Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

2
votes
2answers
280 views

Parse Opcodes from Binary Code

I have been using the Distorm library, using the distorm_decode() function in x64 to retrieve Opcode and Operands from binary code. For example, 44 0F45 C8 is decoded to cmovne r9d,eax. I would like ...
3
votes
2answers
92 views

Hardcoded addresses in dumped PEs

I have taken a dump of a game using Explorer Suite, and while looking at some obfuscated parts of the game PE's text section in IDA, I've seen code that follows this form: mov rbp, 7FF633CE2790h jmp ...
-1
votes
1answer
60 views

Why would MSVC pass a constant “2” for an unused this parameter?

Hex-Rays decompiled (with the assistance of pdb symbols) a piece of code as such: XPerfAddIn::CFramesInfoSource::MatchEventDescriptor( (XPerfAddIn::CFramesInfoSource *)2 And by my following of the ...
0
votes
1answer
52 views

What does _PAIR_ macro do with standard handles?

I've seen this question which says __PAIR__ macro does some conditional computation. But I can not relate that with standard I/O handles. Here is the pseudocode in IDA: if ( (char *)hConout - 1 <= ...
3
votes
1answer
3k views

objdump: can't disassemble for architecture UNKNOWN!

I am trying to use objdump -d fileName on a s-rec file and it returns unknown architecture, however it recognizes fileName: file format srec I looked at objdump --help and under supported targets ...
-1
votes
1answer
151 views

What are these sub_XXX things in IDA's disassembly?

What are these things I marked in red circles on the screenshot? In this program which i tried to disassemble there are 1427 of them. Is there any other application to view it in a better way ?
0
votes
1answer
500 views

What does _mm_store_si128() actually do?

I've a binary (openend in IDA v7) that uses GUID variables to manipulate something. Whenever I see any variable with GUID data type there always be a _mm_store_si128() or _mm_storeu_si128() functions. ...
3
votes
1answer
119 views

Disassemble/decompile arbitrary JVM bytecode

I have an obfuscated java binary which does runtime code injection using java reflection like this. Object o = "a long string"; ((Method)o).invoke(params..); (If I write this in a java file, it ...
5
votes
3answers
1k views

What exactly is binary disassembly and what it produces?

The first time I heard about binary disassembly I thought that it is something what can be called as perfect decompilation tool to assembly code and I still don't understand why it is not. I thought ...
1
vote
1answer
102 views

CFF explorer quick dissassembler not showing function name like IDA pro

I can't see the _set_app_type function name in the CFF explorer , Why is that ?
0
votes
0answers
74 views

Rarun2 Multiple Input Executable

After further analysis of a binary, ran into a separate issue debugging. Have an r2pipe script successfully providing 1 input (more about r2pipe in this solved question: r2pipe won't prompt for ...
-3
votes
1answer
268 views

Identification of AES portion code in binary

I want to locate AES code portion in binary after reverse engineering. I have tried to locate manually and using plugin findcrypt2 but I was not successful. Kindly show me a direction so that I can ...
0
votes
1answer
128 views

Know which bytes are opcode and which operands in IDA

I want to extract a generic signature of a function in IDA and wanted to use just the opcodes of the instructions without its operands. Example: From the first instruction I want to know the bytes ...
1
vote
2answers
71 views

How is the IV generated from a timestamp based on this function?

Background: I am currently looking to make some diagnostic software interoperable with other software, but all communication that occurs in this software is encrypted with AES-128-CBC. A sample ...
1
vote
1answer
49 views

During compiling does the compiler add more functions to the code?

Where does these functions comes from usually ? Compiler Include files DLL ?? #include <stdio.h> int f(int a) { int b=5; char c; c = a + b; return c; } int main(int ...
4
votes
2answers
198 views

General x86 to C tips?

I'm currently trying to finish an assignment for one of my classes that requires a sequence of ten Hexadecimal numbers for it not to blow up. The task is to find these numbers and input them in the ...
-1
votes
1answer
177 views

A newbies question about CFF explorer screen

I am a bit confused about the CFF explorer quick disassembler options shown in my screen , Can somebody explain what those hex values are underneath the Opcode part ? updated the question part , ...
0
votes
1answer
176 views

Stripped elf executable with ~3000 unnamed functions

Reversing a malware sample and have identified the elf as stripped which seems to be why none of the functions are explicitly named. Also, there are no specified imports listed for some reason. Does ...
1
vote
3answers
349 views

Question relating to learning Assembly through CTF challenges

I've just started to dip into Assembly for CTF reversing challenges, and am having a great time. A loop structure in the current challenge I'm working on has me stumped, however - hoping someone can ...
-1
votes
1answer
55 views

Understanding what is represented by function pointers to a block of hex

I'm working on a disassembly project for my class where I'm trying to bypass a license check, but when I throw the executable into Binary Ninja this is what I see: And when I look at those pointers, ...
1
vote
1answer
212 views

identifying function prototype from dll

I have an exe file and a dll file. This exe file uses the dll to decode input file. This exe file is gui based and does not support command line execution. So my requirement is to create a program ...
2
votes
2answers
183 views

Can I provide bytes to Radare to be disassembled?

Let's say I want to check this guys work. He says that he is getting 8d 15 c8 90 04 08 lea 0x80490c8,%edx ba c8 90 04 08 mov $0x80490c8,%edx Is there an easy way with Radare to ...
2
votes
2answers
305 views

ASM code hook/patching with trampoline function

I am stuck on making (my little self-task for learning) that thing: Basically it should be something like Themida or VMProtect (do mutation, virtualization, etc.), but in my case, i want to take ASM ...
0
votes
2answers
1k views

gdb not opening exe file

I'm trying to open an exe with gdb but although it seems to run I'm unable to list or disas anything. The file is obfuscated, and I may be answering my own question here, with nine rays .net ...
-2
votes
2answers
321 views

How can I export only the mnemonics from objdump (or any other program)?

I want to do an analysis with the mnemonics. I can export everything to text but I only need the last column. Any idea on how can I solve this? In other words of this output of objdump (objdump -d ...
2
votes
2answers
644 views

IDA Pro - how to export a listing file in batch mode

I am using IDA Pro 6 and I'm looking for a way to automatically export an analysed file into a listing (.lst) file. The interface of IDA enables to do this action using the menu File > Produce File > ...
1
vote
0answers
110 views

How would I begin REing this proprietary model format?

Disclaimer: This is both my first post, and my first time approaching reverse engineering. Overview: Need for Speed 5 is a classic (1990 era) racing game that was extremely unique in that it featured ...
2
votes
1answer
862 views

Got `Source Code does not match bytecode` debug a Reversed Android app

Reverse an .apk file following This Article Open ApkStudio, edit AndroidManifest.xml to allow debug and Build a new Apk file Got source code with dex2jar and jd-gui Create an project in Android ...
2
votes
1answer
552 views

How does r2dec compare to pdc?

Radare has a command pdc pdc pseudo disassembler output in C-like syntax I'm curious to know how the plugin r2dec-js compares to pdc it seems like they do the same thing.
0
votes
1answer
95 views

Arm function save registers r0 and r1

I see arm 32 bits assembly code. Usually each function do push { r4-r9,lr} ( save 6 registers on stack ). And in the end of function pop them . I see function that save push {r0,r1,r4-r9,lr} but ...
0
votes
1answer
299 views

How to convert pointer and offsets to array in IDA?

Here is an example of a subroutine as pseudocode in IDA: HRESULT __stdcall func(PCWSTR name, PCWSTR command, BOOL folder, DWORD *pCode) { _OWORD *v4; __int128 v5, v12, v13; __int64 v6; ...
1
vote
1answer
63 views

Is there an IDA disassembler module for IBM 360/370/390?

Has anyone written an IDA disassembler module for IBM 360/370/390 or higher processors? Would like to examine one even though i cannot afford IDA Pro.
0
votes
2answers
565 views

Why does IDA show wrong function arguments in pseudocode?

I've open a DLL in IDA v7. In one subroutine, there is a PathAllocCombine() function. The pesudocode shows six arguments in it. But the documentations shows there are four arguments i.e. ...
0
votes
1answer
255 views

How ida choose arm Thumb/Thumb2

I load binary file to ida and choose arm cpu. How can I see if ida choose on arm/arm Thumb2 / arm Thumb? and how can I change it? Bytes translate is depend witch arm is it(arm/arm Thumb2 / arm ...
0
votes
1answer
52 views

Why IDA shows return statement in separate subroutine?

IDA shows this following code in separate subroutine. Assembly: sub_180049410 proc near jmp rax sub_180049410 endp Pseudo-Code: __int64 __usercall sub_180049410@<rax>(__int64 (*a1)(void)...
-1
votes
0answers
113 views

Analyzing functions called in a C++ function

I am looking at the assembly of a C++ program, the program itself is very simple; it outputs that it has started, tries to load the user32.dll and then outputs if it succeeded or not. Currently I ...
1
vote
2answers
2k views

How is a keygen made by reversing a software? [closed]

I know that a software is cracked by reverse engineering it and reading it's assembly code... My question is how and what do crackers look for in the assembly code? And how do they know what algorithm ...
0
votes
1answer
231 views

Radare2 create section

Radare2 has S* commands, that can show, delete, modify sections. Is it possible to create new section in executable file and save it?
1
vote
0answers
467 views

Tracing function calls in x64dbg

I'm new with x64dbg and want to know if there is any way to get the trace of a functions inside a module? I've used trace over option, but basically it just traces all the insturctions but doesn't "...
1
vote
1answer
105 views

Static Offset in PE

I am making a crackme, that get's hexadecimal values and converts it to ASCII to get the password. The problem is I use a part of code into the main function to search the opcodes from .text section ...
-1
votes
2answers
166 views

How to patch a binary file and save it? [closed]

I have an ARM executable binary file and I want to patch it at precise virtual addresses. Is there any safe (and automated) way to perform this task ? Any scripts or tools are welcome!
1
vote
2answers
347 views

How to find CLSID from CoCreateInstance in IDA?

I've find a CoCreateInstance() in IDA disassembly (after CoInitializeEx()). Here are the assembly: loc_18000499D: ; pUnkOuter xor edx, edx mov [rsp+68h+ppv], rbx ; ppv lea r9, ...
3
votes
1answer
168 views

IDA pro obfuscation instance

I have tried all the I have learned so far to figure out how to deal with this instance of obfuscation. So far I understand that an opaque predicate is present, causing an unconditional jump to one ...
1
vote
1answer
213 views

Undefined instruction in Go binary compiled for ARM

I'm reverse engineering an ARM binary written in Go, and the following code sequence occurs fairly often (from runtime.cgoIsGoPointer): BL runtime.panicindex DCD 0xF7FABCFD or, from runtime....
0
votes
3answers
751 views

Tool besides ida to get high level code

I looking another tool besides ida to get high level code from binary file.(like oda pesudocode) I know that the high level is not perfect on every tool, but I want try another tool. My code compile ...
1
vote
1answer
117 views

found easter egg (incl releasing trigger) in as code, but no clue how to fire it

I've been recently looking through decompiled AS3 code from Ubisoft's "The Settlers Online" and found an easter egg along with something that looked like trigger, but - as I have never read AS3 before,...
-1
votes
1answer
496 views

What are the unk in IDA pseudo code?

I've open wsl.exe in IDA v7. With Tab key I open pseudocode of sub_1400129F4 like this: __int64 sub_1400129F4(__int64 a1, __int64 a2, __int64 a3, __int64 a4, ...) { ...... v8 = (__int64 *)...
0
votes
2answers
660 views

Reverse Engineering 8051 firmware

I am looking to reverse engineer an 8051 firmware binary file and am not certain where to start. The firmware is for the Real RTL8188EE wireless card. It is located here: https://github.com/lwfinger/...
2
votes
2answers
260 views

IDA: call a function with different arguments

I'm reversing some software and found the function which decrypts some stuff: As you can see it has the password parameter for it which gets decrypted in this function. Function disassembly: ...
0
votes
0answers
179 views

Reversing an APK to replicate API, X-Request-Sign5

I have been reverse engineering an APK in order to create a Desktop client for an app (just for fun to improve my analytical/programming skills). I have, however, hit a snag. Most requests sent to ...