Questions tagged [compilers]
A computer program that transforms source code into the target language, often having a binary form known as object code.
56
questions
0
votes
0answers
42 views
Why would compiler emit a null pointer assignment
I have been reversing a popular Windows application and ended up in a very interesting place while debugging. What I can clearly see as valid x86 instructions that eventually lead to some sort of &...
1
vote
1answer
57 views
Does Golang's cgo now support output with .gopclntab?
I read this page in which the author, Chris Siebenmann, states that binaries created using cgo will not have the gopclntab or the gosymtab sections. However, I see that on go version go1.13.15 linux/...
1
vote
1answer
639 views
How to disable relro while compilation?
#include <stdio.h>
#include <stdlib.h>
int main(int argc, int *argv[])
{
size_t *p = (size_t *) strtol(argv[1], NULL, 16);
p[0] = 0xDEADBEEF;
printf("RELRO: %p\n", p);
return ...
1
vote
0answers
102 views
How to add Instructions (OpCodes) after a If Statement in C#?
I hope someone can help me out with my problem. Currently I'm working with C# and use the library Mono.Cecil to add Instruction Code before a method exits. There is this one case, when a if statement ...
1
vote
1answer
83 views
Decompilation of CIL code into some high level code - do I need to introduce new variables during data flow analysis?
I'm writing a compiler from .NET CIL code to some high level language. Process is similar to decompilation. I have done some control flow analysis - detecting loops, ifs, and so on. In terms of data ...
0
votes
0answers
38 views
IDA Pro having issue decompiling gcc compiled ELF64 function with more than one leave/ret
I am new to IDA Pro and am not familiar with anything beyond default settings for decompilation. I have an ELF64 kernel module compiled with gcc and, in several cases, IDA Pro's decompilation is ...
1
vote
1answer
68 views
Name other than ".text" for the main code section
Is it safe to assume that, in the general case, the name of the section containing the user code (not the compiler generated code) is .text? I spot-checked several ARM, x86 and MIPS binaries (PE and ...
0
votes
0answers
59 views
Lexer and parser for .asm file produced by objdump
Is there any existing project that parses the x86 disassembly file or .asm produced by the objdump or IDA pro using the lexer and parser library in python or any other programming language?
0
votes
1answer
400 views
Why do those useless instruction are in Rust final binary?
I am currently reversing RUST binaries, and I often come across this block of instruction :
.text:000055F4BFB943F2 db 2Eh
.text:000055F4BFB943F2 nop word ptr [rax+rax+00000000h]
.text:...
1
vote
0answers
47 views
Is it possible to define the adress of a function in assembly?
I am creating a PoC for anti-disassembly techniques, and I would like to know if there were ways to define the address of functions once compiled with gcc.
Here is the PoC program :
BITS 32
EXTERN ...
1
vote
1answer
493 views
Identify function in cpp static binary
When I open cpp static binary, how can identify known functions like fopen/ioctl/printf? They have been compiled statically into the binary.
I dont know the compiler of this binary .
0
votes
1answer
324 views
Is there any decompiler, which can produce a compilable result?
I would like to decompile a 32-bit Linux executable to C, modify some parts of it, and then compile it back. I do not care if the C code is not pretty and really hard to maintain. The only thing I ...
0
votes
1answer
530 views
How to get meaning of flags by integer
Assuming I have a syscall to open.
man 2 open gives me info, that it requires 2 or 3 parameters
int open(const char *pathname, int flags);
int open(const char *pathname, int flags, mode_t mode);
...
2
votes
1answer
169 views
Why having a function with just one instruction
I decompiled a program where there is a function, which has only a single useful instruction which is
xor eax, eax
retn
What it the purpose of having this in an extra function, instead of using xor ...
4
votes
1answer
1k views
What are the first 16 bytes in .rodata section?
What are the first 16 bytes in the .rodata section?
For example, I have the following code:
#include <cstdio>
void myprintf(const char* ptr) {
printf("%p\n", ptr);
}
int main() {
...
4
votes
1answer
407 views
Compile C# like C++?
After reading the ins and outs of compilation differences between C# and C++ , my question is, cant we compile the C#application (or dll) with Visual Studio (or with other program), so similarly to C++...
7
votes
5answers
2k views
How to find out if PE executable was compiled with gcc or VisualStudio?
I looked at two ways so far. Both did not convince me in regard to false positives or false negatives:
Using strings: How to retrieve the GCC version used to compile a given ELF executable?
Using the ...
1
vote
2answers
6k views
How to add code to compiled java class
I have java code that is compiled to a .class file.
There is a function that gets few parameters and do some action (e.g. get int x and int y and do x+y)
I want to add to this .class file code that ...
2
votes
1answer
260 views
Is all debug information of VS-compiled PE files contained in an external PDB file?
I read here that some PE files have debug information baked into the PE file. Is this only the case for older PE files?
Is it safe to assume that all Visual Studio compiled PE files have all debug ...
1
vote
1answer
226 views
What does this instruction pairs mean?
I don't know if it is asked but, I couldn't find it anything despite this question. Is it because of disassembler's fault? Or if it is right, why compiler generates this code?
; int __cdecl main(int ...
-1
votes
1answer
556 views
Shells CTF segfault - wrong address
PicoCTF 2017 Shells
I have a binary and source:
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/mman.h>
#define AMOUNT_OF_STUFF 10
//TODO: Ask IT ...
1
vote
2answers
87 views
Can a Data Type Span Multiple Virtual Pages? (Windows)
Can a multi-byte primitive data type (ie int, double, float, etc) span multiple virtual pages on Windows?
ex) The first 4-bytes of a double on a virtual page, and the next 4-bytes of a double on the ...
4
votes
1answer
195 views
Reconstructing Assembly Truth Map
So I recently read [1] which evaluates several disassemblers. The truth/test binaries are generated by the SPEC CPU 2006 Benchmark suite. The authors provide detailed build instructions for the ELF ...
0
votes
2answers
130 views
Function Address Changes When Gets Referenced elsewhere
i have been trying to get the address of a function and use that hex number for other calculations. I have read that you cannot get the address of a function like you get the address of a variable in ...
0
votes
1answer
60 views
What additional data does a compiler populate the buffer space with? [duplicate]
I am currently learning about the stack, in particular how to perform stack overflow attacks. I understand that the buffer is not the size that the program initially set it as, for example if we ...
0
votes
2answers
583 views
best c compiler on windows for reversing
One of the threads I have discovered in my reading about learning how to reverse engineer is to write "small" c programs compile them and then disassemble them to see how the c code gets translated ...
3
votes
1answer
4k views
I'm unable to copy to executable (ollydebug)
I just finished up with cracking this crackme I found off the net and it's cracked and everything,but the problem is that in ollydebug I don't happen to see a option to copy the modified code and save ...
1
vote
2answers
931 views
C/C++ to Assembly language
Is there any book or articles related to how C/C++ code is converted to assembly language, I mean common patterns for a specific compiler, etc?
1
vote
1answer
934 views
Function dependencies in static libraries
I read in another SO thread:
With static libraries, the unit of copying is the object file in the
library.
In other words, if two programs call a function from a certain object file, both ...
1
vote
1answer
123 views
Recognize certain components in the compiler produced assembly program
Here is my question:
given a marked C code component, how I can find its corresponding assembly instructions in the compiler produced assembly program?
It should be very easy if the marked component ...
2
votes
1answer
395 views
Removing uncalled smali
Does anyone know of a smali re-compiler that will remove uncalled code without obfuscation? I just want to remove unused classes and methods.
1
vote
0answers
101 views
Redundant mov instructions; Why is this? [duplicate]
It's not the first time I see code like the following in assembly:
mov [ebp - 4], eax
mov edx, [ebp - 4]
Which makes myself wonder why it hasn't been optimized to be:
mov edx, eax
Why is this? (...
2
votes
1answer
183 views
Code generation patterns of compilers
After reading the question of zespri it was interesting for me to read something about the code generation patterns of different compilers in order to reverse better and quicker. Do you know good ...
1
vote
1answer
548 views
What is all this code for?
In order to be able to effectively reverse assembly one needs to understand how different compilers work, and what are the common code generation patterns. If you do not know them, you spent much more ...
2
votes
1answer
567 views
Visual studio memory allocation reverse engineering
I compile this code with Visual studio 2010 compiler:
#include "stdafx.h"
#include <iostream>
int main() {
int *p;
p = new int(255);
delete []p;
}
The disassembly of it, is different ...
2
votes
1answer
630 views
Strange function in IDA Pro: Only one basic block ending with a jmp sub_xxxxxx (instead of a ret)
Analyzing the ELF file /usr/bin/curl (Ubuntu 14.04, 64bit), I stumbled upon a strange function (see image). It is called regularly via call sub_403D90 but does not end with a ret. Instead, it jumps to ...
2
votes
1answer
1k views
IDA pro and unrolled loops
Is there a trick in IDA Pro to deal with unrolled loops like in the screenshot below?
Another, possibly related compiler optimisation is this - instead of loading an offset into a memory area, it ...
9
votes
2answers
9k views
PE .rdata section contents
According to MSDN, the .rdata section of a PE should contain the debug directory and the description string. I've read elsewhere that it contains read-only program data. Dumping several files, I found ...
8
votes
1answer
227 views
Why are those instructions generated?
After disassembling a program, I see the following asm code generated :
.text:004D5911 mov [ebp+var_4], ecx
.text:004D5914 mov ecx, [ebp+var_4]
.text:004D5917 test ecx, ecx
.text:004D5919 ...
11
votes
2answers
4k views
Extract non-extractable private key from OS X Keychain
I'm trying to extract a non-extractable private key as a .p12 file from Keychain Access.app or /usr/bin/security on Mac OS X 10.9.4.
Basically, it appears that security import has a -x option to ...
2
votes
1answer
457 views
Why jump to unconditional jumps?
I have noticed many times whilst disassembling executables that often the compiler will produce jumps to other unconditional jumps, rather than simply jumping to the final destination. For example:
...
1
vote
2answers
621 views
Can someone compile a program for me with gcc-mips? [closed]
I am close to having root on my DVR device running busybox. I figured out one of the user login/passwords and am able to telnet in, but that's it. I have a drive that is attached which automatically ...
3
votes
2answers
637 views
How to compile c, cpp and python code as "Released/Final" version?
I want to know if there are ways to compile C, C++ and Python code in order to not be able to reverse engineering it over Linux or not?
I have heard there are some ways over Windows to do it, but I ...
7
votes
1answer
2k views
Chunked function (discontinuous chunks of code comprising a function)
The control flow graph below is from a single function in Notepad (Win7 64-bit). Why is the linker (or the compiler) separating the basic blocks of a single function into multiple, discontinuous ( not ...
2
votes
1answer
1k views
How to extract information from dll compiled in gcc with debug symbols?
I recently read that GCC annotates the source-code into the debug symbols it produces, although I haven't found any examples on how to retrieve this.
If this is true, how can I view the data in the ...
4
votes
2answers
404 views
Grouping functions based on their placement/order in the binary
Can I group functions based on their place in the binary? Can I assume functions next to each othe belong to the same logical group, or at least they have similar functionality? I suspect that the ...
5
votes
1answer
636 views
Dalvik Byte code instrumentation framwork for dynamic data dependency analysis
I am looking forward to having your input regarding the availability of any tool that can do instrumentation in byte code level run-time, so that data dependency analysis can be carried out? Such tool ...
2
votes
3answers
380 views
How to zip or compress resources of your .NET application
I am a Windows application developer, I'd build a few .NET applications and I can see It is very easy to crack out resources of my Application even some simple applications like Resource Editor are ...
6
votes
2answers
2k views
Accessing Data Marked as Alignment Bytes in IDA
Some compilers will add useless bytes in functions or in between functions. In the below block of code at 0040117C we can see the "align" keyword that was inserted by IDA.
.text:00401176 ...
28
votes
4answers
12k views
Can I statically link (not import) the Windows system DLLs?
I have compiled following C source code in VS2010 console project.
#include <stdio.h>
int main(int argc, char* argv[]){
printf("hello world\n");
return 0;
}
then I used /MT option for ...
