Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

4
votes
1answer
1k views

3D control-flow graphs in IDA

Is there any way to leave 2D flow chart graphs and go to 3D model? I mean something like that: Usual 2D graph: 3D graph: The only one solution I've seen is using UbiGraph + Linux on VM (to use ...
6
votes
1answer
296 views

Available tools & techniques for locating sections of interest in a binary executable

If I'm trying to figure out how a program accomplishes a certain task or how it works with an unknown data structure or format, what techniques and tools can I employ to quickly and efficiently locate ...
33
votes
3answers
8k views

How can I reverse optimized integer division/modulo by constant operations?

When compiling a division or modulo by a constant, my compiler (LLVM GCC) generates a series of instructions that I don't understand. When I compile the following minimal examples: int mod7(int x) { ...
6
votes
1answer
116 views

Which format/tool to store 'basic' informations?

It's really a productivity bottleneck when various analysis tools can't share information. What's an efficient way to store symbols+comments+structures, so that they can be easily imported into other ...
24
votes
5answers
3k views

Tools to work cooperatively on the same binary

What's a working tool/methodology to work cooperatively on the same binary (if possible in parallel), that is proven to work? I used various methods long ago to share information with others, but not ...
6
votes
1answer
753 views

Importing external libraries in Hopper scripts?

Can external libraries be used in Hopper scripts? I'd like to add PDB support to Hopper using pdbparse, but I haven't been able to get it to use external libraries. Alternatively, I suppose one could ...
17
votes
4answers
3k views

How to recover variables from an assembly code?

Assuming we have an assembly code, what are the known techniques that could be used to recover the variables used in the original high-level code ? Edit: By recovering variables, I do not mean ...
8
votes
2answers
328 views

What is a correct disassembler?

A disassembler is supposed to produce a human readable representation of the binary program. But the most well known techniques: linear sweep and recursive traversal (see this comment for more) are ...
52
votes
3answers
6k views

What is the purpose of 'mov edi, edi'?

I see this instruction in the beginning of several Windows programs. It's copying a register to itself, so basically, this acts as a nop. What's the purpose of this instruction?
10
votes
1answer
3k views

How to see what compiler made PIC ASM code?

I extracted a .hex file from a PIC16F88. For example: :020000040000FA :100000008F3083160F0570388F009B0183129F017C :1000100083169F0107309C0005108312051483127C :...
10
votes
1answer
481 views

Tracing message passing instead of a call stack

In a microkernel, much of the interesting functionality happens not with traditional function calls, but instead through message passing between separate entities. Is there a structure that OS ...
8
votes
1answer
119 views

AMD64 compiler optimizations with register manipulations

AMD64 (aka x86-64 or x64) registers can be accessed 8, 16, 32 or 64 bits at a time. When reading a disassembly listing, what register operations are not straightforward? For example, when an ...
8
votes
2answers
1k views

Identifying variable args function

How would a C variable argument function such as printf(char* format, ...) look like when disassembled? Is it always identified by calling convention, or are there more ways to identify it?
14
votes
5answers
719 views

Are there any open source test suites for testing how well a disassembler performs?

A key tool in reverse engineering is a good disassembler, so to ensure that a disassembler is performing properly, are there any good test suites available for use to test the correctness of a ...