Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

Filter by
Sorted by
Tagged with
1 vote
1 answer
39 views

Why is JMP ESP required in buffer overflow?

I was reading this article by Hackers Grimoire on Windows buffer overflow attacks. The article made sense, except for the part where the author searched for a DLL (.dll) file which contained a JMP ESP ...
user avatar
0 votes
0 answers
25 views

Convert IDA imagebase to detours

I have succefully hooked a game with imagebase 400000 (Ex: // LRESULT __stdcall sub_6D5040(int a1, UINT Msg, WPARAM wParam, int a4) Game.SecondaryFunctHookAddress = "0x2D5040" and the ...
user avatar
1 vote
0 answers
32 views

How do I read/edit a .xuk file extension?

I am trying to reverse engineer a license key for some software, the company that made it went out of business. In doing so, if you didn't already have the key their $50,000 machines become ...
user avatar
  • 11
0 votes
1 answer
33 views

IDA export settings hotkey

People, good afternoon. Tell me please, can anyone know: how to export hotkey IDA? I understand - IDA saves these settings somewhere in the registry, but I can not find this place
user avatar
  • 1
0 votes
1 answer
42 views

What is libm_sse2_sin_precise() and how to find it's parameters in IDA?

I'm new to reverse engineering with IDA. I've found libm_sse2_sin_precise while inspecting c-pseudocode for some Win32 executable. I tried clicking that function but the executable requires the DLLs. ...
user avatar
  • 1
0 votes
0 answers
45 views

Get function list with radare2

I need to get a list of function start and end addresses using r2. I'm pumping this information into a tool I'm building. First, I'm aware of aaa and afl but those don't seem to provide exactly what ...
user avatar
2 votes
0 answers
75 views

What hints can x86 disassembly give as to GCC/G++ compiler version and options?

I've taken an interest to disassembling binaries and attempting to recreate 1:1 source code (logic) in C and C++ compiled with GCC. I say "logic" because this question does not pertain to ...
user avatar
0 votes
1 answer
22 views

ida jumping to address I can't see in driver

When I open this driver in IDA i can't seem to see the instructions that this jmp at 0x1400DC46D jumps to. I've tried to undefine bytes and re-analyze the function but it then ends up will garbage. ...
user avatar
1 vote
1 answer
131 views

What does the code do?

Challenge #64 What does this code do? An array of array[x][y] form is accessed here. Try to determine the dimensions of the array, at least partially, by finding y. _array$ = 8 _x$ = 12 _y$ = 16 _f ...
user avatar
1 vote
1 answer
51 views

Mov instruction from a pointed location at the beginning of a program

I am trying to learn how to read assembly code. So far I have understood the basic instructions. Now I am trying to see if I can understand a dissassembly from a linked executable. So this is an ...
user avatar
  • 123
1 vote
1 answer
64 views

Understanding disassembly information from Visual Studio's dumpbin and GNU's objdump

I usually write my code on Windows, and there are two different types of development environments, each providing their own tools to view the assembly code of an object file(*.obj) or executable (*....
user avatar
  • 123
0 votes
1 answer
77 views

x64dbg: is there a way to save the complete disassembly of a module to a text file?

Is it possible to save the complete disassembly / listing to a file, and if so, how can it be done?
user avatar
0 votes
2 answers
73 views

How to set a variable as "pointer to struct" in IDA in order to automatically replace offsets by field names?

In IDA, I have the following disassembly code (from an old 16-bit DOS application) : les bx, _Foo mov word ptr es:[bx+84h], 0FFFFh mov word ptr es:[bx+8Ch], 0FFFFh mov word ptr es:[bx+...
user avatar
  • 331
1 vote
1 answer
28 views

What are these Device Object Characteristics / Flags in Windows 10 ntoskrnl!IopParseDevice

In Windows 10 looking at ntoskrnl!IopParseDevice I'm trying to work out the name / purpose of the flags in this check, which seem to be testing for values in a DEVICE_OBJECT Characteristics property ...
user avatar
0 votes
0 answers
65 views

ADD right before CMP?

I am a beginner in RE. I compiled some code (x86 32bit), and opened it up in Ghidra. I come across the following instruction block: CALL _strcmp MOV dword ptr [EBP + local_1c], EAX MOV EAX, dword ptr [...
user avatar
0 votes
0 answers
34 views

Is it possible to copy a video game and edit the copied version?

Sorry if this is a "dumb" question, but I couldn't find anywhere else to ask this. I want to "copy" my game of Super Smash Bros. Ultimate and edit/change in-game features. I also ...
user avatar
0 votes
1 answer
143 views

How to get Assembly source from Bin file?

I have a binary file which is coded in assembly x86 and compiled with nasm. I used command nasm file.asm -f bin -o file.bin to compile it with nasm. I deleted the source code from disk long time ago, ...
user avatar
0 votes
0 answers
48 views

Normal artifact or something else?

I'm working on a Linux ELF challenge. I have found this bit of code in the .text disassembly using objdump -d -M intel program 922: 83 c4 10 add esp,0x10 925: c7 45 f4 00 00 00 ...
user avatar
  • 101
0 votes
0 answers
56 views

x64dbg placing a on write breakpoint on a dynamic allocated address

I am currently trying to reverse the registration scheme of a crackme. I found the jump instruction that decides if the title of the program says “registered” or “unregistered” by simply searching for ...
user avatar
1 vote
2 answers
64 views

Relationship between compiled bytes of jmp instruction and target memory address

I'm very new to all this, so sorry if I mess up and/or am unclear. I'm working on reverse engineering assault cube, where a lot of people start, and I'm struggling to understand how this one AOB ...
user avatar
0 votes
0 answers
39 views

How can I bypass this activation window on checkbox

Some check boxes call the Call function when I click on them: How can I get rid of this call and make these check boxes behave as usual?
user avatar
0 votes
1 answer
248 views

What is xmmword in IDA Pro?

Probably a silly question. What's the xmmword means in IDA Pro?
user avatar
1 vote
1 answer
101 views

Instructions to compare two strings

I made a list of which instructions compare two strings in disassembly so that when I get to intermodular calls in x64dbg, I can simply type this instructions to see if there is a comparison have been ...
user avatar
0 votes
1 answer
101 views

What's DD ? In IDA Pro

I'm new to reverse engineering with IDA. If dd is short for data, double-word, is a 32-bit value. It shows ? How do I identify the value stored in dword_140007674?
user avatar
  • 1
0 votes
0 answers
22 views

Invalid memory access and class check in operator implementation

Say I have the following disassembled function, taken from my favourite 32 bit DLL that was compiled with an old version of MSVC: mov eax, ecx mov ecx, DWORD PTR [eax+4] cmp ecx, CAbstractBlitObj::`...
user avatar
1 vote
2 answers
117 views

What arguments are passed into a CALL instruction?

While reverse enginnering a simple C program for training, I asked myself what was the point of those lines : LAB_001006b5 XREF[1]: ...
user avatar
  • 23
0 votes
0 answers
59 views

Extending Razer Synapse "Turbo-click" keybind past current restricted values?

I know this might sound dumb but as a little challenge, I would like to reverse engineer the Razer Synapse binary and change the current max "Turbo" (auto-click) mode to extend beyond the ...
user avatar
0 votes
0 answers
43 views

ida python: get raw, clean dissassembly without names

Because the exposed DecodeInstruction functionality in IDA is quiet sucky, it can be easier to operate on textual representation. However, IDA even foils this as there doesnt seem to be a good way to ...
user avatar
0 votes
1 answer
62 views

How to make Ghidra don't brake mid token with triple dots?

So I was scraping the Ghidra disassembly output until I realized that some of my tokens are ... Anyone knows how can I configure this up so Ghidra doesn't limit the output of it's disassembler (...
user avatar
  • 413
1 vote
1 answer
107 views

Making sense of an encoded JSON string

I extracted a game file, which is in JSON format, it's a bit too long, so I'll omit parts of it: {name: "\xEE\xB5k~u\u03D7\x80\xF8\xE0\xE2\xC5\xCA\xEE\u04CF\x90\xBE\xD8Cs\xFE\xA5Ec\u007F\u0006\...
user avatar
  • 13
0 votes
0 answers
18 views

why ida7.6, here() return not exact EA in structure address range?

scene: After I use one structure to define a global variable in .data segment, then I cant use here() to get the exact EA where the cursor is, only get the struture's head address. ask for help: How ...
user avatar
0 votes
0 answers
35 views

inspecting the .hex file generated by gpasm

To answer my own question here, I wrote a small sample program, example.asm: var_1 equ H'0001' constant var_2=H'0002' #define var_3 H'0003' cblock H'0004' var_4 endc END and compiled ...
user avatar
  • 159
0 votes
0 answers
50 views

ida shows instructions as hex data

I am new to reverse engineering. I did a couple of projects. now I was doing another project and faced kind of a problem. at the start of the program, there is a label that points to an address of ...
user avatar
1 vote
0 answers
47 views

Is disassembly of standard gcc programs trivial, or just as difficult as video game ROMs?

I am attempting to do some reverse-engineering of ARM binaries, with the ultimate goal of reverse-engineering GBA ROMs. Of course, GBA ROMs contain a mixture of code and data, so a standard ...
user avatar
  • 133
0 votes
1 answer
89 views

Understanding the meaning of EBP + 0xffff98b4

I'm currently reverse-engineering an old game from 2003 to extend its functionality. I have now found what I am looking for and since it was written in C++ I'm trying to re-create the used classes. I ...
user avatar
0 votes
1 answer
51 views

Constructors testing for strange in-stack value

This is something that I found in a lot of constructors that have to do with classes that inherit from other classes. I have a vague idea as to why it's done, but I'd rather have it confirmed before ...
user avatar
1 vote
1 answer
78 views

List instructions to fix wrong IDA analysis

I don't want to get too much into detail, but a disastrous chain of events that began with a boolean of incorrect size forced the IDA analyzer to discard a lot of instruction sections of many ...
user avatar
  • 97
1 vote
2 answers
94 views

How can I tell radare2 to show me a constant's value in disassembly

In radare2, I can disassemble like: 0x004006f0]> pd 3 ... 0x004006f0 ff2532092000 jmp qword [reloc.callme_three] ; [0x601028:8]=0x4006f6 0x004006f6 6802000000 push 2 ...
user avatar
1 vote
1 answer
168 views

How can I use radare2 to list all xrefs to a string?

radare2 can list all strings with iz , and list all functions with afl. How can I use radar2e to list the XREFs for each string? That is, for each string, which funcs reference it? I'd like to be ...
user avatar
1 vote
1 answer
77 views

I don't find the body of a function that I called in the main function

I have created a very simple x86 console program that uses Visual Studio 2019 compiler to sum 2 numbers just to see how is the program be after disassembly but I found something unclear to me. // C++ #...
user avatar
  • 125
0 votes
0 answers
44 views

Malware analysis of undetected NodeJS token grabber

I've recently nearly had my discord account stolen by a token grabber called 'Katana Legends'. Someone contacted me asking to playtest a game, which prompted a .exe file. I ran the file and website on ...
user avatar
3 votes
2 answers
192 views

Why does the "MOV DWORD PTR ds:0xdeadbeef" instruction dereference the 0xdeadbeef address?

I'm reverse engineering a binary and I'm confused, because my theoretical knowledge is currently clashing with what's actually happening. I thought that this instruction writes the value 0xdeadbeef ...
user avatar
1 vote
1 answer
90 views

How could I find a call of a function thats only referenced inside a vftable?

So I have this function which I'm trying to figure out the arguments to. However, all the xrefs of it point to a VFTable. How would I find a call for this function?
user avatar
  • 11
1 vote
1 answer
50 views

How To Access Predefined Class Attributes From IDA Pro After Loading The Binary Without Debugger Attached To Process [closed]

I have this class with constructor offsets and attributes: public class example { // Fields public float Attribute_1 = 1.5f; // 0x8 public int Attribute_2 = 102 ; // 0xC // RVA: ...
user avatar
  • 21
1 vote
1 answer
126 views

A tutorial or docs to unpack a custom packed PE

I am facing an odd situation. I have a licensed game that's doing odd actions on the system. I isolated it as I could and observed the behavior both network and so forth, and I suspect it's a custom-...
user avatar
  • 11
4 votes
1 answer
102 views

What is the purpose of this sequence of HP PA-RISC instructions?

I'm looking at the startup code in an HP SOM executable. The disassembly looks like this: 00004010 b4 00 10 c2 addi,tr 61,r0,r0 00004014 e8 00 01 aa b,...
user avatar
0 votes
0 answers
29 views

Disassembling an embedded camera SPI flash

I would like to read the code from an SPI of embedded camera, in order to customize it. The CPU chip label EMF845 has no search results. According to binwalk/cpu_rec, the code most likely belongs to ...
user avatar
1 vote
0 answers
170 views

Brother DCP-L2550DW Identify Toner Reset TN-760 or TN-730 (Continued)

I'm really continuing discussion on a previous question posed 2 years ago ("Identifying a toner chip and its communication protocol to re-program it"). I found that user to have the most ...
user avatar
  • 11
1 vote
0 answers
55 views

Force IDA to redo SP analysis?

I had a function which I was unable to decompile due to a positive SP value, I tried to change it manually but accidentaly made everything worse, is there a way to restore/make IDA redo the original ...
user avatar
  • 49
2 votes
1 answer
432 views

Dump PCode in Ghidra for a specific decompiled function

I'm working on an automatic exploit-generation system for low level code, and I want to try it out on real world code. I thought PCode might be a nice place to start, since it abstracts away over many ...
user avatar

1
2 3 4 5
24