Questions tagged [disassembly]
The translation of machine code into a human readable assembly code, also the result of such translation.
1,246
questions
3
votes
0
answers
77
views
Reverse DLL and EXE at the same time?
I started reversing a 32-bit x86 EXE that led me down the path of finding the structure and core functions I needed inside of a DLL. I'm currently using Binary Ninja 3.5 as my disassembler, decompiler,...
- 131
0
votes
0
answers
22
views
Requesting Guidance To Understand SuperScape's .VCA Format: Lego Creator Knights Kingdom
I hope you all are doing well and staying safe.
I am in the process of trying to understand how SuperScape stored data in their .VCA/LCA format, so I can extract the original SHAP and PAL data from ...
- 1
0
votes
0
answers
21
views
DesignAKnit shape (.shp) file format
With help from information provided by members of this forum, I have more or less succeeded in reverse engineering DesignAKnit pattern (.stp) files. Has anybody worked on the shape files? I have never ...
0
votes
1
answer
112
views
ARM64 Stack Layout - Why 100x'A' Doesn't Crash?
I'm trying to exploit a buffer overflow vulnerability in an ARM64 program from this blog.
When I give as input 100*'A', and I compile the program for ARM 32 bit (without canaries), the program crashes ...
- 101
1
vote
0
answers
59
views
How can I make IDA disassemble in NASM-like syntax instead of MASM-like syntax?
I'm new to reverse engineering, assembly and IDA and I'm learning NASM. Whenever I load an executable (a PE file or an ELF) IDA disassembles it using a MASM-like syntax (it looks to me that it does) ...
- 11
0
votes
1
answer
109
views
Is DOS Assembly Hexadecimal Different To Modern Hex Editor Hexadecimal?
I am trying to find the correct Data Segment, corresponding to a certain File in a 16bit DOS Game.
The Assembly Instructions for the Decompiled .exe File in IDA Pro Version 5, I am looking at.
I was ...
- 79
1
vote
0
answers
76
views
DOS .exe File Decompiled in Cutter Program Showing Different Than In IDA Pro
I am having an issue when using the Cutter Reverse Engineering Program,
Here is a Segment of Decompiled Assembly, in Cutter :-
at 0000:4ed5 in the picture I posted the .string line of text is there, ...
- 79
1
vote
2
answers
198
views
Using IDA 8.3 Freeware on a Z180 .bin file
The last time I tried my hand at disassembly it was in
1986-1988... a Z80 embedded processor PROM image file...
42K of code turned into 27000+ lines of assembler code...
using a disassembly program ...
- 21
1
vote
1
answer
85
views
Strange entry point for an old Mac OS X x86 32 bit binary
I wanted to reverse engineer an old game for Mac OS X, but I can't figure out how the entry point jumps to other code. The binary is an x86 Macho-O executable and, according to Detect it Easy, it was ...
- 11
0
votes
0
answers
49
views
INT 31h MS DOS Lock linear region function
cseg01:000561C4 mov edx, offset sub_56BA0
cseg01:000561C9 mov eax, offset sub_56C66
cseg01:000561CE sub eax, edx
cseg01:000561D0 ...
- 333
0
votes
0
answers
46
views
Convert hex chars string to int
For example we have chars buffer with hex value:
char * buff = {"e000"}; //this is our hex value in eax - input for Get_Val().
Then there is function Get_Val() - converts hex (string) to ...
- 333
1
vote
0
answers
42
views
Tool for reverse-engineering M7702 binary?
I'm considering reverse-engineering a 1994-era embedded system which CPU is a Mitsubishi M37702S1AFP with external 128k × 8 EPROM that I know how to read.
The CPU has 16-bit registers A, B (data), X, ...
- 186
0
votes
0
answers
37
views
How can I map a binary that uses bank switching in IDA Pro?
Is it possible to memory map a binary that uses bank switching in IDA Pro?
I'm trying to reverse engineer a binary for the Motorola 6800 architecture. The full 64Kb binary is mapped to the upper 32Kb ...
0
votes
0
answers
44
views
MS-DOS 32 bit mode Timer interrupt
My application works in 32 bit MS-DOS mode with dos4gw.exe extender. variables unknown_bool_0004AA8A = 1, unknown_bool_0004AAA0 = 1.
cseg01:0004AAB3 mov eax, offset Proc_Addr1
...
- 333
2
votes
1
answer
105
views
APK Reversing. Some code is hidden?
Sorry for my English. I accepted a challenge (part of the partial exams of the year) from my university professor of IT Security and Privacy. He gave me an APK and I need to find out how the login is ...
- 21
0
votes
1
answer
89
views
Cutter shows addresses relative to stack but not rbp. How to change it?
Look at the first image:
Here what I get is var void *buf @ stack - 0x28.
But I'm watching a tutorial there his Cutter shows like this:
var void *buf @ rbp - 0x20. How can I change cutter to appear ...
- 123
1
vote
1
answer
67
views
vivisect get assembly instructions
I was going through Vivisect Documentation which seems limited. I wanted to create a tool that gets the functions and then get the assembly code or just assembly instruction (mnemonics ) in a given ...
- 11
0
votes
0
answers
44
views
Using __usercall convention in IDA with non-x86 architecture
I'm working on SPARC binary in IDA Pro and need to use __usercall convention, but can't make it work. For example, I've tried to use the following function declaration to reflect the fact that the ...
1
vote
1
answer
615
views
What are the substantive differences between radare2 and rizin?
Rizin was forked from Radare2 several years ago, mainly due to human factors. At the time, there weren't any important differences in features between the two.
I understand that Rizin has rewritten ...
- 187
0
votes
0
answers
89
views
from executable to assembly source code?
let's say i have an ".exe program" and i want to disassemble it and get "disassembled code" .
my question is => can i maintain and organize that "disassembled code" ...
- 23
2
votes
0
answers
132
views
Trying To Understand DOS Game Assembly Instructions
I am trying to understand assembly language instructions, for a DOS Game.
I have looked at the following Link :- https://atrevida.comprenica.com/atrtut07.html
reading about how VGA Graphics work in ...
- 79
0
votes
1
answer
195
views
How can I tell ghidra what structure an address register points to?
I am reversing a raw bare-metal binary firmware for a tricore processor (TC1762/TC1766).
In many functions i'm currently reversing there is access to offsets of the address stored in the a0 register. ...
-1
votes
1
answer
144
views
Simple Question About Reversing a Python
So, detect it easy, shows that the .exe is a python 3.9 compiled on visual studio and the compiler was MS Visual C/C++. Trying to unpack it using pyinstxtractor fails, and shows me the error of
...
2
votes
2
answers
518
views
UPX Unpacking tool
Firstly, thank you for your answer.
What is the best unpacking tool to use to unpack - UPX 0.89.6 - 1.02 / 1.05 - 1.24 ->[Overlay] could you please provide a link so i can obtain as such.
Thank ...
- 21
1
vote
0
answers
91
views
Where can I find the files from Ghidra symbol tree?
I have decompiled a .dll file with Ghidra. At the left, I see the symbol tree. In the symbol tree, there is a tab imports. This tab contains external .dll files. Where can I find the location of these ...
- 83
2
votes
2
answers
218
views
How can I find the buffer of CryptGenRandom?
I am trying to analyze the CryptGenRandom algorithm on my Windows 10 laptop.
According to Niels Ferguson's Whitepaper called 'The Windows 10 random number generation infrastructure', the ...
- 83
0
votes
1
answer
99
views
How to pass an SVD file as an argument to IDA Pro in the command line (batch mode)?
I am trying to disassemble a few Arm Cortex-M3 .elf binaries and run a custom IDAPython script (script.py) from the command line (in batch mode). I have been able to do that with the following command:...
0
votes
0
answers
107
views
What obfuscator do this?
So, first if i try to use DnSpy all the methods are empty and some of them returns decompiler exceptions like
System.ArgumentOutOfRangeException: Non-negative number required. (Parameter 'length')
...
0
votes
0
answers
89
views
How do I properly decode the .bin files (RLE compression)? (DOS game - 1988)
Does anyone know what tools should I use to extract the backgrounds and sprites of this very rare old game: Armorik the Viking?
The files are in .BIN format. Compression is RLE
The game is from 1988 ...
1
vote
2
answers
276
views
How do I extract sprites and backgrounds from .BIN files? (dos game - 1988)
Does anyone know what tools should I use to extract the backgrounds and sprites of this very rare old game: Armorik the Viking?
The files are in .BIN format. No idea how to open them. I tried Game ...
- 11
1
vote
0
answers
119
views
Reversing Assembly to C
I've read the open letter addressing students asking for help with their homework and I agree with it, therefore I will try to be less of a pain in the *** ;)
I need to reverse the x86-64 (AT&T) ...
- 11
1
vote
1
answer
319
views
Dumpbin show function names
Is there any way I can use dumpbin like objdump, where I can just look at the functions machine instructions that I implemented in my Source.c file, which I compiled to source.exe?
If I use dumpbin \...
- 115
3
votes
1
answer
359
views
How to reverse Engineer a Struct in IDA Pro?
How to identify and define a struct in IDA pro Decompiling during reverse engineering?
Please explain the easiest way to figure out the struct in IDA Pro decompilation!
To make life easier are there ...
2
votes
1
answer
137
views
Identify mod operation in ARM firmware with IDA
I have the firmware in which mod operation must be done. I want to find this part of instructions.
Assume the following logic exist in the firmware:
res = var % 17
I have tried to make search by % ...
- 21
2
votes
0
answers
87
views
IDA Pro Exports Table Corrupted!
I've been analyzing a dll file and naming the functions, structs, variables, and so on.
A lot of information has been changed and saved, but after the following message appears, the address column of ...
- 71
2
votes
1
answer
86
views
Stuck decompiling ARM64 function
I am trying to figure out how this function squashes quaternion (double[4], dvar5..6 in the disassembly) data into the 2 int outputs vertexX and vertexY.
As far as I can tell, it reads the raw sensor ...
- 21
5
votes
2
answers
573
views
How can I disassemble/decompile an immediate value to multiplication/summation of two values with IDA Pro?
Is it possible to force IDA to show "5 * 20" instead of "100" in the below disassembled and decompiled lines?
MOV R1, #100 -> MOV R1, #(5 * 20)
LDR R8, =var | ...
- 171
4
votes
3
answers
366
views
Help disassembling a simple 16-bit NE function
I am currently attempting to reverse engineer a simple function from within a 16-Bit Windows 3.1 (NE) DLL, which from what I can tell is used to display a message box when required.
I would assume ...
- 165
1
vote
0
answers
176
views
Get all names of functions from an iOS-App binary (headless)
Setup:
I want to get a list of all (apple built-in) function and variable names that are used in an arbitrary iOS App by headless analysis. So given the .ipa file of any iOS-App, I unpack it and can ...
2
votes
0
answers
37
views
Please help with striped binary reverse
Not so long ago I was engaged in reverse and pwn, I came across such a task
This is a normal task with a vulnerability on the heap, but it is striped and I don’t understand where which functions are
I ...
- 39
2
votes
0
answers
68
views
Angr considers REP instruction as the end of a basic block
I'm developing a python script for angr that has to find all the basic blocks present in each function in a binary. I have noticed that angr splits the basic blocks when it finds a REP instruction, I'...
- 121
2
votes
1
answer
70
views
why some functions push data before the prologue
i am a newbie in the world of RE ,
i start to explorer a main entry of a classic game from 90's
and i start to see something confuse me as a newbie
this main entry function start with pushing stuff to ...
- 23
1
vote
1
answer
149
views
IDAPython doesn't recognize function
I'm developing a python script for IDA Pro that analyzes 32 bit PE files containing an anti-disassembly technique, the problem is that the function that contains the technique isn't being listed in ...
- 121
4
votes
0
answers
163
views
How to assemble back a disassembled Linux kernel?
I have a Linux kernel file and I need to tweak the contents of its corresponding initramfs. I did it in the past for standard distros where kernel and initramfs were separate. However, this specific ...
- 141
1
vote
0
answers
167
views
IDA pro Error how to resolve this error
52C187F5: The instruction at 0x52C187F5 referenced memory at 0x4. The memory could not be read -> 00000004 (exc.code c0000005, tid 672)
How to solve this?
I have seen sandbox reports in those the ...
- 31
2
votes
1
answer
169
views
What are the prerequisite knowledge needed to start solving crackmes?
I started by reading a book on C language and then moved on to "Programming From Ground Up," which teaches basic programming in x86.
School just ended, I'm working on cracking a game called ...
1
vote
1
answer
465
views
Get friendly disassemble hex file
I'd like to know if there is a way to have a more friendly way to get disassemble hex file coming from Adafruit board.
Let me explain actually I'm working with Adafruit feather 32u4 running with ...
- 131
2
votes
0
answers
61
views
Calculate Function Call To Imported Function In Dumpbin Output
What is the easiest way to determine the function called in dumpbin output. No PDBs available.
The disassembly:
004028E2: 8B 1D 70 42 40 00 mov ebx,dword ptr ds:[00404270h]
004028E8: 55 ...
- 1,235
2
votes
0
answers
114
views
I trying rewrite asm to c++ [closed]
This code generates an API key. I use it in an android app as .so file,
but I need to rewrite it to java from c++. How do I translate?
push rbp
push r15
push r14
push r13
push r12
push ...
- 21
2
votes
0
answers
69
views
Tracing odd variant of call analysis failed
Disclaimer before I get flogged: I'm playing with a commercial app, for which I have a license, for my own education because building toy C apps has run out of challenge (and I know whats inside).
...
- 215