Questions tagged [disassembly]
The translation of machine code into a human readable assembly code, also the result of such translation.
1,212
questions
2
votes
0
answers
28
views
Please help with striped binary reverse
Not so long ago I was engaged in reverse and pwn, I came across such a task
This is a normal task with a vulnerability on the heap, but it is striped and I don’t understand where which functions are
I ...
- 21
1
vote
0
answers
44
views
Angr considers REP instruction as the end of a basic block
I'm developing a python script for angr that has to find all the basic blocks present in each function in a binary. I have noticed that angr splits the basic blocks when it finds a REP instruction, I'...
- 99
1
vote
1
answer
44
views
why some functions push data before the prologue
i am a newbie in the world of RE ,
i start to explorer a main entry of a classic game from 90's
and i start to see something confuse me as a newbie
this main entry function start with pushing stuff to ...
- 13
1
vote
1
answer
38
views
IDAPython doesn't recognize function
I'm developing a python script for IDA Pro that analyzes 32 bit PE files containing an anti-disassembly technique, the problem is that the function that contains the technique isn't being listed in ...
- 99
3
votes
0
answers
78
views
How to assemble back a disassembled Linux kernel?
I have a Linux kernel file and I need to tweak the contents of its corresponding initramfs. I did it in the past for standard distros where kernel and initramfs were separate. However, this specific ...
- 131
0
votes
0
answers
21
views
IDA pro Error how to resolve this error
52C187F5: The instruction at 0x52C187F5 referenced memory at 0x4. The memory could not be read -> 00000004 (exc.code c0000005, tid 672)
How to Solve this.
I have seen sandbox reports in those the ...
1
vote
1
answer
60
views
What are the prerequisite knowledge needed to start solving crackmes?
I started by reading a book on C language and then moved on to "Programming From Ground Up," which teaches basic programming in x86.
School just ended, I'm working on cracking a game called ...
1
vote
1
answer
45
views
Get friendly disassemble hex file
I'd like to know if there is a way to have a more friendly way to get disassemble hex file coming from Adafruit board.
Let me explain actually I'm working with Adafruit feather 32u4 running with ...
- 131
1
vote
0
answers
38
views
Calculate Function Call To Imported Function In Dumpbin Output
What is the easiest way to determine the function called in dumpbin output. No PDBs available.
The disassembly:
004028E2: 8B 1D 70 42 40 00 mov ebx,dword ptr ds:[00404270h]
004028E8: 55 ...
- 1,165
1
vote
0
answers
86
views
I trying rewrite asm to c++ [closed]
This code generates an API key. I use it in an android app as .so file,
but I need to rewrite it to java from c++. How do I translate?
push rbp
push r15
push r14
push r13
push r12
push ...
- 11
1
vote
0
answers
47
views
Tracing odd variant of call analysis failed
Disclaimer before I get flogged: I'm playing with a commercial app, for which I have a license, for my own education because building toy C apps has run out of challenge (and I know whats inside).
...
- 185
2
votes
1
answer
46
views
How to Combine 2 .hex to one
I have a Ensoniq Synthesizer with broken buttons,my idea is to simulate the input over sysex. Unfortunately the sysex exclusive is set off by default.
There are 2 ROM files upper.bin and lower.bin ...
2
votes
1
answer
44
views
IDA mov dword ptr with non-existent addresses
This might be obvious, but I'm baffled.. I opened a random .so library to poke around and learn IDA a bit better, and I hit something I've never seen. IDA has these instructions:
mov eax, [esp+4Ch+...
- 185
2
votes
1
answer
59
views
armv7 disassemble thumb instructions from raw binary snippet
I have a portion of a raw binary file that contains ARM instructions, specifically in Thumb mode (and I've manually disassembled a few instructions using the Architecture Manual, and they seemed ...
- 121
1
vote
2
answers
92
views
Reverse engineer a calculation rule from a video game
I have recently bought an economic simulation video game, but neither the docs not the game UI describe how to estimate some costs; the user needs to actually invest and spend their money, then ...
- 111
1
vote
0
answers
62
views
What computer components improve the speed of disassembly in IDA Pro and plugins like BinDiff?
I’m disassembling binaries in IDA Pro.
It usually takes 15+ minutes just to pre-process/open one binary,
Then another 20-30 min before IDA is fully done disassembling and finally becomes idle.
...
3
votes
0
answers
32
views
How can I quickly tell which ARM Thumb version a particular piece of code is using?
I'm working with an ARM processor: an STM32F407VGT6 board, which IIUC powers a 32-bit Arm® Cortex®-M4. I need to inspect the binary weight of some instruction, so I used objdump like this:
arm-none-...
2
votes
1
answer
89
views
Reading memory values in IDA
Want to get 32 bits from 0x8000 adress as 8 bytes
MEM_EXT:00008000 db 54h
MEM_EXT:00008001 db 53h, 57h, 20h
MEM_EXT:00008004 dd 322E3256h, 31332030h, ...
- 123
1
vote
1
answer
51
views
Overclock CPU in BIOS - ARM/C/C++/Py
new guy here. Working on Bi0S script, adding as many features as possible. It is possible to change fan speeds, advanced security, manipulate voltages, etc. How do you overclock the microprocessor ...
1
vote
0
answers
47
views
How to decrypt data during runtime before executing and then encrypting it back
I was doing some research and came across the term protectors. From my understanding is they encrypt a file to be protected but run it without an issue. During its execution it is able to decrypt the ...
- 11
1
vote
1
answer
48
views
How to interpret this __ctype_b based predicate?
I am getting this simplified function from the decomplication results of Ghidra, and I am having a hard time interpreting what the predicate would evaluate to since I do not have access to __ctype_b ...
1
vote
0
answers
40
views
How to obtain import name from disassembled assembly
I'm trying to create my own tools for reverse engineering PE. I have some assembly codes that I fetched from a clone of objdump for a program. Sometimes I see call instructions such as :
callq *...
- 11
1
vote
1
answer
83
views
Unable to understand x86 instruction(s)
Recently I have been given a set of assembly instructions which I must learn to understand. I know an extremely basic level of x86 assembly but I'm starting to come across more nuances that are very ...
- 13
1
vote
1
answer
73
views
Clean Angr disassemble output
I'm developing a python script for Angr that has to print as output something in the form of:
Instruction_disassembled opcode_bytes_of_instruction
This is my python script:
f = open(sys....
- 99
3
votes
0
answers
153
views
Extract disassembly from Ghidra for reassembling
How can I extract a code listing from a Ghidra project such that I can reassemble with something like vasm? I have gone through a memory snapshot and disassembled the code and marked data sections etc....
- 131
2
votes
0
answers
156
views
Specifying struct offsets in Ghidra
I'm using Ghidra to disassemble some 68000 code. I only want to look at the disassembly listing, and I have no interest in the decompilation view.
Here's one instruction I'm looking at.
...
- 163
2
votes
2
answers
68
views
Why does this code use multiple shifts instead of one?
I came across the following piece of 16-bit x86 code for multiplying a value by 40, using just shifts and additions:
; BX holds the value we want to multiply.
; The result is stored in AX.
MOV AX, BX
...
- 143
2
votes
1
answer
195
views
What are these functions for?
Sometimes when reversing the code - I see that each linked file is separated by these functions:
_$E19
_$E18
sometimes - there is no such separation (depending on the degree of compiler optimization)...
- 449
2
votes
0
answers
33
views
Data placement in memory
I am playing with buffer overflow attacks in C. I have the following code:
int foo(void*, void*); // Calculates the distance (in bytes) between two addresses in memory
int main(int argc, char**...
- 21
1
vote
0
answers
79
views
How can I manually figure out stack variable/buffer sizes from stripped x86-64 disassembly?
I am looking at the following CTF challenge:
0x56555779 <+0>: lea ecx,[esp+0x4]
0x5655577d <+4>: and esp,0xfffffff0
0x56555780 <+7>: push DWORD PTR [ecx-0x4]
...
- 1,738
3
votes
1
answer
166
views
Simplifying and reversing an encryption/decryption algorithm in ASM X86 / Python
I'm trying to reverse a decoding function in order to produce the function for encoding (for the curious this is a save game for a legacy adventure game which use codes for saving).
So far I have ...
- 31
3
votes
1
answer
58
views
x64 buffer overflow - tcp shell payload
ASLR: off
Canary: on
I have a binary that when run, it spawns zombie process on port 9191. I've been using ghidra and gdb to reverse engineer this and have found the buffer, canary, found the pop rdi ...
- 31
2
votes
0
answers
360
views
GDB "Cannot access memory at address ...." Breakpoint error
I have not yet found the solution on internet so i ask it here.
Never had this problem before it was always doing fine, so i don't know what changed.
I'm using gdb peda but the problem stays the same ...
1
vote
0
answers
191
views
Dumping .NET Dynamic Methods
I have a .NET exe that creates DynamicMethods whose bodies are built from a byte array and later called. I'm able to access the array, and even to disassemble it "raw" starting from the ...
- 11
0
votes
1
answer
49
views
Trying to understand this interrupted (?) function prologue
Note: The uninterrupted disassembly is at the bottom
Hey, I'm looking at the the assembly and I'm trying to reverse engineer the function
Here, it seems like we are saving the previous rbp. Though, it ...
0
votes
0
answers
85
views
Reversing Assembly Code (ASM) to Extract Password (Pin)
I'm new to binary exploitation and CTF challenges. I need to solve a CTF challenge and find the flag. All the program does is display "Flag length is: 32". I've tried to analyze the file ...
0
votes
0
answers
69
views
IDA Pro maps wrong variable for offset
I hope there is a proper way to fix my issue.
Here's memory layout:
.data:004F3D10 char * * gTownObjNames dd offset aMage ; DATA XREF: townManager::SetupTown(void)+245↑r
.data:004F3D10 ...
- 21
1
vote
1
answer
252
views
How to disassemble an entire function in Windbg?
I am trying to disassemble the function ExAcquireFastMutex using WinDbg but it gives me only 8 rows:
3: kd> u nt!ExAcquireFastMutex
nt!ExAcquireFastMutex:
fffff805`456e3820 4053 push ...
- 573
1
vote
1
answer
191
views
Frida script returning different instruction at address compared to entering commands in repl
I have an iOS device on 14.2 and am using frida 15.2.2 on Ubuntu 18.04.
If I launch an app via frida, in the repl I can get the base address of the module, add an offset to that address, and print the ...
- 157
2
votes
1
answer
760
views
How do I Decompile .Pyd file made with python, cython and pyinstaller 3.6
I created an app in 2018 with python and then used Cython and pyinstaller v 3.6.
I am wondering how to decompile it. I have tried uncompyle6 + pyinstxtractor however this only works for python files,...
- 121
1
vote
1
answer
149
views
Can I get a valid source code from this assembly?
I've used the IDA 8.0 Demo to retrieve (from a .DLL) the assembly code, such as:
; code
pxor xmm0, xmm0
ucomiss xmm0, xmm1
ja short loc_67F31600
movss xmm2, cs:...
- 113
1
vote
0
answers
142
views
Finding the main function on Windows compiled executables
For a C/C++ program compiled on Windows using the x86 architecture, what is the best way to find the main function within disassembled code without relying on signatures such as FLIRT?
I've found ...
- 21
2
votes
1
answer
91
views
Multi segement code, but I'm stuck at this one part. What does sprintf do?
This is a multi part program where a 'challenge token' is generated and I have to provide a response that I believe needs to be in token form as well because when I enter it the parts in without ...
- 21
0
votes
1
answer
53
views
PowerPC disassembly with libopcodes
I want to disassemble Wii game executable binaries in C, which use the broadway microprocessor and unfortunately the only disassembler I am aware that I can use is libopcodes.
I am following this ...
- 11
-1
votes
1
answer
71
views
My IDA have 2 different address for same code How to change it
I am a novice for use ida pro and I do not know I change some settings that are maked left analyse address wrong.How I fix it?Thanks
- 1
1
vote
0
answers
66
views
jump to invalid address when emulating
I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect ...
- 21
1
vote
0
answers
98
views
Assemby reverse engineering
I'm new to assembly and need some help understanding what this program does. This program takes a username and serial. If the combination is correct, it prints the magic words.
I need to write a ...
- 11
2
votes
0
answers
297
views
Disassembly of raw binary of AARCH64 using Ghidra not complete
I am trying to disassemble a raw binary with AARCH64:LE:64:v8A:default (as per below mentioned specs).
Architecture: aarch64
CPU op-mode(s): 32-bit, 64-bit
Byte Order: Little Endian
CPU(s): 8
On-...
- 21
1
vote
1
answer
194
views
Automatically name class methods in IDA
Let's say I have:
mov ecx, [g_pMyClassObj] ; type CMyClass
call sub_B00BA ; a thiscall function
Is there a feature/plugin/script to automatically rename all subroutine occurrences to:
mov ecx, [...
0
votes
0
answers
53
views
Is there any available source code which is Windows 64 bit compatible that can disassemble binary code?
I'm writing a program that takes as input a single byte of binary (machine code from code segment) and converts it into assembly. I've done some searching online but have yet to find anything helpful. ...
- 1
Hot Network Questions
- Computer is frying all USB devices that are connected
- Generating TOTP for 2FA directly from the computer (no mobile device)
- What does "unsearchable" mean in "the unsearchable riches of Christ". Ephesians 3:8?
- Would 1 Peter Be The Oldest Letter In The New Testament?
- Word for a choice that is not really a choice
- Importance of PhD grade for future career in physics research?
- How did Ptolemy know that days were unequal lengths?
- Heating of B-70 vs. SR-71
- How should Directors deal with an overbearing branch Manager?
- Can underage people who commit a crime while underaged but are later charged with the same crime after turning 18 be tried as an adult?
- How to run the execute method of Queueable Apex?
- How to quickly generate rectangles in place of text
- Is Arcana the only profiency in 5e that locks something behind the *skill* profiency system?
- Accused of plagiarism in my master thesis, which I submitted two years ago. What now?
- Interception of missiles in space combat
- Why does Harry think that Dumbledore has never been in the Room of Requirement?
- Why are developers expected to estimate tasks at all?
- Section title inside the indentation of a par in plain TeX
- Binary adder implemented in Rust
- Word for "separating a group of similar-but-not-the-same things into categories"?
- Is the "Bayesian approach" about prior beliefs, viewing parameters as random variables, or both?
- Can bombs gain weapon runes?
- How many TCP retransmissions Internet traffic is considered normal for a basic home setup?
- Draw a vertical line from x to f(x)