Questions tagged [disassemblers]
A disassembler is a software tool which transforms machine code into a human readable mnemonic representation called assembly language.
114
questions
0
votes
1answer
186 views
IDA Python recognize same register
As shown in the picture below, IDA PRO (6.8) knows to recognize that al and eax are referencing the same register.
Given two operands in IDA Python (i.e. by idc.GetOpnd(..)), how can I find that ...
1
vote
1answer
1k views
Elf file format finding .got and .got.plt segments
I'm writing ELF parser and simple disassembler x86. Having code like this
.text:000B5A2A call 0000B470 ;e.g. _glXSwapBuffers
...
...
got.plt:0000B470 jmp dword ptr [ebx+240h] ;jump to ....
0
votes
1answer
75 views
Help with animation function
I'm trying to find the function which is animating a bot ingame (singleplayer). I already figured out the animation state value with Cheat Engine. Freezing that value lets the bot repeat the animation ...
1
vote
0answers
1k views
Reverse Intel hex to programming code
I have a file in the Intel hex format, which was taken of from a pic16F1705 chip. I need to find a way to disassemble it into some form of human friendly programming language in order to make some ...
3
votes
5answers
5k views
Do you need a 64 bit disassembler like IDA Pro to disassemble 64 bit code?
My question is simply can you reverse a 64 bit compiled code using a 64 bit disassembler (like IDA Pro 64 bit) or can you use a 32 bit code disassembler. I'm a little confused.
6
votes
1answer
748 views
How to Make .text Section in Assembly Writeable for Win7-64 EXE
I have a basic XOR decoder that functions perfectly in Linux, but when I try to move it over to an exe in windows, it fails. I am leaving this question open for historical reference since the issue ...
7
votes
2answers
3k views
idapython - Get Xrefs to a stack variable
I am trying to write an IDAPython script that will return a list of references to a local stack-frame variable. However, I couldn't find any API that does so.
What I am trying to achieve is a code ...
3
votes
1answer
395 views
How does the 'graphic views' on Hopper Disassembler work?
I would like to understand better what is that information on "graphic views" at the inspector of Hopper Disassembler. I've checked the tutorial but it just skips this section.
Thanks.
1
vote
2answers
154 views
Real-time changes of executable on IDE/Assembler
I'm new on this, sorry for bad usage of terms or overextending an explanation. I'm learning code languages and the way I found to bring it to my world so I can learn it better was coding for/with ...
1
vote
1answer
746 views
MSP430 - IDA Pro Free Binary Dump
I have a assembly dump from a MSP430 binary in a normal ascii text file as below:
46f4 <strcpy>
46f4: 0d4f mov r15, r13
46f6: 023c jmp #0x46fc <strcpy+0x8>
46f8: ...
4
votes
1answer
851 views
Is it safe to load a virus to IDA Pro?
In other words, Is it safe to load a malware into IDA Pro on my personal machine? Would IDA Pro run the sample or load it into memory?
1
vote
1answer
567 views
Understanding the variables in stack layout
i am reading the "The Grey Hat Hacking-The ethical hacker's Handbook".The book is nice ,but there is a doubt on a particular subject.In the vulnerability analysis chapter it is trying to analyze a ...
5
votes
1answer
478 views
How can the problem posed for disassembly by the admixture of executable code and literal pools in ARM firmware be overcome?
It's probably too soon for me to ask about this since I'm not familiar with ARM but it's been bothering me for a while now so I'm going to ask anyway.
Context and Background Information
Part 1: ARM ...
1
vote
1answer
712 views
Android Native Library - How to match java references to sub_XXX function (static way)
I'm currently learning how native functions are implemented among the ELF SO files contained inside an APK. I'm using IDA.
Native calls are always achieved in this way.
// First load the library ...
5
votes
1answer
962 views
What type of disassembler is distorm?
In Alam you can find the classical differentiation between disassemblers. The author explains in general the two well known types of disassemblers:
The Linear Sweep technique starts from the ...
19
votes
1answer
44k views
Objdump - How to output text (eg ASCII strings) alongside assembly code?
Aim: I want to take hex and ascii data (derived from a binary file using xxd) and use Objdump (or a suitable other tool that Linux comes with) to output the memory addresses / offsets, assembly code, ...
0
votes
1answer
185 views
1
vote
1answer
728 views
C++ to assembly, GCC vs CL
I have following C++ code:
int main(){
int a = 1;
double d = 1.2;
return 0;
}
and get the following assembly using GCC 6.2 -m32:
main:
lea ecx, [esp+4]
and esp, -8
...
3
votes
2answers
2k views
How to find obfuscated hidden command line parameters?
The Amazon KindleGen command line app (Windows, macOS, Linux download links) has several undocumented command line parameters that I'm curious about. One of these hidden command line parameters is:
-...
3
votes
1answer
383 views
IDA Pro addresses of arguments
I am a newbie in reverse engineering and I was trying to understand this blog post:
http://0x0atang.github.io/reversing/2015/09/17/flareon2-concolic.html
At one point, the author says the following ...
-1
votes
1answer
396 views
winmain reversing the assembly to c code
this is I got so far
#include <windows.h>
int WinMain(HINSTANCE hlnst,HINSTANCE hPrev, LPSTR lpCmd,int nShow){
int k =0;
int j= 0 ;
MessageBox(0,"crackname","",0);
int i;
...
0
votes
0answers
43 views
What does the number after '@' symbol mean in IDA disassembly? [duplicate]
As you can see, IDA disassembly shows r0@1, r5@5, [sp+0h] [bp-18h]@7 etc. Presuming r0, r5 to be registers and [sp+0h] [bp-18h] to be a memory location, what does the number at the end signify?
0
votes
3answers
3k views
Mips disassembler
So, I am looking for disassembler code for MIPS commands, for example: if the program gets word of command like 3c1d8010, I want to get the name of the command and the registers, which it uses: lui sp,...
1
vote
2answers
5k views
Getting past a whole lot of anti-debug measures for a windows exe
I'm trying to debug a windows exe that is really full of anti-debug measures. It has pretty much everything you can think of DBGuiremotebreakin, Ntsetinformationthread, NtQueryInformationProcess, the ...
5
votes
2answers
3k views
idapython - Determine if item is code or data
I need to determine whether an IDA's item is code or data.
Sometimes, data resides in an executable's code section (virtual functions tables, switch tables and stuff).
So in IDA, you can sometimes see ...
1
vote
2answers
3k views
How to Find All Switch Jump Tables in IDAPython
I'm using IDAPython on IDA 6.5 and I'm trying to get all the switch jump tables in a DLL. Mainly I'm interested in jump tables that are jumped indirectly:
jmp ds:off_65018790[ecx*4] ; switch jump
...
0
votes
1answer
632 views
How can I read the assembly instructions of a C program from C#?
I want to be able to do what an ordinary disassembler doesālist the assembler instructions of an arbitrary executableābut from C#. It would consist, for instance, of finding a specific instruction ...
2
votes
2answers
1k views
Radare2 to show code hints like IDA Pro?
I am trying to disassemble a binary with radare2, as a free alternative to IDA. Here is how the IDA disassembly of that section looks like :
Here is what I am doing with Radare2 (with an additional ...
0
votes
2answers
267 views
Are there Disassembler for Mac which supports scripting
Are there any disassemblers for Mac that comes in freeware. I have installed radare2 but finding difficult to use.
0
votes
2answers
3k views
LLDB disassembler not working, using command terminal,on mac el captain?
I have created simple code to test using lldb . This is the first time i am using lldb and i am familiar with gdb. while i am trying to disassemble the unix executable file its not working any ...
3
votes
2answers
955 views
Is there a tool to scan for code / functions that can account for different compilers?
I have a library DLL and a program that uses the library (statically; the DLL is separate).
My goal is to find a bunch of the functions from the library in the program, but unfortunately, it looks ...
0
votes
1answer
3k views
How do I log a string in x64dbg?
This one should be simple, but I can't figure it out. How do I log a string in x64dbg? I can log the address with a breakpoint but wasn't able to log the actual text.
3
votes
3answers
2k views
Any Disassembler for iOS?
Is there any iOS app for arm Disassembling?
I mean one that can run on iPhone.
Nor IDA or Hopper have any iOS version
2
votes
3answers
1k views
Disassembler for batch/automated processing
I want to extract opcodes (MOV, ADD, ...etc) from binary files 'exe files' but as I want the process to be completely automated, I was looking for a free disassembler which can be easily integrated ...
-1
votes
1answer
876 views
Extracting Opcodes of a binary
I want to extract opcodes 'Assembly instructions' from malware binaries . and because I have large number of samples I don't want to do it invidiously .. instead I want to automate the process of ...
4
votes
4answers
2k views
Identifying jump table of a switch statement
I'm using a linear disassembler (beaEngine), and whenever I get to a jump table section, I get an error (or an incorrect decode since beaEngine mistakenly thinks it is code).
How can I recognize this ...
4
votes
3answers
2k views
How does disassembler really work?
a simple portable executable file looks like :
I'm wondering how a disassembler works to parse the .text...to produce assembly code ?
Because the PE file in his raw format seems to be unusable and ...
1
vote
0answers
264 views
immunity debugger MSVCR90.dll R6034
I'm new to the science of reverse engineering. I recently downloaded immunity debugger 1.85 32bit Assembler-Level Debugger. My host machine is Windows 7 64 bit. I have python 2.7 installed as 32 bit ...
3
votes
1answer
1k views
Limitations of capstone's disassembly capabilities compared to IDA
I was wondering if there are any limitations of capstone's disassembling capabilities when compared to IDA.
If yes, are those limitations inherent, i.e. a result of the different design/techniques ...
-3
votes
2answers
1k views
Reverse Engineering iOS Apps on a Mac OS X
I want to learn to Reverse Engineer iOS Apps. I know exactly what I need to do and I've got almost everything set up. My iPhone is jailbroken, I have installed OpenSSH to SSH into the iPhone from my ...
4
votes
0answers
194 views
Trying to obtain embedded flash memory on MCP5554 microcontroller
I am capable of dumping flash memory directly from EEPROM; however I am trying to pull data from a microcontroller that has an embedded 2 Mbyte flash in it. I understand that JTAG is one way to go.
...
0
votes
1answer
114 views
Can Reverse Engineering produce code in a different language than the one the program was originally created?
Does Reverse Engineering always produces the source code in the same language the software was originally written?
For example, if the software program(.exe) been reversed was written in C++, the ...
1
vote
1answer
135 views
Capstone Disassembly Engine Issue: OP_Access throws TypeError
After installing the Capstone python module, I ran this example on a Win7x86 PC with a minor edit (added arch and mode).
However, when attempting to use insn.regs_access(), it throws a NoneType ...
0
votes
2answers
2k views
Getting License Key from Installed Program and Making Installed Program an Executable Installer
I want to start off by apologizing because I am not a software engineer so it is quite possible that what I ask cannot be done, I looked up the wrong thing, or I just don't understand what I am ...
1
vote
1answer
1k views
AT&T XOR argument at radare2
Recently I faced with strange (in my opinion) behavior of radare2.
I have been reading the Artificial truth blog post about Hacking bits with this crackme.
In an article Julien used Intel syntax,
...
5
votes
1answer
1k views
Call to an imported function in a PE file: Why is destination prepended with ds (call ds:func_name)?
In windows PE files (32 and 64 bit) calls to imported functions look like this in IDA PRO:
call ds:SetEvent // default setting
call [ds:SetEvent] // Target Assembler set ...
2
votes
1answer
494 views
Need to recover C++ code from binary of server and client
We have an old 2D space shooter multiplayer game community form late 1990s. The game is still alive today but the problem is the creators of the game are no where to be found and the source code is ...
2
votes
2answers
2k views
Initializing a struct in win32 assembly programming using MASM
I'm trying to create a demo program demonstrating struct(s) in MASM ,
I've written a code like this :
struct1 struct
first db ?
second dw ?
struct1 EndS
.386
.model flat,stdcall
option casemap:none
...
26
votes
5answers
44k views
What is the linux equivalent to OllyDbg and Ida Pro?
What is the Linux equivalent to OllyDbg and IDA Pro ? Or if there are multiple tools that do the various functions that OllyDbg and IDA Pro do, where can I find these tools? I'd like to start ...
1
vote
3answers
480 views
IDA SDK Extract Offset From Instruction
get_screen_ea( ) is ==
.text:000000014000B065 mov cs:qword_142167D38, rcx
Is there a function in the SDK to extract qword_142167D38? Preferably as a hexadecimal value rather than a string.
