Questions tagged [disassemblers]

A disassembler is a software tool which transforms machine code into a human readable mnemonic representation called assembly language.

Filter by
Sorted by
Tagged with
0 votes
0 answers
22 views

Call function only when check box is checked

Which function is responsible whether the check box is checked or not in disassembler's intermodular calls window?
user avatar
1 vote
1 answer
67 views

How to locate memory address in register $esp

000011d9 <main>: 11d9: 8d 4c 24 04 lea 0x4(%esp),%ecx 11dd: 83 e4 f0 and $0xfffffff0,%esp 11e0: ff 71 fc push -0x4(%ecx) 11e3: ...
user avatar
1 vote
2 answers
171 views

is there a tool to decompile old exe to C?

I follow the free software implementation of OpenRCT2 from the beggining (when it was in other repository). And the first commits are a bunch of C files, these files has a lot of asm blocks of code ...
user avatar
1 vote
0 answers
47 views

Is disassembly of standard gcc programs trivial, or just as difficult as video game ROMs?

I am attempting to do some reverse-engineering of ARM binaries, with the ultimate goal of reverse-engineering GBA ROMs. Of course, GBA ROMs contain a mixture of code and data, so a standard ...
user avatar
  • 133
1 vote
0 answers
26 views

File not want to patch. Radare2

I am learning by doing some cracking in files that i made in C. One of this files is this: file.c: #include <stdio.h> #include <stdlib.h> int main() { char s[15] = "...
user avatar
  • 113
0 votes
1 answer
60 views

Creating table with IDAPython

I'd like to create the table like below, I could not found any clue while googling it. Is it possible to make table with IDAPython, especially with idaapi.simplecustviewer_t class? Any advises would ...
user avatar
  • 123
1 vote
0 answers
48 views

Function Arguments/Name on Radare and IDA

I am starting with reverse engineering and Radare and I'm facing the following problem, on IDA Free I see the following code: mov ecx, 11h lea edi, [esp+1208h+StartupInfo] rep stosd lea ...
user avatar
  • 11
-1 votes
1 answer
225 views

How to understand the result of disassembling IDA Pro (dll x86_64)

I'm studying the dll that was built for x86_64. I study where there are links to the function "call_f1_1806F3630" and do not understand three of them. Are these features of OOP? Help me ...
user avatar
  • 11
1 vote
0 answers
52 views

The method of searching for similar code in a binary file of a new release

Got into the hands of such a task. There are two dlls. As the second file was explained to me (new.dll) this is a new release of the first file (old.dll). Both files are compiled for x64. I need to ...
user avatar
  • 11
2 votes
2 answers
360 views

How to convert to float

.rdata:00414704 __real@c0800000 dd 0C0800000h How to convert this value 0C0800000h to float point number?
user avatar
  • 113
0 votes
0 answers
42 views

Unrecognized function

There is function: push 65h push edi call sub_5D8750 In this case, function takes 65 bytes to be filled with zeros, and edi is memory address starting from which to fill these 65 bytes with ...
user avatar
  • 113
3 votes
2 answers
215 views

On reverse engineering an udp protocol to control a drone

My goal is to control my drone with my raspberry pi using python and not the app that is being delivered together with it. First I connected the app to the drone, flew and used aircrack-ng to get the ...
user avatar
2 votes
1 answer
189 views

Not able to understand the C-switch statement in disassembly

While I'm trying to disassemble my own C code I am stuck in a problem of not understanding how this Switch statement is implemented in assembly code. Can anyone please help to figure it out? This the ...
user avatar
0 votes
1 answer
75 views

Is the code like this reverse able? (from Assembly - UnityScript)

i try to reverse this code but cant figure it out what is this number mean or how to call it...
user avatar
12 votes
4 answers
5k views

Why do reversers nowadays reverse engineer using decompilers and not disassemblers?

I see many reverse engineering lessons and every second person does reverse engineer using Ghidra decompiler and not disassembler as both are available in the same platform. I assume that reversing ...
user avatar
1 vote
0 answers
149 views

Disassembler with pixel/bitmap view

I am looking for an ARM disassembler that runs on Linux that has a graphic "pixel" or "bitmap" view like the one shown in the pictures below: I am reverse engineering some old ...
user avatar
  • 31
2 votes
1 answer
239 views

The Knowledge of Compiler for becoming a good Reverser

I just reached the the topic of Compilers in the book "Reversing:Secrets of Reverse Engineering" So, I want to ask, is the knowledge of Compilers necessary for becoming a Malware Reverse ...
user avatar
0 votes
1 answer
104 views

Virtual functions call asm

It seems to be a virtual function call. How would this code look in a high-level language like C ++? .text:0053A745 loc_53A745: ; CODE XREF: sub_53A690+CEj .text:0053A745 ...
user avatar
  • 113
0 votes
1 answer
54 views

Visual c compiler options

I ask if exist some c compiler option that can "keep" some imformation after compile that can be visible when I disassamble with IDA. This because I need to find a particular funciton with ...
user avatar
0 votes
1 answer
357 views

IDA pro 7.5 - No previous fonts / color imports

For the past few years I've been using an ida color scheme which I created, that was very easy on my eyes with the previous versions of IDA Pro (<7.0). However, after start using version 7.5 I ...
user avatar
0 votes
0 answers
69 views

Lexer and parser for .asm file produced by objdump

Is there any existing project that parses the x86 disassembly file or .asm produced by the objdump or IDA pro using the lexer and parser library in python or any other programming language?
user avatar
  • 1
2 votes
1 answer
414 views

IDA/HexRays: how do I retrieve the memory address associated with a given line of decompiled code?

I'm trying to programmatically link decompiled code generated by HexRays with the disassembly code of a given binary by mapping memory addresses between the two. The mapping exists, as I can see view ...
user avatar
  • 21
0 votes
0 answers
105 views

String as constant , even not visible in disassembler

I was reading this article Where I saw that while reversing the WinRAR I saw that the x64dbg is not able to search for a string in all modules "evaluation copy". but why is that happening. ...
user avatar
0 votes
1 answer
109 views

Variable location address

There is variable in data section: .data:00427000 dword_427000 dd 64h Base address of code is: .text:00411000 ; Segment type: Pure code How to calculate actual address and location in memory of ...
user avatar
  • 113
0 votes
1 answer
53 views

what means "ilegal use of registers"?

I read pe program using a Pe Reader to view all sections, the .text section starts is "0x0001000": What is in the pe program reader: And is this what i see on the debugguer :
user avatar
1 vote
2 answers
572 views

How to determine ARM architecture from the ELF file extracted from the firmware?

I have extracted the ELF file from the flash dump of a printer, I cannot find too much information about the SoC chip on the printer. What's the best practice to determine the ARM architecture (ARMv7-...
user avatar
0 votes
1 answer
55 views

Recognize of data block

Assembler code from data segment: .data:006A5038 dword_6A5038 dd 0 .data:006A5038 .data:006A503C ; char *off_6A503C .data:006A503C off_6A503C dd offset aOption0 .data:...
user avatar
  • 113
1 vote
1 answer
163 views

How do disassemblers work?

I have 2 questions regarding this, but feel free to elaborate more if you want to, I'm really interested in this topic: Do they really just read byte by byte until they get a valid instruction? How ...
user avatar
1 vote
1 answer
39 views

Are there some assemblers or disassemblers that allow dw/defw etc directives with specified endianness?

I've been working with reverse engineering tape image and disk image formats and the files and filesystems they contain. It struck me that sometimes there are data fields that are not in the same ...
user avatar
2 votes
1 answer
47 views

Two copies to store values

I have this a piece of code, disassembled DX: .text:004386D3 push ecx .text:004386D4 fld1 .text:004386D6 fstp [esp+26Ch+var_26C] ;load 1.0 value ...
user avatar
  • 113
0 votes
1 answer
82 views

Why there are only 8 hexa memory digits while my RAM is 16G

I'm totally new to reverse engineering, when I start debugging my c program with radare2, and start showing assembly, I found that addresses are only 8 hexa digits, which means 16^8 = 4294967296 ...
user avatar
1 vote
0 answers
139 views

What to do with a text file of disassembly code and binaries?

I am fairly new to software reverse engineering and I'd like to know how proceed with analyzing a program if I have a text file of disassembly code and a bin file of binary data. I understand ...
user avatar
-1 votes
1 answer
95 views

Automatic decompilation from Assembly x86

Is there a tool to automatic decompile an assembly x86 code? What I need is a tool where I simply paste my code and it returns C code. Thanks
user avatar
2 votes
3 answers
237 views

High-level language decompiler on WIndows

So I have been using Binary ninja and I was wondering if there was any other tool except IDA or any binary ninja plugin that would transform assembly code into high level code, I already tried binja-...
user avatar
3 votes
1 answer
72 views

x86 disassembly confusion regarding VESA functions

I'm trying to disassemble an old DOS application and got stuck at some point of the VESA graphics handling. The VESA function to be called will be stored in a global variable, e.g. ...
user avatar
1 vote
1 answer
8k views

How to to decompile a pyinstaller exe, back to source code?

Python versions, this method has been tried on: 3.7.5, 3.6.0, 3.5.0, 2.7.17? (I know, I'm just too desperate to get my source back.) I have problem with decompiling an exe. I kind of deleted the ...
user avatar
1 vote
0 answers
47 views

Is it possible to define the adress of a function in assembly?

I am creating a PoC for anti-disassembly techniques, and I would like to know if there were ways to define the address of functions once compiled with gcc. Here is the PoC program : BITS 32 EXTERN ...
user avatar
  • 261
0 votes
0 answers
42 views

Which instruction at which address calls the address 0x1a95 or the address 0x204a in the following program or rather smart contract?

The Ethereum Virtual Machine uses a Virtual Instruction Set flavored for transaction processing that doesn’t use any registers and where all opcodes are a single byte long and have a single ABI for ...
user avatar
1 vote
2 answers
1k views

Difference between 32 bit and 64 bit disassemblers

As far as my level of understanding goes, the only difference between a 32 bit and 64 bit disassembler is that the produced assembler-code of a 32 bit disassembler is only using 32 bit assembly ...
user avatar
  • 15
5 votes
1 answer
4k views

How to do debug a running java process in linux?

TLDR I want to do live debugging of a java program on a linux machine, and don't how/what debugger to attach to the JVM to get this done. I expect that this is a well-solved problem, but I lack the ...
user avatar
1 vote
1 answer
341 views

what's meaning address inside disassembler

I'm recently start in reverse engineering filed. While working with the disassembler I asked myself:what the "address" label meant. For example here we have hopper image:https://www.hopperapp.com/...
user avatar
1 vote
0 answers
920 views

Turning p-code generated by VBA (Visual Basic for Applications) back into VBA

According to the README in https://github.com/bontchev/pcodedmp : "As each VBA line is entered into the VBA editor, it is immediately compiled into p-code" "when you open the source of a macro ...
user avatar
  • 11
3 votes
1 answer
609 views

Can you change the architecture in Ghidra after importing?

I've been analyzing an ARMv7 binary for a while and have done a lot of work with it (e.g. labeling functions, creating structs, labeling globals etc.). Unfortunately, I just realized that Ghidra ...
user avatar
2 votes
2 answers
1k views

NSA Ghidra 9 - Is the decompiler open source?

I recently downloaded Ghidra (link) ver 9 on windows. The decompiler feature is presumable found at <GHIDRA_HOME>\Ghidra\Features\Decompiler There is a lib folder containing the Java code. ...
user avatar
  • 257
3 votes
2 answers
1k views

Can I stop Ghidra from creating extended references?

I'm trying to disassemble some 6502 using Ghidra. The following (prerequisites: POSIX-style shell, Python 2.x) will generate a file called test.dat that demonstrates the issue: python -c "open('test....
user avatar
3 votes
1 answer
618 views

Why disassemble multi-thread binary is hard?

Why disassemble multi-thread binary is hard? I also know that some obfuscation techniques are to create unnecessary threads. But why reverse engineering multi-thread program is hard.
user avatar
3 votes
2 answers
3k views

Can Machine Learning be used to develop better reverse engineering tools? [duplicate]

So i googled this but other than some papers i couldnt find any reverse engineering tool that was built using machine learning I'm not an expert in machine learning and deep learning but it seems ...
user avatar
  • 197
3 votes
1 answer
162 views

Enumerating (name, addresses) in PLT of an ELF file without elf.h

I want to show users imported symbols of a given ELF file like this(#1) in a disassembler project.(Android app) 1d21a: f7fa e8e8 blx 173ec ; __android_log_print@plt ... Currently, I can only show ...
user avatar
1 vote
0 answers
280 views

Radare2: pd command ignores cfg.bigendian setting

I am currently using radare2 to disassemble a raw ARM binary (bootloader) in little endian format. I used the command e cfg.bigendian = false to set the endianness, but the pd command seems to ignore ...
user avatar
  • 11
7 votes
2 answers
1k views

Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll

As a pentester for a consulting agency, it is part of our job to "evade" antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, ...
user avatar
  • 123