Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

The translation of machine code into a human readable assembly code, also the result of such translation.

0
votes
0answers
45 views

IDA doesn't see code

I'm trying to analyze some binary but IDA doesn't see code inside .reloc section. I loaded it manually, changed segment class from DATA to CODE and marked as executable. In 010 Editor these bytes are ...
0
votes
1answer
44 views

Break when pattern found in x64dbg and few small questions [on hold]

I am a beginner to reverse engineering and I have been trying for the whole day to learn how to force WinRAR to extract a file without giving the right password. I have cornered it down to a Windows ...
1
vote
0answers
71 views

Trying to identify block of code which generates 256 bit key

I'm reversing a C++ program using IDA PRO to examine how the some data is stored, encrypted and decrypted. I've managed to identify the data is encrypted with AES CBC 16 block and 256 bit key. I have ...
5
votes
1answer
46 views

Passing a (string) argument via the return address?

I'm debugging an old PC BIOS and it has most of its constant strings interspersed directly with the code, like this: As the comment notes, the function putsc will take the string as its argument, ...
2
votes
1answer
61 views

Why are these 0-byte jumps used as a delay?

I'm debugging an old PC BIOS and see a lot of what I assume are delay sequences, using 0-byte jump instructions (EB 00 = jmp short $+2). Why this particular instruction? I'm guessing it must have ...
0
votes
2answers
86 views

How to interpret disassembled MIPS code?

I have disassembled MIPS binary with raw opcodes. How to interpret, for example, these lines: Disassembly of section .data: 00000000 <.data>: ... ... f864: 30a5ffff sd ra,-23248(...
2
votes
0answers
34 views

Show parameters stored in stack with __fastcall in IDA

This is an extension of my previous question. Here is a sample of assembly in x64 Windows executable using COM virtual function with __fastcall convention. mov [rsp+32], rdx ...
1
vote
1answer
71 views

Data moved after program rebase

Consider the following piece of code: .text:00F74B42 call sub_12D1130 .text:00F74B47 mov eax, dword_15A0C80 Now, I want to add a sanity check but as I don't have enough space to do that I ...
0
votes
1answer
66 views

Reversing video protocol for chinese drone so i can view the stream outside of the app

I am trying to view the video stream of the vento protocol air drone on my computer. The final goal is to get the video stream into python or c++ for opencv; however, if i can just view it in a ...
3
votes
2answers
60 views

IDA function never called and only cross-referenced as data

When I press the X key (list x-refs) on a function (sub_xyz) to see which functions call it, I only saw dd offset sub_xyz twice, with no call sub_xyz instructions. There is no another place that ...
3
votes
2answers
148 views

Reverse Engineering Challenge 2 from challenges.re

I am trying to solve reverse engineering problem(s) from https://challenges.re/2/ - this is challenge 2 and the target is to get the highest possible level of understanding what the code does. <f&...
0
votes
1answer
52 views

What are zero terminated strings below vftable in RTTI?

I am reversing a class, which has RTTI information. It has 2 virtual functions in its vftable, and in IDA Pro I can see some kind of zero terminated strings below the last vfunction. Here's how it ...
1
vote
0answers
45 views

Trace back Offset Function

I have 2 armv7-m (Thumb) branch instructions (in Hex) which call one function. Can you tell me how can I caculate the offset of this function, so that I can call it at other position. Thanks! Offset ...
2
votes
1answer
83 views

How to find start of .text section?

i made a random console application and loaded into IDA. The start of .text section shown is 00BA1000. Then i loaded the application into CFF explorer. The address of entry point was 000110AA. Is it ...
0
votes
1answer
72 views

How to Modify this Branch in ARM64?

I try to modify the branch of this disassembly in a binary: SUB SP, SP, #0x60 STP X26, X25, [SP,#0x50+var_40] STP X24, X23, [SP,#0x50+var_30] STP X22, ...
1
vote
1answer
48 views

Could someone explain how this ARM instructions works compared to the actual Objective-C code?

I'm trying to understands how it works by decompiling my own Objective-C code. Here's the decompiled instruction: var_8= -8 var_4= -4 SUB SP, SP, #8 MOVS R2, #1 STR ...
1
vote
2answers
91 views

Lea instruction on datasegment

I wrote simple program(was built in release mode(x86)) to practise re skills but I can not understand one part of it. C++ program: int doSub(int a, int b) { int result = a + b; result -= 2;...
0
votes
2answers
35 views

Addition Function Parameter Location in Assembly Stack Memory

So my C program looks like: int main() { int a = 5; int b = 1; int c = add(a, b); printf("%d", c); return 0; } int add(int a, int b){ return a + b; } And I am trying to ...
1
vote
0answers
24 views

ODBC Finding the password an application uses to access the database

I have a program which uses ODBC to access an accdb database. I can open it in access but it asks for a password. The application accesses it through a DSN string. I have found the string using ODBC ...
-3
votes
1answer
63 views

How does array indexing works at the assembly level?

Can anyone give me an example to understand how array indexing is working in assembly. For example, in C: char s[1000]; for (int = 0; i < 5; i++) { s[i] = i; } And, in x86 assembly: add ...
3
votes
1answer
53 views

Getting to the specific offset in assembly code

I try to reverse engineering an application and I came to the point that I don't understand. I have the following disassembled code with gdb: │0x7ffff76f7e4b <_ZN16CRRegistratorImp8RegisterEbPv+...
0
votes
0answers
31 views

Not able to sync msvbvm60 dll function address in exe

Iam totally new to assembly language. T have written a small program in VB when exe is loaded in Olly the msvbvm60.vba1214, msvbvm60.vbaExitProc and msvbvm60.vbaFreeStr keeps on changing and unable ...
3
votes
0answers
60 views

more memory allocated on the stack than seems to be needed [duplicate]

Im working on the bof challange in http://pwnable.kr/play.php. the source code has a function func: void func(int key){ char overflowme[32]; printf("overflow me : "); gets(overflowme); // ...
-1
votes
1answer
55 views

index of array in assembly? [duplicate]

In the following picture the line i want to mention is: mov [esp+eax*4+0Ch], edx Here eax is the index in the array. But, where is the address of the array to access? what does mean this line of ...
-2
votes
1answer
49 views

Understand help me array in assembly? [duplicate]

Can anyone explain the following code as it's an array in assembly. I can't understand can you help me to figure it out line by line. Thanks Q.1) what does the 401024 & 40102E line does ?
1
vote
1answer
79 views

Visual Win32 (UI) style?

what is the following image is about ? Is it design using win32 (UI) ? the following image contains functions are being output from a DLL. Can you help me to understand. Suggest me anything which ...
2
votes
0answers
60 views

Radare2 - Insert asm instructions without overwriting

In order to patch a x86 elf file on Linux, I'm struggling to insert a specific assembler instruction into the binary file without overwriting any of the preexisting instructions. I've been reading ...
2
votes
1answer
35 views

How to unpack Inno Setup bundles with Arc+SREP data?

I've stumbled upon Inno Setup installer with additional separate Arc archives (commonly with .bin extension) that I was unable to extract using normal methods: the installer didn't work for an ...
2
votes
0answers
41 views

Hopper: What does stack[xxxx] mean?

When using the 'decompiler' tool in Hopper on the start function of an application it shows this: What does the stack[2043] mean, is it 2043 bytes from the top of high memory and its assigning it to ...
1
vote
2answers
62 views

How identify witch cpu run assembly [duplicate]

I have around 300 bytes of binary machine code. I don't know which instruction set the code is for so I can't open it with IDA. Is there any tool that can help identify the instruction set?
1
vote
2answers
117 views

How to add/find parameters to a function declaration in IDA/HexRays?

I've a binary opened in IDA. It uses a function pointer from a COM vtable. I found that the COM method has 13 parameters (including this). But IDA shows only 4 parameters as shown in this pseudocode: ...
0
votes
0answers
63 views

What is the pseudocode of the struct?

what is the pseudocode of an structure (int C) in assembly. ASM->C How to recognize struct? What is the pseudocode of the following assembly. Why the struct calculation is happening in esp (in ...
3
votes
2answers
41 views

How do you look for a a particular value at address in IDA

So, I was trying to load some binary and in the main function, I saw instructions such as mov edi, [esi+1Ch] ... lea eax, [esi+18h] So, what are these values at [esi+1Ch] and [esi+18h]. How do ...
3
votes
1answer
45 views

ARM Thumb2 register usage

I am reversing ARM Thumb2 code. I am looking for a table that shows which registers are used to pass arguments to functions, and which registers must be saved after the function ends. By the way, if ...
3
votes
1answer
145 views

Instruction set for code snippet?

I'm looking for the CPU/Instruction-Set of a closed embedded system. Code snippet: E6 F2 F3 15 E6 F3 0A EF E6 F8 9B 7F E6 F9 5B D5 0D 32 49 94 EA 30 60 71 What I know: E6 Fx is "LDR 16-Bit-...
0
votes
3answers
127 views

Explain struct access in assembly?

I am having trouble understanding working with structs in assembly from disassembly. can you please explain the code below. Disassembly below: Source code:
2
votes
1answer
118 views

How to simplify C++ standard template library in IDA?

I've a X64 DLL file which uses C++ standard library heavily. I've loaded the PDB symbol file in IDA and all the subroutines names sub_xxyz changes to std::xyz, which is as expected. But there are many ...
0
votes
1answer
73 views

Help me to understand disassembly MFC or Win32

I am trying to reverse engineer an application. I don't understand is this MFC framework. Should i learn MFC to understand the following code. or is it Win32 code developing. But how Win32 works with ...
1
vote
1answer
92 views

help me to understand array?

Question #1 is the lea edx, [esp+24] start of array ? and eax, [esp+140] index? then whats add eax, edx doing here and this source code mean ? can you please explain? I am confused about array ...
1
vote
0answers
36 views

how can i get real hex values of vdso outputs [closed]

I'm trying to get an algorithm in a program but i can't see the hex codes. At the moment i break all debug checks it fully debugging but i can't see how it creates the request.
1
vote
1answer
108 views

Would it be possible to reverse engineer a game's rom file to get source code?

More specifically, could you get low level code from a rom, and piece it together and translate it to a higher level language?
2
votes
2answers
120 views

Parse Opcodes from Binary Code

I have been using the Distorm library, using the distorm_decode() function in x64 to retrieve Opcode and Operands from binary code. For example, 44 0F45 C8 is decoded to cmovne r9d,eax. I would like ...
3
votes
2answers
78 views

Hardcoded addresses in dumped PEs

I have taken a dump of a game using Explorer Suite, and while looking at some obfuscated parts of the game PE's text section in IDA, I've seen code that follows this form: mov rbp, 7FF633CE2790h jmp ...
-1
votes
1answer
52 views

Why would MSVC pass a constant “2” for an unused this parameter?

Hex-Rays decompiled (with the assistance of pdb symbols) a piece of code as such: XPerfAddIn::CFramesInfoSource::MatchEventDescriptor( (XPerfAddIn::CFramesInfoSource *)2 And by my following of the ...
0
votes
1answer
26 views

What does _PAIR_ macro do with standard handles?

I've seen this question which says __PAIR__ macro does some conditional computation. But I can not relate that with standard I/O handles. Here is the pseudocode in IDA: if ( (char *)hConout - 1 <= ...
3
votes
1answer
483 views

objdump: can't disassemble for architecture UNKNOWN!

I am trying to use objdump -d fileName on a s-rec file and it returns unknown architecture, however it recognizes fileName: file format srec I looked at objdump --help and under supported targets ...
-1
votes
1answer
124 views

What are these sub_XXX things in IDA's disassembly?

What are these things I marked in red circles on the screenshot? In this program which i tried to disassemble there are 1427 of them. Is there any other application to view it in a better way ?
0
votes
1answer
94 views

What does _mm_store_si128() actually do?

I've a binary (openend in IDA v7) that uses GUID variables to manipulate something. Whenever I see any variable with GUID data type there always be a _mm_store_si128() or _mm_storeu_si128() functions. ...
3
votes
1answer
57 views

Disassemble/decompile arbitrary JVM bytecode

I have an obfuscated java binary which does runtime code injection using java reflection like this. Object o = "a long string"; ((Method)o).invoke(params..); (If I write this in a java file, it ...
5
votes
3answers
210 views

What exactly is binary disassembly and what it produces?

The first time I heard about binary disassembly I thought that it is something what can be called as perfect decompilation tool to assembly code and I still don't understand why it is not. I thought ...