Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

Filter by
Sorted by
Tagged with
0
votes
1answer
9 views

Variable var_4 filled with value -1

Who can explain to me, why this line code there is before each jmp or end of some part of code where is label. What this line of code is to do? mov [ebp+var_4], 0FFFFFFFFh This is WinMain used C+...
2
votes
2answers
22 views

X86 access to global strings pattern

While reversing some x86 executables, I came across a pattern of addressing globals, that I don't familiar with, but it looks like IDA is, and I would like to know more about it. .text:00002560 ...
1
vote
0answers
23 views

IDA 7.0: Why does editing this function result in red-marked stack-pointer offsets?

I tried to fix the size of both the saved registers and the local variable area using IDA's "Edit function" option as IDA could not recognize it properly by itself. Unedited function: Corrected ...
-2
votes
0answers
60 views

How to reverse engineer Google Chrome

Guys! Can anyone explain me how to reverse engineer Google Chrome? For example I want to add a Logo inside Chrome window. How it's possible to find exact assembly line where contents of website loaded,...
0
votes
0answers
32 views

Command line method to disassemble to a valid .asm file?

I'm trying to automate the disassembly of multiple .o files at once, and need the output to be in a valid .asm file. Is there a way to do this? I've been attempting to use objdump, but the output isn'...
1
vote
0answers
38 views

ARM chip gpio/ identification from firmware code

Device: i was able to recover bricked Chinese IOT a Sous Vide cooker. Replaced damaged capacitor. it works. it has ARM soc/mcu/processor WI-FI (broadcom) LCD touch screen + 16bit STM mcu. EEPROM ...
0
votes
1answer
21 views

How to determine commands sent over DC-37 port by software from 1992

Background Since some time we've been in the possession of a greenhouse. It was build around 1990 and had an automated system for climate control. However most of the installation has been removed ...
8
votes
1answer
74 views

Why use MOV R0, R3 and then MOV R3, R0 (thus back and forth)

I have a static library archive which I try to understand. First I use 'ar' to extract the object files. The object files ar "ELF 32-bit LSB relocatable, ARM, EABI5 version 1 (SYSV), not stripped" ...
1
vote
1answer
50 views

Compiled binary functional comparison through different versions / assembled functions

Good Day! I've not hit upon a solution to compare different compiled binaries for identical functions. Take, say, BusyBox. A very common application with a rich history and source code. Say take 3 ...
-2
votes
1answer
52 views

What steps needed to decode a Base64 binary?

I tried to decode it by Base64 but still didn't understand the result WfsRRmNNX02LzKxYKrh030TjLxD4636bf0crQ2ZeWBFiCRx9Yn0kQG1OPDcYSEN+cR1+...
-1
votes
0answers
51 views

Decompiling/ Deobfuscating/ Decrypting/ Editting SWZ files

I am trying to modify code in a game that, from my understanding, was built with Adobe AIR and Actionscript 3. The code is stored inside SWZ (not SWF) files however, and I have been able to find no ...
2
votes
1answer
35 views

NEC 76F004GD Disassembly

I have a Toyota ECU from 2005 with an NEC 76F0004GD micro controller on it, I have already read the full 512k dump from the chip using a K-Tag. However, when I tried to put it into IDA, there weren't ...
0
votes
1answer
56 views

Why there are only 8 hexa memory digits while my RAM is 16G

I'm totally new to reverse engineering, when I start debugging my c program with radare2, and start showing assembly, I found that addresses are only 8 hexa digits, which means 16^8 = 4294967296 ...
1
vote
2answers
100 views

How to decompile /usr/bin/ls

How to decompile the following assembly instructions ? Note: this could be reproduced using /usr/bin/ls binary inside ghidra
-2
votes
0answers
54 views

I cant understand this function

i know this is probably not the place to ask but I am desperate can anyone tell me what this snippet of Assembly: .text:00401310 ; Attributes: bp-based frame .text:00401310 .text:00401310 sub_401310 ...
0
votes
0answers
32 views

Shellcode doesn't match OllyDbg

I have created a simple program that is susceptible to a buffer overflow using strcat(buffer1, buffer2). I have successfully overflowed into the EIP and have placed an address located in NTDLL which ...
8
votes
0answers
83 views

Extracting strings from Go binaries

Is there an easy way to extract all of the strings from Go binaries that will work cross architecture? The problem with Go is that strings are stored without a null terminator so you can't use the "...
0
votes
1answer
61 views

App from playstore runs but the same apk crashes on sideload install

On my nougat device, I have downloaded an app from the playstore, which is running great. I then extract the apk from the installed app, and uninstall it and again successfully, with package installer....
0
votes
1answer
39 views

Find code executed on button press in Qt5 Linux application

I have an executable of a (rather simple) GUI application on Linux, built in Qt5. I am able to run it, and want to find out what happens internally when I press one of the buttons. I suspect that the ...
1
vote
2answers
76 views

Working with strong obfuscated Java

I've got a jar file, that is strong obfuscated. When I tried to put it into decompilers such as bytecode-viewer and luyten I seen many lines of traps and Chinese letters. I tried to deobfuscate it ...
-1
votes
0answers
19 views

How do I patch a CBNZ instruction

I'm trying to batch a CBNZ instruction 68 00 00 B5 I tried to convert to CBZ 68 00 00 B4 but the patching has no affect. How can I patch that CBNZ instruction? Sample CBNZ: 48 00 00 B5 09 01 00 ...
1
vote
0answers
41 views

What to do with a text file of disassembly code and binaries?

I am fairly new to software reverse engineering and I'd like to know how proceed with analyzing a program if I have a text file of disassembly code and a bin file of binary data. I understand ...
1
vote
0answers
74 views

How to use Ghidra to work with VM obfuscated binaries?

By "VM obfuscated binary", I mean a binary that contains one or more implementations of a VM internally, and also some bytecode that can run on this VM. One of the reasons why this binary is this way, ...
0
votes
0answers
42 views

How to reverse engineer Apple MacBook SMC update firmware image using IDA Pro 7.2?

Alright so I have watched extraordinary presentations videos from three different reverse engineers who hacked the Apple SMC Update firmware: Charlie Miller: https://www.youtube.com/watch?v=...
0
votes
1answer
46 views

Need some help and advices as regards as reverse engineering IoT devices

Hi everyone, I saw this video on youtube as regards as reversing IPTV cameras and finding security vulnerabilities: Black Hat 2013 - Exploiting Network Surveillance Cameras Like a Hollywood Hacker I ...
0
votes
0answers
44 views

Fixing ghidra decompilation

i am working a little bit with Ghidra. My assembly code doesn't match with the decompiled code: * FUNCTION * ...
0
votes
1answer
67 views

Malware attempting to move a value into $zero in MIPS?

Recently I have been trying to reverse engineer an IoT malware called NyaDrop using IDA. There I came across this mysterious assignment a few times. addiu $zero, 0xA as well as move $at, $at ...
0
votes
0answers
29 views

How can I reassemble a DDS header with the information I have?

I have 2 files which I know for certainty to be as follows: File 1: Includes all of the DDS image data File 2: Includes some data from the header. The data it includes is the width and the height (...
0
votes
0answers
13 views

How is the data analyzed without knowing the object structure?

I found the address of the Entity list, but I don't know the object structure. I don't know what kind of data (char, pointer, int,double etc) on the member of list. Since the data sizes are different, ...
1
vote
1answer
27 views

What is the mdisp field in RTTI for throw used for?

First of here is the article from which I'm looking up the fields. I was trying out different combinations to see how they affect the RTTI for a C++ throw. It seems that having a virtual base class ...
0
votes
1answer
30 views

GDB disassembly - breakpoint problem

My question is, when i dont use any breakpoint it show the message saying "You made it, now keygen me!", but when i put a breakpoint in the main, or any other place it will show a message about ...
1
vote
2answers
70 views

What does objdump -b binary means?

So I have started to digging in malware analysis and I came across with some malware samples that I couldn't disassembly with objdump. More specifically I use objdump -dS /path/to/malware and I got ...
0
votes
1answer
75 views

Android app crashes even while not edited, how can I solve it?

Installed an application from google playstore and then transferred to it my computer to apparently edit it and without any changes I made to it then I tried to install it through ADB, well the ...
0
votes
0answers
58 views

Jump without jmp near

I need to jump a Hello, I need to jump some lines that lock program in a loop status. i use process hacker to find lines with string in binary but when i find this lines i have not jumps near, in ...
1
vote
1answer
75 views

Reverse Engineering Java - Deobfuscating symbols

I'm new to Java and working on cleaning up a fairly large Java .jar sample where the obfuscator has renamed symbols into invalid names. For example: import org.lib.00.0.2; public final class 90 ...
0
votes
0answers
26 views

Disassembly Memory Organization parameters for C166 micro firmware (RAM and ROM section)?

I'm trying to disassemble some microprocessor firmware with C166 architecture in IDA, but I have no idea what to use for the memory organization screen (IGNORE THE VALUES IN ROM/LOADING SIZE) My ...
0
votes
0answers
36 views

rep movsd for uninitialized data

I have this chunk of code in the DllMain() that I am failing to parse: sub_405644 proc near push ecx ; Save 4 registers push ...
0
votes
0answers
25 views

Finding out what creates FIFA RTWC 98's main window

I am currently familiarizing myself with x64dbg as a tool for reverse engineering. As an exercise, I challenged myself to try and patch FIFA RTWC 98's executable to force it to run on a windowed mode. ...
0
votes
0answers
51 views

Cheat engine process causes game to crash

When I start cheat engine while game is running, the game crashes nearly immediately with error: "Exe does not work anymore." To figure out which checks the game does on processes I created a fake ...
0
votes
0answers
26 views

Protections against disassembly tools

I am very new to reverse engineering and thus, I struggle to even know the right search terms for effective research. I have been trying to reverse engineering an encryption algorithm of a software ...
0
votes
0answers
17 views

Understanding obscure function names [duplicate]

I have seen functions like this before in disassembly but don't have a clue what they are. Their names are extremely confusing. Would someone be able to explain what these are?
4
votes
1answer
119 views

Is it possible to modify a movss or xmm# in Assembly using Cheat Engine?

Im using cheat engine as a beginner to getting into Disassembly and Hacking, and I want to know how to modify an address/pointer (not really sure how to term it) thats using a movss [...],xmm#? ...
1
vote
1answer
118 views

IDA Pro sp-analysis failed

I'm trying to reverse engineer a C# file that requires a password to continue running. When I load it in IDA Pro I get nothing in the functions window and a sp-analysis failed What I see when loaded
1
vote
1answer
71 views

Unable to intercept traffic of an android app even after patching ssl pinning

Recently, I was trying to test an app developed on Rhomobile, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can intercept other apps on my device but ...
0
votes
0answers
26 views

can't see java file but debugger shows it is present and can access using reflection

I am debugging an android application to find out the implementation of something. I am using a debugger in Android studio from which I came to know that there is a java file that is responsible but ...
0
votes
1answer
49 views

IDA subroutine code running when not being called

Im trying to find where this subroutine is being called in IDA. I use xrefs to see where the subroutine is being called and I NOP the all the calls in all the subroutines in the xrefs. I do this for ...
-1
votes
1answer
49 views

How to find where a subroutine is being called (ida)

I am reversing an application using IDA. I have found a small subroutine that returns information at the end of that subroutine. However I would like to see the subroutine that uses this small ...
2
votes
0answers
41 views

Review a collection of executable binaries to determine similarity

I have a collection of different binaries I want to review for code similarity and classification, but I would rather not have to open each of them in IDA and manually review the code in 15 different ...
0
votes
3answers
130 views

Reverse engineer .so file from android app with radare2

I have a .so file from an android app, and I know how to list all functions in IDA Pro. How can I do this with radare2?
1
vote
1answer
92 views

Adding a static variable to Windows DLL

I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls. I ...

1
2 3 4 5
20