Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

Filter by
Sorted by
Tagged with
0
votes
0answers
25 views

Finding a stored key in the EAX register: Debugging

I am completely new to this sort of reverse engineering (binary unpacking/analysis, disassembling, etc.) I am looking for a stored value at a given offset in the EAX register of an executable, i.e. ...
0
votes
0answers
38 views

CRC16 Reverse in C166 Arch

Before that I asked about piece of code that used in this algorithm (here). Now I have a bit problem with the rest of algorithm. So I have to describe this with detail. Sorry if i vast your time for ...
1
vote
1answer
42 views

Where are the intel manual x86-16?

I was studying the code for x86-16 operating systems(como DOS),with a desassembler, but I can't find the intel manual on the intel website: Searching on google, only unofficial sources. Perhaps the ...
-1
votes
1answer
91 views

What do these 2 Ghidra warnings mean?

When disassembling ARM binaries in Ghidra, I often see these warnings: /* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */ /* WARNING: Treating ...
0
votes
2answers
58 views

ASM Debuggers that visualize the stack (beginner friendly)

(Cross-posted from Stack Overflow) Are there any debuggers that constantly show a visual of the stack and where everything is within it? For example, taking some random image: I use gdb for most ...
0
votes
0answers
25 views

understand how call __usercall function

I have disassable with ida this function: int __usercall sub_4F314A@<eax>(char *Src@<ecx>, int a2@<edx>, int a3, int a4, int a5, int a6) I attach the original assembly: can you ...
-1
votes
2answers
79 views

How would I start to decode this? Asking for help from a friend (Alien Hominid Invasion)

I have literally no idea how to start to decode this kind of a file, but I really want these fonts and a decoder would be huge for the community, so any help would be great. Linked below is a google ...
-1
votes
0answers
29 views

String to instruction

I am more into reverse engineering more than binary exploitation. I like to bypass jump instruction. but sometimes, I get very frustrated when I don't find the jump instruction via a string. for ...
0
votes
3answers
106 views

How to find if a function is using registers as parameters?

The disassembly of the function Winload!CmpFindNlsData whose prototype I'm trying to construct 00893c10 8bff mov edi,edi 00893c12 55 push ebp 00893c13 8bec ...
5
votes
2answers
937 views

Difference between Main and Entry

Sometimes, I see while disassembling a binary that there is the main function. but sometimes, instead of main, there is entry function. I want to know what is the difference between entry and main.
-3
votes
1answer
139 views

The C166 family code meaning

What the meaning of this code with an explanation? sub_37C2: mov r5, r4 shr r5, #14 shl r5, #1 mov r5, [r5+0FE00h] ; DPP0 bmov r4.14, r5.0 bmov r4.15, r5.1 shr r5, #2 rets ; ...
0
votes
1answer
59 views

What is the meaning of ARM LDAXR/STLXR instructions?

Often while disassembling ARM files, I see some code snippet with the following pattern: loc_BB30: .text:C0 FE 5F 88 LDAXR WZR, W0, [X22] .text:00 04 00 51 SUB W0, W0, #1 .text:...
1
vote
1answer
28 views

are address for instructions specified during compilation?

when following certain youtube tutorials, the address in memory for the instructions are same in my machine and the youtuber's machine. How is that possible? Are instructions provided with memory ...
0
votes
0answers
27 views

Decypher hw key generation process

This one is kinda tricky question, as it sounds a bit shady, I am well aware of that. Let me first explain the situation. I have this special software designed to read paired industrial sensors from ...
0
votes
0answers
23 views

C166 Memory and Addressing mode

Here I think I have some wrong in base concepts, In the code shown below as you have seen, r4 is input argument for sub_37C2 where r4 is r0 + 6. And probably this function return r4 and r5. So, we ...
0
votes
1answer
75 views

How to track output parameters in disassembly?

I have the following disassembly of winload!CmpFindNlsData function and I need to check the output parameters of this function. P.S.: CmpFindNLSData(int a1<eax>, int a2, PUNICODE_STRING ...
2
votes
2answers
221 views

Getting the algorithm used inside this .so file

I'v been trying to reverse-engineer a BLE "Smartlock" to open it using Python instead of the App that it came with. I progressed quite far with disassembling the SDK they provide, ...
0
votes
1answer
59 views

What is physical address on a pe reader?

What is physical address on a Pe file? I had search on the microsoft website article about pe files and don't have found anything.
0
votes
0answers
73 views

C166/C167 code analyzing

Recently I try to reverse piece of assembly code that written for C166/C167 Arch. But I have a problem with some places for convert to C code, such as: loc_1892: mov r9, #4 add r9, r0 mov ...
1
vote
1answer
76 views

Trying to reverse engineer CmpFindNlsData of winload

I have a basic understanding of assembly language and I'm unable to perfectly define the algorithm of winload!CmpFindNlsData looking at the disassembly. Basically I need to understand how NLS data is ...
0
votes
0answers
34 views

Crash after hook a function

I have hooked a sound function that work within the game menu after, when the battle start, the game will crash. The function at the first parameter get correctly the sound file name, before the ...
0
votes
1answer
47 views

Buffer space in C

I was wondering if there is some way to get information about buffer size via reversing the binary, created in C language. can we also know how many buffers we have created while writing that script. ...
1
vote
2answers
53 views

How to determine ARM architecture from the ELF file extracted from the firmware?

I have extracted the ELF file from the flash dump of a printer, I cannot find too much information about the SoC chip on the printer. What's the best practice to determine the ARM architecture (ARMv7-...
0
votes
1answer
67 views

ASLR in Linux Vs Windows

I am quite new in binary exploitation. I am doing a lot of beginners exercise here. I am confused about ASLR. I tried some binary exploitation thing in Linux. It was recommended that I should stop ...
3
votes
1answer
64 views

reason of padding in exploit

I was doing vulnserver bufferflow exploit. I saw a tutorial where the he makes a payload to exploit the server. Take a look at the exploit: #!/usr/bin/python import socket target_ip = "10.0.2....
0
votes
1answer
70 views

2 byte format string attacks

Protostar I was doing the protostar format string (3rd challenge). where we have to change the value of a variable target with format string buffer overflow. so, I came up to this medium article: ...
0
votes
0answers
44 views

Access to variable never stored to

I'm disassembling a Microsoft dll in IDA Pro, and there's one point where a value is loaded to a register from a location that has never been written to (it's the first location on the variables stack)...
0
votes
0answers
20 views

Intercepting object value in a Frida intercepted method

Suppose I have a C# method with the following signature public virtual void DoSomething(int index, int value, List<int> results) I've had success so far using Frida to hook into the method call ...
1
vote
1answer
62 views

Confusion between different ARM architectures

I am trying to develop a machine learning model to help with the process of reverse engineering. As the first stage, we are currently trying to train an embedding model that understand the ...
0
votes
2answers
76 views

How does an executable’s static API differ from it’s dynamic API?

Running an executable in Cuckoo sandbox gives me its dynamic API information. How do these API calls differ from their static API information (eg. If I were to just put the executable through IDA Pro ...
0
votes
1answer
90 views

How can I modify these?

So I'm onto something interesting, I asked the less direct way but failed to meet the requirements in terms of explanation So here it is, how would I go about editing these the same way I would go ...
3
votes
1answer
115 views

Radare2 - what does dot mean in disassembly

I've just started using radare2 and I've noticed a dot when I tried to disassamble one on my programs. The output is: 0x00000000 48b841000000. movabs rax, 0x41 I understand that 0x48 is the REX ...
0
votes
0answers
31 views

N64 ROM file index hacking issue

Alright, I downloaded the N64 SDK and compiled one of the samples provided by the SDK and dissembled the ROM with IDA and found the asset data is stored some way using index's so my question is. What ...
0
votes
0answers
45 views

Relative/absolute addressing; RVA, ASLR, the relocation table and patching instructions

I've been trying to learn reverse-engineering for fun, cracking my own dummy games and whatnot and I just learned ASLR is a thing. I'm now trying to re-conceptualize everything I've read so far ...
0
votes
1answer
74 views

How to find function start in stripped binary?

Given C code, are the function addresses from the ELF the same as those in the stripped version? I don't have any specific code in mind. Just trying to learn in general how to find the function ...
0
votes
1answer
82 views

Why do those useless instruction are in Rust final binary?

I am currently reversing RUST binaries, and I often come across this block of instruction : .text:000055F4BFB943F2 db 2Eh .text:000055F4BFB943F2 nop word ptr [rax+rax+00000000h] .text:...
0
votes
0answers
49 views

strange results with IDA (some function different Pseudo Code)

After show the pseudo code in IDA I see different results: The function 4436C0 show different pseudo code. For example: result = sub_4376C0("vvcbb3.wav",v8,0); and result = sub_4376C0((int)...
1
vote
1answer
112 views

How do disassemblers work?

I have 2 questions regarding this, but feel free to elaborate more if you want to, I'm really interested in this topic: Do they really just read byte by byte until they get a valid instruction? How ...
0
votes
2answers
57 views

Where do arguments 5 and 6 go in this Microsoft x64 function call?

I'm disassembling a working-as-expected compiled C program (MS/Windows x64, MinGW gcc 10.1.0). In the main function, I have the following call which passes 6 arguments to the function DotProduct: ... /...
1
vote
1answer
49 views

How can I move an integer number into a XMM register with Cheat Engine?

First off, I need to clear out that I'm a total noob on this, and I have tried reading and understanding documentation about this assembly stuff on the internet, but almost all I found, was meant for ...
-1
votes
1answer
50 views

Best way to find the entropy of an EXE file?

I want to write a script to extract the entropy of each sections of an EXE file. What is the best tool that I can use to do this? I tried Ghidra but it doesn't have an entropy API which I can use.
2
votes
1answer
115 views

dll injection (assembly code)

I need some tip to undrestand what is the best way to execute external code from DLL or command line. I like to add the force feedback support to different games that not support it. I can write a DLL ...
3
votes
1answer
104 views

Figure out with fopen

Can anyone explain, why fopen takes as argument- not a file name- according to code takes some off_6A5D8C: .text:00537F9F push offset stru_6C4E40 ; FILE * .text:00537FA4 ...
1
vote
1answer
33 views

How to turn off XREF comments in Ghidra's disassembly view?

Sometimes a function will have a series of XREF comments next to it in the disassembly view such as in the following example: ******************************************************...
3
votes
0answers
235 views

disassembly - bad results generated with ghidra but not with objdump and IDA

I am using Ghidra to analyze libpng-compat.1.5.10.so (downloaded from Fedora mirrors). But it didn't load the expected disassembly. Then I used Objdump and IDA to check the code and they get the same ...
1
vote
1answer
101 views

How to import files and analyze it in Ghidra using a python script?

I want to write a script which imports an exe file, analyzes it, extracts some features and saves it using python. The part which I am not able to understand is, how to import a file from the script ...
1
vote
0answers
135 views

which has better pseudocode? IDA or Ghidra [closed]

I would like to know which of the two has a better pseudo code generator in C, IDA or Ghidra, if possible, point out the strengths and low points of each one.
1
vote
1answer
65 views

How to find DOS Header and PE Header with an entry point in Radare2?

I am currently doing byte extraction from PE files using Radare2. I know how to find the byte sequence for Dos Header and PE Header when there is no entry point and the start is defaulted to 0x0. But ...
3
votes
2answers
92 views

Extracting Info from Ghidra Listing Window

I have written a script which extracts all the assembly code from a PE using this code in ghidra instructionList = [] for instr in currentProgram.getListing().getInstructions(True): ...
1
vote
1answer
44 views

Results of radare2 are not correct

I am using radare2 to analyze libpng_amd64.so.1.6.34, commands are as follows: r2 = r2pipe.open(binary_file) r2.cmd('aaa') funcs = r2.cmdj('aflj') len(funcs) is 461, but the number of functions got ...

1
2 3 4 5
21