Questions tagged [disassemblers]
A disassembler is a software tool which transforms machine code into a human readable mnemonic representation called assembly language.
106
questions
0
votes
1answer
88 views
IDA/HexRays: how do I retrieve the memory address associated with a given line of decompiled code?
I'm trying to programmatically link decompiled code generated by HexRays with the disassembly code of a given binary by mapping memory addresses between the two. The mapping exists, as I can see view ...
0
votes
0answers
35 views
Lexer and parser for .asm file produced by objdump
Is there any existing project that parses the x86 disassembly file or .asm produced by the objdump or IDA pro using the lexer and parser library in python or any other programming language?
0
votes
0answers
37 views
String as constant , even not visible in disassembler
I was reading this article Where I saw that while reversing the WinRAR I saw that the x64dbg is not able to search for a string in all modules "evaluation copy". but why is that happening. ...
0
votes
1answer
51 views
Variable location address
There is variable in data section:
.data:00427000 dword_427000 dd 64h
Base address of code is:
.text:00411000 ; Segment type: Pure code
How to calculate actual address and location in memory of ...
0
votes
1answer
35 views
what means “ilegal use of registers”?
I read pe program using a Pe Reader to view all sections, the .text section starts is "0x0001000":
What is in the pe program reader:
And is this what i see on the debugguer :
1
vote
2answers
80 views
How to determine ARM architecture from the ELF file extracted from the firmware?
I have extracted the ELF file from the flash dump of a printer, I cannot find too much information about the SoC chip on the printer. What's the best practice to determine the ARM architecture (ARMv7-...
0
votes
1answer
45 views
Recognize of data block
Assembler code from data segment:
.data:006A5038 dword_6A5038 dd 0
.data:006A5038
.data:006A503C ; char *off_6A503C
.data:006A503C off_6A503C dd offset aOption0
.data:...
1
vote
1answer
116 views
How do disassemblers work?
I have 2 questions regarding this, but feel free to elaborate more if you want to, I'm really interested in this topic:
Do they really just read byte by byte until they get a valid instruction? How ...
2
votes
1answer
45 views
Two copies to store values
I have this a piece of code, disassembled DX:
.text:004386D3 push ecx
.text:004386D4 fld1
.text:004386D6 fstp [esp+26Ch+var_26C] ;load 1.0 value ...
3
votes
1answer
291 views
Can you change the architecture in Ghidra after importing?
I've been analyzing an ARMv7 binary for a while and have done a lot of work with it (e.g. labeling functions, creating structs, labeling globals etc.). Unfortunately, I just realized that Ghidra ...
1
vote
1answer
36 views
Are there some assemblers or disassemblers that allow dw/defw etc directives with specified endianness?
I've been working with reverse engineering tape image and disk image formats and the files and filesystems they contain.
It struck me that sometimes there are data fields that are not in the same ...
0
votes
1answer
70 views
Why there are only 8 hexa memory digits while my RAM is 16G
I'm totally new to reverse engineering, when I start debugging my c program with radare2, and start showing assembly, I found that addresses are only 8 hexa digits, which means 16^8 = 4294967296 ...
1
vote
0answers
50 views
What to do with a text file of disassembly code and binaries?
I am fairly new to software reverse engineering and I'd like to know how proceed with analyzing a program if I have a text file of disassembly code and a bin file of binary data. I understand ...
3
votes
1answer
365 views
IDA Pro addresses of arguments
I am a newbie in reverse engineering and I was trying to understand this blog post:
http://0x0atang.github.io/reversing/2015/09/17/flareon2-concolic.html
At one point, the author says the following ...
-1
votes
1answer
52 views
Automatic decompilation from Assembly x86
Is there a tool to automatic decompile an assembly x86 code?
What I need is a tool where I simply paste my code and it returns C code.
Thanks
5
votes
1answer
1k views
How to do debug a running java process in linux?
TLDR I want to do live debugging of a java program on a linux machine, and don't how/what debugger to attach to the JVM to get this done.
I expect that this is a well-solved problem, but I lack the ...
26
votes
8answers
38k views
Decompiling a 1990 DOS application
I have some crucial data written decades ago by an ancient 16bit DOS application. There are no docs, no source, and no information about the author. Just the 16 bit exe. I guess it's time for me to ...
1
vote
2answers
147 views
High-level langage decompiler on WIndows
So I have been using Binary ninja and I was wondering if there was any other tool except IDA or any binary ninja plugin that would transform assembly code into high level code, I already tried binja-...
1
vote
1answer
2k views
How to extract firmware from a chip ( snarfing) [closed]
Is there anyone who can guide me how do i do snarfing of firmware on a chip of a VIN Tuner.
Is there anyone who can do it ?
1
vote
1answer
3k views
How to to decompile a pyinstaller exe, back to source code?
Python versions, this method has been tried on: 3.7.5, 3.6.0, 3.5.0, 2.7.17? (I know, I'm just too desperate to get my source back.)
I have problem with decompiling an exe. I kind of deleted the ...
3
votes
1answer
69 views
x86 disassembly confusion regarding VESA functions
I'm trying to disassemble an old DOS application and got stuck at some point of the VESA graphics handling.
The VESA function to be called will be stored in a global variable, e.g. ...
1
vote
2answers
492 views
Difference between 32 bit and 64 bit disassemblers
As far as my level of understanding goes, the only difference between a 32 bit and 64 bit disassembler is that the produced assembler-code of a 32 bit disassembler is only using 32 bit assembly ...
1
vote
0answers
39 views
Is it possible to define the adress of a function in assembly?
I am creating a PoC for anti-disassembly techniques, and I would like to know if there were ways to define the address of functions once compiled with gcc.
Here is the PoC program :
BITS 32
EXTERN ...
0
votes
0answers
41 views
Which instruction at which address calls the address 0x1a95 or the address 0x204a in the following program or rather smart contract?
The Ethereum Virtual Machine uses a Virtual Instruction Set flavored for transaction processing that doesn’t use any registers and where all opcodes are a single byte long and have a single ABI for ...
3
votes
1answer
125 views
Enumerating (name, addresses) in PLT of an ELF file without elf.h
I want to show users imported symbols of a given ELF file like this(#1) in a disassembler project.(Android app)
1d21a: f7fa e8e8 blx 173ec ; __android_log_print@plt ...
Currently, I can only show ...
1
vote
1answer
188 views
what's meaning address inside disassembler
I'm recently start in reverse engineering filed. While working with the disassembler I asked myself:what the "address" label meant. For example here we have hopper image:https://www.hopperapp.com/...
1
vote
0answers
521 views
Turning p-code generated by VBA (Visual Basic for Applications) back into VBA
According to the README in https://github.com/bontchev/pcodedmp :
"As each VBA line is entered into the VBA editor, it is immediately compiled into p-code"
"when you open the source of a macro ...
26
votes
5answers
42k views
What is the linux equivalent to OllyDbg and Ida Pro?
What is the Linux equivalent to OllyDbg and IDA Pro ? Or if there are multiple tools that do the various functions that OllyDbg and IDA Pro do, where can I find these tools? I'd like to start ...
3
votes
3answers
2k views
Radare produces a bunch of `add byte [rax], al`, but why?
What does a bunch of add byte [rax], al mean? I see a lot of memory addressing point to specific parts of the shared library (.dll) that have for instance, this...
0x10064faf8 0000 ...
2
votes
2answers
2k views
Can Machine Learning be used to develop better reverse engineering tools? [duplicate]
So i googled this but other than some papers i couldnt find any reverse engineering tool that was built using machine learning
I'm not an expert in machine learning and deep learning but it seems ...
303
votes
16answers
353k views
Is there any disassembler to rival IDA Pro?
Is there any disassembler (not only a live debugger) second to IDA in capabilities? IDA is wonderful, and somewhat amazing in how robust and useful it is for reversing. However, it is quite expensive ...
5
votes
2answers
3k views
idapython - Determine if item is code or data
I need to determine whether an IDA's item is code or data.
Sometimes, data resides in an executable's code section (virtual functions tables, switch tables and stuff).
So in IDA, you can sometimes see ...
2
votes
1answer
1k views
NSA Ghidra 9 - Is the decompiler open source?
I recently downloaded Ghidra (link) ver 9 on windows.
The decompiler feature is presumable found at
<GHIDRA_HOME>\Ghidra\Features\Decompiler
There is a lib folder containing the Java code. ...
3
votes
2answers
1k views
Can I stop Ghidra from creating extended references?
I'm trying to disassemble some 6502 using Ghidra. The following (prerequisites: POSIX-style shell, Python 2.x) will generate a file called test.dat that demonstrates the issue:
python -c "open('test....
3
votes
1answer
332 views
Why disassemble multi-thread binary is hard?
Why disassemble multi-thread binary is hard? I also know that some obfuscation techniques are to create unnecessary threads. But why reverse engineering multi-thread program is hard.
7
votes
2answers
883 views
Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll
As a pentester for a consulting agency, it is part of our job to "evade" antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, ...
1
vote
0answers
156 views
Radare2: pd command ignores cfg.bigendian setting
I am currently using radare2 to disassemble a raw ARM binary (bootloader) in little endian format. I used the command e cfg.bigendian = false to set the endianness, but the pd command seems to ignore ...
30
votes
5answers
9k views
Why there are not any disassemblers that can generate re-assemblable asm code?
I am struggling on this problem for around three months:
How to use disassemblers (IDA Pro and others...) to generate re-assemblable asm code and assemble it back
My experience is that:
There is NO ...
3
votes
1answer
290 views
Disassembly - Why the CMP instruction is multiplying by 2 the value being compared
I'll get right to the point, I have a crack me program, that is a program with a password inside that needs to be found so that you can complete the challenge.
I easily found the cmp instruction ...
6
votes
4answers
2k views
Can AI be used to write better decompilers/disassemblers? [closed]
In the past for years I used some disassembler and tried some decompiler, nowadays there's so much talking and stuff about deep learning and AI, I wonder if some can be used with those tasks (given ...
2
votes
1answer
135 views
Can I step through a binary with IDA (eval version), reading registers step-wise?
I am new to disassembly, and I'm trying to understand how a 32 bit binary is operating. I have the evaluation (free) version, 32 bit (Version 7.0.170920 macOS x86_64 (32-bit address size)).
I'm used ...
0
votes
1answer
404 views
Know which bytes are opcode and which operands in IDA
I want to extract a generic signature of a function in IDA and wanted to use just the opcodes of the instructions without its operands.
Example:
From the first instruction I want to know the bytes ...
1
vote
1answer
413 views
Disassembler for Renesas RX62 micro
Does anybody know a free disassembler tool for decoding a Renesas RX62 micrcocontroller binary file? There had been www.onlinedisassembler.com, but this site is down and the new beta....
0
votes
2answers
2k views
OnlineDisassembler is down - any alternative?
Since weeks my beloved and favorite site www.onlinedisassembler.com is down and shows server error 500.
Does anybody know any alternative for trying different microcontroller architetures on an ...
1
vote
1answer
621 views
Capstone: What's the purpose of the 'address' argument in cs_disasm()?
I'm trying to play around with the Capstone Disassembler in C.
In the documentation they show the following use of the cs_disasm() function:
from here
count = cs_disasm(handle, CODE, sizeof(CODE)-1, ...
0
votes
2answers
1k views
Windasm32 cant allocate enough memory to display 151680 lines
Hey I was using Windasm32 today and I loaded a .dll file and it told me this
I tried to increase my virtual memory on windows 10 to 12000 and the max to 12000 and restarted the computer and ran ...
1
vote
1answer
357 views
Tools to translate x86-64 ELF to PPC (or i386 decompilation)
I've been working on a project on an IBM POWER8 system. I'd like to translate some very simple binaries from x86-64 to PPC.
Is there a tool that can either:
Translate the binary from x86-64 to PPC (...
0
votes
1answer
181 views
IDA Python recognize same register
As shown in the picture below, IDA PRO (6.8) knows to recognize that al and eax are referencing the same register.
Given two operands in IDA Python (i.e. by idc.GetOpnd(..)), how can I find that ...
-1
votes
2answers
644 views
extract opcodes using radare
When we have many binaries, there is a python base solution for disassemble and extract opcodes from binaries in IDA program.
Is there any or similar solution to disassemble binaries for Radare2?
18
votes
1answer
42k views
Objdump - How to output text (eg ASCII strings) alongside assembly code?
Aim: I want to take hex and ascii data (derived from a binary file using xxd) and use Objdump (or a suitable other tool that Linux comes with) to output the memory addresses / offsets, assembly code, ...
