Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

1
vote
1answer
55 views

When can trapping be used?

This is the beginning of one of the functions inside NTDLL of Windows XP: MOV EDI,EDI PUSH EBP MOV EBP,ESP ... The book on reverse engineering I am reading(Eldad Eilam - Reversing: Secrets of ...
0
votes
0answers
27 views

Legality on sharing rom dumps on abandoned hardware

I have an old piece of HP test gear from the 80's that HP no longer supports. I want to add in a feature and need to dump roms and figure things out to do that. How can I share my process and ...
-2
votes
0answers
29 views

Can anyone please explain this disassembly code? [on hold]

Disassembly: 0: 6a 05 push 0x5 2: 58 pop eax 3: 31 c9 xor ecx,ecx 5: 51 push ecx ...
-1
votes
1answer
79 views

Can anyone please explain the following dissasembly codes?

Disassembly: 0: 31 c9 xor ecx,ecx 2: f7 e1 mul ecx 4: 51 push ecx 5: 68 2f 2f 73 68 push 0x68732f2f a: 68 2f 62 69 ...
0
votes
0answers
21 views

Finding lua C functions compiled binary

So i am trying to "hack" a game however not for cheating purposes. I am looking to extend the games scripting functionality through a DLL that can look for processes and return them. The game I am ...
4
votes
1answer
761 views

IDA Pro: Platform-independent way to check if an instruction is a jump

I am looking for a way to tell if an instruction is a jump instruction. Of course, I would like to avoid checking all possible jump mnemonics for all possible CPU architectures. I thought one may ...
2
votes
3answers
151 views

Jump in the middle of an instruction Coldfire firmware

I'm working on an embedded system Coldfire ROM. Currently, I'm trying to reverse engineering it to gain some more in-depth knowledge about its structure. ROM code quality seems pretty low, and I see ...
1
vote
2answers
51 views

Calculation with not defined variables?

I am new to reverse engineering and try to solve a crackme with radare2. My problem is understanding of the following lines: | 0x000007a9 c745b8000000. mov dword [var_48h], 0 | ...
2
votes
1answer
61 views

Extract a secret from an Android apk or .so file

Context As an exercise I am researching all methods of hiding a secret in an android mobile app binary... Yes I know that with more or less effort they can always be extracted with static analyses, ...
2
votes
1answer
514 views

Unknown CRC calculation

I am seeking for a CRC calculation on EEPROM content. I try to add options to my car with BOSCH ECU. MCU in this ECU is Tricore TC1793 and EEPROM content seems to be divided into blocks of 128 bytes ...
0
votes
0answers
48 views

Disassembly and decryption of internal files of Unity game [closed]

I'm seeking for help and future direction for my work. I'm looking for game data of Ragnarok M: Eternal Love and stuck at point of decryption of LUA files. The game use SLua unity library (c++ ...
-3
votes
1answer
1k views

How much time would it take to reverse engineer 100,000 lines of disassembly?

I'm trying to get a sense of the amount of time it takes to RE something, but I'm going to try to make this question as least subjective as possible. Imagine a very simple application that has only ...
1
vote
2answers
123 views

Lots of mov instructions into ebp+offset - What is happening?

While learning RE I have come across this large segment of instructions that contains a majority of mov [ebp+offset], value instructions. I believe that ebp + offset are local variables? I think? ...
10
votes
5answers
2k views

Lifting up binaries of any arch into an intermediate language for static analysis

Background As the title is self-explanatory, I would like to translate binaries of any architecture (e.g. x86, ARM, ARM Thumb) to an intermediate language in order to apply arch-independent static ...
16
votes
6answers
1k views

In what industries is [code] reverse engineering used?

While we all know what fun reverse engineering of code can be, I am wondering what legitimate industries, besides the anti-X industry, reverse engineer code? While this may sometimes be needed in many ...
0
votes
1answer
819 views

Unpacking firmware

I have a ROM dump firmware which must be reversed (as a task). Binwalk output: DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------...
-1
votes
0answers
16 views

Asking the meaning of an assembly instruction [duplicate]

I want to know the meaning of following instruction. MOV AL,BYTE PTR DS:[ECX+402158]
2
votes
0answers
106 views

Tools and techniques for analyzing NaCL binaries?

Are there any tools, tutorials, or resources out there for helping to make sense of NaCL binaries? They have some features that should make things easier – most crucially, fully decidable disassembly ...
1
vote
0answers
110 views

How would I begin REing this proprietary model format?

Disclaimer: This is both my first post, and my first time approaching reverse engineering. Overview: Need for Speed 5 is a classic (1990 era) racing game that was extremely unique in that it featured ...
-1
votes
1answer
65 views

Strange Message after manipulating an exe file

i debugged und reversed an exe file with x64dbg I simply changed an assembly command (je) into nop , patched the file and saved it under a different name. (only one line was changed) When i tried to ...
3
votes
1answer
83 views

Why disassemble multi-thread binary is hard?

Why disassemble multi-thread binary is hard? I also know that some obfuscation techniques are to create unnecessary threads. But why reverse engineering multi-thread program is hard.
-1
votes
0answers
26 views

Error Exception EOLeSysError class, When execute delphi program

I ran into a error and get the following message and just have EXE Files: Error EOLeSysError class not registered Class Not Registered. How I can find the name of the class which is not registered?...
53
votes
7answers
148k views

How do I reverse engineer .so files found in android APKs?

I know how to reverse engineer normal android APKs using tools like APK-tool anddex2jar but i don't know how to work with obfuscation. Can anyone help or atleast provide some pointers? I know this ...
0
votes
1answer
84 views

How do I go about overriding a function internally defined in a binary on Linux?

To be specific, I cannot recompile this binary, nor do I have access to the sourcecode. The functions are not defined within a shared library. So, how can I go about changing a function, or ...
2
votes
0answers
132 views

Unable to figure out how to map segments in IDA

I have a 2 MB executable that I'm attempting to reverse engineer. It's executed on a 16-bit 8086 CPU. The segments go from 4000 (0x140000) to F000 (0x1F0000). I'm attempting to map the segments in ...
1
vote
3answers
870 views

Books on reversing with GDB?

I'm getting started with some reverse engineering lately, especially on Linux and ELF format, but I'm struggling here. For now I'm only using GDB to disassemble binaries, and even though I can read ...
0
votes
1answer
231 views

Radare2 create section

Radare2 has S* commands, that can show, delete, modify sections. Is it possible to create new section in executable file and save it?
24
votes
5answers
3k views

Tools to work cooperatively on the same binary

What's a working tool/methodology to work cooperatively on the same binary (if possible in parallel), that is proven to work? I used various methods long ago to share information with others, but not ...
14
votes
2answers
1k views

Is there an actively maintained collaboration plugin for IDA?

There are many IDA Pro plugins that assist with collaboration, but are any actively maintained and known to work with the latest version of IDA (version 6.9)? These are the tools that I'm aware of, ...
2
votes
1answer
73 views

How do the PSHUFLW and PSHUFD instructions work?

I have been trying to figure out exactly what is happening with these instructions and can't make sense of them. I can see that the PSHUFLW instruction acts upon the first 16 bytes of the XMM register ...
1
vote
1answer
32 views

How is the I/O address space on the PC arranged?

I'm disassembling a 16-bit DOS executable, and looking at the following three instructions: mov dx,0x3ce mov ax,0xff08 out dx,ax I know it writes the value 0xff08 to I/O port 0x3ce. I also know that ...
2
votes
1answer
50 views

Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2?

Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2? I'm using the newest version of Radare2 to analyze the Windows application. As can be seen ...
2
votes
2answers
135 views

Why are there so much more functions in ida than my source code?

I am trying to learn how to use IDA Pro 6.8 to analyze binaries. However, there are much more functions in ida function list than my code. For example, there is a function in source code that calls ...
-1
votes
1answer
204 views

Using x86dbg valid opcodes produce '??? invalid instruction' output

Using the most recent ( as of today ) version of x86dbg I have a problem that follow every executable I have tried. The disassembler in the CPU window, look at the 5th line from the top: Any ideas ...
2
votes
2answers
148 views

Can Machine Learning be used to develop better reverse engineering tools? [duplicate]

So i googled this but other than some papers i couldnt find any reverse engineering tool that was built using machine learning I'm not an expert in machine learning and deep learning but it seems ...
2
votes
1answer
83 views

Reversing PE32 executable - CTF Question

So we were playing CTF , and we found this interesting RE challenge . And when we did a statical analysis to the file we found an interesting for loop . for (var_84 = 0x0; var_84 < 0x13; var_84 = ...
3
votes
2answers
114 views

Can't find SetCooperativeLevel call in disassembled program

I am trying to make some changes to the setup program that installs the game "Emperor: Battle for Dune". If you want to look at the EXE I am working on, you can download a copy of this setup program ...
3
votes
3answers
3k views

Use Android Shared library (.so) files in Linux

I decompiled an APK file,and that program have native codes in a .so file. I want to use that .so file in Linux in order to use inline functions. These codes have functions to connect to a server and ...
2
votes
1answer
163 views

How to disassemble a packed .NET executable?

I'm trying to reverse a Windows executable that shows as having been packed with ENIGMA(5.X): If I later check the class name for one of its UI elements, when the process is unpacked and running, it ...
4
votes
1answer
934 views

C-sky CPU reverse-engineering

I am trying to RE a firmware for a TV STB, its based on a GX3201 chip which is based on C-sky CPU (CK610M I think). I am stuck in the following points : I am not able to properly identify the CPU ...
7
votes
1answer
115 views

Radare2 Call $+5 and register-based cross-references not found

I have a library of ~65MB which uses this "technique" as a kind of PIC. First, it gets some kind of base address (it is always the same): 0x00708497 e800000000 call 0x70849c 0x0070849c ...
3
votes
1answer
235 views

Instruction set for code snippet?

I'm looking for the CPU/Instruction-Set of a closed embedded system. Code snippet: E6 F2 F3 15 E6 F3 0A EF E6 F8 9B 7F E6 F9 5B D5 0D 32 49 94 EA 30 60 71 What I know: E6 Fx is "LDR 16-Bit-...
0
votes
0answers
54 views

How is DS register interpreted in x86-64 assembly instructions?

IDA disassembled an x86-64 instruction as below: 0000000000000761 lea rdx, ds:0[rax*4] What I know is, segment registers are only relevant in in segmented memory model, while in ...
0
votes
1answer
124 views

How can I make IDA understand this switch statement with a signed jump table?

I took the following C code and compiled it on Ubuntu 16.04 with GCC 5.4.0: int main() { int a = 0; for (int i = 0; i < 5; i++) { switch (i) { case 0: a = 1; break; ...
6
votes
1answer
2k views

radare2 ascii graph to image?

After analysing a function and pressing VV to go into graph mode, is it somehow possible to export/render the whole graph to an image? I have some huge main functions and it would be nice to have it ...
0
votes
0answers
46 views

Getting function arguments with IDA: When do function prototypes exist?

This post explains how to get function arguments using idapython. However, I read here that get_arg_addrs() requires the prototype of the called function to be present. My question: In which cases ...
1
vote
0answers
44 views

Common practices for 'hiding' a class within an Android application?

I've recently gotten into Android reverse engineering, and I've been messing around with some apps lately for education/research purposes to see how some things are done with private (mobile) APIs. ...
4
votes
1answer
229 views

Reverse Engineering bios of ATM Machine

I bought an Hyosung NH1500 off Offer-up and it boots up and initializes some peripherals and then spits out and error of "COM download is failed". I've searched Google and 0 results came up, I've been ...
3
votes
2answers
81 views

ARM Thumb2 register usage

I am reversing ARM Thumb2 code. I am looking for a table that shows which registers are used to pass arguments to functions, and which registers must be saved after the function ends. By the way, if ...
3
votes
0answers
39 views

int 2eh instead of syscall/sysenter [duplicate]

I have been looking into ntdll.dll on windows 10 x64 bit, and i noticed a check inside the ntdll like this: So after testing some bit, it tries to execute the system call via int 2eh. I have tried to ...