Questions tagged [disassemblers]

A disassembler is a software tool which transforms machine code into a human readable mnemonic representation called assembly language.

Filter by
Sorted by
Tagged with
1 vote
1 answer
98 views

how to diassemble an .obj file

I'm new to programming and recently studying an ancient DOS assembly program written for 80186 and assembled with MASM. There are some .obj files that I want to open and take a look. I tried obj2asm....
skyforest's user avatar
3 votes
0 answers
110 views

Reverse DLL and EXE at the same time?

I started reversing a 32-bit x86 EXE that led me down the path of finding the structure and core functions I needed inside of a DLL. I'm currently using Binary Ninja 3.5 as my disassembler, decompiler,...
TyCobb's user avatar
  • 131
1 vote
0 answers
84 views

How can I make IDA disassemble in NASM-like syntax instead of MASM-like syntax?

I'm new to reverse engineering, assembly and IDA and I'm learning NASM. Whenever I load an executable (a PE file or an ELF) IDA disassembles it using a MASM-like syntax (it looks to me that it does) ...
LyZeN77's user avatar
  • 11
0 votes
0 answers
96 views

How do I properly decode the .bin files (RLE compression)? (DOS game - 1988)

Does anyone know what tools should I use to extract the backgrounds and sprites of this very rare old game: Armorik the Viking? The files are in .BIN format. Compression is RLE The game is from 1988 ...
The Thinker's user avatar
4 votes
2 answers
178 views

Change code segment with disassemblers like IDA

Do disassemblers like IDA or Ghidra change write rules on code segment of a process to change instructions? For example one can place NOP instead of a function call, so it should have RWX instead only ...
Balora's user avatar
  • 41
2 votes
0 answers
70 views

Angr considers REP instruction as the end of a basic block

I'm developing a python script for angr that has to find all the basic blocks present in each function in a binary. I have noticed that angr splits the basic blocks when it finds a REP instruction, I'...
Luca's user avatar
  • 121
1 vote
1 answer
199 views

IDAPython doesn't recognize function

I'm developing a python script for IDA Pro that analyzes 32 bit PE files containing an anti-disassembly technique, the problem is that the function that contains the technique isn't being listed in ...
Luca's user avatar
  • 121
2 votes
0 answers
183 views

In IDA freeware, how to create a new database in IDC and load a file into it?

I have IDA freeware version 5 and version 8, v5 is running on wine, v8 is directly on kali OS, and I am trying to create an IDC script to generate asm+lst files for all files in a certain folder. What ...
IDAIDCMalAnalysis's user avatar
2 votes
0 answers
148 views

Does AnyOne knows how to reverse python file that is encoded into elf binary .cpython-310.so extension? Please Help me Out

Following is the link to the file that I want to reverse. This is the python file that is encoded in cpython or cython and it is now a binary file. Please help me to decode it as it is very important ...
Jameel Safdar's user avatar
2 votes
0 answers
138 views

Access a XREFs with frida

I have a string which has a XREF to a func. This func changes of address at every updates of the app I am working on. So this string is the only "stable" point I can rely on to access to ...
hmngwn's user avatar
  • 51
2 votes
1 answer
117 views

Clean Angr disassemble output

I'm developing a python script for Angr that has to print as output something in the form of: Instruction_disassembled opcode_bytes_of_instruction This is my python script: f = open(sys....
Luca's user avatar
  • 121
2 votes
1 answer
430 views

frida hook `loc_*` or `sub_*`

Is it possible to hook a sub_... object in Frida ? I disassembled an arm64 executable, when running the app on my iPhone, I can see a lot of classes also in the disassembled executable, but I can't ...
hmngwn's user avatar
  • 51
2 votes
0 answers
114 views

Assemby reverse engineering

I'm new to assembly and need some help understanding what this program does. This program takes a username and serial. If the combination is correct, it prints the magic words. I need to write a ...
TN_stud's user avatar
  • 21
2 votes
0 answers
308 views

how to find a string in memory having ARM instructions ARDP and LDR?

hello, I disassembled the request sent to the game server, I need to change the symbol, but I don’t know its memory address. Help me understand the ADRP and LDR instructions, I need to understand what ...
qazwsx135's user avatar
0 votes
1 answer
487 views

Missing mnemonics '??' in Ghidra Assembly Code

I was just trying to google and search for "??" Ghidra with no luck. I am trying to understand what the following questions mean in this Binary (meant for SuperH2 SH-2 processor) which is ...
Aeonitis's user avatar
  • 101
1 vote
1 answer
96 views

Capstone not disassembling vpunpcklqdq, vprold, and vshufi32x4

I am trying to disassemble a binary using Capstone. I noticed that there are some instructions that cannot be disassembled, e.g. the vshufi32x4 instruction: from capstone import * from capstone.x86 ...
langlauf.io's user avatar
  • 1,560
2 votes
0 answers
80 views

LG C1 Firmware Flashing/Modifying

I have a new TV that is smart enough to not have options and configuration I can actually use, and worse of all my tv changes all setting like brightness, sharpness, warmth and input setting to what ...
GrandmaNeedsHelp's user avatar
1 vote
0 answers
64 views

Wrong access .data segment

Preface I'm a PHP programmer, in my spare time I've been doing reverse work. Achieved good progress in the analysis game. But there was a big problem on my way. And now, more than ever, i need the ...
 Blezigen 's user avatar
1 vote
0 answers
99 views

Capstone Disassembler to Extract OpCode from Malware and Benign Executables in C++

The project that I am trying to develop has as a vital component, specifically a machine learning based malware detection system. The way in which I decided to teach the detection system in order to ...
def's user avatar
  • 31
1 vote
0 answers
103 views

Disassemble Executable Automatically in C++

I have 2 types of files, namely benign and malware. I would like to build a malware detection system based on the assembly language used by these files, by using machine learning. The language that I ...
def's user avatar
  • 31
1 vote
1 answer
413 views

How to locate memory address in register $esp

000011d9 <main>: 11d9: 8d 4c 24 04 lea 0x4(%esp),%ecx 11dd: 83 e4 f0 and $0xfffffff0,%esp 11e0: ff 71 fc push -0x4(%ecx) 11e3: ...
user40564's user avatar
1 vote
2 answers
2k views

is there a tool to decompile old exe to C?

I follow the free software implementation of OpenRCT2 from the beggining (when it was in other repository). And the first commits are a bunch of C files, these files has a lot of asm blocks of code ...
tres.14159's user avatar
1 vote
0 answers
68 views

Is disassembly of standard gcc programs trivial, or just as difficult as video game ROMs?

I am attempting to do some reverse-engineering of ARM binaries, with the ultimate goal of reverse-engineering GBA ROMs. Of course, GBA ROMs contain a mixture of code and data, so a standard ...
JBraha's user avatar
  • 133
1 vote
1 answer
98 views

File not want to patch. Radare2

I am learning by doing some cracking in files that i made in C. One of this files is this: file.c: #include <stdio.h> #include <stdlib.h> int main() { char s[15] = "...
Guilherme's user avatar
  • 113
1 vote
1 answer
166 views

Creating table with IDAPython

I'd like to create the table like below, I could not found any clue while googling it. Is it possible to make table with IDAPython, especially with idaapi.simplecustviewer_t class? Any advises would ...
Jiwon's user avatar
  • 153
1 vote
0 answers
103 views

Function Arguments/Name on Radare and IDA

I am starting with reverse engineering and Radare and I'm facing the following problem, on IDA Free I see the following code: mov ecx, 11h lea edi, [esp+1208h+StartupInfo] rep stosd lea ...
secjav's user avatar
  • 11
-1 votes
1 answer
738 views

How to understand the result of disassembling IDA Pro (dll x86_64)

I'm studying the dll that was built for x86_64. I study where there are links to the function "call_f1_1806F3630" and do not understand three of them. Are these features of OOP? Help me ...
mlr's user avatar
  • 21
2 votes
0 answers
119 views

The method of searching for similar code in a binary file of a new release

Got into the hands of such a task. There are two dlls. As the second file was explained to me (new.dll) this is a new release of the first file (old.dll). Both files are compiled for x64. I need to ...
mlr's user avatar
  • 21
2 votes
2 answers
731 views

How to convert to float

.rdata:00414704 __real@c0800000 dd 0C0800000h How to convert this value 0C0800000h to float point number?
black4's user avatar
  • 333
1 vote
0 answers
56 views

Unrecognized function

There is function: push 65h push edi call sub_5D8750 In this case, function takes 65 bytes to be filled with zeros, and edi is memory address starting from which to fill these 65 bytes with ...
black4's user avatar
  • 333
4 votes
2 answers
600 views

On reverse engineering an udp protocol to control a drone

My goal is to control my drone with my raspberry pi using python and not the app that is being delivered together with it. First I connected the app to the drone, flew and used aircrack-ng to get the ...
Pascal Widmann's user avatar
2 votes
1 answer
455 views

Not able to understand the C-switch statement in disassembly

While I'm trying to disassemble my own C code I am stuck in a problem of not understanding how this Switch statement is implemented in assembly code. Can anyone please help to figure it out? This the ...
Ramesses II's user avatar
0 votes
1 answer
118 views

Is the code like this reverse able? (from Assembly - UnityScript)

i try to reverse this code but cant figure it out what is this number mean or how to call it...
EntryEmb's user avatar
12 votes
4 answers
6k views

Why do reversers nowadays reverse engineer using decompilers and not disassemblers?

I see many reverse engineering lessons and every second person does reverse engineer using Ghidra decompiler and not disassembler as both are available in the same platform. I assume that reversing ...
Ramesses II's user avatar
1 vote
0 answers
317 views

Disassembler with pixel/bitmap view

I am looking for an ARM disassembler that runs on Linux that has a graphic "pixel" or "bitmap" view like the one shown in the pictures below: I am reverse engineering some old ...
PJMOR's user avatar
  • 31
2 votes
1 answer
489 views

The Knowledge of Compiler for becoming a good Reverser

I just reached the the topic of Compilers in the book "Reversing:Secrets of Reverse Engineering" So, I want to ask, is the knowledge of Compilers necessary for becoming a Malware Reverse ...
Ramesses II's user avatar
0 votes
1 answer
270 views

Virtual functions call asm

It seems to be a virtual function call. How would this code look in a high-level language like C ++? .text:0053A745 loc_53A745: ; CODE XREF: sub_53A690+CEj .text:0053A745 ...
black4's user avatar
  • 333
0 votes
1 answer
121 views

Visual c compiler options

I ask if exist some c compiler option that can "keep" some imformation after compile that can be visible when I disassamble with IDA. This because I need to find a particular funciton with ...
user3449922's user avatar
0 votes
1 answer
837 views

IDA pro 7.5 - No previous fonts / color imports

For the past few years I've been using an ida color scheme which I created, that was very easy on my eyes with the previous versions of IDA Pro (<7.0). However, after start using version 7.5 I ...
rustam Shirinov's user avatar
1 vote
0 answers
172 views

Lexer and parser for .asm file produced by objdump

Is there any existing project that parses the x86 disassembly file or .asm produced by the objdump or IDA pro using the lexer and parser library in python or any other programming language?
soaj33's user avatar
  • 11
2 votes
1 answer
1k views

IDA/HexRays: how do I retrieve the memory address associated with a given line of decompiled code?

I'm trying to programmatically link decompiled code generated by HexRays with the disassembly code of a given binary by mapping memory addresses between the two. The mapping exists, as I can see view ...
TFD's user avatar
  • 21
0 votes
0 answers
198 views

String as constant , even not visible in disassembler

I was reading this article Where I saw that while reversing the WinRAR I saw that the x64dbg is not able to search for a string in all modules "evaluation copy". but why is that happening. ...
lucky thandel's user avatar
0 votes
1 answer
237 views

Variable location address

There is variable in data section: .data:00427000 dword_427000 dd 64h Base address of code is: .text:00411000 ; Segment type: Pure code How to calculate actual address and location in memory of ...
black4's user avatar
  • 333
0 votes
1 answer
143 views

what means "ilegal use of registers"?

I read pe program using a Pe Reader to view all sections, the .text section starts is "0x0001000": What is in the pe program reader: And is this what i see on the debugguer :
Loliconaoquadrado's user avatar
1 vote
2 answers
2k views

How to determine ARM architecture from the ELF file extracted from the firmware?

I have extracted the ELF file from the flash dump of a printer, I cannot find too much information about the SoC chip on the printer. What's the best practice to determine the ARM architecture (ARMv7-...
ItsSoHard's user avatar
0 votes
1 answer
62 views

Recognize of data block

Assembler code from data segment: .data:006A5038 dword_6A5038 dd 0 .data:006A5038 .data:006A503C ; char *off_6A503C .data:006A503C off_6A503C dd offset aOption0 .data:...
black4's user avatar
  • 333
1 vote
1 answer
274 views

How do disassemblers work?

I have 2 questions regarding this, but feel free to elaborate more if you want to, I'm really interested in this topic: Do they really just read byte by byte until they get a valid instruction? How ...
user33834's user avatar
1 vote
1 answer
51 views

Are there some assemblers or disassemblers that allow dw/defw etc directives with specified endianness?

I've been working with reverse engineering tape image and disk image formats and the files and filesystems they contain. It struck me that sometimes there are data fields that are not in the same ...
hippietrail's user avatar
2 votes
1 answer
48 views

Two copies to store values

I have this a piece of code, disassembled DX: .text:004386D3 push ecx .text:004386D4 fld1 .text:004386D6 fstp [esp+26Ch+var_26C] ;load 1.0 value ...
black4's user avatar
  • 333
0 votes
1 answer
93 views

Why there are only 8 hexa memory digits while my RAM is 16G

I'm totally new to reverse engineering, when I start debugging my c program with radare2, and start showing assembly, I found that addresses are only 8 hexa digits, which means 16^8 = 4294967296 ...
zyydoosh's user avatar
  • 111