Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

3
votes
2answers
118 views

Can't find SetCooperativeLevel call in disassembled program

I am trying to make some changes to the setup program that installs the game "Emperor: Battle for Dune". If you want to look at the EXE I am working on, you can download a copy of this setup program ...
0
votes
0answers
99 views

How is DS register interpreted in x86-64 assembly instructions?

IDA disassembled an x86-64 instruction as below: 0000000000000761 lea rdx, ds:0[rax*4] What I know is, segment registers are only relevant in in segmented memory model, while in ...
0
votes
1answer
205 views

How can I make IDA understand this switch statement with a signed jump table?

I took the following C code and compiled it on Ubuntu 16.04 with GCC 5.4.0: int main() { int a = 0; for (int i = 0; i < 5; i++) { switch (i) { case 0: a = 1; break; ...
0
votes
0answers
80 views

Getting function arguments with IDA: When do function prototypes exist?

This post explains how to get function arguments using idapython. However, I read here that get_arg_addrs() requires the prototype of the called function to be present. My question: In which cases ...
1
vote
0answers
56 views

Common practices for 'hiding' a class within an Android application?

I've recently gotten into Android reverse engineering, and I've been messing around with some apps lately for education/research purposes to see how some things are done with private (mobile) APIs. ...
3
votes
2answers
272 views

How to disassemble a packed .NET executable?

I'm trying to reverse a Windows executable that shows as having been packed with ENIGMA(5.X): If I later check the class name for one of its UI elements, when the process is unpacked and running, it ...
4
votes
1answer
265 views

Reverse Engineering bios of ATM Machine

I bought an Hyosung NH1500 off Offer-up and it boots up and initializes some peripherals and then spits out and error of "COM download is failed". I've searched Google and 0 results came up, I've been ...
3
votes
0answers
49 views

int 2eh instead of syscall/sysenter [duplicate]

I have been looking into ntdll.dll on windows 10 x64 bit, and i noticed a check inside the ntdll like this: So after testing some bit, it tries to execute the system call via int 2eh. I have tried to ...
2
votes
2answers
80 views

Check if instruction is reached

I am doing a challenge for a CTF and I have to reverse an encryption scheme to find a flag. However it would be easier to just try all inputs but they are too much. There is an instruction that when ...
2
votes
1answer
133 views

Finding the main function without symbols

for a C/C++ program compiled on windows using the x86 architecture, what is the best way to find the main function within disassembled code? I've found various answers to questions similar to this, ...
-2
votes
1answer
146 views

Can someone please help me reverse engineer this assembly code to C please! [closed]

I am really bad at understanding assembly code and the way it works. I have little problems given to me in Assembly code and I have to reverse engineer it to C, but I have been doing really bad job at ...
3
votes
1answer
417 views

XCHG RAX, RAX: 0x09, what does this code do and how does it work?

Given the following short assembly snippet: shr rax, 3 adc rax, 0 I worked this out a bit: We know SHR sets the CF with the last bit shifted. We know ADC dest, 0 is just adding the CF. So ...
1
vote
0answers
111 views

Has anyone reversed Wyze cameras? [closed]

Has anyone looked at the hardware to see what processor they're using or disassembled the firmware? Wyze claims to have opensourced their firmware but their github repository seems to be mostly ...
1
vote
1answer
59 views

Reversing characters from argument of the program

Below code is from the IDA. This is the code before the parsing function: movzx eax, byte ptr [rbp+nineth_char+3] movsx eax, al mov edi, eax call sub_898 And this is the code of the ...
2
votes
1answer
81 views

How are ARMv7 assembly opcodes and operands stored in bytes?

I've been trying to analyze an ARM binary but cannot figure out how the operators and operands are stored in the bytes of a program. For example, by looking at the disassembly listing of an ARMv7 ...
1
vote
0answers
41 views

getting %localappdata% in asm

I have an old windows x86 application that no longer works properly since windows 8. This app creates files within its own folders for things like app settings. Unfortunately, Microsoft no longer ...
7
votes
1answer
132 views

Radare2 Call $+5 and register-based cross-references not found

I have a library of ~65MB which uses this "technique" as a kind of PIC. First, it gets some kind of base address (it is always the same): 0x00708497 e800000000 call 0x70849c 0x0070849c ...
1
vote
2answers
180 views

Why there are two different shellcodes for bin/sh with much different syntax and which one is better to use? (x86)

I have found two shellcodes for spawning /bin/sh which are much different from each other. The second one is hardly ever found on the net, and it mostly comes up in reverse engineering websites: 1. "\...
2
votes
1answer
301 views

Converting Assembly x64 code to C

I have the following code: 0000000000400526 <main>: 400526: 55 push rbp 400527: 48 89 e5 mov rbp,rsp 40052a: 48 83 ec 20 sub ...
3
votes
1answer
252 views

How can I convert this assembly code (x64) to C?

I have the following assembly (x64) function: 400700: sub rsp,0x18 400704: mov QWORD PTR [rsp+0x8],rdi 400709: cmp QWORD PTR [rsp+0x8],0x0 40070f: jne 400718 <bar+0x18> 400711: mov eax,0x0 ...
1
vote
1answer
116 views

Figuring out what a segment of assembly code does

I have the following assembly code: 0000000000400711 <foo>: 400711: 55 push rbp 400712: 48 89 e5 mov rbp,rsp 400715: 48 89 7d e8 ...
-1
votes
1answer
177 views

How can I decompile the CC2650 .hex file to C?

I want to decompile it to C, or at least assembly the CC2650 hex file (Bluetooth Low Energy Sensor Tag), that provide TI. My goal is to know the specific way used by CC2650 to generate the LTK. I'll ...
4
votes
1answer
216 views

Need help identifying main processor for Roland synthesizer

I desperately need help figuring out the ic chips in this unit so I can view the firmware in ida pro. So the unit is a roland gr-55 guitar synthesizer and i'm trying to disassemble the firmware into ...
1
vote
2answers
299 views

.NET assembly IDA PRO, using LDSTR IL op code, how to patch a string?

I'm trying to patch a string. So right now I'm trying to replace instruction LDSTR with LDSTR "mystring"; however, I have been unsuccessful. After assembling the LDSTR op code, I don't quite ...
3
votes
2answers
309 views

Move twice, from and to the same location

I'm trying to reverse a function and I came across these lines inside the function: 1. call ds:HeapAlloc 2. mov [ebp+var_4], eax 3. mov eax, [ebp+var_4] Why is line 3 needed? If I need to ...
3
votes
2answers
201 views

replacing static value with variable

I'm trying to replace a static value: MOV DWORD PTR SS:[EBP-30],4c With a value from a specific address: MOV DWORD PTR SS:[EBP-30],400400 // MOV DWORD PTR SS:[EBP-30],OFFSET 400400 But SS:[EBP-30] ...
1
vote
2answers
209 views

Getting opcode Length , How to

I am apparently not very good with assembly as I am novice to somethings! Hence i wanted to make a question again. Now i got this from here to make something like a LDE (Length Disassembly Engine) ...
4
votes
4answers
1k views

Calculation of jmp address through subtraction

I don't get why the two addresses of the functions are subtracted in order to get the jump destination. mov eax, [ebp+func1] sub eax, [ebp+func2] sub eax, 5 mov [ebp+var_4], eax Which ...
0
votes
2answers
718 views

Can't find the password anywhere in the binary

This is my first post here. I was recently involved in a capture the flag preparation test which involved decompiling an ELF 32-bit LSB executable, Intel 80386 file for Linux compiled with GCC. The ...
0
votes
1answer
219 views

What is the password to this file? I can't figure it out with radare2 or gdb

Here is the binary file. https://drive.google.com/file/d/1ywN60yZYIhPPRyZMGbQudZRYoLYBhkeJ/view?usp=sharing I am able to figure out some of the assembly, but can't get the correct password. I know ...
1
vote
1answer
494 views

How detect version of VMProtect

I have a binary with VMProtect. Some tools giving info that this is 2.x, some that 3.x. How I could check it? Thanks.
3
votes
1answer
142 views

Disassembly - Why the CMP instruction is multiplying by 2 the value being compared

I'll get right to the point, I have a crack me program, that is a program with a password inside that needs to be found so that you can complete the challenge. I easily found the cmp instruction ...
2
votes
1answer
82 views

Remove Binary from IDA Database

I saw the File -> Load File -> Additional Binary File option and tried it out. Now I want my original IDA database back (with just one binary), but can't afford to lose the comments I have saved ...
4
votes
2answers
153 views

Prevent game from pausing on lost focus (Fallout New Vegas)

I am trying to modify a game (Fallout New Vegas) to not show a pause menu when the window loses focus. I thought of two approaches: Find the code that is called when focus changes and nop the call ...
8
votes
2answers
191 views

How did this 80286 detection code work?

I'm poking through a disassembled 16-bit DOS game circa 1992. The original system requirements state that the game needs an IBM AT-compatible machine or later, with the 286 processor, to run. And ...
2
votes
3answers
97 views

What is _bittest macro?

Here is an example of the bt instruction in a X64 Windows binary: bt eax, 18h jnb short loc_a lea rcx, String call cs:__imp_wprintf mov eax, [rbx+40h] In pseudocode: if ( ...
6
votes
4answers
5k views

Purpose of test eax,eax after a strcmp

This is my first program i am trying to reverse and my intro to this field. The C program will test if two strings match, and it will printf() a message for each occasion. This is what the reversed ...
1
vote
3answers
117 views

How to identify the purpose behind a bitmask?

The bitmask is used to manipulate the value of the integer variable. From debugging, I guessed that the bitwise operation generates nearest even integer. Here is the assembly: mov r8d, 0FFFFFFF8h ...
2
votes
1answer
86 views

Why do we need to know the address of shellcode?

I have read many articles regarding the buffer overflow exploit. Everywhere its written as follow. "It's difficult to know the starting address of the shellcode" Why do we need to know the address ...
2
votes
1answer
200 views

What does this magic number do? [duplicate]

I've opened a 64 bit DLL file in IDA. One function has this pseudocode: unsigned __int64 output; ULONG input; output = (unsigned __int64)(input * (unsigned __int128)0xE38E38E38E38E38Fui64 >> 64)...
1
vote
0answers
130 views

Trying to identify block of code which generates 256 bit key

I'm reversing a C++ program using IDA PRO to examine how the some data is stored, encrypted and decrypted. I've managed to identify the data is encrypted with AES CBC 16 block and 256 bit key. I have ...
5
votes
1answer
66 views

Passing a (string) argument via the return address?

I'm debugging an old PC BIOS and it has most of its constant strings interspersed directly with the code, like this: As the comment notes, the function putsc will take the string as its argument, ...
2
votes
1answer
87 views

Why are these 0-byte jumps used as a delay?

I'm debugging an old PC BIOS and see a lot of what I assume are delay sequences, using 0-byte jump instructions (EB 00 = jmp short $+2). Why this particular instruction? I'm guessing it must have ...
0
votes
2answers
220 views

How to interpret disassembled MIPS code?

I have disassembled MIPS binary with raw opcodes. How to interpret, for example, these lines: Disassembly of section .data: 00000000 <.data>: ... ... f864: 30a5ffff sd ra,-23248(...
2
votes
0answers
106 views

Show parameters stored in stack with __fastcall in IDA

This is an extension of my previous question. Here is a sample of assembly in x64 Windows executable using COM virtual function with __fastcall convention. mov [rsp+32], rdx ...
1
vote
1answer
95 views

Data moved after program rebase

Consider the following piece of code: .text:00F74B42 call sub_12D1130 .text:00F74B47 mov eax, dword_15A0C80 Now, I want to add a sanity check but as I don't have enough space to do that I ...
1
vote
1answer
165 views

Reversing video protocol for chinese drone so i can view the stream outside of the app

I am trying to view the video stream of the vento protocol air drone on my computer. The final goal is to get the video stream into python or c++ for opencv; however, if i can just view it in a ...
3
votes
2answers
102 views

IDA function never called and only cross-referenced as data

When I press the X key (list x-refs) on a function (sub_xyz) to see which functions call it, I only saw dd offset sub_xyz twice, with no call sub_xyz instructions. There is no another place that ...
3
votes
2answers
396 views

Reverse Engineering Challenge 2 from challenges.re

I am trying to solve reverse engineering problem(s) from https://challenges.re/2/ - this is challenge 2 and the target is to get the highest possible level of understanding what the code does. <f&...
0
votes
1answer
81 views

What are zero terminated strings below vftable in RTTI?

I am reversing a class, which has RTTI information. It has 2 virtual functions in its vftable, and in IDA Pro I can see some kind of zero terminated strings below the last vfunction. Here's how it ...