Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

0
votes
2answers
85 views

crackme disassembly - are these local variables ever initialized?

I'm working on a crackme, where the objective is to find the valid password given a program. I'm using radare2 to reverse engineering the program. To do so, I need to enter a password that forces this ...
0
votes
0answers
21 views

Changing pseudocode based on FPU fmul behaviour

A 3D software was compiled in which a typical x/4096f was translated as: fmul ds:f4096 where f4096 equals to: 0.00024414062 Example decompiled pseudocode as-is: skeletonMemoryPointer[i].pos = *(...
0
votes
1answer
62 views

How to split ARM code/data from binary in Inmarsat Isatphone Pro?

I'm analyzing the 3 binaries for updating firmware to the Inmarsat Isatphone Pro phone. Additionally, I'm following the Groundworks Technologies paper, and attempting to recreate their work as a ...
0
votes
1answer
85 views

Finding the correct emulator for programming a renesas sh7722 processor

I have a question about reverse engineering a Roland gr-55 guitar synthesizer. I'm 90% sure the device uses a Renesas sh7722 processor as the main CPU, or at least one of the CPU's in the SH family. I ...
3
votes
1answer
41 views

How to examine/edit stack memory contents using radare2 in debug mode?

How can i examine/edit stack contents using radare2, just like gdb ? Is there a way to examine memory using $rbp or $rsp register like below. x $rbp-10 <--- something like this which can dump from ...
1
vote
0answers
23 views

IDA Pro how debug constant function returning different results?

The code below is executed with the parameters (0, 4, 0) , the first 0 being an int pointer casted to an int, and these are the same every time. After execution, a 3 digit number string is returned/...
2
votes
1answer
103 views

Edit an ELF file (language pack)

I have here an ELF file that contains a language pack (German and Chinese) and I want to swap the chinese language to the german language. hex cannot represent Chinese :) here an excerpt from the ...
0
votes
1answer
67 views

How to find functions in IDA Pro/x64dbg

i created a program for testing, very simple in c++. is ask for password if it is match is print correct, if no it is print "bad". i try to find with ida where is the function of what i made. but i ...
0
votes
1answer
37 views

Finding function at offset loaded with ADRP/ADD

I have this assembly: ADRP X8, #off_FFFFFFF006F1E960@PAGE ADD X8, X8, #off_FFFFFFF006F1E960@PAGEOFF LDR X0, [X8] ; qword_FFFFFFF0077F08A8 LDR X8, [X0] ...
1
vote
1answer
91 views

C# Changing method body in runtime

I am trying to change a part in a third party library, it has a bug, however, there are no fixes and source code is not available as well. At first, I tried to modify IL Opcodes directly by ...
1
vote
2answers
90 views

How to determine platform from .bin?

I have an android app (com.daye.dayeapp) to control my robot lawn mower. The App contains new firmware in the assets folder, in the form of a 122KB .bin file. How do I determine the architecture of ...
0
votes
1answer
57 views

IDA PRO Tracing stopps

I need to get data from the window of the external program. This data is dynamic and changes each time the additional window is restarted. I have already found an offset, but I need to find the ...
0
votes
0answers
42 views

How to disassemble .mbn files?

I can't disassemble .mbn files using ida pro 7+ if I use some scripts from GitHub than I can't disassemble any function, any help ? I want to reverse qcom bootloader
2
votes
0answers
154 views

How to load symbols from a symbol server in Ghidra?

I've been trying to learn Ghidra by attempting to reverse the comctl32.dll system library, which has many of its functions documented. I started the de-compilation analysis in it, and after a while it ...
-1
votes
1answer
102 views

How can I convert the following assembly code to pseudo code?

I got the following disassembly code in IDA pro. I really find it hard to convert it into pseudo code. push ebp mov ebp, esp sub esp, 14h mov dword ptr [ebp-14h], 1 mov dword ptr [ebp-10h], 2 mov ...
-1
votes
1answer
81 views

How can I convert the following disassembly code to pseudo code or C code?

I used IDA pro to get the following disassembly code. I am having difficulty converting it into the equivalent c code. mov dword ptr [ebp-8], 1 mov dword ptr [ebp-4], 0 loc_401014: cmp dword ptr [...
0
votes
2answers
259 views

What's happening in the assembly main function?

I'm currently inspecting a 32-bit malware executable in a WinXP VM using IDA Pro (free version). I don't understand what's happening in the main function here. Where should I set the breakpoints (...
0
votes
1answer
76 views

What is this assembly doing?

I wrote a very basic crackme to learn how assembly works. Even though I wrote it myself, I am having some trouble understanding a few pieces of the assembly: What I know up to now is: [rbp+rax+...
1
vote
0answers
58 views

Can anyone make much sense of this binary for an embedded system? [closed]

I want to see if anyone more experienced in reverse engineering and disassembly can take a look at this binary update file I have and maby ether help or just say if it is even possible to reverse it. ...
2
votes
2answers
222 views

Can I stop Ghidra from creating extended references?

I'm trying to disassemble some 6502 using Ghidra. The following (prerequisites: POSIX-style shell, Python 2.x) will generate a file called test.dat that demonstrates the issue: python -c "open('test....
0
votes
1answer
29 views

Is there a way to see & keep track of registers in dnSpy?

Hello I am trying to see if there is a way to see & keep track of the IP, and other registers as you would in OllyDbg or x64Dbg?
1
vote
1answer
100 views

Does a symbolic disassembler exist?

I would like to know if there are disassemblers based on a symbolic analysis, I'm beginner in RE, but I think that a disassembler based on symbolic techniques can be very interesting and could ...
3
votes
1answer
279 views

How to display the CFG of a function in Ghidra?

I am currently trying Ghidra and, I am looking at a specific function. I have the assembly code and the decompiled version of it. But, I am looking to see if I can have it as a CFG... Does someone ...
0
votes
0answers
46 views

Trace back function call

I'm learning reverse engineering and I'm trying to find where an error message is called. I want to get in the part of the code, in the main module, where it decides to display the error message or ...
0
votes
0answers
39 views

Handling __int64 in IDA?

This is probably something very easy that I'm missing. I have this operation length_of_userInput = (signed int)(unsigned __int8)userInput >> 1; And length_of_userInput is currently reading '...
1
vote
0answers
65 views

Which architecture is this firmware?

I am currently investigating GSL touch-screen controllers firmwares. A firmware example can be found here : https://github.com/onitake/gsl-firmware/blob/master/firmware/4good/t803i/silead_ts.fw In ...
1
vote
2answers
140 views

Assembly that just seems to be a jumble

I've disassembled an old DOS program into assembly and I'm trying to figure out a function call. Here is the ASM: seg000:373C ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦...
8
votes
2answers
1k views

What's this assembly doing?

I have been trying to figure out the assembly for part of a DOS game and there is an operation that keeps getting called that uses all 4 registers. I can see what each line does but I can't for the ...
0
votes
0answers
24 views

How to generate .TEXT only asm output in IDM?

So I tried to do File -> Produce File -> Create ASM File. There are lots of dd stuff that I don't want. So now, what I need is, either an android app where I can view that .asm file ...
0
votes
1answer
89 views

Tricore debugging tools

I am new in the reverse engineering, I have a good experience in programming MCUs like c51 and ARM. Now I would like to learn about Tricore reverse engineering... ECUs mainly. I can obtain the ECU ...
1
vote
1answer
61 views

(CTF) Speed up assembly by hooking to an static function

For a CTF I have a fairly slow recursive function. I just need to cached the previous results in a dictionary and get them instead. I did it but had to reverse engineer the code. I was wondering if ...
0
votes
1answer
51 views

Executing CMP DS:[] by inline assembly inline hooks

I need to execute some instructions of library I'm using (ws2_32.dll) inside my C code, but I have a problem with a simple cmp instruction. Followed by IDA, this instruction is: cmp off_41AE7048, ...
1
vote
0answers
37 views

Legality on sharing rom dumps on abandoned hardware

I have an old piece of HP test gear from the 80's that HP no longer supports. I want to add in a feature and need to dump roms and figure things out to do that. How can I share my process and ...
-2
votes
1answer
99 views

Can anyone please explain the following dissasembly codes?

Disassembly: 0: 31 c9 xor ecx,ecx 2: f7 e1 mul ecx 4: 51 push ecx 5: 68 2f 2f 73 68 push 0x68732f2f a: 68 2f 62 69 ...
1
vote
0answers
63 views

Finding lua C functions compiled binary

So i am trying to "hack" a game however not for cheating purposes. I am looking to extend the games scripting functionality through a DLL that can look for processes and return them. The game I am ...
1
vote
1answer
70 views

When can trapping be used?

This is the beginning of one of the functions inside NTDLL of Windows XP: MOV EDI,EDI PUSH EBP MOV EBP,ESP ... The book on reverse engineering I am reading(Eldad Eilam - Reversing: Secrets of ...
1
vote
2answers
58 views

Calculation with not defined variables?

I am new to reverse engineering and try to solve a crackme with radare2. My problem is understanding of the following lines: | 0x000007a9 c745b8000000. mov dword [var_48h], 0 | ...
2
votes
1answer
217 views

Extract a secret from an Android apk or .so file

Context As an exercise I am researching all methods of hiding a secret in an android mobile app binary... Yes I know that with more or less effort they can always be extracted with static analyses, ...
3
votes
3answers
195 views

Jump in the middle of an instruction Coldfire firmware

I'm working on an embedded system Coldfire ROM. Currently, I'm trying to reverse engineering it to gain some more in-depth knowledge about its structure. ROM code quality seems pretty low, and I see ...
3
votes
1answer
97 views

Why disassemble multi-thread binary is hard?

Why disassemble multi-thread binary is hard? I also know that some obfuscation techniques are to create unnecessary threads. But why reverse engineering multi-thread program is hard.
2
votes
0answers
145 views

Unable to figure out how to map segments in IDA

I have a 2 MB executable that I'm attempting to reverse engineer. It's executed on a 16-bit 8086 CPU. The segments go from 4000 (0x140000) to F000 (0x1F0000). I'm attempting to map the segments in ...
0
votes
1answer
92 views

How do I go about overriding a function internally defined in a binary on Linux?

To be specific, I cannot recompile this binary, nor do I have access to the sourcecode. The functions are not defined within a shared library. So, how can I go about changing a function, or ...
2
votes
1answer
107 views

How do the PSHUFLW and PSHUFD instructions work?

I have been trying to figure out exactly what is happening with these instructions and can't make sense of them. I can see that the PSHUFLW instruction acts upon the first 16 bytes of the XMM register ...
1
vote
1answer
40 views

How is the I/O address space on the PC arranged?

I'm disassembling a 16-bit DOS executable, and looking at the following three instructions: mov dx,0x3ce mov ax,0xff08 out dx,ax I know it writes the value 0xff08 to I/O port 0x3ce. I also know that ...
1
vote
2answers
143 views

Lots of mov instructions into ebp+offset - What is happening?

While learning RE I have come across this large segment of instructions that contains a majority of mov [ebp+offset], value instructions. I believe that ebp + offset are local variables? I think? ...
2
votes
2answers
162 views

Why are there so much more functions in ida than my source code?

I am trying to learn how to use IDA Pro 6.8 to analyze binaries. However, there are much more functions in ida function list than my code. For example, there is a function in source code that calls ...
2
votes
1answer
65 views

Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2?

Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2? I'm using the newest version of Radare2 to analyze the Windows application. As can be seen ...
2
votes
2answers
348 views

Can Machine Learning be used to develop better reverse engineering tools? [duplicate]

So i googled this but other than some papers i couldnt find any reverse engineering tool that was built using machine learning I'm not an expert in machine learning and deep learning but it seems ...
2
votes
1answer
114 views

Reversing PE32 executable - CTF Question

So we were playing CTF , and we found this interesting RE challenge . And when we did a statical analysis to the file we found an interesting for loop . for (var_84 = 0x0; var_84 < 0x13; var_84 = ...
-1
votes
1answer
81 views

Strange Message after manipulating an exe file

i debugged und reversed an exe file with x64dbg I simply changed an assembly command (je) into nop , patched the file and saved it under a different name. (only one line was changed) When i tried to ...