problem computing the following arithmetic questions using SHL/SAL, LEA and ADD, and hoping someone can help explain or find the best ways to apply those: Multiply a variable by 24 ...
Evion Wong's user avatar
2 votes
2 answers
442 views

HEX code to call DLL function

I'm working with 2 third party DLLs (let's A.dll and B.dll), which I don't have the source code, only the compiled DLL. I know A.dll uses the main function from B.dll, and they both works perfectly. ...
VIRGO's user avatar
  • 23
3 votes
1 answer
967 views

What is the meaning of jmp dword ptr off_XXXXXXXX + 8 in IDA?

What is the meaning of this kind of jmp instruction in x86 assembly in IDA? Does it mean that we should jump to the address [6CA2E9B0] + 8 or [6CA2E9B0+8]? When I follow that off_XXX, I get to the ...
Moteke's user avatar
  • 31
1 vote
0 answers
121 views

Which encryption returns 192 hash value it means 96 in bytes?

I am reversing an APK and there is a signature that needs to be found. The function from where the signature is generated is present in the .so file. I did small debugging. While doing it, the ...
Nirbhay Jain's user avatar
1 vote
1 answer
150 views

ARM/THUMB assembly mismatch between binaries causes crash

I am trying to play around with an app for Android and every time I try to call a function (lua_gettop() from the Lua 5.1 library) from the app's address space, it hits me with ILL_ILLOPC. I made sure ...
BitFlow's user avatar
  • 11
0 votes
0 answers
67 views

stack explanation from https://revers.engineering/applied-re-the-stack/

I've been reading [1] (By Daax Rynd) to get an understanding the stack and at around the 12th page, I'm a bit stumped by how the value 60 from sub rsp, 60 was arrived at. [Note, all code and quotes ...
ewokx's user avatar
  • 135
3 votes
1 answer
828 views

How to resolve illegal instruction for this ARM stack exploitation?

Summary I am trying to write a stack overflow exploit for ARM Cortex-A72 running Raspberry Pi OS (32-bit). Because of my choice of OS, I am restricted to the ARMv7 (32-bit) instruction set. I have ...
RosterPantyhose's user avatar
1 vote
2 answers
2k views

is there a tool to decompile old exe to C?

I follow the free software implementation of OpenRCT2 from the beggining (when it was in other repository). And the first commits are a bunch of C files, these files has a lot of asm blocks of code ...
tres.14159's user avatar
1 vote
1 answer
222 views

what is metaData of assemblies and what is used for

hi there I hope you doing well lately, I have searched about ildasm and how to protect my DLLs from reverse engineering, so I found some great open source projects (ConfuseEx..), it works when I tried ...
makri aymen abderraouf's user avatar

1
2
3 4 5
17