Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [disassemblers]

A disassembler is a software tool which transforms machine code into a human readable mnemonic representation called assembly language.

Filter by
Sorted by
Tagged with
1
vote
0answers
34 views

Is it possible to define the adress of a function in assembly?

I am creating a PoC for anti-disassembly techniques, and I would like to know if there were ways to define the address of functions once compiled with gcc. Here is the PoC program : BITS 32 EXTERN ...
0
votes
0answers
39 views

Which instruction at which address calls the address 0x1a95 or the address 0x204a in the following program or rather smart contract?

The Ethereum Virtual Machine uses a Virtual Instruction Set flavored for transaction processing that doesn’t use any registers and where all opcodes are a single byte long and have a single ABI for ...
0
votes
1answer
90 views

Difference between 32 bit and 64 bit dissasemblers

As far as my level of understanding goes, the only difference between a 32 bit and 64 bit dissasembler is that the produced assembler-code of a 32 bit dissasembler is only using 32 bit assemby ...
3
votes
0answers
173 views

How to do debug a running java process in linux?

TLDR I want to do live debugging of a java program on a linux machine, and don't how/what debugger to attach to the JVM to get this done. I expect that this is a well-solved problem, but I lack the ...
1
vote
1answer
76 views

what's meaning address inside disassembler

I'm recently start in reverse engineering filed. While working with the disassembler I asked myself:what the "address" label meant. For example here we have hopper image:https://www.hopperapp.com/...
0
votes
0answers
94 views

Turning p-code generated by VBA (Visual Basic for Applications) back into VBA

According to the README in https://github.com/bontchev/pcodedmp : "As each VBA line is entered into the VBA editor, it is immediately compiled into p-code" "when you open the source of a macro ...
1
vote
0answers
104 views

Can you change the architecture in Ghidra after importing?

I've been analyzing an ARMv7 binary for a while and have done a lot of work with it (e.g. labeling functions, creating structs, labeling globals etc.). Unfortunately, I just realized that Ghidra ...
2
votes
1answer
800 views

NSA Ghidra 9 - Is the decompiler open source?

I recently downloaded Ghidra (link) ver 9 on windows. The decompiler feature is presumable found at <GHIDRA_HOME>\Ghidra\Features\Decompiler There is a lib folder containing the Java code. ...
2
votes
2answers
600 views

Can I stop Ghidra from creating extended references?

I'm trying to disassemble some 6502 using Ghidra. The following (prerequisites: POSIX-style shell, Python 2.x) will generate a file called test.dat that demonstrates the issue: python -c "open('test....
3
votes
1answer
155 views

Why disassemble multi-thread binary is hard?

Why disassemble multi-thread binary is hard? I also know that some obfuscation techniques are to create unnecessary threads. But why reverse engineering multi-thread program is hard.
2
votes
2answers
1k views

Can Machine Learning be used to develop better reverse engineering tools? [duplicate]

So i googled this but other than some papers i couldnt find any reverse engineering tool that was built using machine learning I'm not an expert in machine learning and deep learning but it seems ...
3
votes
1answer
100 views

Enumerating (name, addresses) in PLT of an ELF file without elf.h

I want to show users imported symbols of a given ELF file like this(#1) in a disassembler project.(Android app) 1d21a: f7fa e8e8 blx 173ec ; __android_log_print@plt ... Currently, I can only show ...
1
vote
0answers
81 views

Radare2: pd command ignores cfg.bigendian setting

I am currently using radare2 to disassemble a raw ARM binary (bootloader) in little endian format. I used the command e cfg.bigendian = false to set the endianness, but the pd command seems to ignore ...
7
votes
2answers
546 views

Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll

As a pentester for a consulting agency, it is part of our job to "evade" antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, ...
3
votes
1answer
218 views

Disassembly - Why the CMP instruction is multiplying by 2 the value being compared

I'll get right to the point, I have a crack me program, that is a program with a password inside that needs to be found so that you can complete the challenge. I easily found the cmp instruction ...
5
votes
4answers
1k views

Can AI be used to write better decompilers/disassemblers? [closed]

In the past for years I used some disassembler and tried some decompiler, nowadays there's so much talking and stuff about deep learning and AI, I wonder if some can be used with those tasks (given ...
0
votes
1answer
293 views

Know which bytes are opcode and which operands in IDA

I want to extract a generic signature of a function in IDA and wanted to use just the opcodes of the instructions without its operands. Example: From the first instruction I want to know the bytes ...
0
votes
1answer
1k views

How to extract firmware from a chip ( snarfing) [closed]

Is there anyone who can guide me how do i do snarfing of firmware on a chip of a VIN Tuner. Is there anyone who can do it ? Please respond if you can do it. Ty Vj
1
vote
1answer
295 views

Disassembler for Renesas RX62 micro

Does anybody know a free disassembler tool for decoding a Renesas RX62 micrcocontroller binary file? There had been www.onlinedisassembler.com, but this site is down and the new beta....
0
votes
2answers
1k views

OnlineDisassembler is down - any alternative?

Since weeks my beloved and favorite site www.onlinedisassembler.com is down and shows server error 500. Does anybody know any alternative for trying different microcontroller architetures on an ...
1
vote
1answer
361 views

Capstone: What's the purpose of the 'address' argument in cs_disasm()?

I'm trying to play around with the Capstone Disassembler in C. In the documentation they show the following use of the cs_disasm() function: from here count = cs_disasm(handle, CODE, sizeof(CODE)-1, ...
0
votes
2answers
482 views

Windasm32 cant allocate enough memory to display 151680 lines

Hey I was using Windasm32 today and I loaded a .dll file and it told me this I tried to increase my virtual memory on windows 10 to 12000 and the max to 12000 and restarted the computer and ran ...
2
votes
1answer
120 views

Can I step through a binary with IDA (eval version), reading registers step-wise?

I am new to disassembly, and I'm trying to understand how a 32 bit binary is operating. I have the evaluation (free) version, 32 bit (Version 7.0.170920 macOS x86_64 (32-bit address size)). I'm used ...
2
votes
3answers
1k views

Radare produces a bunch of `add byte [rax], al`, but why?

What does a bunch of add byte [rax], al mean? I see a lot of memory addressing point to specific parts of the shared library (.dll) that have for instance, this... 0x10064faf8 0000 ...
1
vote
1answer
232 views

Tools to translate x86-64 ELF to PPC (or i386 decompilation)

I've been working on a project on an IBM POWER8 system. I'd like to translate some very simple binaries from x86-64 to PPC. Is there a tool that can either: Translate the binary from x86-64 to PPC (...
-1
votes
2answers
515 views

extract opcodes using radare

When we have many binaries, there is a python base solution for disassemble and extract opcodes from binaries in IDA program. Is there any or similar solution to disassemble binaries for Radare2?
0
votes
1answer
148 views

IDA Python recognize same register

As shown in the picture below, IDA PRO (6.8) knows to recognize that al and eax are referencing the same register. Given two operands in IDA Python (i.e. by idc.GetOpnd(..)), how can I find that ...
1
vote
1answer
782 views

Elf file format finding .got and .got.plt segments

I'm writing ELF parser and simple disassembler x86. Having code like this .text:000B5A2A call 0000B470 ;e.g. _glXSwapBuffers ... ... got.plt:0000B470 jmp dword ptr [ebx+240h] ;jump to ....
0
votes
1answer
62 views

Help with animation function

I'm trying to find the function which is animating a bot ingame (singleplayer). I already figured out the animation state value with Cheat Engine. Freezing that value lets the bot repeat the animation ...
1
vote
0answers
635 views

Reverse Intel hex to programming code

I have a file in the Intel hex format, which was taken of from a pic16F1705 chip. I need to find a way to disassemble it into some form of human friendly programming language in order to make some ...
3
votes
5answers
4k views

Do you need a 64 bit disassembler like IDA Pro to disassemble 64 bit code?

My question is simply can you reverse a 64 bit compiled code using a 64 bit disassembler (like IDA Pro 64 bit) or can you use a 32 bit code disassembler. I'm a little confused.
5
votes
1answer
584 views

How to Make .text Section in Assembly Writeable for Win7-64 EXE

I have a basic XOR decoder that functions perfectly in Linux, but when I try to move it over to an exe in windows, it fails. I am leaving this question open for historical reference since the issue ...
7
votes
2answers
2k views

idapython - Get Xrefs to a stack variable

I am trying to write an IDAPython script that will return a list of references to a local stack-frame variable. However, I couldn't find any API that does so. What I am trying to achieve is a code ...
3
votes
1answer
330 views

How does the 'graphic views' on Hopper Disassembler work?

I would like to understand better what is that information on "graphic views" at the inspector of Hopper Disassembler. I've checked the tutorial but it just skips this section. Thanks.
1
vote
2answers
142 views

Real-time changes of executable on IDE/Assembler

I'm new on this, sorry for bad usage of terms or overextending an explanation. I'm learning code languages and the way I found to bring it to my world so I can learn it better was coding for/with ...
1
vote
1answer
597 views

MSP430 - IDA Pro Free Binary Dump

I have a assembly dump from a MSP430 binary in a normal ascii text file as below: 46f4 <strcpy> 46f4: 0d4f mov r15, r13 46f6: 023c jmp #0x46fc <strcpy+0x8> 46f8: ...
4
votes
1answer
677 views

Is it safe to load a virus to IDA Pro?

In other words, Is it safe to load a malware into IDA Pro on my personal machine? Would IDA Pro run the sample or load it into memory?
1
vote
1answer
478 views

Understanding the variables in stack layout

i am reading the "The Grey Hat Hacking-The ethical hacker's Handbook".The book is nice ,but there is a doubt on a particular subject.In the vulnerability analysis chapter it is trying to analyze a ...
3
votes
1answer
338 views

How can the problem posed for disassembly by the admixture of executable code and literal pools in ARM firmware be overcome?

It's probably too soon for me to ask about this since I'm not familiar with ARM but it's been bothering me for a while now so I'm going to ask anyway. Context and Background Information Part 1: ARM ...
1
vote
1answer
585 views

Android Native Library - How to match java references to sub_XXX function (static way)

I'm currently learning how native functions are implemented among the ELF SO files contained inside an APK. I'm using IDA. Native calls are always achieved in this way. // First load the library ...
5
votes
1answer
811 views

What type of disassembler is distorm?

In Alam you can find the classical differentiation between disassemblers. The author explains in general the two well known types of disassemblers: The Linear Sweep technique starts from the ...
14
votes
1answer
31k views

Objdump - How to output text (eg ASCII strings) alongside assembly code?

Aim: I want to take hex and ascii data (derived from a binary file using xxd) and use Objdump (or a suitable other tool that Linux comes with) to output the memory addresses / offsets, assembly code, ...
0
votes
1answer
177 views

How do I Reverse Firmwares? [closed]

How do I Reverse Firmware? What is firmware binary?
1
vote
1answer
606 views

C++ to assembly, GCC vs CL

I have following C++ code: int main(){ int a = 1; double d = 1.2; return 0; } and get the following assembly using GCC 6.2 -m32: main: lea ecx, [esp+4] and esp, -8 ...
3
votes
2answers
1k views

How to find obfuscated hidden command line parameters?

The Amazon KindleGen command line app (Windows, macOS, Linux download links) has several undocumented command line parameters that I'm curious about. One of these hidden command line parameters is: -...
1
vote
1answer
272 views

IDA Pro addresses of arguments

I am a newbie in reverse engineering and I was trying to understand this blog post: http://0x0atang.github.io/reversing/2015/09/17/flareon2-concolic.html At one point, the author says the following ...
-1
votes
1answer
307 views

winmain reversing the assembly to c code

this is I got so far #include <windows.h> int WinMain(HINSTANCE hlnst,HINSTANCE hPrev, LPSTR lpCmd,int nShow){ int k =0; int j= 0 ; MessageBox(0,"crackname","",0); int i; ...
0
votes
0answers
40 views

What does the number after '@' symbol mean in IDA disassembly? [duplicate]

As you can see, IDA disassembly shows r0@1, r5@5, [sp+0h] [bp-18h]@7 etc. Presuming r0, r5 to be registers and [sp+0h] [bp-18h] to be a memory location, what does the number at the end signify?
0
votes
3answers
2k views

Mips disassembler

So, I am looking for disassembler code for MIPS commands, for example: if the program gets word of command like 3c1d8010, I want to get the name of the command and the registers, which it uses: lui sp,...
1
vote
2answers
4k views

Getting past a whole lot of anti-debug measures for a windows exe

I'm trying to debug a windows exe that is really full of anti-debug measures. It has pretty much everything you can think of DBGuiremotebreakin, Ntsetinformationthread, NtQueryInformationProcess, the ...