Questions tagged [compilers]
A computer program that transforms source code into the target language, often having a binary form known as object code.
48
questions
0
votes
1answer
78 views
Why do those useless instruction are in Rust final binary?
I am currently reversing RUST binaries, and I often come across this block of instruction :
.text:000055F4BFB943F2 db 2Eh
.text:000055F4BFB943F2 nop word ptr [rax+rax+00000000h]
.text:...
1
vote
0answers
39 views
Is it possible to define the adress of a function in assembly?
I am creating a PoC for anti-disassembly techniques, and I would like to know if there were ways to define the address of functions once compiled with gcc.
Here is the PoC program :
BITS 32
EXTERN ...
1
vote
1answer
230 views
Identify function in cpp static binary
When I open cpp static binary, how can identify known functions like fopen/ioctl/printf? They have been compiled statically into the binary.
I dont know the compiler of this binary .
0
votes
1answer
173 views
Is there any decompiler, which can produce a compilable result?
I would like to decompile a 32bit linux executable to C, modify some parts of it, and then compile it back. I do not care if the C code is not pretty and really hard to maintain. The only thing I care ...
0
votes
1answer
105 views
How to get meaning of flags by integer
Assuming I have a syscall to open.
man 2 open gives me info, that it requires 2 or 3 parameters
int open(const char *pathname, int flags);
int open(const char *pathname, int flags, mode_t mode);
...
2
votes
1answer
143 views
Why having a function with just one instruction
I decompiled a program where there is a function, which has only a single useful instruction which is
xor eax, eax
retn
What it the purpose of having this in an extra function, instead of using xor ...
4
votes
1answer
741 views
What are the first 16 bytes in .rodata section?
What are the first 16 bytes in the .rodata section?
For example, I have the following code:
#include <cstdio>
void myprintf(const char* ptr) {
printf("%p\n", ptr);
}
int main() {
...
4
votes
1answer
318 views
Compile C# like C++?
After reading the ins and outs of compilation differences between C# and C++ , my question is, cant we compile the C#application (or dll) with Visual Studio (or with other program), so similarly to C++...
5
votes
5answers
734 views
How to find out if PE executable was compiled with gcc or VisualStudio?
I looked at two ways so far. Both did not convince me in regard to false positives or false negatives:
Using strings: How to retrieve the GCC version used to compile a given ELF executable?
Using the ...
-1
votes
1answer
3k views
How to add code to compiled java class
I have java code that is compiled to a .class file.
There is a function that gets few parameters and do some action (e.g. get int x and int y and do x+y)
I want to add to this .class file code that ...
2
votes
1answer
211 views
Is all debug information of VS-compiled PE files contained in an external PDB file?
I read here that some PE files have debug information baked into the PE file. Is this only the case for older PE files?
Is it safe to assume that all Visual Studio compiled PE files have all debug ...
1
vote
1answer
154 views
What does this instruction pairs mean?
I don't know if it is asked but, I couldn't find it anything despite this question. Is it because of disassembler's fault? Or if it is right, why compiler generates this code?
; int __cdecl main(int ...
-1
votes
1answer
451 views
Shells CTF segfault - wrong address
PicoCTF 2017 Shells
I have a binary and source:
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/mman.h>
#define AMOUNT_OF_STUFF 10
//TODO: Ask IT ...
1
vote
2answers
80 views
Can a Data Type Span Multiple Virtual Pages? (Windows)
Can a multi-byte primitive data type (ie int, double, float, etc) span multiple virtual pages on Windows?
ex) The first 4-bytes of a double on a virtual page, and the next 4-bytes of a double on the ...
3
votes
1answer
121 views
Reconstructing Assembly Truth Map
So I recently read [1] which evaluates several disassemblers. The truth/test binaries are generated by the SPEC CPU 2006 Benchmark suite. The authors provide detailed build instructions for the ELF ...
0
votes
2answers
112 views
Function Address Changes When Gets Referenced elsewhere
i have been trying to get the address of a function and use that hex number for other calculations. I have read that you cannot get the address of a function like you get the address of a variable in ...
0
votes
1answer
50 views
What additional data does a compiler populate the buffer space with? [duplicate]
I am currently learning about the stack, in particular how to perform stack overflow attacks. I understand that the buffer is not the size that the program initially set it as, for example if we ...
0
votes
2answers
480 views
best c compiler on windows for reversing
One of the threads I have discovered in my reading about learning how to reverse engineer is to write "small" c programs compile them and then disassemble them to see how the c code gets translated ...
2
votes
1answer
4k views
I'm unable to copy to executable (ollydebug)
I just finished up with cracking this crackme I found off the net and it's cracked and everything,but the problem is that in ollydebug I don't happen to see a option to copy the modified code and save ...
1
vote
2answers
876 views
C/C++ to Assembly language
Is there any book or articles related to how C/C++ code is converted to assembly language, I mean common patterns for a specific compiler, etc?
1
vote
1answer
862 views
Function dependencies in static libraries
I read in another SO thread:
With static libraries, the unit of copying is the object file in the
library.
In other words, if two programs call a function from a certain object file, both ...
1
vote
1answer
112 views
Recognize certain components in the compiler produced assembly program
Here is my question:
given a marked C code component, how I can find its corresponding assembly instructions in the compiler produced assembly program?
It should be very easy if the marked component ...
2
votes
1answer
367 views
Removing uncalled smali
Does anyone know of a smali re-compiler that will remove uncalled code without obfuscation? I just want to remove unused classes and methods.
1
vote
0answers
93 views
Redundant mov instructions; Why is this? [duplicate]
It's not the first time I see code like the following in assembly:
mov [ebp - 4], eax
mov edx, [ebp - 4]
Which makes myself wonder why it hasn't been optimized to be:
mov edx, eax
Why is this? (...
2
votes
1answer
173 views
Code generation patterns of compilers
After reading the question of zespri it was interesting for me to read something about the code generation patterns of different compilers in order to reverse better and quicker. Do you know good ...
1
vote
1answer
487 views
What is all this code for?
In order to be able to effectively reverse assembly one needs to understand how different compilers work, and what are the common code generation patterns. If you do not know them, you spent much more ...
2
votes
1answer
497 views
Visual studio memory allocation reverse engineering
I compile this code with Visual studio 2010 compiler:
#include "stdafx.h"
#include <iostream>
int main() {
int *p;
p = new int(255);
delete []p;
}
The disassembly of it, is different ...
2
votes
1answer
510 views
Strange function in IDA Pro: Only one basic block ending with a jmp sub_xxxxxx (instead of a ret)
Analyzing the ELF file /usr/bin/curl (Ubuntu 14.04, 64bit), I stumbled upon a strange function (see image). It is called regularly via call sub_403D90 but does not end with a ret. Instead, it jumps to ...
2
votes
1answer
931 views
IDA pro and unrolled loops
Is there a trick in IDA Pro to deal with unrolled loops like in the screenshot below?
Another, possibly related compiler optimisation is this - instead of loading an offset into a memory area, it ...
9
votes
2answers
6k views
PE .rdata section contents
According to MSDN, the .rdata section of a PE should contain the debug directory and the description string. I've read elsewhere that it contains read-only program data. Dumping several files, I found ...
8
votes
1answer
205 views
Why are those instructions generated?
After disassembling a program, I see the following asm code generated :
.text:004D5911 mov [ebp+var_4], ecx
.text:004D5914 mov ecx, [ebp+var_4]
.text:004D5917 test ecx, ecx
.text:004D5919 ...
10
votes
2answers
3k views
Extract non-extractable private key from OS X Keychain
I'm trying to extract a non-extractable private key as a .p12 file from Keychain Access.app or /usr/bin/security on Mac OS X 10.9.4.
Basically, it appears that security import has a -x option to ...
2
votes
1answer
416 views
Why jump to unconditional jumps?
I have noticed many times whilst disassembling executables that often the compiler will produce jumps to other unconditional jumps, rather than simply jumping to the final destination. For example:
...
1
vote
2answers
584 views
Can someone compile a program for me with gcc-mips? [closed]
I am close to having root on my DVR device running busybox. I figured out one of the user login/passwords and am able to telnet in, but that's it. I have a drive that is attached which automatically ...
3
votes
2answers
560 views
How to compile c, cpp and python code as “Released/Final” version?
I want to know if there are ways to compile C, C++ and Python code in order to not be able to reverse engineering it over Linux or not?
I have heard there are some ways over Windows to do it, but I ...
6
votes
1answer
2k views
Chunked function (discontinuous chunks of code comprising a function)
The control flow graph below is from a single function in Notepad (Win7 64-bit). Why is the linker (or the compiler) separating the basic blocks of a single function into multiple, discontinuous ( not ...
2
votes
1answer
1k views
How to extract information from dll compiled in gcc with debug symbols?
I recently read that GCC annotates the source-code into the debug symbols it produces, although I haven't found any examples on how to retrieve this.
If this is true, how can I view the data in the ...
3
votes
2answers
338 views
Grouping functions based on their placement/order in the binary
Can I group functions based on their place in the binary? Can I assume functions next to each othe belong to the same logical group, or at least they have similar functionality? I suspect that the ...
5
votes
1answer
632 views
Dalvik Byte code instrumentation framwork for dynamic data dependency analysis
I am looking forward to having your input regarding the availability of any tool that can do instrumentation in byte code level run-time, so that data dependency analysis can be carried out? Such tool ...
2
votes
3answers
376 views
How to zip or compress resources of your .NET application
I am a Windows application developer, I'd build a few .NET applications and I can see It is very easy to crack out resources of my Application even some simple applications like Resource Editor are ...
5
votes
2answers
2k views
Accessing Data Marked as Alignment Bytes in IDA
Some compilers will add useless bytes in functions or in between functions. In the below block of code at 0040117C we can see the "align" keyword that was inserted by IDA.
.text:00401176 ...
23
votes
3answers
10k views
Can I statically link (not import) the Windows system DLLs?
I have compiled following C source code in VS2010 console project.
#include <stdio.h>
int main(int argc, char* argv[]){
printf("hello world\n");
return 0;
}
then I used /MT option for ...
5
votes
1answer
4k views
How to compile Hex-Rays decompiler generated code?
I need help to compile Pseudo-C code generated with IDA Pro and the Hex-Rays decompiler plugin. It shows an error on this line:
int (__thiscall *off_401F14)(void *, char); // weak
Error:
error ...
7
votes
3answers
26k views
Find out a Java class file's compiler version
I have a java class file. How do I find out the version of the compiler used to compile this file? I'm on Ubuntu Server 12.04.
10
votes
1answer
3k views
How to see what compiler made PIC ASM code?
I extracted a .hex file from a PIC16F88. For example:
:020000040000FA
:100000008F3083160F0570388F009B0183129F017C
:1000100083169F0107309C0005108312051483127C
:...
7
votes
5answers
878 views
Is it possible to hide the details of which compiler was used?
The compiler adds system information to the output/object file that is created on compilation.
Is there any compiler option that can prevent this information from being added?
Can the compiler ...
28
votes
1answer
8k views
What kinds of steps can I take to make my C++ application harder to reverse engineer?
If I am building a C++ application and I want to make it more difficult to reverse engineer, what steps can I take to do this?
Does the choice of compiler affect this?
What about compiler flags, ...
33
votes
7answers
11k views
What hints in machine code can point me to the compiler which was used to generate it?
When I am looking at the machine code of an application, are there hints and patterns I can discern from the generated machine code which would indicate which compiler (and possibly version) was used ...
