Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

Filter by
Sorted by
Tagged with
1
vote
0answers
31 views

Is disassembly of standard gcc programs trivial, or just as difficult as video game ROMs?

I am attempting to do some reverse-engineering of ARM binaries, with the ultimate goal of reverse-engineering GBA ROMs. Of course, GBA ROMs contain a mixture of code and data, so a standard ...
0
votes
1answer
67 views

Understanding the meaning of EBP + 0xffff98b4

I'm currently reverse-engineering an old game from 2003 to extend its functionality. I have now found what I am looking for and since it was written in C++ I'm trying to re-create the used classes. I ...
0
votes
1answer
36 views

Constructors testing for strange in-stack value

This is something that I found in a lot of constructors that have to do with classes that inherit from other classes. I have a vague idea as to why it's done, but I'd rather have it confirmed before ...
1
vote
1answer
55 views

List instructions to fix wrong IDA analysis

I don't want to get too much into detail, but a disastrous chain of events that began with a boolean of incorrect size forced the IDA analyzer to discard a lot of instruction sections of many ...
1
vote
2answers
53 views

How can I tell radare2 to show me a constant's value in disassembly

In radare2, I can disassemble like: 0x004006f0]> pd 3 ... 0x004006f0 ff2532092000 jmp qword [reloc.callme_three] ; [0x601028:8]=0x4006f6 0x004006f6 6802000000 push 2 ...
1
vote
1answer
47 views

How can I use radare2 to list all xrefs to a string?

radare2 can list all strings with iz , and list all functions with afl. How can I use radar2e to list the XREFs for each string? That is, for each string, which funcs reference it? I'd like to be ...
1
vote
1answer
68 views

I don't find the body of a function that I called in the main function

I have created a very simple x86 console program that uses Visual Studio 2019 compiler to sum 2 numbers just to see how is the program be after disassembly but I found something unclear to me. // C++ #...
0
votes
0answers
35 views

Malware analysis of undetected NodeJS token grabber

I've recently nearly had my discord account stolen by a token grabber called 'Katana Legends'. Someone contacted me asking to playtest a game, which prompted a .exe file. I ran the file and website on ...
3
votes
2answers
110 views

Why does the "MOV DWORD PTR ds:0xdeadbeef" instruction dereference the 0xdeadbeef address?

I'm reverse engineering a binary and I'm confused, because my theoretical knowledge is currently clashing with what's actually happening. I thought that this instruction writes the value 0xdeadbeef ...
1
vote
1answer
70 views

How could I find a call of a function thats only referenced inside a vftable?

So I have this function which I'm trying to figure out the arguments to. However, all the xrefs of it point to a VFTable. How would I find a call for this function?
1
vote
1answer
39 views

How To Access Predefined Class Attributes From IDA Pro After Loading The Binary Without Debugger Attached To Process [closed]

I have this class with constructor offsets and attributes: public class example { // Fields public float Attribute_1 = 1.5f; // 0x8 public int Attribute_2 = 102 ; // 0xC // RVA: ...
1
vote
1answer
97 views

A tutorial or docs to unpack a custom packed PE

I am facing an odd situation. I have a licensed game that's doing odd actions on the system. I isolated it as I could and observed the behavior both network and so forth, and I suspect it's a custom-...
3
votes
1answer
71 views

What is the purpose of this sequence of HP PA-RISC instructions?

I'm looking at the startup code in an HP SOM executable. The disassembly looks like this: 00004010 b4 00 10 c2 addi,tr 61,r0,r0 00004014 e8 00 01 aa b,...
0
votes
0answers
24 views

Disassembling an embedded camera SPI flash

I would like to read the code from an SPI of embedded camera, in order to customize it. The CPU chip label EMF845 has no search results. According to binwalk/cpu_rec, the code most likely belongs to ...
1
vote
0answers
94 views

Brother DCP-L2550DW Identify Toner Reset TN-760 or TN-730 (Continued)

I'm really continuing discussion on a previous question posed 2 years ago ("Identifying a toner chip and its communication protocol to re-program it"). I found that user to have the most ...
1
vote
0answers
41 views

Force IDA to redo SP analysis?

I had a function which I was unable to decompile due to a positive SP value, I tried to change it manually but accidentaly made everything worse, is there a way to restore/make IDA redo the original ...
1
vote
1answer
137 views

Dump PCode in Ghidra for a specific decompiled function

I'm working on an automatic exploit-generation system for low level code, and I want to try it out on real world code. I thought PCode might be a nice place to start, since it abstracts away over many ...
1
vote
1answer
53 views

.data segment seems to contain code?

I have recently been trying to improve my skills on reverse engineering. So, I opened C:/Windows/System32/DriverStore/FileRepository/xboxgip.inf_amd64_90ed6b3fdc759a5b/devauthe.sys in IDA. While ...
1
vote
1answer
47 views

How to call a func in an executable binary?

I have a binary with a func that I can disassemble. What are simple ways for me to call it with arbitrary args and observe its return val and behavior? Ideally, I'd like to do this: Within gdb (or ...
1
vote
1answer
50 views

How to change string-detection rule in IDA Pro?

I'd like to debug a Firmware (ARM-based) which contains a lot of C-Strings. IDA Pro 7.2 seems to have problems detecting strings having special chars (above 7-Bit ASCII) in it. Here is one example of ...
1
vote
1answer
79 views

Reverse compression of QDSP6 modem files

I'm trying to reverse a qdsp6 modem file but I'm stuck with the (probably) compressed segments. There is also a third compressed segment which simply uses zlib but the other two are not recognized by ...
4
votes
1answer
94 views

How to reverse engineer a setjmp/longjmp sequence?

I'm trying to reverse engineer the GNU libc x86 (32 bit) setjmp / longjmp (re a vuln which may allow arbitrary overwrite of the jmp_buf env. There's a great writeup of the musl setjmp but I can find ...
2
votes
1answer
161 views

Arm custom u-boot reversing

I'm trying to reverse a custom u-boot that implements cryptography for the Kernel at runtime (the Kernel at rest is encrypted also in a flash). I can probably ask the IoT vendor to provide the ...
1
vote
1answer
94 views

What's purpose of mov ebx, [esp+0]?

I'm disassembling one SO library for fun and was wondering what's purpose of following procedure: sub_3699 proc near mov ebx, [esp+0] retn sub_3699 endp It's widely used across entire library ...
0
votes
0answers
42 views

Why would compiler emit a null pointer assignment

I have been reversing a popular Windows application and ended up in a very interesting place while debugging. What I can clearly see as valid x86 instructions that eventually lead to some sort of &...
0
votes
1answer
61 views

Reading from buffer and printing output to a text file

00001f10 2846 mov r0, r5 00001f12 6349 ldr r1, [pc, #0x18c] {data_20a0} 00001f14 7944 add r1, pc {data_ce5e, "OK:%16[^:]:%16[^:]:%d:%d:%d:%d:%…"} ...
1
vote
3answers
131 views

x64dbg Crash on Dynamic Debugging Remove Anti-Debugging Protection

I am trying to run Dynamic code analysis using x64dbg for Windows 64 bit executable. I install the anti-debugging plugin for x64dbg from https://github.com/x64dbg/ScyllaHide. I still find the ...
0
votes
0answers
82 views

Starting out with reverse engineering. What assembly is disassembled code

I am new to reverse engineering and want to analyze my own exe/dll files. I took a look at nasm and masm and so far I have the feeling that this is unnecessary for me to learn in detail because it ...
0
votes
1answer
123 views

Translate ASM code x86 32 bits in C

I have a exercise which i can't resolve it, and i need help. If anyone can help me it would be great. I have the next ASM code in x86 32 bits which i need to translate in C language: Dump of assembler ...
2
votes
1answer
104 views

Code caves in arm assembly

In a disassembled elf binary i found these arm thumb instructions: function0 0x002cc3a8 8079 ldrb r0, [r0, #6] 0x002cc3aa 7047 bx lr In the codecave these were the initial hex ...
1
vote
1answer
62 views

How to insert arm instructions into a function in a native library?

I am new and am still learning assembly languuage. In a native android app library that has been disassembled i found this function which had 1 instruction. addres hex arm instruction ...
2
votes
1answer
61 views

When would a program normally transfer data between memory and coprocessor?

In the analysis of an ARM binary, when would one normally encounter transfer operations between memory and a coprocessor? These are encoded as the LDC and STC operators. Would it be common for ...
0
votes
1answer
46 views

ARM floating point register S0 used without initialization

The following code snippet is the first few assembly instructions of a function. The code runs on armv8a. SUB SP, SP, #0x170 is the first assembly instruction of the function. Please note the ...
2
votes
1answer
284 views

Finding AES Key in binary using Ghidra and FindCrypt

I would like to learn more about RE. I wrote a simple program on a STM32F107 which does nothing else than encrypting and decrypting a text once using AES128-ECB. Here is the C code (I intentionally ...
0
votes
0answers
56 views

Is it possible to detect that a function has been called from a loop? - Radare-2

is it possible to detect a function is calling from inside a loop in Radare-2. for (i = 0; i<n; i++) foo() foo() ==> 0x00402f90 // starting address Thanks
1
vote
0answers
110 views

Pascal string representation in Hex-Rays Decompiler of IDA Pro

I'm trying to prettify a representation of Pascal-string "Could not access file "" in Hex-Rays decompiler's output. As you can see below, now its type is char[25] due to inclusion of ...
1
vote
0answers
117 views

Radare2 cannot open bin for writing

Im on Kali and im using Radare2 but it says r2 -d bin Killing child process 16151 due to an error Killing child process 16152 due to an error [w] Cannot open 'dbg://./bin' for writing. I tried chmod +...
0
votes
0answers
64 views

Ghidra - search for library usage?

Using Ghidra: if library A imports library B, is there a way to search for all function calls from A into B? And more specifically: if B exports function foo, how can I find where that specific ...
0
votes
1answer
23 views

How to convert string to a variable in IDA

I have the following string "CreatePipe" and I want to convert it to a variable so I can use x to find all its references: How can I do it? I am not sure what to choose here:
1
vote
0answers
67 views

How to change how the calculated value is shown for registers in Ghidra

I'm currently working on reversing some Sparc code in Ghidra, and calculated register values are shown incorrectly. This is how the line looks in the listing: add o3, o0=>DAT_00007d88, o0 and I ...
0
votes
2answers
60 views

Ollydbg - bytes in memory different than on disk

I have been analyzing an application and I'm getting confused about something. When I open an executable with OllyDbg, it shows 0xAA byte. The same executable opened with CFF explorer at the same ...
0
votes
1answer
125 views

Why the disassembled code in IDA is different from in xcode? And How to solve unk_xxxx in IDA View?

I have built an executable file (the architecture is ARMv7, the base SDK is iOS), which depended on an xxx.a file in xcode; I don't have the source code of thexxx.a. I want to check some logic in `xx. ...
0
votes
2answers
74 views

Format of data in the .code/.text section

I'm attempting to dissect/disassemble a windows PE file under Linux using objdump. On surface analysis, the .code section was disassembled to : tmp.exe: file format pei-i386 Disassembly of ...
0
votes
2answers
93 views

How to identify method order in disassembled C++ object

Here are some chunks: v13 = cocos2d::FileUtils::getInstance(v9); (*(void (__fastcall **)(char *))(*(_DWORD *)v13 + 64))(&v46); v19 = cocos2d::FileUtils::getInstance(fileHandle); v21 = *(...
0
votes
0answers
48 views

How can I find out where relocated functions are in a Win16 executable in SoftICE?

Backstory: I'm poking through SimTower for Windows to discover the actual logic for how it decides how much alternative background is used for the SimTower lobby floors (the ones with the green ...
0
votes
0answers
69 views

Ghidra: Identify and display a struct broken into multiple smaller fields

Me vs the 90s game, part two. I'm trying to figure out how the game detects the current date, since that part doesn't work correctly anymore. At some point, GetLocalTime() from kernel32.dll gets ...
0
votes
0answers
87 views

radare2: Print strings in function for 32-bit binaries

I want to see the strings that are printed by the puts() function in the output of radare2's pdf, but it doesn't work. I have a similar problem as mentioned here, but I think it's somehow related to ...
0
votes
0answers
41 views

Indirect calls using registers (IDA)

I need some help. Using IDA for disasembling an executable PE file. It has several indirect calls using registers like call eax. Trying to add breakpoints and get the content of the registers, but ...
5
votes
1answer
192 views

Would hiring a RE service be worth it?

Before I clarify my question, I will explain the project I'm working on, and what I've done so far so there will be a better understanding of what I'm trying to do. I'm trying to modify the UI of a ...
0
votes
0answers
298 views

How to disassemble an obfuscated .NET DLL?

I asked earlier about unpacking a packed .NET exe. But now I need to see the source code for an obfuscated DLL: Any idea how to unpack it?

1
2 3 4 5
23