Questions tagged [disassemblers]

A disassembler is a software tool which transforms machine code into a human readable mnemonic representation called assembly language.

Filter by
Sorted by
Tagged with
2
votes
2answers
2k views

Initializing a struct in win32 assembly programming using MASM

I'm trying to create a demo program demonstrating struct(s) in MASM , I've written a code like this : struct1 struct first db ? second dw ? struct1 EndS .386 .model flat,stdcall option casemap:none ...
2
votes
1answer
490 views

Need to recover C++ code from binary of server and client

We have an old 2D space shooter multiplayer game community form late 1990s. The game is still alive today but the problem is the creators of the game are no where to be found and the source code is ...
2
votes
1answer
45 views

Two copies to store values

I have this a piece of code, disassembled DX: .text:004386D3 push ecx .text:004386D4 fld1 .text:004386D6 fstp [esp+26Ch+var_26C] ;load 1.0 value ...
1
vote
3answers
479 views

IDA SDK Extract Offset From Instruction

get_screen_ea( ) is == .text:000000014000B065 mov cs:qword_142167D38, rcx Is there a function in the SDK to extract qword_142167D38? Preferably as a hexadecimal value rather than a string.
1
vote
2answers
5k views

Getting past a whole lot of anti-debug measures for a windows exe

I'm trying to debug a windows exe that is really full of anti-debug measures. It has pretty much everything you can think of DBGuiremotebreakin, Ntsetinformationthread, NtQueryInformationProcess, the ...
1
vote
2answers
152 views

High-level langage decompiler on WIndows

So I have been using Binary ninja and I was wondering if there was any other tool except IDA or any binary ninja plugin that would transform assembly code into high level code, I already tried binja-...
1
vote
1answer
2k views

How to extract firmware from a chip ( snarfing) [closed]

Is there anyone who can guide me how do i do snarfing of firmware on a chip of a VIN Tuner. Is there anyone who can do it ?
1
vote
2answers
1k views

Windasm32 cant allocate enough memory to display 151680 lines

Hey I was using Windasm32 today and I loaded a .dll file and it told me this I tried to increase my virtual memory on windows 10 to 12000 and the max to 12000 and restarted the computer and ran ...
1
vote
1answer
719 views

C++ to assembly, GCC vs CL

I have following C++ code: int main(){ int a = 1; double d = 1.2; return 0; } and get the following assembly using GCC 6.2 -m32: main: lea ecx, [esp+4] and esp, -8 ...
1
vote
2answers
548 views

Difference between 32 bit and 64 bit disassemblers

As far as my level of understanding goes, the only difference between a 32 bit and 64 bit disassembler is that the produced assembler-code of a 32 bit disassembler is only using 32 bit assembly ...
1
vote
1answer
389 views

Tools to translate x86-64 ELF to PPC (or i386 decompilation)

I've been working on a project on an IBM POWER8 system. I'd like to translate some very simple binaries from x86-64 to PPC. Is there a tool that can either: Translate the binary from x86-64 to PPC (...
1
vote
1answer
33 views

Virtual functions call asm

It seems to be a virtual function call. How would this code look in a high-level language like C ++? .text:0053A745 loc_53A745: ; CODE XREF: sub_53A690+CEj .text:0053A745 ...
1
vote
2answers
115 views

How to determine ARM architecture from the ELF file extracted from the firmware?

I have extracted the ELF file from the flash dump of a printer, I cannot find too much information about the SoC chip on the printer. What's the best practice to determine the ARM architecture (ARMv7-...
1
vote
1answer
117 views

How do disassemblers work?

I have 2 questions regarding this, but feel free to elaborate more if you want to, I'm really interested in this topic: Do they really just read byte by byte until they get a valid instruction? How ...
1
vote
1answer
36 views

Are there some assemblers or disassemblers that allow dw/defw etc directives with specified endianness?

I've been working with reverse engineering tape image and disk image formats and the files and filesystems they contain. It struck me that sometimes there are data fields that are not in the same ...
1
vote
2answers
2k views

OnlineDisassembler is down - any alternative?

Since weeks my beloved and favorite site www.onlinedisassembler.com is down and shows server error 500. Does anybody know any alternative for trying different microcontroller architetures on an ...
1
vote
1answer
706 views

Android Native Library - How to match java references to sub_XXX function (static way)

I'm currently learning how native functions are implemented among the ELF SO files contained inside an APK. I'm using IDA. Native calls are always achieved in this way. // First load the library ...
1
vote
1answer
4k views

How to to decompile a pyinstaller exe, back to source code?

Python versions, this method has been tried on: 3.7.5, 3.6.0, 3.5.0, 2.7.17? (I know, I'm just too desperate to get my source back.) I have problem with decompiling an exe. I kind of deleted the ...
1
vote
1answer
206 views

what's meaning address inside disassembler

I'm recently start in reverse engineering filed. While working with the disassembler I asked myself:what the "address" label meant. For example here we have hopper image:https://www.hopperapp.com/...
1
vote
1answer
433 views

Disassembler for Renesas RX62 micro

Does anybody know a free disassembler tool for decoding a Renesas RX62 micrcocontroller binary file? There had been www.onlinedisassembler.com, but this site is down and the new beta....
1
vote
1answer
1k views

Elf file format finding .got and .got.plt segments

I'm writing ELF parser and simple disassembler x86. Having code like this .text:000B5A2A call 0000B470 ;e.g. _glXSwapBuffers ... ... got.plt:0000B470 jmp dword ptr [ebx+240h] ;jump to ....
1
vote
1answer
728 views

MSP430 - IDA Pro Free Binary Dump

I have a assembly dump from a MSP430 binary in a normal ascii text file as below: 46f4 <strcpy> 46f4: 0d4f mov r15, r13 46f6: 023c jmp #0x46fc <strcpy+0x8> 46f8: ...
1
vote
1answer
559 views

Understanding the variables in stack layout

i am reading the "The Grey Hat Hacking-The ethical hacker's Handbook".The book is nice ,but there is a doubt on a particular subject.In the vulnerability analysis chapter it is trying to analyze a ...
1
vote
2answers
2k views

How to Find All Switch Jump Tables in IDAPython

I'm using IDAPython on IDA 6.5 and I'm trying to get all the switch jump tables in a DLL. Mainly I'm interested in jump tables that are jumped indirectly: jmp ds:off_65018790[ecx*4] ; switch jump ...
1
vote
1answer
1k views

AT&T XOR argument at radare2

Recently I faced with strange (in my opinion) behavior of radare2. I have been reading the Artificial truth blog post about Hacking bits with this crackme. In an article Julien used Intel syntax, ...
1
vote
0answers
47 views

Disassembler with pixel/bitmap view

I am looking for an ARM disassembler that runs on Linux that has a graphic "pixel" or "bitmap" view like the one shown in the pictures below: I am reverse engineering some old ...
1
vote
0answers
53 views

What to do with a text file of disassembly code and binaries?

I am fairly new to software reverse engineering and I'd like to know how proceed with analyzing a program if I have a text file of disassembly code and a bin file of binary data. I understand ...
1
vote
0answers
39 views

Is it possible to define the adress of a function in assembly?

I am creating a PoC for anti-disassembly techniques, and I would like to know if there were ways to define the address of functions once compiled with gcc. Here is the PoC program : BITS 32 EXTERN ...
1
vote
0answers
564 views

Turning p-code generated by VBA (Visual Basic for Applications) back into VBA

According to the README in https://github.com/bontchev/pcodedmp : "As each VBA line is entered into the VBA editor, it is immediately compiled into p-code" "when you open the source of a macro ...
1
vote
0answers
163 views

Radare2: pd command ignores cfg.bigendian setting

I am currently using radare2 to disassemble a raw ARM binary (bootloader) in little endian format. I used the command e cfg.bigendian = false to set the endianness, but the pd command seems to ignore ...
1
vote
0answers
1k views

Reverse Intel hex to programming code

I have a file in the Intel hex format, which was taken of from a pic16F1705 chip. I need to find a way to disassemble it into some form of human friendly programming language in order to make some ...
1
vote
2answers
154 views

Real-time changes of executable on IDE/Assembler

I'm new on this, sorry for bad usage of terms or overextending an explanation. I'm learning code languages and the way I found to bring it to my world so I can learn it better was coding for/with ...
1
vote
0answers
261 views

immunity debugger MSVCR90.dll R6034

I'm new to the science of reverse engineering. I recently downloaded immunity debugger 1.85 32bit Assembler-Level Debugger. My host machine is Windows 7 64 bit. I have python 2.7 installed as 32 bit ...
1
vote
1answer
135 views

Capstone Disassembly Engine Issue: OP_Access throws TypeError

After installing the Capstone python module, I ran this example on a Win7x86 PC with a minor edit (added arch and mode). However, when attempting to use insn.regs_access(), it throws a NoneType ...
0
votes
3answers
2k views

Mips disassembler

So, I am looking for disassembler code for MIPS commands, for example: if the program gets word of command like 3c1d8010, I want to get the name of the command and the registers, which it uses: lui sp,...
0
votes
1answer
73 views

Why there are only 8 hexa memory digits while my RAM is 16G

I'm totally new to reverse engineering, when I start debugging my c program with radare2, and start showing assembly, I found that addresses are only 8 hexa digits, which means 16^8 = 4294967296 ...
0
votes
1answer
100 views

IDA pro 7.5 - No previous fonts / color imports

For the past few years I've been using an ida color scheme which I created, that was very easy on my eyes with the previous versions of IDA Pro (<7.0). However, after start using version 7.5 I ...
0
votes
1answer
422 views

Know which bytes are opcode and which operands in IDA

I want to extract a generic signature of a function in IDA and wanted to use just the opcodes of the instructions without its operands. Example: From the first instruction I want to know the bytes ...
0
votes
2answers
263 views

Are there Disassembler for Mac which supports scripting

Are there any disassemblers for Mac that comes in freeware. I have installed radare2 but finding difficult to use.
0
votes
2answers
3k views

LLDB disassembler not working, using command terminal,on mac el captain?

I have created simple code to test using lldb . This is the first time i am using lldb and i am familiar with gdb. while i am trying to disassemble the unix executable file its not working any ...
0
votes
1answer
46 views

Recognize of data block

Assembler code from data segment: .data:006A5038 dword_6A5038 dd 0 .data:006A5038 .data:006A503C ; char *off_6A503C .data:006A503C off_6A503C dd offset aOption0 .data:...
0
votes
1answer
74 views

Help with animation function

I'm trying to find the function which is animating a bot ingame (singleplayer). I already figured out the animation state value with Cheat Engine. Freezing that value lets the bot repeat the animation ...
0
votes
1answer
34 views

Visual c compiler options

I ask if exist some c compiler option that can "keep" some imformation after compile that can be visible when I disassamble with IDA. This because I need to find a particular funciton with ...
0
votes
1answer
54 views

Variable location address

There is variable in data section: .data:00427000 dword_427000 dd 64h Base address of code is: .text:00411000 ; Segment type: Pure code How to calculate actual address and location in memory of ...
0
votes
1answer
37 views

what means “ilegal use of registers”?

I read pe program using a Pe Reader to view all sections, the .text section starts is "0x0001000": What is in the pe program reader: And is this what i see on the debugguer :
0
votes
1answer
184 views

How do I Reverse Firmwares? [closed]

How do I Reverse Firmware? What is firmware binary?
0
votes
1answer
613 views

How can I read the assembly instructions of a C program from C#?

I want to be able to do what an ordinary disassembler does—list the assembler instructions of an arbitrary executable—but from C#. It would consist, for instance, of finding a specific instruction ...
0
votes
1answer
3k views

How do I log a string in x64dbg?

This one should be simple, but I can't figure it out. How do I log a string in x64dbg? I can log the address with a breakpoint but wasn't able to log the actual text.
0
votes
1answer
114 views

Can Reverse Engineering produce code in a different language than the one the program was originally created?

Does Reverse Engineering always produces the source code in the same language the software was originally written? For example, if the software program(.exe) been reversed was written in C++, the ...
0
votes
2answers
2k views

Getting License Key from Installed Program and Making Installed Program an Executable Installer

I want to start off by apologizing because I am not a software engineer so it is quite possible that what I ask cannot be done, I looked up the wrong thing, or I just don't understand what I am ...