Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

Filter by
Sorted by
Tagged with
1
vote
1answer
28 views

Confusion between different ARM architectures

I am trying to develop a machine learning model to help with the process of reverse engineering. As the first stage, we are currently trying to train an embedding model that understand the ...
0
votes
2answers
62 views

How does an executable’s static API differ from it’s dynamic API?

Running an executable in Cuckoo sandbox gives me its dynamic API information. How do these API calls differ from their static API information (eg. If I were to just put the executable through IDA Pro ...
0
votes
1answer
86 views

How can I modify these?

So I'm onto something interesting, I asked the less direct way but failed to meet the requirements in terms of explanation So here it is, how would I go about editing these the same way I would go ...
3
votes
1answer
90 views

Radare2 - what does dot mean in disassembly

I've just started using radare2 and I've noticed a dot when I tried to disassamble one on my programs. The output is: 0x00000000 48b841000000. movabs rax, 0x41 I understand that 0x48 is the REX ...
0
votes
0answers
31 views

N64 ROM file index hacking issue

Alright, I downloaded the N64 SDK and compiled one of the samples provided by the SDK and dissembled the ROM with IDA and found the asset data is stored some way using index's so my question is. What ...
0
votes
0answers
29 views

Relative/absolute addressing; RVA, ASLR, the relocation table and patching instructions

I've been trying to learn reverse-engineering for fun, cracking my own dummy games and whatnot and I just learned ASLR is a thing. I'm now trying to re-conceptualize everything I've read so far ...
0
votes
1answer
59 views

How to find function start in stripped binary?

Given C code, are the function addresses from the ELF the same as those in the stripped version? I don't have any specific code in mind. Just trying to learn in general how to find the function ...
0
votes
1answer
61 views

Why do those useless instruction are in Rust final binary?

I am currently reversing RUST binaries, and I often come across this block of instruction : .text:000055F4BFB943F2 db 2Eh .text:000055F4BFB943F2 nop word ptr [rax+rax+00000000h] .text:...
0
votes
0answers
48 views

strange results with IDA (some function different Pseudo Code)

After show the pseudo code in IDA I see different results: The function 4436C0 show different pseudo code. For example: result = sub_4376C0("vvcbb3.wav",v8,0); and result = sub_4376C0((int)...
1
vote
1answer
94 views

How do disassemblers work?

I have 2 questions regarding this, but feel free to elaborate more if you want to, I'm really interested in this topic: Do they really just read byte by byte until they get a valid instruction? How ...
0
votes
2answers
48 views

Where do arguments 5 and 6 go in this Microsoft x64 function call?

I'm disassembling a working-as-expected compiled C program (MS/Windows x64, MinGW gcc 10.1.0). In the main function, I have the following call which passes 6 arguments to the function DotProduct: ... /...
-2
votes
0answers
27 views

print instructions app executes using frida android

i connected my android device over tcp and now i want my device to print all instructions as the app executes when it loads this module but print instructions from current thread not those present in ...
0
votes
1answer
22 views

How can I move an integer number into a XMM register with Cheat Engine?

First off, I need to clear out that I'm a total noob on this, and I have tried reading and understanding documentation about this assembly stuff on the internet, but almost all I found, was meant for ...
-1
votes
1answer
45 views

Best way to find the entropy of an EXE file?

I want to write a script to extract the entropy of each sections of an EXE file. What is the best tool that I can use to do this? I tried Ghidra but it doesn't have an entropy API which I can use.
2
votes
1answer
102 views

dll injection (assembly code)

I need some tip to undrestand what is the best way to execute external code from DLL or command line. I like to add the force feedback support to different games that not support it. I can write a DLL ...
3
votes
1answer
98 views

Figure out with fopen

Can anyone explain, why fopen takes as argument- not a file name- according to code takes some off_6A5D8C: .text:00537F9F push offset stru_6C4E40 ; FILE * .text:00537FA4 ...
1
vote
1answer
30 views

How to turn off XREF comments in Ghidra's disassembly view?

Sometimes a function will have a series of XREF comments next to it in the disassembly view such as in the following example: ******************************************************...
3
votes
0answers
187 views

disassembly - bad results generated with ghidra but not with objdump and IDA

I am using Ghidra to analyze libpng-compat.1.5.10.so (downloaded from Fedora mirrors). But it didn't load the expected disassembly. Then I used Objdump and IDA to check the code and they get the same ...
1
vote
1answer
64 views

How to import files and analyze it in Ghidra using a python script?

I want to write a script which imports an exe file, analyzes it, extracts some features and saves it using python. The part which I am not able to understand is, how to import a file from the script ...
1
vote
0answers
99 views

which has better pseudocode? IDA or Ghidra [closed]

I would like to know which of the two has a better pseudo code generator in C, IDA or Ghidra, if possible, point out the strengths and low points of each one.
1
vote
1answer
52 views

How to find DOS Header and PE Header with an entry point in Radare2?

I am currently doing byte extraction from PE files using Radare2. I know how to find the byte sequence for Dos Header and PE Header when there is no entry point and the start is defaulted to 0x0. But ...
3
votes
2answers
83 views

Extracting Info from Ghidra Listing Window

I have written a script which extracts all the assembly code from a PE using this code in ghidra instructionList = [] for instr in currentProgram.getListing().getInstructions(True): ...
1
vote
1answer
42 views

Results of radare2 are not correct

I am using radare2 to analyze libpng_amd64.so.1.6.34, commands are as follows: r2 = r2pipe.open(binary_file) r2.cmd('aaa') funcs = r2.cmdj('aflj') len(funcs) is 461, but the number of functions got ...
1
vote
1answer
48 views

How can I get my shellcode to work outside of GDB?

I'm working inside a Warzone VM with no ALSR or NX bit. The program I'm trying to exploit is really simple: #include <stdlib.h> #include <stdio.h> #include <string.h> /* * ...
1
vote
1answer
57 views

Issue understanding simple ARM ASM function

I'm a little stuck trying to understand this simple piece of code. It get's a number in R0. The first part seems to be a R0 = abs(R0), but then it get's more difficult. The number of leading zeros is ...
1
vote
1answer
39 views

Can Ghidra currently be used to disassemble Tandy Color Computer binaries? Are the 6805 and 6809 opcode compatible?

I'm working on some Ghidra loader and filesystem modules for 80s microcomputers. I started work on a Loader for .cas tape image files for the TRS-80 CoCo because Ghidra suports the 6805 CPU. (It also ...
0
votes
1answer
32 views

How can I find the function that throws an error message in IDA Pro? [closed]

Let's suppose I want to use IDA Pro to debug a Windows PE64 application that always throws an error message at a specific point when being run. What steps would I have to take to find the specific ...
2
votes
1answer
37 views

Register edx and CreateDevice function DX

I disassemble CreateDevice function from my DirectX code and commented each paratemer: .text:0043F485 mov eax, [ebp+lpParam] .text:0043F488 add eax, 730h .text:...
0
votes
0answers
26 views

Ida pro 6.5 (BATCH MODE)

I have a question related to IDA pro 6.5 batch mode. I want to disassemble (.exe) files and generate (.asm) files. I have executed the cmd command for this and generated an asm file too. But it does ...
0
votes
1answer
43 views

dereferencing structure members

I am reading a book on reversing and I am curious about one of the assembly snippet i have read in it. There is a simple disassembly of the function RtlNumberGenericTableElements and it looks like ...
1
vote
1answer
55 views

Variable var_4 filled with value -1

Who can explain to me, why this line code there is before each jmp or end of some part of code where there is label. What this line of code is to do? mov [ebp+var_4], 0FFFFFFFFh This is WinMain ...
2
votes
2answers
40 views

X86 access to global strings pattern

While reversing some x86 executables, I came across a pattern of addressing globals, that I don't familiar with, but it looks like IDA is, and I would like to know more about it. .text:00002560 ...
1
vote
0answers
36 views

IDA 7.0: Why does editing this function result in red-marked stack-pointer offsets?

I tried to fix the size of both the saved registers and the local variable area using IDA's "Edit function" option as IDA could not recognize it properly by itself. Unedited function: Corrected ...
0
votes
0answers
42 views

Command line method to disassemble to a valid .asm file?

I'm trying to automate the disassembly of multiple .o files at once, and need the output to be in a valid .asm file. Is there a way to do this? I've been attempting to use objdump, but the output isn'...
1
vote
0answers
42 views

ARM chip gpio/ identification from firmware code

Device: i was able to recover bricked Chinese IOT a Sous Vide cooker. Replaced damaged capacitor. it works. it has ARM soc/mcu/processor WI-FI (broadcom) LCD touch screen + 16bit STM mcu. EEPROM ...
0
votes
1answer
29 views

How to determine commands sent over DC-37 port by software from 1992

Background Since some time we've been in the possession of a greenhouse. It was build around 1990 and had an automated system for climate control. However most of the installation has been removed ...
8
votes
1answer
95 views

Why use MOV R0, R3 and then MOV R3, R0 (thus back and forth)

I have a static library archive which I try to understand. First I use 'ar' to extract the object files. The object files ar "ELF 32-bit LSB relocatable, ARM, EABI5 version 1 (SYSV), not stripped" ...
1
vote
1answer
60 views

Compiled binary functional comparison through different versions / assembled functions

Good Day! I've not hit upon a solution to compare different compiled binaries for identical functions. Take, say, BusyBox. A very common application with a rich history and source code. Say take 3 ...
-2
votes
1answer
55 views

What steps needed to decode a Base64 binary? [closed]

I tried to decode it by Base64 but still didn't understand the result WfsRRmNNX02LzKxYKrh030TjLxD4636bf0crQ2ZeWBFiCRx9Yn0kQG1OPDcYSEN+cR1+...
2
votes
1answer
49 views

NEC 76F004GD Disassembly

I have a Toyota ECU from 2005 with an NEC 76F0004GD micro controller on it, I have already read the full 512k dump from the chip using a K-Tag. However, when I tried to put it into IDA, there weren't ...
0
votes
1answer
65 views

Why there are only 8 hexa memory digits while my RAM is 16G

I'm totally new to reverse engineering, when I start debugging my c program with radare2, and start showing assembly, I found that addresses are only 8 hexa digits, which means 16^8 = 4294967296 ...
1
vote
2answers
119 views

How to decompile /usr/bin/ls

How to decompile the following assembly instructions ? Note: this could be reproduced using /usr/bin/ls binary inside ghidra
0
votes
0answers
43 views

Shellcode doesn't match OllyDbg

I have created a simple program that is susceptible to a buffer overflow using strcat(buffer1, buffer2). I have successfully overflowed into the EIP and have placed an address located in NTDLL which ...
8
votes
0answers
111 views

Extracting strings from Go binaries

Is there an easy way to extract all of the strings from Go binaries that will work cross architecture? The problem with Go is that strings are stored without a null terminator so you can't use the "...
-1
votes
1answer
77 views

App from playstore runs but the same apk crashes on sideload install

On my nougat device, I have downloaded an app from the playstore, which is running great. I then extract the apk from the installed app, and uninstall it and again successfully, with package installer....
0
votes
1answer
40 views

Find code executed on button press in Qt5 Linux application

I have an executable of a (rather simple) GUI application on Linux, built in Qt5. I am able to run it, and want to find out what happens internally when I press one of the buttons. I suspect that the ...
1
vote
2answers
94 views

Working with strong obfuscated Java

I've got a jar file, that is strong obfuscated. When I tried to put it into decompilers such as bytecode-viewer and luyten I seen many lines of traps and Chinese letters. I tried to deobfuscate it ...
1
vote
0answers
46 views

What to do with a text file of disassembly code and binaries?

I am fairly new to software reverse engineering and I'd like to know how proceed with analyzing a program if I have a text file of disassembly code and a bin file of binary data. I understand ...
1
vote
0answers
109 views

How to use Ghidra to work with VM obfuscated binaries?

By "VM obfuscated binary", I mean a binary that contains one or more implementations of a VM internally, and also some bytecode that can run on this VM. One of the reasons why this binary is this way, ...
0
votes
0answers
84 views

How to reverse engineer Apple MacBook SMC update firmware image using IDA Pro 7.2?

Alright so I have watched extraordinary presentations videos from three different reverse engineers who hacked the Apple SMC Update firmware: Charlie Miller: https://www.youtube.com/watch?v=...

1
2 3 4 5
20