Skip to main content

Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

Filter by
Sorted by
Tagged with
1 vote
1 answer
38 views

What's the best way or approach to debug binary Linux library?

I've got a header file (I know the functions and have some documentation) and a .so file: From a wrapper library and from context, I need to call "Connect", but it does not work, just fails ...
1 vote
0 answers
52 views

Reverse engineering with IDA

I'm trying to reverse engineer a program (with IDA Freeware) which receives serial data packet and manipulates it. I need to decode the received message but I can't find the function that does the ...
0 votes
1 answer
51 views

C disassembly - biwise operations with 0x7FFFFFFFFFFFFFFF and 0x8000000000000000

I am using IDA to reverse engineer x86_64 binary file written in C. And pretty often I meet the following in IDA's pseudocode: (int64)v7 | 0x8000000000000000LL (int64)v7 & 0x7FFFFFFFFFFFFFFFLL ...
6 votes
4 answers
3k views

Is Null in Windows equal to zero?

(This question refers to assembly language.) I'm a little bit confused. I've encountered many times Windows functions that are supposed to return a Handle, and if they don't they return NULL. Why ...
1 vote
1 answer
103 views

Tips for reverse engineering Common Lisp (SBCL) ELF binary

I got to the task of reverse engineering the ELF binary. I found out that it is a compiled SBCL. I have no idea how to do static or dynamic analysis, any tips (where to start, I found basically ...
0 votes
1 answer
256 views

How to pass an SVD file as an argument to IDA Pro in the command line (batch mode)?

I am trying to disassemble a few Arm Cortex-M3 .elf binaries and run a custom IDAPython script (script.py) from the command line (in batch mode). I have been able to do that with the following command:...
0 votes
1 answer
49 views

How to split a variable into 2 variables in pseudo c code generated by IDA?

Some times IDA's decompiler translates more than variables into a single variable or an array of varibles, for example, I have 2 variables A a; // size = 30h B b; // size = 60h but IDA gives A arr[3];...
1 vote
2 answers
5k views

How to find functions in IDA Pro/x64dbg

i created a program for testing, very simple in c++. is ask for password if it is match is print correct, if no it is print "bad". i try to find with ida where is the function of what i made. but i ...
4 votes
1 answer
594 views

How to make IDA processor for file format with tree structure

Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on. However when it comes to tree-structured file format, I can't come up with a ...
0 votes
1 answer
111 views

How can I change the data type of `puVar1` in this C++ function?

I was reversing ( new to the reversing world of course) being using Ghidra for this. I get a C++ function AppChat::__Status::setDescription(ErrorCode param_1). Within this function, there's a variable ...
1 vote
2 answers
435 views

How do I extract sprites and backgrounds from .BIN files? (dos game - 1988)

Does anyone know what tools should I use to extract the backgrounds and sprites of this very rare old game: Armorik the Viking? The files are in .BIN format. No idea how to open them. I tried Game ...
1 vote
1 answer
853 views

A newbies question about CFF explorer screen

I am a bit confused about the CFF explorer quick disassembler options shown in my screen , Can somebody explain what those hex values are underneath the Opcode part ? updated the question part , ...
0 votes
1 answer
89 views

IDA - Decoding this "XORed"? string automatically in psuedocode

__m128i ModuleName; __m128i ProcName; ModuleName.m128i_i64[0] = 0x3E4D19089E7D5EDi64; ModuleName.m128i_i64[1] = 0xD8855EB576AF36A0ui64; ProcName.m128i_i64[0] = 0x6F80FFFCE583A183i64; ProcName....
1 vote
1 answer
120 views

Strange entry point for an old Mac OS X x86 32 bit binary

I wanted to reverse engineer an old game for Mac OS X, but I can't figure out how the entry point jumps to other code. The binary is an x86 Macho-O executable and, according to Detect it Easy, it was ...
0 votes
1 answer
158 views

Is DOS Assembly Hexadecimal Different To Modern Hex Editor Hexadecimal?

I am trying to find the correct Data Segment, corresponding to a certain File in a 16bit DOS Game. The Assembly Instructions for the Decompiled .exe File in IDA Pro Version 5, I am looking at. I was ...
0 votes
2 answers
198 views

Cutter shows addresses relative to stack but not rbp. How to change it?

Look at the first image: Here what I get is var void *buf @ stack - 0x28. But I'm watching a tutorial there his Cutter shows like this: var void *buf @ rbp - 0x20. How can I change cutter to appear ...
0 votes
0 answers
28 views

How to trigger calls and attach to functions on a running process?

I'm a software developer, with some knowledge in memory management but near zero experience in reverse engineering. I wonder if there is a way to detect which function a program calls at certain ...
0 votes
0 answers
23 views

wWinMainCRTStartup and wWinMain are filled with uninitialized memory

I have a PE executable (32 bit) GUI program and I tried to reverse engineer it. I opened it in Ghidra and discovered the entry calls wWinMainCRTStartup. However, when I checked wWinMainCRTStartup all ...
2 votes
0 answers
125 views

Vtables in objects with inheritance in IDA

I'm struggling to get object inheritance working in IDA. The original structure is as follows: INoticeSource : INoticeSink IRTTITypeInfo : IUnknown, INoticeSource IPersist : IUnknown IPersistStream : ...
1 vote
2 answers
1k views

How do I go about overriding a function internally defined in a binary on Linux?

To be specific, I cannot recompile this binary, nor do I have access to the sourcecode. The functions are not defined within a shared library. So, how can I go about changing a function, or ...
2 votes
0 answers
54 views

Changing instruction that was misidentified in IDA Pro

I am trying to compare a source code to a disassembled version of a Sega Genesis (68000 processor) game. I ran the binary through IDA Pro 7.7 to disassemble it, and when I was going through the code ...
2 votes
1 answer
2k views

How do I Decompile .Pyd file made with python, cython and pyinstaller 3.6

I created an app in 2018 with python and then used Cython and pyinstaller v 3.6. I am wondering how to decompile it. I have tried uncompyle6 + pyinstxtractor however this only works for python files,...
0 votes
1 answer
88 views

Patch all calls to a single function using IDC

I am quite new in reverse-engineering and programming in general, sorry in advance if this question is dumb. It goes like this: In c++ disassembled code exist calls to a certain function. 2 thousand ...
0 votes
1 answer
129 views

Hooking a function

So, I'm attempting to create a mod for an older game, Fable: The Lost Chapters. I was able to find the MacOS release of the game, which contains symbols, and I was also able to find a leaked debug ...
0 votes
1 answer
57 views

Offset addressing

I’m writing a C-SKY (CK803S) processor module for IDA Pro, and a question arose about offsets in transitions, small ones are fine, but long ones lead to nowhere, from the documentation: in code I ...
0 votes
0 answers
47 views

IDA can't load DLL, possibly packed but how?

I tried to load a DLL to reverse engineer the code inside using IDA, but it tells me this on loading: So i assume the .text resource is somewhat "packed". I then fetched a tool named "...
2 votes
4 answers
4k views

What happened to woodman.com?

I had bookmarked woodman.com/crackz a couple years back because it looked like it had some good content for learning how to reverse engineer, but I never had the time/vested interest to dig in deep ...
1 vote
1 answer
111 views

Why are these strings padded every other byte?

I've seen this multiple times, through various apps and snooping of hex values. Character strings but every other value is actually a null byte. This particular example is with API Monitor, but I'm ...
4 votes
2 answers
2k views

How do you look for a a particular value at address in IDA

So, I was trying to load some binary and in the main function, I saw instructions such as mov edi, [esi+1Ch] ... lea eax, [esi+18h] So, what are these values at [esi+1Ch] and [esi+18h]. How do ...
0 votes
0 answers
57 views

Is there a way to access the background calculation & data in a .exe coded in fortran 30+ years ago?

The company I work for has an ancient (circa 1989-1992) program coded in Fortran that is used for sizing and selecting some of our products. We are going through a modernization project with the goal ...
0 votes
0 answers
131 views

Prevent GCC compiler from constant folding

I have simple C Code: int main() { int b = 3-1; return 0; } And when I objdump it after compiling with no optimization: 000000000000113d <main>: 113d: f3 0f 1e fa ...
0 votes
0 answers
54 views

Executable Opcodes of Windows Image File Seem Offset from My Calculations

Background: I'm trying to manually disassemble a practice executable file for practice. https://github.com/stryker2k2/dbg-demo/blob/master/assem/assem_0x00.asm Issue: When I take a look at what I ...
0 votes
1 answer
739 views

How can I convert the following assembly code to pseudo code?

I got the following disassembly code in IDA pro. I really find it hard to convert it into pseudo code. push ebp mov ebp, esp sub esp, 14h mov dword ptr [ebp-14h], 1 mov dword ptr [ebp-10h], 2 mov ...
0 votes
0 answers
76 views

Memory address conversion

I have 32 bit MS-DOS app, it used dos4gw.exe extender. I run this app in DosBox debug mode. I looked at IDA - and function main() in this app has address: cseg01:00038460 main_ proc near ...
0 votes
0 answers
72 views

Requesting Guidance To Understand SuperScape's .VCA Format: Lego Creator Knights Kingdom

I hope you all are doing well and staying safe. I am in the process of trying to understand how SuperScape stored data in their .VCA/LCA format, so I can extract the original SHAP and PAL data from ...
1 vote
1 answer
196 views

ARM64 Stack Layout - Why 100x'A' Doesn't Crash?

I'm trying to exploit a buffer overflow vulnerability in an ARM64 program from this blog. When I give as input 100*'A', and I compile the program for ARM 32 bit (without canaries), the program crashes ...
5 votes
2 answers
2k views

Unknown CRC calculation

I am seeking for a CRC calculation on EEPROM content. I try to add options to my car with BOSCH ECU. MCU in this ECU is Tricore TC1793 and EEPROM content seems to be divided into blocks of 128 bytes ...
3 votes
0 answers
136 views

Reverse DLL and EXE at the same time?

I started reversing a 32-bit x86 EXE that led me down the path of finding the structure and core functions I needed inside of a DLL. I'm currently using Binary Ninja 3.5 as my disassembler, decompiler,...
0 votes
1 answer
745 views

How to reverse engineer Apple MacBook SMC update firmware image using IDA Pro 7.2?

Alright so I have watched extraordinary presentations videos from three different reverse engineers who hacked the Apple SMC Update firmware: Charlie Miller: https://www.youtube.com/watch?v=...
2 votes
2 answers
3k views

Need help disassembling Qualcomm QDSP6

Im trying to disassemble a qualcomm QDSP6 modem file. According to the ELF header, there should be 26 sections(modem.b00-b25). However after dumping the device, b.16,b.17,b.25 are missing, making the ...
0 votes
0 answers
39 views

DesignAKnit shape (.shp) file format

With help from information provided by members of this forum, I have more or less succeeded in reverse engineering DesignAKnit pattern (.stp) files. Has anybody worked on the shape files? I have never ...
3 votes
3 answers
2k views

Exports that redirects to other library

I'm writing an analog of GetProcAddress function. When looking inside the export table I see the exports like this in advapi32.dll for example: .text:4C362BAA aEventregister db 'EventRegister',0 ;...
1 vote
0 answers
274 views

IDA pro Error how to resolve this error

52C187F5: The instruction at 0x52C187F5 referenced memory at 0x4. The memory could not be read -> 00000004 (exc.code c0000005, tid 672) How to solve this? I have seen sandbox reports in those the ...
1 vote
0 answers
112 views

How can I make IDA disassemble in NASM-like syntax instead of MASM-like syntax?

I'm new to reverse engineering, assembly and IDA and I'm learning NASM. Whenever I load an executable (a PE file or an ELF) IDA disassembles it using a MASM-like syntax (it looks to me that it does) ...
0 votes
1 answer
498 views

Change URL a program sends data to

I'm pretty new to reverse engineering, and I have several times seen that programs make requests to certain websites with specific host names. I tried to use a debugger and checked for the URL it ...
1 vote
0 answers
94 views

DOS .exe File Decompiled in Cutter Program Showing Different Than In IDA Pro

I am having an issue when using the Cutter Reverse Engineering Program, Here is a Segment of Decompiled Assembly, in Cutter :- at 0000:4ed5 in the picture I posted the .string line of text is there, ...
1 vote
2 answers
438 views

Using IDA 8.3 Freeware on a Z180 .bin file

The last time I tried my hand at disassembly it was in 1986-1988... a Z80 embedded processor PROM image file... 42K of code turned into 27000+ lines of assembler code... using a disassembly program ...
93 votes
9 answers
317k views

How do I reverse-engineer .so files found in Android APKs?

I know how to reverse-engineer normal Android APKs using tools like apktool and dex2jar, but I don't know how to work with obfuscation. When I extract everything from APK, I get some Smali files (I ...
0 votes
0 answers
52 views

INT 31h MS DOS Lock linear region function

cseg01:000561C4 mov edx, offset sub_56BA0 cseg01:000561C9 mov eax, offset sub_56C66 cseg01:000561CE sub eax, edx cseg01:000561D0 ...
4 votes
0 answers
1k views

Extract disassembly from Ghidra for reassembling

How can I extract a code listing from a Ghidra project such that I can reassemble with something like vasm? I have gone through a memory snapshot and disassembled the code and marked data sections etc....

1
2 3 4 5
26