Questions tagged [compilers]

A computer program that transforms source code into the target language, often having a binary form known as object code.

Filter by
Sorted by
Tagged with
1 vote
0 answers
33 views

Where can I find these compilers given in the Rich Header of a system BIOS file?

I am working on a project which deals with the BIOS file of a well known manufacturer. I recovered the file from the disk partition which stores and uses the file in case BIOS is corrupted or its ...
user avatar
1 vote
1 answer
96 views

Why aren't compilers using registers for their intended purpose?

It seem to be well known that x86 registers names have a purpose and indicate on how the register should be use (see this website for example). According to this, ecx should be the register holding my ...
user avatar
  • 27
0 votes
0 answers
45 views

Why would compiler emit a null pointer assignment

I have been reversing a popular Windows application and ended up in a very interesting place while debugging. What I can clearly see as valid x86 instructions that eventually lead to some sort of &...
user avatar
  • 11
1 vote
1 answer
83 views

Does Golang's cgo now support output with .gopclntab?

I read this page in which the author, Chris Siebenmann, states that binaries created using cgo will not have the gopclntab or the gosymtab sections. However, I see that on go version go1.13.15 linux/...
user avatar
  • 1,625
1 vote
1 answer
1k views

How to disable relro while compilation?

#include <stdio.h> #include <stdlib.h> int main(int argc, int *argv[]) { size_t *p = (size_t *) strtol(argv[1], NULL, 16); p[0] = 0xDEADBEEF; printf("RELRO: %p\n", p); return ...
user avatar
  • 23
1 vote
0 answers
144 views

How to add Instructions (OpCodes) after a If Statement in C#?

I hope someone can help me out with my problem. Currently I'm working with C# and use the library Mono.Cecil to add Instruction Code before a method exits. There is this one case, when a if statement ...
user avatar
1 vote
1 answer
99 views

Decompilation of CIL code into some high level code - do I need to introduce new variables during data flow analysis?

I'm writing a compiler from .NET CIL code to some high level language. Process is similar to decompilation. I have done some control flow analysis - detecting loops, ifs, and so on. In terms of data ...
user avatar
1 vote
1 answer
72 views

Name other than ".text" for the main code section

Is it safe to assume that, in the general case, the name of the section containing the user code (not the compiler generated code) is .text? I spot-checked several ARM, x86 and MIPS binaries (PE and ...
user avatar
  • 1,432
0 votes
0 answers
75 views

Lexer and parser for .asm file produced by objdump

Is there any existing project that parses the x86 disassembly file or .asm produced by the objdump or IDA pro using the lexer and parser library in python or any other programming language?
user avatar
  • 1
0 votes
1 answer
426 views

Why do those useless instruction are in Rust final binary?

I am currently reversing RUST binaries, and I often come across this block of instruction : .text:000055F4BFB943F2 db 2Eh .text:000055F4BFB943F2 nop word ptr [rax+rax+00000000h] .text:...
user avatar
  • 27
1 vote
0 answers
47 views

Is it possible to define the adress of a function in assembly?

I am creating a PoC for anti-disassembly techniques, and I would like to know if there were ways to define the address of functions once compiled with gcc. Here is the PoC program : BITS 32 EXTERN ...
user avatar
  • 261
1 vote
1 answer
588 views

Identify function in cpp static binary

When I open cpp static binary, how can identify known functions like fopen/ioctl/printf? They have been compiled statically into the binary. I dont know the compiler of this binary .
user avatar
  • 503
0 votes
1 answer
348 views

Is there any decompiler, which can produce a compilable result?

I would like to decompile a 32-bit Linux executable to C, modify some parts of it, and then compile it back. I do not care if the C code is not pretty and really hard to maintain. The only thing I ...
user avatar
  • 204
0 votes
1 answer
693 views

How to get meaning of flags by integer

Assuming I have a syscall to open. man 2 open gives me info, that it requires 2 or 3 parameters int open(const char *pathname, int flags); int open(const char *pathname, int flags, mode_t mode); ...
user avatar
  • 125
2 votes
1 answer
172 views

Why having a function with just one instruction

I decompiled a program where there is a function, which has only a single useful instruction which is xor eax, eax retn What it the purpose of having this in an extra function, instead of using xor ...
user avatar
  • 125
4 votes
1 answer
2k views

What are the first 16 bytes in .rodata section?

What are the first 16 bytes in the .rodata section? For example, I have the following code: #include <cstdio> void myprintf(const char* ptr) { printf("%p\n", ptr); } int main() { ...
user avatar
  • 143
4 votes
1 answer
432 views

Compile C# like C++?

After reading the ins and outs of compilation differences between C# and C++ , my question is, cant we compile the C#application (or dll) with Visual Studio (or with other program), so similarly to C++...
user avatar
  • 603
7 votes
5 answers
2k views

How to find out if PE executable was compiled with gcc or VisualStudio?

I looked at two ways so far. Both did not convince me in regard to false positives or false negatives: Using strings: How to retrieve the GCC version used to compile a given ELF executable? Using the ...
user avatar
  • 1,432
1 vote
2 answers
7k views

How to add code to compiled java class

I have java code that is compiled to a .class file. There is a function that gets few parameters and do some action (e.g. get int x and int y and do x+y) I want to add to this .class file code that ...
user avatar
  • 31
2 votes
1 answer
266 views

Is all debug information of VS-compiled PE files contained in an external PDB file?

I read here that some PE files have debug information baked into the PE file. Is this only the case for older PE files? Is it safe to assume that all Visual Studio compiled PE files have all debug ...
user avatar
  • 1,432
1 vote
1 answer
238 views

What does this instruction pairs mean?

I don't know if it is asked but, I couldn't find it anything despite this question. Is it because of disassembler's fault? Or if it is right, why compiler generates this code? ; int __cdecl main(int ...
user avatar
-1 votes
1 answer
591 views

Shells CTF segfault - wrong address

PicoCTF 2017 Shells I have a binary and source: #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/mman.h> #define AMOUNT_OF_STUFF 10 //TODO: Ask IT ...
user avatar
1 vote
2 answers
88 views

Can a Data Type Span Multiple Virtual Pages? (Windows)

Can a multi-byte primitive data type (ie int, double, float, etc) span multiple virtual pages on Windows? ex) The first 4-bytes of a double on a virtual page, and the next 4-bytes of a double on the ...
user avatar
4 votes
1 answer
205 views

Reconstructing Assembly Truth Map

So I recently read [1] which evaluates several disassemblers. The truth/test binaries are generated by the SPEC CPU 2006 Benchmark suite. The authors provide detailed build instructions for the ELF ...
user avatar
  • 41
0 votes
2 answers
137 views

Function Address Changes When Gets Referenced elsewhere

i have been trying to get the address of a function and use that hex number for other calculations. I have read that you cannot get the address of a function like you get the address of a variable in ...
user avatar
0 votes
1 answer
62 views

What additional data does a compiler populate the buffer space with? [duplicate]

I am currently learning about the stack, in particular how to perform stack overflow attacks. I understand that the buffer is not the size that the program initially set it as, for example if we ...
user avatar
0 votes
2 answers
599 views

best c compiler on windows for reversing

One of the threads I have discovered in my reading about learning how to reverse engineer is to write "small" c programs compile them and then disassemble them to see how the c code gets translated ...
user avatar
  • 379
3 votes
1 answer
4k views

I'm unable to copy to executable (ollydebug)

I just finished up with cracking this crackme I found off the net and it's cracked and everything,but the problem is that in ollydebug I don't happen to see a option to copy the modified code and save ...
user avatar
  • 33
1 vote
2 answers
947 views

C/C++ to Assembly language

Is there any book or articles related to how C/C++ code is converted to assembly language, I mean common patterns for a specific compiler, etc?
user avatar
  • 85
1 vote
1 answer
954 views

Function dependencies in static libraries

I read in another SO thread: With static libraries, the unit of copying is the object file in the library. In other words, if two programs call a function from a certain object file, both ...
user avatar
  • 1,432
1 vote
1 answer
124 views

Recognize certain components in the compiler produced assembly program

Here is my question: given a marked C code component, how I can find its corresponding assembly instructions in the compiler produced assembly program? It should be very easy if the marked component ...
user avatar
2 votes
1 answer
410 views

Removing uncalled smali

Does anyone know of a smali re-compiler that will remove uncalled code without obfuscation? I just want to remove unused classes and methods.
user avatar
1 vote
0 answers
101 views

Redundant mov instructions; Why is this? [duplicate]

It's not the first time I see code like the following in assembly: mov [ebp - 4], eax mov edx, [ebp - 4] Which makes myself wonder why it hasn't been optimized to be: mov edx, eax Why is this? (...
user avatar
  • 176
2 votes
1 answer
186 views

Code generation patterns of compilers

After reading the question of zespri it was interesting for me to read something about the code generation patterns of different compilers in order to reverse better and quicker. Do you know good ...
user avatar
1 vote
1 answer
564 views

What is all this code for?

In order to be able to effectively reverse assembly one needs to understand how different compilers work, and what are the common code generation patterns. If you do not know them, you spent much more ...
user avatar
2 votes
1 answer
576 views

Visual studio memory allocation reverse engineering

I compile this code with Visual studio 2010 compiler: #include "stdafx.h" #include <iostream> int main() { int *p; p = new int(255); delete []p; } The disassembly of it, is different ...
user avatar
  • 139
2 votes
1 answer
655 views

Strange function in IDA Pro: Only one basic block ending with a jmp sub_xxxxxx (instead of a ret)

Analyzing the ELF file /usr/bin/curl (Ubuntu 14.04, 64bit), I stumbled upon a strange function (see image). It is called regularly via call sub_403D90 but does not end with a ret. Instead, it jumps to ...
user avatar
  • 1,432
2 votes
1 answer
1k views

IDA pro and unrolled loops

Is there a trick in IDA Pro to deal with unrolled loops like in the screenshot below? Another, possibly related compiler optimisation is this - instead of loading an offset into a memory area, it ...
user avatar
  • 193
9 votes
2 answers
10k views

PE .rdata section contents

According to MSDN, the .rdata section of a PE should contain the debug directory and the description string. I've read elsewhere that it contains read-only program data. Dumping several files, I found ...
user avatar
  • 93
8 votes
1 answer
228 views

Why are those instructions generated?

After disassembling a program, I see the following asm code generated : .text:004D5911 mov [ebp+var_4], ecx .text:004D5914 mov ecx, [ebp+var_4] .text:004D5917 test ecx, ecx .text:004D5919 ...
user avatar
  • 439
12 votes
2 answers
4k views

Extract non-extractable private key from OS X Keychain

I'm trying to extract a non-extractable private key as a .p12 file from Keychain Access.app or /usr/bin/security on Mac OS X 10.9.4. Basically, it appears that security import has a -x option to ...
user avatar
  • 299
2 votes
1 answer
479 views

Why jump to unconditional jumps?

I have noticed many times whilst disassembling executables that often the compiler will produce jumps to other unconditional jumps, rather than simply jumping to the final destination. For example: ...
user avatar
  • 474
1 vote
2 answers
624 views

Can someone compile a program for me with gcc-mips? [closed]

I am close to having root on my DVR device running busybox. I figured out one of the user login/passwords and am able to telnet in, but that's it. I have a drive that is attached which automatically ...
user avatar
  • 455
3 votes
2 answers
656 views

How to compile c, cpp and python code as "Released/Final" version?

I want to know if there are ways to compile C, C++ and Python code in order to not be able to reverse engineering it over Linux or not? I have heard there are some ways over Windows to do it, but I ...
user avatar
  • 291
7 votes
1 answer
3k views

Chunked function (discontinuous chunks of code comprising a function)

The control flow graph below is from a single function in Notepad (Win7 64-bit). Why is the linker (or the compiler) separating the basic blocks of a single function into multiple, discontinuous ( not ...
user avatar
2 votes
1 answer
1k views

How to extract information from dll compiled in gcc with debug symbols?

I recently read that GCC annotates the source-code into the debug symbols it produces, although I haven't found any examples on how to retrieve this. If this is true, how can I view the data in the ...
user avatar
4 votes
2 answers
430 views

Grouping functions based on their placement/order in the binary

Can I group functions based on their place in the binary? Can I assume functions next to each othe belong to the same logical group, or at least they have similar functionality? I suspect that the ...
user avatar
5 votes
1 answer
636 views

Dalvik Byte code instrumentation framwork for dynamic data dependency analysis

I am looking forward to having your input regarding the availability of any tool that can do instrumentation in byte code level run-time, so that data dependency analysis can be carried out? Such tool ...
user avatar
  • 151
2 votes
3 answers
384 views

How to zip or compress resources of your .NET application

I am a Windows application developer, I'd build a few .NET applications and I can see It is very easy to crack out resources of my Application even some simple applications like Resource Editor are ...
user avatar
  • 263
6 votes
2 answers
2k views

Accessing Data Marked as Alignment Bytes in IDA

Some compilers will add useless bytes in functions or in between functions. In the below block of code at 0040117C we can see the "align" keyword that was inserted by IDA. .text:00401176 ...
user avatar
  • 1,052