Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

Filter by
Sorted by
Tagged with
0 votes
1 answer
52 views

Tips for reverse engineering Common Lisp (SBCL) ELF binary

I got to the task of reverse engineering the ELF binary. I found out that it is a compiled SBCL. I have no idea how to do static or dynamic analysis, any tips (where to start, I found basically ...
Grandmaster's user avatar
0 votes
0 answers
23 views

How to trigger calls and attach to functions on a running process?

I'm a software developer, with some knowledge in memory management but near zero experience in reverse engineering. I wonder if there is a way to detect which function a program calls at certain ...
Unknown X's user avatar
0 votes
0 answers
20 views

wWinMainCRTStartup and wWinMain are filled with uninitialized memory

I have a PE executable (32 bit) GUI program and I tried to reverse engineer it. I opened it in Ghidra and discovered the entry calls wWinMainCRTStartup. However, when I checked wWinMainCRTStartup all ...
notabot's user avatar
2 votes
0 answers
51 views

Changing instruction that was misidentified in IDA Pro

I am trying to compare a source code to a disassembled version of a Sega Genesis (68000 processor) game. I ran the binary through IDA Pro 7.7 to disassemble it, and when I was going through the code ...
John G's user avatar
  • 21
0 votes
1 answer
56 views

Offset addressing

I’m writing a C-SKY (CK803S) processor module for IDA Pro, and a question arose about offsets in transitions, small ones are fine, but long ones lead to nowhere, from the documentation: in code I ...
Andynvkz's user avatar
0 votes
1 answer
83 views

IDA - Decoding this "XORed"? string automatically in psuedocode

__m128i ModuleName; __m128i ProcName; ModuleName.m128i_i64[0] = 0x3E4D19089E7D5EDi64; ModuleName.m128i_i64[1] = 0xD8855EB576AF36A0ui64; ProcName.m128i_i64[0] = 0x6F80FFFCE583A183i64; ProcName....
lightersmash's user avatar
0 votes
1 answer
117 views

Hooking a function

So, I'm attempting to create a mod for an older game, Fable: The Lost Chapters. I was able to find the MacOS release of the game, which contains symbols, and I was also able to find a leaked debug ...
Reaper's user avatar
  • 1
2 votes
0 answers
100 views

Vtables in objects with inheritance in IDA

I'm struggling to get object inheritance working in IDA. The original structure is as follows: INoticeSource : INoticeSink IRTTITypeInfo : IUnknown, INoticeSource IPersist : IUnknown IPersistStream : ...
ZivDero's user avatar
  • 21
0 votes
1 answer
86 views

How can I change the data type of `puVar1` in this C++ function?

I was reversing ( new to the reversing world of course) being using Ghidra for this. I get a C++ function AppChat::__Status::setDescription(ErrorCode param_1). Within this function, there's a variable ...
hanan's user avatar
  • 309
0 votes
0 answers
44 views

IDA can't load DLL, possibly packed but how?

I tried to load a DLL to reverse engineer the code inside using IDA, but it tells me this on loading: So i assume the .text resource is somewhat "packed". I then fetched a tool named "...
HeckMeck's user avatar
1 vote
1 answer
101 views

Why are these strings padded every other byte?

I've seen this multiple times, through various apps and snooping of hex values. Character strings but every other value is actually a null byte. This particular example is with API Monitor, but I'm ...
Katastic Voyage's user avatar
0 votes
1 answer
85 views

Patch all calls to a single function using IDC

I am quite new in reverse-engineering and programming in general, sorry in advance if this question is dumb. It goes like this: In c++ disassembled code exist calls to a certain function. 2 thousand ...
flying_meatball's user avatar
0 votes
0 answers
55 views

Is there a way to access the background calculation & data in a .exe coded in fortran 30+ years ago?

The company I work for has an ancient (circa 1989-1992) program coded in Fortran that is used for sizing and selecting some of our products. We are going through a modernization project with the goal ...
JMG656's user avatar
  • 1
0 votes
0 answers
126 views

Prevent GCC compiler from constant folding

I have simple C Code: int main() { int b = 3-1; return 0; } And when I objdump it after compiling with no optimization: 000000000000113d <main>: 113d: f3 0f 1e fa ...
killertoge's user avatar
0 votes
0 answers
51 views

Executable Opcodes of Windows Image File Seem Offset from My Calculations

Background: I'm trying to manually disassemble a practice executable file for practice. https://github.com/stryker2k2/dbg-demo/blob/master/assem/assem_0x00.asm Issue: When I take a look at what I ...
Liam Hanrahan's user avatar
0 votes
0 answers
71 views

Memory address conversion

I have 32 bit MS-DOS app, it used dos4gw.exe extender. I run this app in DosBox debug mode. I looked at IDA - and function main() in this app has address: cseg01:00038460 main_ proc near ...
black4's user avatar
  • 331
3 votes
0 answers
130 views

Reverse DLL and EXE at the same time?

I started reversing a 32-bit x86 EXE that led me down the path of finding the structure and core functions I needed inside of a DLL. I'm currently using Binary Ninja 3.5 as my disassembler, decompiler,...
TyCobb's user avatar
  • 131
0 votes
0 answers
67 views

Requesting Guidance To Understand SuperScape's .VCA Format: Lego Creator Knights Kingdom

I hope you all are doing well and staying safe. I am in the process of trying to understand how SuperScape stored data in their .VCA/LCA format, so I can extract the original SHAP and PAL data from ...
amoebame's user avatar
0 votes
0 answers
36 views

DesignAKnit shape (.shp) file format

With help from information provided by members of this forum, I have more or less succeeded in reverse engineering DesignAKnit pattern (.stp) files. Has anybody worked on the shape files? I have never ...
Tom Price's user avatar
1 vote
1 answer
176 views

ARM64 Stack Layout - Why 100x'A' Doesn't Crash?

I'm trying to exploit a buffer overflow vulnerability in an ARM64 program from this blog. When I give as input 100*'A', and I compile the program for ARM 32 bit (without canaries), the program crashes ...
alond22's user avatar
  • 113
1 vote
0 answers
102 views

How can I make IDA disassemble in NASM-like syntax instead of MASM-like syntax?

I'm new to reverse engineering, assembly and IDA and I'm learning NASM. Whenever I load an executable (a PE file or an ELF) IDA disassembles it using a MASM-like syntax (it looks to me that it does) ...
LyZeN77's user avatar
  • 11
0 votes
1 answer
150 views

Is DOS Assembly Hexadecimal Different To Modern Hex Editor Hexadecimal?

I am trying to find the correct Data Segment, corresponding to a certain File in a 16bit DOS Game. The Assembly Instructions for the Decompiled .exe File in IDA Pro Version 5, I am looking at. I was ...
Edward Winch's user avatar
1 vote
0 answers
93 views

DOS .exe File Decompiled in Cutter Program Showing Different Than In IDA Pro

I am having an issue when using the Cutter Reverse Engineering Program, Here is a Segment of Decompiled Assembly, in Cutter :- at 0000:4ed5 in the picture I posted the .string line of text is there, ...
Edward Winch's user avatar
1 vote
2 answers
384 views

Using IDA 8.3 Freeware on a Z180 .bin file

The last time I tried my hand at disassembly it was in 1986-1988... a Z80 embedded processor PROM image file... 42K of code turned into 27000+ lines of assembler code... using a disassembly program ...
Mike's user avatar
  • 21
1 vote
1 answer
116 views

Strange entry point for an old Mac OS X x86 32 bit binary

I wanted to reverse engineer an old game for Mac OS X, but I can't figure out how the entry point jumps to other code. The binary is an x86 Macho-O executable and, according to Detect it Easy, it was ...
Ajadaz's user avatar
  • 11
0 votes
0 answers
52 views

INT 31h MS DOS Lock linear region function

cseg01:000561C4 mov edx, offset sub_56BA0 cseg01:000561C9 mov eax, offset sub_56C66 cseg01:000561CE sub eax, edx cseg01:000561D0 ...
black4's user avatar
  • 331
0 votes
0 answers
48 views

Convert hex chars string to int

For example we have chars buffer with hex value: char * buff = {"e000"}; //this is our hex value in eax - input for Get_Val(). Then there is function Get_Val() - converts hex (string) to ...
black4's user avatar
  • 331
1 vote
0 answers
53 views

Tool for reverse-engineering M7702 binary?

I'm considering reverse-engineering a 1994-era embedded system which CPU is a Mitsubishi M37702S1AFP with external 128k × 8 EPROM that I know how to read. The CPU has 16-bit registers A, B (data), X, ...
fgrieu's user avatar
  • 186
0 votes
0 answers
45 views

How can I map a binary that uses bank switching in IDA Pro?

Is it possible to memory map a binary that uses bank switching in IDA Pro? I'm trying to reverse engineer a binary for the Motorola 6800 architecture. The full 64Kb binary is mapped to the upper 32Kb ...
graphite_block's user avatar
0 votes
0 answers
55 views

MS-DOS 32 bit mode Timer interrupt

My application works in 32 bit MS-DOS mode with dos4gw.exe extender. variables unknown_bool_0004AA8A = 1, unknown_bool_0004AAA0 = 1. cseg01:0004AAB3 mov eax, offset Proc_Addr1 ...
black4's user avatar
  • 331
2 votes
1 answer
201 views

APK Reversing. Some code is hidden?

Sorry for my English. I accepted a challenge (part of the partial exams of the year) from my university professor of IT Security and Privacy. He gave me an APK and I need to find out how the login is ...
Mr Ciccio's user avatar
0 votes
2 answers
157 views

Cutter shows addresses relative to stack but not rbp. How to change it?

Look at the first image: Here what I get is var void *buf @ stack - 0x28. But I'm watching a tutorial there his Cutter shows like this: var void *buf @ rbp - 0x20. How can I change cutter to appear ...
NobinPegasus's user avatar
1 vote
1 answer
72 views

vivisect get assembly instructions

I was going through Vivisect Documentation which seems limited. I wanted to create a tool that gets the functions and then get the assembly code or just assembly instruction (mnemonics ) in a given ...
Aditya's user avatar
  • 11
0 votes
0 answers
47 views

Using __usercall convention in IDA with non-x86 architecture

I'm working on SPARC binary in IDA Pro and need to use __usercall convention, but can't make it work. For example, I've tried to use the following function declaration to reflect the fact that the ...
Vadim  Yakovlev's user avatar
3 votes
1 answer
2k views

What are the substantive differences between radare2 and rizin?

Rizin was forked from Radare2 several years ago, mainly due to human factors. At the time, there weren't any important differences in features between the two. I understand that Rizin has rewritten ...
SRobertJames's user avatar
0 votes
0 answers
129 views

from executable to assembly source code?

let's say i have an ".exe program" and i want to disassemble it and get "disassembled code" . my question is => can i maintain and organize that "disassembled code" ...
0x00001F's user avatar
2 votes
0 answers
138 views

Trying To Understand DOS Game Assembly Instructions

I am trying to understand assembly language instructions, for a DOS Game. I have looked at the following Link :- https://atrevida.comprenica.com/atrtut07.html reading about how VGA Graphics work in ...
Edward Winch's user avatar
1 vote
1 answer
439 views

How can I tell ghidra what structure an address register points to?

I am reversing a raw bare-metal binary firmware for a tricore processor (TC1762/TC1766). In many functions i'm currently reversing there is access to offsets of the address stored in the a0 register. ...
user103675's user avatar
-1 votes
1 answer
222 views

Simple Question About Reversing a Python

So, detect it easy, shows that the .exe is a python 3.9 compiled on visual studio and the compiler was MS Visual C/C++. Trying to unpack it using pyinstxtractor fails, and shows me the error of ...
Roy Guzman's user avatar
2 votes
2 answers
2k views

UPX Unpacking tool

Firstly, thank you for your answer. What is the best unpacking tool to use to unpack - UPX 0.89.6 - 1.02 / 1.05 - 1.24 ->[Overlay] could you please provide a link so i can obtain as such. Thank ...
Alan's user avatar
  • 21
1 vote
0 answers
165 views

Where can I find the files from Ghidra symbol tree?

I have decompiled a .dll file with Ghidra. At the left, I see the symbol tree. In the symbol tree, there is a tab imports. This tab contains external .dll files. Where can I find the location of these ...
Riemann's user avatar
  • 83
2 votes
2 answers
252 views

How can I find the buffer of CryptGenRandom?

I am trying to analyze the CryptGenRandom algorithm on my Windows 10 laptop. According to Niels Ferguson's Whitepaper called 'The Windows 10 random number generation infrastructure', the ...
Riemann's user avatar
  • 83
0 votes
1 answer
213 views

How to pass an SVD file as an argument to IDA Pro in the command line (batch mode)?

I am trying to disassemble a few Arm Cortex-M3 .elf binaries and run a custom IDAPython script (script.py) from the command line (in batch mode). I have been able to do that with the following command:...
Konstantinos's user avatar
0 votes
0 answers
133 views

What obfuscator do this?

So, first if i try to use DnSpy all the methods are empty and some of them returns decompiler exceptions like System.ArgumentOutOfRangeException: Non-negative number required. (Parameter 'length') ...
SilverStitch's user avatar
0 votes
0 answers
99 views

How do I properly decode the .bin files (RLE compression)? (DOS game - 1988)

Does anyone know what tools should I use to extract the backgrounds and sprites of this very rare old game: Armorik the Viking? The files are in .BIN format. Compression is RLE The game is from 1988 ...
The Thinker's user avatar
1 vote
2 answers
391 views

How do I extract sprites and backgrounds from .BIN files? (dos game - 1988)

Does anyone know what tools should I use to extract the backgrounds and sprites of this very rare old game: Armorik the Viking? The files are in .BIN format. No idea how to open them. I tried Game ...
Fab's user avatar
  • 11
1 vote
0 answers
135 views

Reversing Assembly to C

I've read the open letter addressing students asking for help with their homework and I agree with it, therefore I will try to be less of a pain in the *** ;) I need to reverse the x86-64 (AT&T) ...
mikealexx's user avatar
1 vote
1 answer
558 views

Dumpbin show function names

Is there any way I can use dumpbin like objdump, where I can just look at the functions machine instructions that I implemented in my Source.c file, which I compiled to source.exe? If I use dumpbin \...
killertoge's user avatar
3 votes
1 answer
565 views

How to reverse Engineer a Struct in IDA Pro?

How to identify and define a struct in IDA pro Decompiling during reverse engineering? Please explain the easiest way to figure out the struct in IDA Pro decompilation! To make life easier are there ...
Jose I. Hughes's user avatar
2 votes
1 answer
147 views

Identify mod operation in ARM firmware with IDA

I have the firmware in which mod operation must be done. I want to find this part of instructions. Assume the following logic exist in the firmware: res = var % 17 I have tried to make search by % ...
ALEX's user avatar
  • 21

1
2 3 4 5
26