Questions tagged [compilers]
A computer program that transforms source code into the target language, often having a binary form known as object code.
59 questions
0
votes
2
answers
130
views
How to change default pointer size in IDA Pro
so, I'm writing a script to automate analysis, and the code I'm working with is 64bit.
the pointer size field shown here is the wrong one:
I want to change it from within python to 64bit. I've ...
- 21
0
votes
1
answer
90
views
Creating the SkiFree 2 dream... An introduction [closed]
I am no programmer but I like to do it for my own purpose and entertainment. As in earlier posts I said:
Excuse me, I am just liking to use the SkiFree source code for my very own purpose. The purpose ...
- 31
2
votes
1
answer
256
views
What are these functions for?
Sometimes when reversing the code - I see that each linked file is separated by these functions:
_$E19
_$E18
sometimes - there is no such separation (depending on the degree of compiler optimization)...
user42316
2
votes
0
answers
88
views
Where can I find these compilers given in the Rich Header of a system BIOS file?
I am working on a project which deals with the BIOS file of a well known manufacturer.
I recovered the file from the disk partition which stores and uses the file in case BIOS is corrupted or its ...
- 461
1
vote
1
answer
117
views
Why aren't compilers using registers for their intended purpose?
It seem to be well known that x86 registers names have a purpose and indicate on how the register should be use (see this website for example).
According to this, ecx should be the register holding my ...
- 72
1
vote
1
answer
283
views
Does Golang's cgo now support output with .gopclntab?
I read this page in which the author, Chris Siebenmann, states that binaries created using cgo will not have the gopclntab or the gosymtab sections. However, I see that on go version go1.13.15 linux/...
- 1,880
2
votes
1
answer
5k
views
How to disable relro while compilation?
My doubt is how to compile the binary without RELRO? and why it is enabling FULL-RELRO when we are not providing any flags?
This is the code.
#include <stdio.h>
#include <stdlib.h>
int ...
- 33
1
vote
0
answers
414
views
How to add Instructions (OpCodes) after a If Statement in C#?
I hope someone can help me out with my problem. Currently I'm working with C# and use the library Mono.Cecil to add Instruction Code before a method exits. There is this one case, when a if statement ...
1
vote
1
answer
215
views
Decompilation of CIL code into some high level code - do I need to introduce new variables during data flow analysis?
I'm writing a compiler from .NET CIL code to some high level language. Process is similar to decompilation. I have done some control flow analysis - detecting loops, ifs, and so on. In terms of data ...
- 13
1
vote
1
answer
122
views
Name other than ".text" for the main code section
Is it safe to assume that, in the general case, the name of the section containing the user code (not the compiler generated code) is .text? I spot-checked several ARM, x86 and MIPS binaries (PE and ...
- 1,560
1
vote
0
answers
185
views
Lexer and parser for .asm file produced by objdump
Is there any existing project that parses the x86 disassembly file or .asm produced by the objdump or IDA pro using the lexer and parser library in python or any other programming language?
- 11
0
votes
1
answer
522
views
Why do those useless instruction are in Rust final binary?
I am currently reversing RUST binaries, and I often come across this block of instruction :
.text:000055F4BFB943F2 db 2Eh
.text:000055F4BFB943F2 nop word ptr [rax+rax+00000000h]
.text:...
- 72
1
vote
0
answers
56
views
Is it possible to define the adress of a function in assembly?
I am creating a PoC for anti-disassembly techniques, and I would like to know if there were ways to define the address of functions once compiled with gcc.
Here is the PoC program :
BITS 32
EXTERN ...
- 283
2
votes
1
answer
1k
views
Identify function in cpp static binary
When I open cpp static binary, how can identify known functions like fopen/ioctl/printf? They have been compiled statically into the binary.
I dont know the compiler of this binary .
- 533
1
vote
1
answer
475
views
Is there any decompiler, which can produce a compilable result?
I would like to decompile a 32-bit Linux executable to C, modify some parts of it, and then compile it back. I do not care if the C code is not pretty and really hard to maintain. The only thing I ...
- 214
0
votes
1
answer
2k
views
How to get meaning of flags by integer
Assuming I have a syscall to open.
man 2 open gives me info, that it requires 2 or 3 parameters
int open(const char *pathname, int flags);
int open(const char *pathname, int flags, mode_t mode);
...
- 125
2
votes
1
answer
191
views
Why having a function with just one instruction
I decompiled a program where there is a function, which has only a single useful instruction which is
xor eax, eax
retn
What it the purpose of having this in an extra function, instead of using xor ...
- 125
4
votes
1
answer
2k
views
What are the first 16 bytes in .rodata section?
What are the first 16 bytes in the .rodata section?
For example, I have the following code:
#include <cstdio>
void myprintf(const char* ptr) {
printf("%p\n", ptr);
}
int main() {
...
- 143
4
votes
1
answer
557
views
Compile C# like C++?
After reading the ins and outs of compilation differences between C# and C++ , my question is, cant we compile the C#application (or dll) with Visual Studio (or with other program), so similarly to C++...
- 683
7
votes
5
answers
3k
views
How to find out if PE executable was compiled with gcc or VisualStudio?
I looked at two ways so far. Both did not convince me in regard to false positives or false negatives:
Using strings: How to retrieve the GCC version used to compile a given ELF executable?
Using the ...
- 1,560
1
vote
2
answers
10k
views
How to add code to compiled java class
I have java code that is compiled to a .class file.
There is a function that gets few parameters and do some action (e.g. get int x and int y and do x+y)
I want to add to this .class file code that ...
- 31
2
votes
1
answer
370
views
Is all debug information of VS-compiled PE files contained in an external PDB file?
I read here that some PE files have debug information baked into the PE file. Is this only the case for older PE files?
Is it safe to assume that all Visual Studio compiled PE files have all debug ...
- 1,560
1
vote
1
answer
319
views
What does this instruction pairs mean?
I don't know if it is asked but, I couldn't find it anything despite this question. Is it because of disassembler's fault? Or if it is right, why compiler generates this code?
; int __cdecl main(int ...
-1
votes
1
answer
721
views
Shells CTF segfault - wrong address
PicoCTF 2017 Shells
I have a binary and source:
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/mman.h>
#define AMOUNT_OF_STUFF 10
//TODO: Ask IT ...
1
vote
2
answers
112
views
Can a Data Type Span Multiple Virtual Pages? (Windows)
Can a multi-byte primitive data type (ie int, double, float, etc) span multiple virtual pages on Windows?
ex) The first 4-bytes of a double on a virtual page, and the next 4-bytes of a double on the ...
- 113
6
votes
1
answer
236
views
Reconstructing Assembly Truth Map
So I recently read [1] which evaluates several disassemblers. The truth/test binaries are generated by the SPEC CPU 2006 Benchmark suite. The authors provide detailed build instructions for the ELF ...
- 61
0
votes
2
answers
160
views
Function Address Changes When Gets Referenced elsewhere
i have been trying to get the address of a function and use that hex number for other calculations. I have read that you cannot get the address of a function like you get the address of a variable in ...
- 395
0
votes
1
answer
63
views
What additional data does a compiler populate the buffer space with? [duplicate]
I am currently learning about the stack, in particular how to perform stack overflow attacks. I understand that the buffer is not the size that the program initially set it as, for example if we ...
- 3
0
votes
2
answers
752
views
best c compiler on windows for reversing
One of the threads I have discovered in my reading about learning how to reverse engineer is to write "small" c programs compile them and then disassemble them to see how the c code gets translated ...
- 379
3
votes
1
answer
5k
views
I'm unable to copy to executable (ollydebug)
I just finished up with cracking this crackme I found off the net and it's cracked and everything,but the problem is that in ollydebug I don't happen to see a option to copy the modified code and save ...
- 33
1
vote
2
answers
1k
views
C/C++ to Assembly language
Is there any book or articles related to how C/C++ code is converted to assembly language, I mean common patterns for a specific compiler, etc?
- 95
1
vote
1
answer
1k
views
Function dependencies in static libraries
I read in another SO thread:
With static libraries, the unit of copying is the object file in the
library.
In other words, if two programs call a function from a certain object file, both ...
- 1,560
1
vote
1
answer
130
views
Recognize certain components in the compiler produced assembly program
Here is my question:
given a marked C code component, how I can find its corresponding assembly instructions in the compiler produced assembly program?
It should be very easy if the marked component ...
- 2,485
2
votes
1
answer
484
views
Removing uncalled smali
Does anyone know of a smali re-compiler that will remove uncalled code without obfuscation? I just want to remove unused classes and methods.
- 135
1
vote
0
answers
101
views
Redundant mov instructions; Why is this? [duplicate]
It's not the first time I see code like the following in assembly:
mov [ebp - 4], eax
mov edx, [ebp - 4]
Which makes myself wonder why it hasn't been optimized to be:
mov edx, eax
Why is this? (...
- 176
2
votes
1
answer
224
views
Code generation patterns of compilers
After reading the question of zespri it was interesting for me to read something about the code generation patterns of different compilers in order to reverse better and quicker. Do you know good ...
- 426
1
vote
1
answer
686
views
What is all this code for?
In order to be able to effectively reverse assembly one needs to understand how different compilers work, and what are the common code generation patterns. If you do not know them, you spent much more ...
- 155
2
votes
1
answer
625
views
Visual studio memory allocation reverse engineering
I compile this code with Visual studio 2010 compiler:
#include "stdafx.h"
#include <iostream>
int main() {
int *p;
p = new int(255);
delete []p;
}
The disassembly of it, is different ...
- 139
3
votes
1
answer
784
views
Strange function in IDA Pro: Only one basic block ending with a jmp sub_xxxxxx (instead of a ret)
Analyzing the ELF file /usr/bin/curl (Ubuntu 14.04, 64bit), I stumbled upon a strange function (see image). It is called regularly via call sub_403D90 but does not end with a ret. Instead, it jumps to ...
- 1,560
2
votes
1
answer
1k
views
IDA pro and unrolled loops
Is there a trick in IDA Pro to deal with unrolled loops like in the screenshot below?
Another, possibly related compiler optimisation is this - instead of loading an offset into a memory area, it ...
- 193
11
votes
2
answers
13k
views
PE .rdata section contents
According to MSDN, the .rdata section of a PE should contain the debug directory and the description string. I've read elsewhere that it contains read-only program data. Dumping several files, I found ...
- 113
8
votes
1
answer
240
views
Why are those instructions generated?
After disassembling a program, I see the following asm code generated :
.text:004D5911 mov [ebp+var_4], ecx
.text:004D5914 mov ecx, [ebp+var_4]
.text:004D5917 test ecx, ecx
.text:004D5919 ...
- 439
12
votes
2
answers
5k
views
Extract non-extractable private key from OS X Keychain
I'm trying to extract a non-extractable private key as a .p12 file from Keychain Access.app or /usr/bin/security on Mac OS X 10.9.4.
Basically, it appears that security import has a -x option to ...
- 299
2
votes
1
answer
569
views
Why jump to unconditional jumps?
I have noticed many times whilst disassembling executables that often the compiler will produce jumps to other unconditional jumps, rather than simply jumping to the final destination. For example:
...
- 474
1
vote
2
answers
638
views
Can someone compile a program for me with gcc-mips? [closed]
I am close to having root on my DVR device running busybox. I figured out one of the user login/passwords and am able to telnet in, but that's it. I have a drive that is attached which automatically ...
- 485
3
votes
2
answers
735
views
How to compile c, cpp and python code as "Released/Final" version?
I want to know if there are ways to compile C, C++ and Python code in order to not be able to reverse engineering it over Linux or not?
I have heard there are some ways over Windows to do it, but I ...
- 331
8
votes
1
answer
3k
views
Chunked function (discontinuous chunks of code comprising a function)
The control flow graph below is from a single function in Notepad (Win7 64-bit). Why is the linker (or the compiler) separating the basic blocks of a single function into multiple, discontinuous ( not ...
- 83
3
votes
1
answer
2k
views
How to extract information from dll compiled in gcc with debug symbols?
I recently read that GCC annotates the source-code into the debug symbols it produces, although I haven't found any examples on how to retrieve this.
If this is true, how can I view the data in the ...
- 177
5
votes
2
answers
482
views
Grouping functions based on their placement/order in the binary
Can I group functions based on their place in the binary? Can I assume functions next to each othe belong to the same logical group, or at least they have similar functionality? I suspect that the ...
- 2,038
6
votes
1
answer
643
views
Dalvik Byte code instrumentation framwork for dynamic data dependency analysis
I am looking forward to having your input regarding the availability of any tool that can do instrumentation in byte code level run-time, so that data dependency analysis can be carried out? Such tool ...
- 161