Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

Filter by
Sorted by
Tagged with
0
votes
1answer
10 views

Change instruction test eax, eax to text eax, 1

I'm trying to change an instruction in assembly. Try with test eax, eax to test eax, 1. I try modify the opcodes. For example opcode of test eax, eax: 85c0 Try to understand why is 85c0 with this ...
1
vote
0answers
35 views

write radare2 output to a file

I am trying to write all the write logs of a binary program into a file for further analysis. I am using radare2 for it. I don't know what's the issue, I am not able to write the 'dte' output to a ...
0
votes
1answer
44 views

Change IDA pro dissassembly to linear sweep

I would like to know if there is any way to modify the algorithm used in IDA pro. I have a binary where I suspect that junk isn't junk, and I would like to see what output would a linear disassembly ...
0
votes
1answer
49 views

Dump value of register using frida

I'm new with frida and came to this problem. I have dll that I want to reverse engeneer(there are no debug symbols). Specifically I want to dump some data from a function. So I have this big function ...
2
votes
0answers
20 views

What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump

I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array. First 6 headers are shown below from readelf Program Headers: Type Offset ...
5
votes
1answer
135 views

Any reason why Ghidra is screwing with this byte in this dissassembly?

I am poking around some PS2 ELFs and I found this weird issue where Ghidra seems to be doubling the value of this byte for some reason. Here's what Ghidra shows: ...
0
votes
0answers
52 views

find a video file in memory dump of a process

I have a player that plays encrypted video files and works like this: I open an encrypted video file with it it decrypts the video file and writes it to its memory and plays the file from the memory ...
2
votes
1answer
75 views

Finding address in IDA from address found in Cheat Engine

I found a pointer's address, 0x485FE058, in Cheat Engine. However, when I load up the exe in IDA, the addresses are smaller and start from 0x00401000. I read up somewhere that this was called virtual ...
0
votes
1answer
49 views

ACCESS_VIOLATION when attaching a debugger

I'm debugging a software and it hits access violation on wcslen function under debugger but runs normally without it. First I thought It had some anti-debug trick, but I could not found any ...
1
vote
0answers
36 views

Reproduce compilation (ASM) output for library detection - identifying compiler, version & options used

I want to reverse a stripped x86 sample that uses a static library. So far I could identify the library itself and narrow the version of the library used. Now I want to use Ghidra's Function ID ...
1
vote
0answers
50 views

Determine what architecture a piece of shellcode targets

After some personal research I didn't find any possible way or a paper to explain how to determine what architecture a given piece of shellcode may targets. The only obvious way I found would be to ...
1
vote
0answers
65 views

Ghidra - Export namespaces

I am currently learning to use ghidra, and I found the Symbol Tree. Ghidra found some namespaces that I would like to export. These namespaces don't even have to be readable, just reusable, such that ...
0
votes
0answers
74 views

Why decrement a hex value in assembly code?

I am running a disassembly of a firmware image for a Cortex-M4 and the entry point is doing something strange. EntryPoint: 00001000 db 0x00 ; '.' 00001001 db 0xff ; '.' 00001002 ...
0
votes
0answers
35 views

Turning p-code generated by VBA (Visual Basic for Applications) back into VBA

According to the README in https://github.com/bontchev/pcodedmp : "As each VBA line is entered into the VBA editor, it is immediately compiled into p-code" "when you open the source of a macro ...
0
votes
0answers
57 views

Disassembling ARM binary

I am trying to disassemble a firmware binary which I am interested in. Yet I don't have much experience in this field, which is why I would like some input from you guys. My current state is that I ...
3
votes
1answer
157 views

ELF x86 - Why is return address pushed twice?

I reverse an ELF x86, and I would like to understand why the return address is pushed again on the stack? It should be already present there. main: lea ecx, [esp+0x4 {argc}] and esp, 0xfffffff0 ...
1
vote
0answers
105 views

Mysterious chunk of code in IOLI crackme0x06 challenge

I've been struggling to understand a very strange piece of x86 assembly code from the IOLI crackme0x06 challenge. Context But first of all, here is the context : I've successfully cracked the ...
3
votes
1answer
104 views

How to identify memory access locations

I'm working on disassembling a flash dump from a TriCore TC1766 which came from a car (an MT86 ECU). My goal is to identify tables and scalars in the data area, and determine what they are used for. I ...
0
votes
1answer
61 views

What does ds mean?

When debugging with x64dbg I sometimes see mov ss:[address] 0xAA, I know that this means: move 0xAA into memory at specified address. But what does mov ds:[address] 0xAA mean?
1
vote
0answers
39 views

How is sprintf() identified by IDApro? [closed]

#include<stdio.h> int main() { char buffer[50]; int a = 10, b = 20, c; c = a + b; sprintf(buffer, "Sum of %d and %d is %d", a, b, c); // The string "sum of 10 and 20 is 30" ...
2
votes
2answers
148 views

Translating a Korean Exclusive PS2 game ~ hangeul encoding?

I got my hands on a copy of Mystic Nights, a survival horror game for the PS2 realeased exclusively in Korea. The game's text is all in Hangeul (Korean writting system). I extracted the ISO and ...
1
vote
1answer
82 views

eip register address not matching with address at breakpoint (breakpoint set at main function)

I recently started reading a book about reverse engineering. In one of the examples it uses gdb (debugger) to disassemble the main. So I did it, and the output is below (gdb) disass main Dump of ...
2
votes
1answer
309 views

Can Ghidra show me the p-code generated for an instruction?

I'm trying to verify the correctness of a custom processor module in Ghidra. The instruction that I am currently analyzing does some fancy stuff with its p-code. Specifically, it uses a bunch of ...
0
votes
0answers
95 views

Help reverse engineering a small (60kb) .exe file used for extracting .tga images from a custom container

The executable grabs the specified container format and extracts .tga images from it. It was community-made to satisfy a certain niche, unfortunately I cannot get into contact with the original ...
0
votes
2answers
110 views

crackme disassembly - are these local variables ever initialized?

I'm working on a crackme, where the objective is to find the valid password given a program. I'm using radare2 to reverse engineering the program. To do so, I need to enter a password that forces this ...
0
votes
0answers
26 views

Changing pseudocode based on FPU fmul behaviour

A 3D software was compiled in which a typical x/4096f was translated as: fmul ds:f4096 where f4096 equals to: 0.00024414062 Example decompiled pseudocode as-is: skeletonMemoryPointer[i].pos = *(...
0
votes
1answer
98 views

How to split ARM code/data from binary in Inmarsat Isatphone Pro?

I'm analyzing the 3 binaries for updating firmware to the Inmarsat Isatphone Pro phone. Additionally, I'm following the Groundworks Technologies paper, and attempting to recreate their work as a ...
0
votes
1answer
95 views

Finding the correct emulator for programming a renesas sh7722 processor

I have a question about reverse engineering a Roland gr-55 guitar synthesizer. I'm 90% sure the device uses a Renesas sh7722 processor as the main CPU, or at least one of the CPU's in the SH family. I ...
2
votes
1answer
60 views

How to examine/edit stack memory contents using radare2 in debug mode?

How can i examine/edit stack contents using radare2, just like gdb ? Is there a way to examine memory using $rbp or $rsp register like below. x $rbp-10 <--- something like this which can dump from ...
1
vote
0answers
35 views

IDA Pro how debug constant function returning different results?

The code below is executed with the parameters (0, 4, 0) , the first 0 being an int pointer casted to an int, and these are the same every time. After execution, a 3 digit number string is returned/...
3
votes
2answers
160 views

Edit an ELF file (language pack)

I have here an ELF file that contains a language pack (German and Chinese) and I want to swap the chinese language to the german language. hex cannot represent Chinese :) here an excerpt from the ...
0
votes
1answer
147 views

How to find functions in IDA Pro/x64dbg

i created a program for testing, very simple in c++. is ask for password if it is match is print correct, if no it is print "bad". i try to find with ida where is the function of what i made. but i ...
0
votes
1answer
58 views

Finding function at offset loaded with ADRP/ADD

I have this assembly: ADRP X8, #off_FFFFFFF006F1E960@PAGE ADD X8, X8, #off_FFFFFFF006F1E960@PAGEOFF LDR X0, [X8] ; qword_FFFFFFF0077F08A8 LDR X8, [X0] ...
1
vote
1answer
234 views

C# Changing method body in runtime

I am trying to change a part in a third party library, it has a bug, however, there are no fixes and source code is not available as well. At first, I tried to modify IL Opcodes directly by ...
1
vote
2answers
100 views

How to determine platform from .bin?

I have an android app (com.daye.dayeapp) to control my robot lawn mower. The App contains new firmware in the assets folder, in the form of a 122KB .bin file. How do I determine the architecture of ...
0
votes
1answer
95 views

IDA PRO Tracing stopps

I need to get data from the window of the external program. This data is dynamic and changes each time the additional window is restarted. I have already found an offset, but I need to find the ...
0
votes
0answers
68 views

How to disassemble .mbn files?

I can't disassemble .mbn files using ida pro 7+ if I use some scripts from GitHub than I can't disassemble any function, any help ? I want to reverse qcom bootloader
3
votes
0answers
536 views

How to load symbols from a symbol server in Ghidra?

I've been trying to learn Ghidra by attempting to reverse the comctl32.dll system library, which has many of its functions documented. I started the de-compilation analysis in it, and after a while it ...
-1
votes
1answer
117 views

How can I convert the following assembly code to pseudo code?

I got the following disassembly code in IDA pro. I really find it hard to convert it into pseudo code. push ebp mov ebp, esp sub esp, 14h mov dword ptr [ebp-14h], 1 mov dword ptr [ebp-10h], 2 mov ...
-1
votes
1answer
86 views

How can I convert the following disassembly code to pseudo code or C code?

I used IDA pro to get the following disassembly code. I am having difficulty converting it into the equivalent c code. mov dword ptr [ebp-8], 1 mov dword ptr [ebp-4], 0 loc_401014: cmp dword ptr [...
0
votes
2answers
308 views

What's happening in the assembly main function?

I'm currently inspecting a 32-bit malware executable in a WinXP VM using IDA Pro (free version). I don't understand what's happening in the main function here. Where should I set the breakpoints (...
0
votes
1answer
82 views

What is this assembly doing?

I wrote a very basic crackme to learn how assembly works. Even though I wrote it myself, I am having some trouble understanding a few pieces of the assembly: What I know up to now is: [rbp+rax+...
1
vote
0answers
68 views

Can anyone make much sense of this binary for an embedded system? [closed]

I want to see if anyone more experienced in reverse engineering and disassembly can take a look at this binary update file I have and maby ether help or just say if it is even possible to reverse it. ...
2
votes
2answers
386 views

Can I stop Ghidra from creating extended references?

I'm trying to disassemble some 6502 using Ghidra. The following (prerequisites: POSIX-style shell, Python 2.x) will generate a file called test.dat that demonstrates the issue: python -c "open('test....
0
votes
1answer
36 views

Is there a way to see & keep track of registers in dnSpy?

Hello I am trying to see if there is a way to see & keep track of the IP, and other registers as you would in OllyDbg or x64Dbg?
1
vote
1answer
117 views

Does a symbolic disassembler exist?

I would like to know if there are disassemblers based on a symbolic analysis, I'm beginner in RE, but I think that a disassembler based on symbolic techniques can be very interesting and could ...
3
votes
1answer
536 views

How to display the CFG of a function in Ghidra?

I am currently trying Ghidra and, I am looking at a specific function. I have the assembly code and the decompiled version of it. But, I am looking to see if I can have it as a CFG... Does someone ...
0
votes
1answer
97 views

Trace back function call

I'm learning reverse engineering and I'm trying to find where an error message is called. I want to get in the part of the code, in the main module, where it decides to display the error message or ...
0
votes
0answers
50 views

Handling __int64 in IDA?

This is probably something very easy that I'm missing. I have this operation length_of_userInput = (signed int)(unsigned __int8)userInput >> 1; And length_of_userInput is currently reading '...
1
vote
0answers
78 views

Which architecture is this firmware?

I am currently investigating GSL touch-screen controllers firmwares. A firmware example can be found here : https://github.com/onitake/gsl-firmware/blob/master/firmware/4good/t803i/silead_ts.fw In ...