Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

Filter by
Sorted by
Tagged with
0
votes
0answers
6 views

Disassembly Memory Organization parameters for C166 micro firmware (RAM and ROM section)?

I'm trying to disassemble some microprocessor firmware with C166 architecture in IDA, but I have no idea what to use for the memory organization screen (IGNORE THE VALUES IN ROM/LOADING SIZE) My ...
-2
votes
0answers
47 views

Interest in adapting signal processing for reverse engineering principally from a biogenomic standpoint [migrated]

NB: This was also posted over on dsp.stackexchange.com. I am seeking any possible help for a problem I have devoted a quite protracted period of time exploring. I am total perm disabled, and thus ...
0
votes
0answers
35 views

rep movsd for uninitialized data

I have this chunk of code in the DllMain() that I am failing to parse: sub_405644 proc near push ecx ; Save 4 registers push ...
0
votes
0answers
20 views

Finding out what creates FIFA RTWC 98's main window

I am currently familiarizing myself with x64dbg as a tool for reverse engineering. As an exercise, I challenged myself to try and patch FIFA RTWC 98's executable to force it to run on a windowed mode. ...
0
votes
0answers
38 views

Cheat engine process causes game to crash

When I start cheat engine while game is running, the game crashes nearly immediately with error: "Exe does not work anymore." To figure out which checks the game does on processes I created a fake ...
0
votes
0answers
24 views

Protections against disassembly tools

I am very new to reverse engineering and thus, I struggle to even know the right search terms for effective research. I have been trying to reverse engineering an encryption algorithm of a software ...
0
votes
0answers
17 views

Understanding obscure function names [duplicate]

I have seen functions like this before in disassembly but don't have a clue what they are. Their names are extremely confusing. Would someone be able to explain what these are?
4
votes
1answer
72 views

Is it possible to modify a movss or xmm# in Assembly using Cheat Engine?

Im using cheat engine as a beginner to getting into Disassembly and Hacking, and I want to know how to modify an address/pointer (not really sure how to term it) thats using a movss [...],xmm#? ...
0
votes
1answer
45 views

IDA Pro sp-analysis failed

I'm trying to reverse engineer a C# file that requires a password to continue running. When I load it in IDA Pro I get nothing in the functions window and a sp-analysis failed What I see when loaded
1
vote
1answer
56 views

Unable to intercept traffic of an android app even after patching ssl pinning

Recently, I was trying to test an app developed on Rhomobile, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can intercept other apps on my device but ...
0
votes
0answers
24 views

can't see java file but debugger shows it is present and can access using reflection

I am debugging an android application to find out the implementation of something. I am using a debugger in Android studio from which I came to know that there is a java file that is responsible but ...
-1
votes
0answers
40 views

Unknown fields on Visual Studio disassembler window

When I disassemble a simple program on debug mode in Visual Studio I see some fields that I don't understand what they are doing. This is my simple program: int main() { int a = 1; int b ...
0
votes
1answer
46 views

IDA subroutine code running when not being called

Im trying to find where this subroutine is being called in IDA. I use xrefs to see where the subroutine is being called and I NOP the all the calls in all the subroutines in the xrefs. I do this for ...
-1
votes
1answer
45 views

How to find where a subroutine is being called (ida)

I am reversing an application using IDA. I have found a small subroutine that returns information at the end of that subroutine. However I would like to see the subroutine that uses this small ...
2
votes
0answers
41 views

Review a collection of executable binaries to determine similarity

I have a collection of different binaries I want to review for code similarity and classification, but I would rather not have to open each of them in IDA and manually review the code in 15 different ...
0
votes
3answers
84 views

Reverse engineer .so file from android app with radare2

I have a .so file from an android app, and I know how to list all functions in IDA Pro. How can I do this with radare2?
1
vote
1answer
82 views

Adding a static variable to Windows DLL

I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls. I ...
0
votes
1answer
67 views

Getting radare2 to load z80 binaries properly

I'm trying to disassemble some Sega Master System roms. In order to do so, I've checked for the extra 512 bytes from old roms and once I was sure they weren't there, I proceeded to run radare2 on one ...
1
vote
1answer
93 views

Shellcode not working correctly

I wrote a small program in assembly which is supposed to print "AAAA". It works fine when I run it directly, but when I run it as a shellcode in a c program, it doesn't work. Please help. Here is the ...
1
vote
1answer
161 views

Understanding ghidra disassembly

I'm kind of new to assembly and ghidra as a tool. I have a question about the meaning of this line Mov dword PTR [ESP] => local_70 , eax I get we are moving eax into the left side but I'm not ...
0
votes
0answers
20 views

Yara sigs based on imported functions used in code snippet

I'm looking to write a yara signature based on an interesting decoding algorithm in a family of malware, but I'm having difficulty with correlating addresses with imported functions. Specifically, I ...
1
vote
1answer
33 views

Help with IDA pro please — functions made are not Xref'ing to the caller

I am reversing some Motorola 9s12 (68hc12) code and using IDA pro. I am having the strangest issue. The code makes a call to a function: ROM:B300 call $BFF7, #$FE when I go to ...
-1
votes
2answers
86 views

How to see assembly of main function?

How can I dump the assembly of main function of binary(not striped) in ubuntu? I want to see the assembly command and the hex value of this command There are 1 binary for arm and 1 binary for x86
0
votes
0answers
31 views

Can you add data to a binary, without affecting its jump labels?

I'm a total beginner, so I don't know the vocabulary yet to search effectively. What I want to do is add some data (let's say level data), to an old game ROM, but that would probably shift all the ...
0
votes
0answers
86 views

Disassembly - First steps

I decided that I need to understand this more thoroughly, so am working in parallel with two resources: one more modern and one original from @Aleph1. In the essay, there is a basic code snippet, ...
0
votes
1answer
80 views

Renaming variables radare2

I have a variable called var_14h in disassemble code. I want to rename this variable. I try to rename the variable by using the following afvn var_14h i However, radare complains and returns an ...
0
votes
1answer
48 views

Within A Folder of 100s of 16-bit MS-DOS Disassembled EXEs Identify Ones That Need/Use DOS/4GW

So far I batch disassembled all files using following PowerShell and IDA: $files = Get-Content S:\files.txt ForEach ($file in $files) { Write-Host "Processing $file" &"C:\Program Files\...
0
votes
2answers
99 views

Byte-patch a JMP

I have an address and I want to byte-patch it because there is a JMP that I want to block. But when I NOP it, the game just crash because it corrupt the function. So, I don't know what to do for block ...
1
vote
1answer
60 views

Executable code in the same location differs in memory and on disk

I'm trying to inject code to change the byte value of a CMP in an executable from 0 to 2 at runtime, in order to effectively no-op a boolean comparison as part of an effort to insert my own behavior. ...
0
votes
1answer
28 views

Linux encryption/luks/pymouth password scripts corruption

I noticed that the bootup scripts that collect the password for full disk encryption on linux (fedora-31) were displaying corrupted text. The kind that looked like binary data being printed at text: ...
1
vote
0answers
60 views

Strange function in Disassembly (IDA)

I was reversing one executable in IDA and found out the function with this structure: .text:0058A6E0 sub_58A6E0 proc near .text:0058A6E0 .text:0058A6E0 var_4 = dword ptr ...
1
vote
0answers
24 views

Find High Entropy VA (64-bit ALSR) Incompatibility in Disassembly

Have a 64-bit plugin DLL (no source code) and the host application in an update changed its DLL characteristic to include "high-entropy 64-bit address space layout randomization (ASLR)" When this is ...
2
votes
2answers
250 views

Why Ghidra doesn't load the disassembly correctly while radare2 does?

I'm trying to get the disassembly of a very small binary file available here. This file is cropped from part of another executable binary. When I open it with r2 it automatically recognizes the ...
0
votes
1answer
78 views

IDA Pro ignores condition in breakpoint

Look at the condition. It is supposed to break only when the R2 is 40, but it breaks in any call to this instruction. I'm using IDA Pro 7.2.181105, debugging with Remote GDB Debugger, an ARMv4T code. ...
0
votes
1answer
110 views

How to reverse engineering a proguarded .apk? [closed]

Lets say you have android1.apk file coded with proguard enable. I want to reverse engineer it in such a way that it shows the original methods names instead letters of alphabets, example bellow ...
0
votes
1answer
115 views

Ghidra can't Decompile kernelbase.dll exported functions?

I was trying to understand the IsDebuggerPresent() function exported by kernelbase.dll by importing the file on Ghidra. But Ghidra can't show me the proper disassembly or decompilation of function ...
0
votes
0answers
61 views

Why does this execve shellcode work with this argv?

I wrote the following program in fasm, and am using Evan's Debugger on Ubuntu to debug it: format ELF64 executable 3 segment readable executable entry $ mov rbp, rsp sub rsp, 32 mov rax, 'this a t' ...
2
votes
2answers
185 views

Static analysis obfuscated code

I'm reversing a code that is heavily obfuscated. It uses opaque predicates, call stack tampering, junk code and control flow flattering. Call stack tampering uses indirect branches (push register / ...
1
vote
1answer
68 views

reverse engineering hi3516ev200

I am new to reverse engineering and will describe my situation thus far. In short, I am looking for some tips on what to do next to gain access to a piece of hardware I am playing with. I bought a ...
1
vote
1answer
34 views

How to determine what code created a string, in a live debugger session?

I'm using IDA 7 to debug a running application that must be a child of another application, which means I can't start it from IDA (using Debugger->Run). Instead, I have to run the application normally,...
2
votes
1answer
55 views

Finding the correct input of an executable to print out the flag. IDA 7

I'm trying to understand the behaviour of the code below so I can determine what input will trigger the "YOU DID IT !~!" string (at the end of the program instructions): .text:00C21034 Buf= byte ptr -...
1
vote
2answers
43 views

Any “simple” way to disassemble a block of hex for a 80C188?

I have used IDA to disassemble a big EPROM (27020) but there remain a large number of code sections which haven't been disassembled. Here is a typical one where I have identified the beginning and ...
1
vote
0answers
34 views

Learning Intel Disassembler, What to learn for Intel XED [closed]

In order to learn about disassembly and code something like Capstone disassembler, HDE etc. for a function , calculate opcodes etc , Please advise on what I should know. I have some knowledge of ...
2
votes
0answers
29 views

80188 relocation register mystery

I'm reverse engineering an embedded system using the 80C188 and the way the relocation register (RELREG) is used mystifies me. One of the first steps at initialization is to move the processor ...
2
votes
0answers
43 views

submitting input into AFL fuzzer

I have some questions about the AFL Fuzzer: How does the AFL Fuzzer know where to inject the payload in the code I compile? For instance if I want to inject it in a specific parameter, how do I do it?...
0
votes
2answers
126 views

Is it possible to use a program's GUI abilities without the GUI?

Is it possible to use/call programs' GUI abilities directly without using the GUI (programmatically, not by keyboarding)? For example, a program with abilities nested too deeply in cascading submenus:...
0
votes
0answers
91 views

How to recover randomly generated private key from a Program that implements Diffie Hellman Exchange

This program implements Diffie Hellman key Exchange, a pair of random private keys are generated every time the program runs. How should I go about finding the random number generation subroutine ...
0
votes
0answers
35 views

IDA Fails to Analyze Stack Pointer Correctly in Heavily Chunked Functions

I am currently dealing with obfuscated code in IDA. The obfuscation I am combating is control flow obfuscation, where a function is split up into hundreds of basic blocks spread across the entire ...
0
votes
0answers
14 views

reflection in objectiveC - method invocation return null value

I'm trying to reverse the way dpsconfigad extracting the current active directory domain. Notice : It's rather simple query that can be performed using OpenDirectory public framework but it requires ...
2
votes
1answer
87 views

How can I objdump the assembler code of dynamically linked functions in a dynamically linked executable?

Compiling a minimal C++ program: g++ -g -Wall -Wextra -std=c++17 -o prog main.cpp int main() { } Performing an objdump -C -D prog of all sections I am given the following output: prog: file ...

1
2 3 4 5
19