Skip to main content

Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

Filter by
Sorted by
Tagged with
32 votes
5 answers
12k views

Why there are not any disassemblers that can generate re-assemblable asm code?

I am struggling on this problem for around three months: How to use disassemblers (IDA Pro and others...) to generate re-assemblable asm code and assemble it back My experience is that: There is NO ...
lllllllllllll's user avatar
10 votes
1 answer
6k views

Extracting arguments from IDA

Let's say I have the following function in IDA: int __usercall function<eax>(char* message<ebp>, unsigned int count<edi>) What's the fastest way to extract the argument information ...
Zach Riggle's user avatar
  • 2,357
93 votes
9 answers
317k views

How do I reverse-engineer .so files found in Android APKs?

I know how to reverse-engineer normal Android APKs using tools like apktool and dex2jar, but I don't know how to work with obfuscation. When I extract everything from APK, I get some Smali files (I ...
Pervy Sage's user avatar
  • 1,205
32 votes
5 answers
5k views

Why is disassembly not an exact science?

Newbie here. From Wikipedia Disassembly is not an exact science: on CISC platforms with variable-width instructions, or in the presence of self-modifying code, it is possible for a single ...
Einar's user avatar
  • 421
37 votes
3 answers
12k views

How can I reverse optimized integer division/modulo by constant operations?

When compiling a division or modulo by a constant, my compiler (LLVM GCC) generates a series of instructions that I don't understand. When I compile the following minimal examples: int mod7(int x) { ...
Dougall's user avatar
  • 1,789
17 votes
1 answer
5k views

COM interface methods

I'm reversing malware and it uses COM, which I evidently don't know. My question is how to find out what method is called using ppv (and objectstublessclient?) push offset ppv ; Address of ...
astrophonic's user avatar
10 votes
2 answers
6k views

What is the purpose of these instructions before the main preamble?

I wrote a small C program below: #include <stdlib.h> int sub(int x, int y){ return 2*x+y; } int main(int argc, char ** argv){ int a; a = atoi(argv[1]); return sub(argc,a); } Compiled ...
drdot's user avatar
  • 279
10 votes
1 answer
2k views

Mapping an external module's source code to assembly - extracting information from source code

The situation is the following: I'm reversing an application, In which I found a lot of functions that belongs to the OpenSSL library. Since I have the source code for this module, I was wondering if ...
Dominik Antal's user avatar
8 votes
2 answers
2k views

basic reversing question about local variable

I do not understand the following: in a very simple dummy C function: void vulnerable_function(char* string) { char buffer[100]; } When I use gdb to disassemble it, I obtain: 0x08048464 <+...
David Labay's user avatar
27 votes
6 answers
3k views

Tools to work cooperatively on the same binary

What's a working tool/methodology to work cooperatively on the same binary (if possible in parallel), that is proven to work? I used various methods long ago to share information with others, but not ...
Ange's user avatar
  • 6,694
12 votes
2 answers
16k views

How to find arrays of objects (entities, enemies) in a game I'm reversing with Cheat Engine?

I am reversing a game using Cheat Engine and OllyDBG, through this memory addresses within an FPS game are read and monitored, these addresses will contain the coordinates(xyz) of enemies. My ...
Daniel Filipe's user avatar
11 votes
2 answers
5k views

What to do when IDA cannot provide a function name?

For learning (and fun) I have been analyzing a text editor application using IDA Pro. While looking at the disassembly, I notice many function calls are made by explicitly calling the name of the ...
clark's user avatar
  • 215
6 votes
3 answers
4k views

Segments in IDA. How to overcome NONAME problem

I'm disassembling a packed 16 bit DOS MZ EXE. To deobfuscate it, I've set a breakpoint in DOSbox at the end of the unpacking routine, let it run, and made a memory dump. This way I essentially got ...
ScumCoder's user avatar
  • 609
6 votes
2 answers
10k views

What is the difference between static disassembly and dynamic disassembly?

I am told that tools like IDA Pro are static disassembly tool, and tools like OllyDbg are dynamic disassembly tool. But from the using experiences on these tools, I don't think there is any ...
lllllllllllll's user avatar
4 votes
3 answers
1k views

Soundness of ARM disassembly

I'm interested in formal verification of software at binary code level. Obviously, the first step would be to recover the actual assembly instructions from binaries. IDAPro can do a pretty good job ...
Codoka's user avatar
  • 403
2 votes
2 answers
4k views

Why does IDA show wrong function arguments in pseudocode?

I've open a DLL in IDA v7. In one subroutine, there is a PathAllocCombine() function. The pesudocode shows six arguments in it. But the documentations shows there are four arguments i.e. ...
Biswapriyo's user avatar
  • 1,569
18 votes
3 answers
5k views

What are nullsub_ functions in IDA?

In nearly every dis-assembly created by IDA, there are several functions that are marked nullsub_ which according to IDA, return null nothing (just ret instruction). So, what are those and why are ...
PhoeniX's user avatar
  • 3,062
18 votes
6 answers
2k views

In what industries is [code] reverse engineering used?

While we all know what fun reverse engineering of code can be, I am wondering what legitimate industries, besides the anti-X industry, reverse engineer code? While this may sometimes be needed in many ...
dyasta's user avatar
  • 4,198
16 votes
2 answers
2k views

Is there an actively maintained collaboration plugin for IDA?

There are many IDA Pro plugins that assist with collaboration, but are any actively maintained and known to work with the latest version of IDA (version 6.9)? These are the tools that I'm aware of, ...
Reverser's user avatar
  • 179
12 votes
5 answers
3k views

Artifacts similar to "@YAXPAX@" within memory and IDA sessions

When reversing binaries and parsing memory, I often run across strings like "@YAXPAX@" used to reference procedures. Is there a name for this type of convention? I believe theses strings are symbol ...
rekav0k's user avatar
  • 123
12 votes
1 answer
3k views

Delphi Pascal Try..Except..Finally block

I'm having trouble reverse-engineering a specific Delphi Pascal .exe (old vsn., pre-1995 so probably v.3). From the system calls I understand this is probably a try..except..finally block, but I am at ...
Jongware's user avatar
  • 2,364
12 votes
3 answers
2k views

Why is JMP used with CALL?

I am trying to analyze an old malware sample in OllyDbg. It has instruction of the format CALL <JMP.&KERNEL32.SetUnhandledExceptionFilter> I am not an expert in Assembly. I know that CALL ...
TheRookierLearner's user avatar
8 votes
1 answer
240 views

Why are those instructions generated?

After disassembling a program, I see the following asm code generated : .text:004D5911 mov [ebp+var_4], ecx .text:004D5914 mov ecx, [ebp+var_4] .text:004D5917 test ecx, ecx .text:004D5919 ...
Eric's user avatar
  • 439
7 votes
1 answer
4k views

How to recover the exception info from .gcc_except_table and .eh_handle sections?

For C++ program with try catch defined, when using g++ to compile it into assembly code (test is on x86 32bit Linux, g++ 4.6.3) g++ -S cppexcept.cc A specified section called .gcc_except_table is ...
lllllllllllll's user avatar
7 votes
1 answer
6k views

Recursive traversal disassembling with Radare2?

I am trying the recursive traversal disassembler of the radare2 tool. But, I cannot use it properly. First, according to the radare2 manual, we can use recursive traversal disassembler by using the ...
perror's user avatar
  • 19.1k
6 votes
1 answer
724 views

Recompiling/optimizing redundant code to make analysis easier

I'm analyzing an application created with Borland Delphi but the poor quality of the object code makes analysis difficult and tedious. The code is so convoluted and inflated with superfluous ...
Eric's user avatar
  • 439
4 votes
2 answers
2k views

What could be the purpose of XORing esp with a global variable? (stack canary protection)

I am currently looking at a function inside a Win32 executable's main module. After allocating memory on the stack (sub esp) and saving some registers on the stack, the value of esp is XORed with a ...
InkassoHeinzi's user avatar
3 votes
1 answer
4k views

What are the unk in IDA pseudo code?

I've open wsl.exe in IDA v7. With Tab key I open pseudocode of sub_1400129F4 like this: __int64 sub_1400129F4(__int64 a1, __int64 a2, __int64 a3, __int64 a4, ...) { ...... v8 = (__int64 *)...
Biswapriyo's user avatar
  • 1,569
3 votes
2 answers
14k views

Hikvision camera firmware reverse engineering

I have a camera with Hikvision firmware. The firmware file has clear text in it, for example, there's a shell script you can see in there that coincides with a shell script when I tellnet in. There's ...
carl's user avatar
  • 47
3 votes
1 answer
649 views

Identify a decryption scheme

I'm trying to identify a decryption scheme used by some licencing mechanism. It took me some time to realize that this was encryption and this is some kind of follow up to this other question of mine :...
Eric's user avatar
  • 439
3 votes
3 answers
6k views

Determind length of instructions in bytes

Where is it possible to find a list of x86 instructions (and x64 instructions) with the (hex) opcode and the length/size in bytes of the instructions, such as: 0x90 = NOP = 1 byte 0xE9 = JMP = 5 ...
vallentin's user avatar
  • 149
3 votes
2 answers
986 views

x86_64 Calling convention

I am slightly confused by some x86_64 linux code here (generated by llvm): # BB#0: # %entry push RBP .Ltmp21: .cfi_def_cfa_offset 16 .Ltmp22: ....
John Nemo's user avatar
1 vote
0 answers
1k views

Create key generator algorithm from validation algo

I understand that this question will be rather vague, but I'm unsure how to process from here. I'm trying to see how a key generator can be made. I have been toying with IDA and managed to ...
Eric's user avatar
  • 439
0 votes
1 answer
6k views

index of array in assembly? [duplicate]

In the following picture the line i want to mention is: mov [esp+eax*4+0Ch], edx Here eax is the index in the array. But, where is the address of the array to access? what does mean this line of ...
ReverserT's user avatar
-3 votes
1 answer
2k views

How does array indexing works at the assembly level?

Can anyone give me an example to understand how array indexing is working in assembly. For example, in C: char s[1000]; for (int = 0; i < 5; i++) { s[i] = i; } And, in x86 assembly: add ...
ReverserT's user avatar
71 votes
3 answers
15k views

What is the purpose of 'mov edi, edi'?

I see this instruction in the beginning of several Windows programs. It's copying a register to itself, so basically, this acts as a nop. What's the purpose of this instruction?
Mellowcandle's user avatar
  • 4,825
56 votes
7 answers
159k views

How to know in which language/technology program (.exe) is written?

How to understand if exe/dll is written in C++/.Net/Java or in any other language. I tried to use Dependency walker but not able to get required information.
Pranit Kothari's user avatar
42 votes
1 answer
94k views

Decompiling iPhone App

I've been searching this site and more, but I haven't had much luck. I want to decompile an app to see how part of it works, and I've tried multiple programs. I've tried Hopper, IDA, and some other ...
user94584392's user avatar
27 votes
3 answers
4k views

Why are special tools required to ascertain the differences between two related binary code files?

How comes that text diffing tools like diff, kdiff3 or even more complex ones usually fail at highlighting the differences between two disassemblies in textual form - in particular two related binary ...
0xC0000022L's user avatar
  • 10.9k
16 votes
4 answers
5k views

How to recover variables from an assembly code?

Assuming we have an assembly code, what are the known techniques that could be used to recover the variables used in the original high-level code ? Edit: By recovering variables, I do not mean ...
perror's user avatar
  • 19.1k
15 votes
1 answer
8k views

How can BIOS routines be disassemblied?

There was once a disassembler on DOS named Sourcer that can disassembly BIOS routines. However, how do we access to BIOS ROM from software to do such a thing?
Amumu's user avatar
  • 253
13 votes
2 answers
3k views

How can I find the source of a string in an old DOS game?

I am attempting to amend some strings in an old DOS game (FIFA International Soccer), specifically the names of players. In the past it hasn't been too hard to pull off such a task on post-DOS games ...
user avatar
12 votes
1 answer
11k views

Where can I find tools for reverse engineering Lua

Since Lua is an interpreted/compiled language that its own compilers and isn't usually translated/compiled with a C compiler. What tools should be used to reverse engineer an application written in ...
cb88's user avatar
  • 2,330
12 votes
3 answers
9k views

Reverse engineer an old DOS QBasic executable

I recently decided to try my hand at reverse engineer an old DOS text based game that was coded in QBasic. I found some info online about old DOS games disassembly but mostly for Wacom compiled C/C++ ...
ricardojoaoreis's user avatar
10 votes
2 answers
2k views

How to do static analysis to identify pointer from concrete value in assembly?

So basically I am writing some code to do analysis work on disassembled assembly code. I am trapped in this issue for a while, here is an simple example of a disassembled asm code by objdump, ...
lllllllllllll's user avatar
9 votes
1 answer
15k views

How to find main() in binary?

Given a binary and only using a tool like ndisasm, how can I find main()? I don't want to use smart tools like IDA Pro because I'm doing this exercise to learn.
drum's user avatar
  • 284
9 votes
1 answer
6k views

BYTE3, does it mean the third or fourth byte of an int? IDB file that's already supplied

I've got a program that i'm trying to debug a little bit by trying to make sense of a function or two, there's already some info that i've downloaded via a idb file and it's helped me get somewhere. ...
lfxgroove's user avatar
  • 369
9 votes
2 answers
11k views

How to extract functions from one executable to include/link in another

I'm wondering what are the options (aside from attempting disassembly/decompilation and reassembly/recompilation) one has when it comes to extracting a series of functions from one binary, compiled ...
Roberto Andrade's user avatar
9 votes
4 answers
55k views

Modify code with ILSpy

I want to modify an exe a little bit. With ILSpy I see all the code that I need but I don't know how to modify the code. I tried "save code" on ILSpy that exports a .cs file, but when I open the .cs ...
sivlab's user avatar
  • 91
9 votes
2 answers
3k views

C-sky CPU reverse-engineering

I am trying to RE a firmware for a TV STB, its based on a GX3201 chip which is based on C-sky CPU (CK610M I think). I am stuck in the following points : I am not able to properly identify the CPU ...
Steavebba's user avatar
  • 111