Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

Filter by
Sorted by
Tagged with
1
vote
1answer
45 views

What's purpose of mov ebx, [esp+0]?

I'm disassembling one SO library for fun and was wondering what's purpose of following procedure: sub_3699 proc near mov ebx, [esp+0] retn sub_3699 endp It's widely used across entire library ...
0
votes
0answers
26 views

Why would compiler emit a null pointer assignment

I have been reversing a popular Windows application and ended up in a very interesting place while debugging. What I can clearly see as valid x86 instructions that eventually lead to some sort of &...
0
votes
1answer
47 views

Reading from buffer and printing output to a text file

00001f10 2846 mov r0, r5 00001f12 6349 ldr r1, [pc, #0x18c] {data_20a0} 00001f14 7944 add r1, pc {data_ce5e, "OK:%16[^:]:%16[^:]:%d:%d:%d:%d:%…"} ...
0
votes
1answer
26 views

x64dbg Crash on Dynamic Debugging Remove Anti-Debugging Protection

I am trying to run Dynamic code analysis using x64dbg for Windows 64 bit executable. I install the anti-debugging plugin for x64dbg from https://github.com/x64dbg/ScyllaHide. I still find the ...
0
votes
0answers
61 views

Starting out with reverse engineering. What assembly is disassembled code

I am new to reverse engineering and want to analyze my own exe/dll files. I took a look at nasm and masm and so far I have the feeling that this is unnecessary for me to learn in detail because it ...
0
votes
1answer
72 views

Translate ASM code x86 32 bits in C

I have a exercise which i can't resolve it, and i need help. If anyone can help me it would be great. I have the next ASM code in x86 32 bits which i need to translate in C language: Dump of assembler ...
1
vote
1answer
77 views

Code caves in arm assembly

In a disassembled elf binary i found these arm thumb instructions: function0 0x002cc3a8 8079 ldrb r0, [r0, #6] 0x002cc3aa 7047 bx lr In the codecave these were the initial hex ...
-1
votes
0answers
38 views

Finding registry keys/values using IDA PRO

It's been a while since I've started optimizing my Windows 10 and the great way how to do it, is by using IDA PRO by looking for "strings" from .sys or .dll files. Problem is, that I need to ...
1
vote
1answer
53 views

How to insert arm instructions into a function in a native library?

I am new and am still learning assembly languuage. In a native android app library that has been disassembled i found this function which had 1 instruction. addres hex arm instruction ...
2
votes
1answer
51 views

When would a program normally transfer data between memory and coprocessor?

In the analysis of an ARM binary, when would one normally encounter transfer operations between memory and a coprocessor? These are encoded as the LDC and STC operators. Would it be common for ...
0
votes
1answer
32 views

ARM floating point register S0 used without initialization

The following code snippet is the first few assembly instructions of a function. The code runs on armv8a. SUB SP, SP, #0x170 is the first assembly instruction of the function. Please note the ...
2
votes
1answer
109 views

Finding AES Key in binary using Ghidra and FindCrypt

I would like to learn more about RE. I wrote a simple program on a STM32F107 which does nothing else than encrypting and decrypting a text once using AES128-ECB. Here is the C code (I intentionally ...
0
votes
0answers
47 views

Is it possible to detect that a function has been called from a loop? - Radare-2

is it possible to detect a function is calling from inside a loop in Radare-2. for (i = 0; i<n; i++) foo() foo() ==> 0x00402f90 // starting address Thanks
1
vote
0answers
74 views

Pascal string representation in Hex-Rays Decompiler of IDA Pro

I'm trying to prettify a representation of Pascal-string "Could not access file "" in Hex-Rays decompiler's output. As you can see below, now its type is char[25] due to inclusion of ...
1
vote
0answers
52 views

Radare2 cannot open bin for writing

Im on Kali and im using Radare2 but it says r2 -d bin Killing child process 16151 due to an error Killing child process 16152 due to an error [w] Cannot open 'dbg://./bin' for writing. I tried chmod +...
0
votes
0answers
50 views

Ghidra - search for library usage?

Using Ghidra: if library A imports library B, is there a way to search for all function calls from A into B? And more specifically: if B exports function foo, how can I find where that specific ...
0
votes
1answer
18 views

How to convert string to a variable in IDA

I have the following string "CreatePipe" and I want to convert it to a variable so I can use x to find all its references: How can I do it? I am not sure what to choose here:
0
votes
0answers
16 views

Is there any way to find whether a software uses hasp api or hasp envelope?

Is there any method to know whether a software uses hasp envelope or api?
1
vote
0answers
60 views

How to change how the calculated value is shown for registers in Ghidra

I'm currently working on reversing some Sparc code in Ghidra, and calculated register values are shown incorrectly. This is how the line looks in the listing: add o3, o0=>DAT_00007d88, o0 and I ...
0
votes
2answers
58 views

Ollydbg - bytes in memory different than on disk

I have been analyzing an application and I'm getting confused about something. When I open an executable with OllyDbg, it shows 0xAA byte. The same executable opened with CFF explorer at the same ...
0
votes
1answer
109 views

Why the disassembled code in IDA is different from in xcode? And How to solve unk_xxxx in IDA View?

I have built an executable file (the architecture is ARMv7, the base SDK is iOS), which depended on an xxx.a file in xcode; I don't have the source code of thexxx.a. I want to check some logic in `xx. ...
0
votes
2answers
55 views

Format of data in the .code/.text section

I'm attempting to dissect/disassemble a windows PE file under Linux using objdump. On surface analysis, the .code section was disassembled to : tmp.exe: file format pei-i386 Disassembly of ...
0
votes
2answers
90 views

How to identify method order in disassembled C++ object

Here are some chunks: v13 = cocos2d::FileUtils::getInstance(v9); (*(void (__fastcall **)(char *))(*(_DWORD *)v13 + 64))(&v46); v19 = cocos2d::FileUtils::getInstance(fileHandle); v21 = *(...
0
votes
0answers
31 views

How can I find out where relocated functions are in a Win16 executable in SoftICE?

Backstory: I'm poking through SimTower for Windows to discover the actual logic for how it decides how much alternative background is used for the SimTower lobby floors (the ones with the green ...
0
votes
0answers
52 views

Ghidra: Identify and display a struct broken into multiple smaller fields

Me vs the 90s game, part two. I'm trying to figure out how the game detects the current date, since that part doesn't work correctly anymore. At some point, GetLocalTime() from kernel32.dll gets ...
0
votes
0answers
66 views

radare2: Print strings in function for 32-bit binaries

I want to see the strings that are printed by the puts() function in the output of radare2's pdf, but it doesn't work. I have a similar problem as mentioned here, but I think it's somehow related to ...
0
votes
0answers
30 views

Indirect calls using registers (IDA)

I need some help. Using IDA for disasembling an executable PE file. It has several indirect calls using registers like call eax. Trying to add breakpoints and get the content of the registers, but ...
5
votes
1answer
181 views

Would hiring a RE service be worth it?

Before I clarify my question, I will explain the project I'm working on, and what I've done so far so there will be a better understanding of what I'm trying to do. I'm trying to modify the UI of a ...
0
votes
0answers
197 views

How to disassemble an obfuscated .NET DLL?

I asked earlier about unpacking a packed .NET exe. But now I need to see the source code for an obfuscated DLL: Any idea how to unpack it?
0
votes
2answers
80 views

What does the cs register do here?

I've come across this sequence of bytes: 2e 88 38. Hopper disassembles this as: mov byte [cs:rax], bh This online disassembler gives slightly different output: mov BYTE PTR cs:[rax],bh Either ...
0
votes
0answers
35 views

Is it possible to Direct3D 9 debug DLL in an app using the release version

I have an application using d3d9.dll, but I want to figure out which functions it calls to gain insight. Since online tools I have found are incompatible with my app (32-bit d3d9), is it instead ...
3
votes
2answers
102 views

The compiler adds a function call to user-defined functions. What does the function do? (x64 Windows executable)

Introduction I compiled a simple executable with Visual Studio in x64 Windows. Source code: long test(int a, int b, int c, int d, int e, int f, int g, int h, int i, int j) { printf("%d %d %d&...
1
vote
1answer
135 views

I'm having trouble understanding this specific notation in Ghidra

I'm reversing a code construct I created to learn Ghidra, and it looks different to what it is in GDB. I was wondering if anyone could clarify what the highlighted LEA instruction means: [I don't know ...
1
vote
0answers
29 views

Function Arguments/Name on Radare and IDA

I am starting with reverse engineering and Radare and I'm facing the following problem, on IDA Free I see the following code: mov ecx, 11h lea edi, [esp+1208h+StartupInfo] rep stosd lea ...
1
vote
1answer
111 views

How to jump to a new empty memory that related to the program to write another code there?

I have a line of code like that ex:MOV EAX, 100, I want to write a little bigger code instead of that code but I can't, so I want to write a jump instruction ex:jmp 0x123456 that jumps to another ...
0
votes
1answer
72 views

Understanding the basics of Reverse Engineering a segment of code

Currently trying to understand the following code and what it is doing. mov eax, 1 test eax, eax jz loc_411503 mov esi, esp call ds:_kbhit cmp esi, esp call sub_411159 test ...
2
votes
1answer
50 views

Reversing uboot on an aarch64 Hi3559AV target problems

I am trying to reverse uboot for an ARM aarch64 Hi3559AV target. I've dumped the binary uboot.bin.gz, and have loaded it in IDA at the correct address. IDA seems to see a lot of strings (and ...
2
votes
0answers
73 views

How can I extract working files (in the form of graphics) from these MZP executables?

There's a 1999 PC/Mac game that I'm hoping to extract assets from. All game data appears to be stored in various files with the extension .rsc. I've been able to extract all the game's audio from the ...
0
votes
0answers
36 views

what do these assembly codes doing? [duplicate]

I tried to reverse engineer an apk app, and it was loading a native code. I have observed that the app was using the native code like this public static String v = sUQWWyTBEs().toString().substring(32,...
1
vote
0answers
197 views

Getting value of local variable in Ghidra

I've been trying to solve a crackme challenge by examining it's decompiled version by Ghidra. So I figured the code where the strcmp is done as shown in the figure below. Now I need to to patch the ...
1
vote
0answers
149 views

radare2 unable to run a binary file

I've been trying to debug a binary file in radare2 but it throws me this error. $ r2 -d bin Killing child process 1688 due to an error Killing child process 1689 due to an error [...
2
votes
1answer
306 views

How to make ghidra display the real offset from rbp

How to make ghidra display the actual offset from rbp in assembly? For the same program, ghidra shows mov dword [rbp + local_c], edi I want to see the actual offset from rbp instead of local_c In ...
3
votes
2answers
129 views

Find the entry point in Interrupt Vector Table ARM9

I'm analyzing the firmware of a device that has the cpu ARM946E-S. It has not a file system, just assembly code and strings. I've disassembled the firmware using ida pro, but I couldn't find the entry ...
1
vote
1answer
164 views

jmp $+5, why the jump

I am looking at some code that has jmp $+5 instruction at the beginning of the entry code in a library, right after pushing registers to the stack. I understand that jmp $+5 puts IP at the next ...
1
vote
0answers
73 views

How to add Instructions (OpCodes) after a If Statement in C#?

I hope someone can help me out with my problem. Currently I'm working with C# and use the library Mono.Cecil to add Instruction Code before a method exits. There is this one case, when a if statement ...
0
votes
0answers
59 views

Assembly to C decompiler

I need an assembly to C decompiler, I tried this one https://onlinedisassembler.com/odaweb/ but my code looks like this: #include <p16F887.inc> cblock 0x20 Delay1 ; Assign an ...
1
vote
0answers
40 views

Automotive engine management - reversing a PIN that has locked an MTX8 ECU

I'm after advice on how to identify a PIN that has been accidently entered and has locked an automotive ECU making it useless. The problem is resolvable by sending the computer back to the ...
3
votes
2answers
193 views

What does this ARM assembly code do?

I'm trying to figure out the password that is used to access the U-Boot shell, as mentoined in my previous question. I'm having trouble understanding how exactly the code works. Here is an image of ...
0
votes
1answer
92 views

A question about moving data with LEA and MOV

Given the above code, i am struggling to understand what happens in line 5 and 6 As i understand it, in line 5 the Adress of the ESP is loaded into the EAX register. While there may be the value 4 ...
0
votes
0answers
31 views

Ghidra Using __stdcall for all my Mips64 functions do I have to manually change them all?

Compiled in mips4 this is a unix driver elf object. ************************************************************* * ...

1
2 3 4 5
23