Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

Filter by
Sorted by
Tagged with
1
vote
1answer
426 views

What algorithm does Metasm use to dissassemble binary code?

Metasm is an assembly manipulation suite written in Ruby. It does provide a quite extensive API for disassembling and extracting a CFG representation from a binary program. I would like to know what ...
4
votes
1answer
2k views

How to reverse command line arguments?

I am working on a console windows executable. So far what I figured out is that the executable checks number of command line arguments. Afterwards, it branches out depending on the number of arguments ...
6
votes
3answers
6k views

IDA Pro function stack frame view

IDA Pro displays certain buffer or padding above (at lower addresses) local variables in stack frame view. For instance: Example 1. The following screen shot of stack frame view shows 12 bytes (...
1
vote
1answer
2k views

how to convert this ASM to C

I have this function that I know its responsible for making some nice math between a 2D vector to return the highest 3D Y value at the provided 2D coordinate. I also know it takes two parameters, int ...
3
votes
1answer
345 views

What type of data structure is it?

I have the following data: .data:004305FC word_4305FC dw 1583h .data:004305FC .data:004305FE word_4305FE dw 35B6h ....
15
votes
1answer
4k views

IDA EBP variable offset

Let's take a look of how IDA displays address of local variable. For instance: MOV EAX, [EBP + var_4] As we all know as far as local variables go, they are located at lower addresses of EBP. Though,...
12
votes
2answers
12k views

How to find arrays of objects (entities, enemies) in a game I'm reversing with Cheat Engine?

I am reversing a game using Cheat Engine and OllyDBG, through this memory addresses within an FPS game are read and monitored, these addresses will contain the coordinates(xyz) of enemies. My ...
5
votes
1answer
632 views

What could this sequence of assembly instructions possibly mean?

I have recently came across the following sequence of assembly instructions. call ds:WSAStartup push ecx push edi mov ecx, 69E65AC4h mov edi, 2776452Ah pop edi pop ecx jmp ...
8
votes
1answer
10k views

How to identify function calls in IDA Pro's disassembly?

I am reverse engineering some code from which IDA has generated the following disassembly. These specific lines of code are just for illustrative purposes. Notice that the third line does not call a ...
8
votes
2answers
3k views

What to do when IDA cannot provide a function name?

For learning (and fun) I have been analyzing a text editor application using IDA Pro. While looking at the disassembly, I notice many function calls are made by explicitly calling the name of the ...
10
votes
3answers
3k views

Hooking functions in Linux and/or OSX?

I want to hook functions in a library (lib.so or lib.dylib) from another process. I know that unlike windows libraries, libraries in linux and mac still have their symbols (function names and ...
13
votes
2answers
2k views

How do you set registers as structs within a function in IDA?

For example, in the following disassembly: .text:007C6834 014 mov eax, [esi+4] .text:007C6837 014 mov dword ptr [esi], offset ??_7CAvatar@@6B@ ; const CAvatar::...
11
votes
2answers
15k views

What purpose of mov %esp,%ebp?

When execution enters a new function by performing call I do often see this code template (asm list generated by Gnu Debugger when in debugging mode): 0x00401170 push %ebp 0x00401171 mov %esp,...
10
votes
1answer
852 views

Re-run autoanalysis in Hopper?

I have loaded a raw binary (ARM firmware image) into Hopper, and manually marked the entry point as code. But now I'd like to have Hopper do auto-analysis (recursive traversal) starting from that code ...
10
votes
1answer
6k views

Where can I find tools for reverse engineering Lua

Since Lua is an interpreted/compiled language that its own compilers and isn't usually translated/compiled with a C compiler. What tools should be used to reverse engineer an application written in ...
6
votes
1answer
3k views

What does %reg:value mean in ATT assembly?

When I disassemble a function, I encounter from time to time an expression of the form %reg:value. Typically, I encounter this syntax when I activate the canaries in GCC (-fstack-protector), as in the ...
9
votes
2answers
590 views

What does the text in angle brackets refer to (From objdump)

I constantly see the text (<perror@plt+0x2008e0>) as seen in the snippet below, but I am not sure if its making a call to perror of if the disassembler was having issues. Since it would be odd ...
26
votes
2answers
3k views

Why are special tools required to ascertain the differences between two related binary code files?

How comes that text diffing tools like diff, kdiff3 or even more complex ones usually fail at highlighting the differences between two disassemblies in textual form - in particular two related binary ...
5
votes
3answers
2k views

Ripping/pasting code into an executable using Olly

I'm working with some x86 assembly code and I need to rip from one executable and paste that code into another. Originally, I had an executable that was meant to accept two command line parameters ...
7
votes
3answers
5k views

Are there any ARM disassemblers that provide structured output?

Are there any ARM (or other non-x86) disassemblers that decompose an instruction into its component parts in a machine-friendly structure? Ideally it would be something like XED or distorm3, which ...
16
votes
6answers
1k views

In what industries is [code] reverse engineering used?

While we all know what fun reverse engineering of code can be, I am wondering what legitimate industries, besides the anti-X industry, reverse engineer code? While this may sometimes be needed in many ...
11
votes
2answers
1k views

Is there a collaborative reversing forum for people that deal with firmware?

The question pretty much says it. Beyond knowing people that are interested in the same things, is there a collaborative reversing dumping ground for documenting specifically disassembly of closed ...
5
votes
3answers
1k views

Determining if a variable is local or an argument passed to a function

How can you determine if a variable is a local variable of the function or an argument passed to the function?
8
votes
2answers
915 views

Porting Linux executable from 32bit to 64bit

As you might imagine, source code is not available. The executable was written using C/C++ and compiled using gcc. This is what file has to say about the file ELF 32-bit LSB executable, Intel 80386, ...
6
votes
2answers
1k views

Are there any free or low cost disassemblers for the Renesas H8 family of processors?

IDA Pro can deal with the Renesas H8 processors, but not the free version. Are there any free or low cost (<£100) disassemblers for the Renesas H8 family or processors?
3
votes
2answers
376 views

Why is this string on the stack not exactly the one I entered? [closed]

I was trying to understand buffer overflow attacks using the following C program #include"stdio.h" #include"string.h" void iwontprint() { printf("i wont be printed!"); } void ...
11
votes
3answers
7k views

Reverse engineer an old DOS QBasic executable

I recently decided to try my hand at reverse engineer an old DOS text based game that was coded in QBasic. I found some info online about old DOS games disassembly but mostly for Wacom compiled C/C++ ...
4
votes
1answer
1k views

3D control-flow graphs in IDA

Is there any way to leave 2D flow chart graphs and go to 3D model? I mean something like that: Usual 2D graph: 3D graph: The only one solution I've seen is using UbiGraph + Linux on VM (to use ...
6
votes
1answer
298 views

Available tools & techniques for locating sections of interest in a binary executable

If I'm trying to figure out how a program accomplishes a certain task or how it works with an unknown data structure or format, what techniques and tools can I employ to quickly and efficiently locate ...
34
votes
3answers
8k views

How can I reverse optimized integer division/modulo by constant operations?

When compiling a division or modulo by a constant, my compiler (LLVM GCC) generates a series of instructions that I don't understand. When I compile the following minimal examples: int mod7(int x) { ...
6
votes
1answer
120 views

Which format/tool to store 'basic' informations?

It's really a productivity bottleneck when various analysis tools can't share information. What's an efficient way to store symbols+comments+structures, so that they can be easily imported into other ...
24
votes
5answers
3k views

Tools to work cooperatively on the same binary

What's a working tool/methodology to work cooperatively on the same binary (if possible in parallel), that is proven to work? I used various methods long ago to share information with others, but not ...
6
votes
1answer
785 views

Importing external libraries in Hopper scripts?

Can external libraries be used in Hopper scripts? I'd like to add PDB support to Hopper using pdbparse, but I haven't been able to get it to use external libraries. Alternatively, I suppose one could ...
17
votes
4answers
3k views

How to recover variables from an assembly code?

Assuming we have an assembly code, what are the known techniques that could be used to recover the variables used in the original high-level code ? Edit: By recovering variables, I do not mean ...
8
votes
2answers
336 views

What is a correct disassembler?

A disassembler is supposed to produce a human readable representation of the binary program. But the most well known techniques: linear sweep and recursive traversal (see this comment for more) are ...
53
votes
3answers
7k views

What is the purpose of 'mov edi, edi'?

I see this instruction in the beginning of several Windows programs. It's copying a register to itself, so basically, this acts as a nop. What's the purpose of this instruction?
10
votes
1answer
3k views

How to see what compiler made PIC ASM code?

I extracted a .hex file from a PIC16F88. For example: :020000040000FA :100000008F3083160F0570388F009B0183129F017C :1000100083169F0107309C0005108312051483127C :...
10
votes
1answer
508 views

Tracing message passing instead of a call stack

In a microkernel, much of the interesting functionality happens not with traditional function calls, but instead through message passing between separate entities. Is there a structure that OS ...
8
votes
1answer
123 views

AMD64 compiler optimizations with register manipulations

AMD64 (aka x86-64 or x64) registers can be accessed 8, 16, 32 or 64 bits at a time. When reading a disassembly listing, what register operations are not straightforward? For example, when an ...
8
votes
2answers
1k views

Identifying variable args function

How would a C variable argument function such as printf(char* format, ...) look like when disassembled? Is it always identified by calling convention, or are there more ways to identify it?
15
votes
5answers
771 views

Are there any open source test suites for testing how well a disassembler performs?

A key tool in reverse engineering is a good disassembler, so to ensure that a disassembler is performing properly, are there any good test suites available for use to test the correctness of a ...