Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

2
votes
3answers
328 views

What are the .cpp files in IDA disassembly [duplicate]

I opened wsl.exe in IDA Pro v7 and follow some strings. I saw some strings with .cpp extension. Can anyone explain what are those .cpp file in that disassembly? Where can I find it? Are those hidden ...
1
vote
3answers
506 views

Radare produces a bunch of `add byte [rax], al`, but why?

What does a bunch of add byte [rax], al mean? I see a lot of memory addressing point to specific parts of the shared library (.dll) that have for instance, this... 0x10064faf8 0000 ...
1
vote
1answer
161 views

Tools to translate x86-64 ELF to PPC (or i386 decompilation)

I've been working on a project on an IBM POWER8 system. I'd like to translate some very simple binaries from x86-64 to PPC. Is there a tool that can either: Translate the binary from x86-64 to PPC (...
4
votes
2answers
237 views

Disassembling Hex to assembly, then what?

I am working on a HEX string, which I figured out is a binary. I would like some pointers on what to do next after I have disassembled from hex to assembly. I'm just assuming that the architecture is ...
6
votes
1answer
445 views

How does this EB F2 x86 instruction work?

In the following code snippet, the EB F2 instruction is causing execution to jump back up to the line indicated by the arrow. How is this the case given that there is no address supplied to EB and the ...
1
vote
1answer
297 views

explain java bytecode

I saw java bytecode that need to compare to var, if they equal return true, else ..... if(var1==var2) return true; else { ...} on bytecode aload 1 aload 2 if_acmpne 6 iconst 1 ireturn I ...
-1
votes
1answer
126 views

[B symbol in java bytecode

I looking at java bytecode and understand almost everything. I saw the symbol [B on java bytecode. What does it mean?
-1
votes
1answer
876 views

How to add code to compiled java class

I have java code that is compiled to a .class file. There is a function that gets few parameters and do some action (e.g. get int x and int y and do x+y) I want to add to this .class file code that ...
0
votes
2answers
117 views

Can more than one person disassemble part of a file? [duplicate]

I am looking to outsource a disassembly project. Basically I need to add custom code to a MCP5xxx MCU and change the function of a certain part. I have identified, named and found the axis for ...
0
votes
1answer
119 views

IDA Python recognize same register

As shown in the picture below, IDA PRO (6.8) knows to recognize that al and eax are referencing the same register. Given two operands in IDA Python (i.e. by idc.GetOpnd(..)), how can I find that ...
3
votes
2answers
176 views

Appropriate function to set NTFS extended attributes: ZwSetEaFile or NtSetEaFile

I am making a program to set those attributes with C++. With IDA, I find that lxcore.sys driver uses ZwSetEaFile() and LxssManager.dll uses NtSetEaFile() function to set NTFS extended attributes. Here ...
-1
votes
0answers
165 views

Finding reference to plain text string (in executable) in IDA or ollydbg

what is the best (or: what is a way) to find the code assembly line referencing a text string that I can find in plain text in the executable? I want to debug it in IDA or ollydbg, but for the love ...
0
votes
1answer
85 views

Operand address in Capstone disassembly is not the same as in IDA/HIEW

I'm trying to disassembly x64 executable (dll) using Capstone. But operand address returned by it doesn't match disassembly from IDA/HIEW. Here is the machine code: 0x48, 0x8D, 0x0D, 0xED, 0x44, ...
-1
votes
0answers
132 views

Understanding static library symbols

I have edited my question and make it more clear by splitting in few subquestions. Why statically linked library does not have symbols on functions ? Why symbols from those libraries exists in main ...
2
votes
1answer
254 views

Disassemble CC2541 firmware (TI SensorTag)

I'm digging into a BLE product based on a CC2541 MCU (similar to the Texas Instruments SensorTag). So for experimenting we can use an official firmware: http://processors.wiki.ti.com/images/1/10/...
0
votes
1answer
149 views

Encrypted String? [closed]

(I made a topic but I was ask'd to re-made it) Hi! I have a program and when I want to decompile/dissamble it finish and when I inspect the code everywhere where should be some filenames there are .(...
1
vote
2answers
1k views

scanf return value

Looking this snippet of code I can't figure out where is stored the return value of the scanf() function. EDIT: From man page, scanf() return an int value representing the number of input items ...
5
votes
2answers
300 views

Flare-ON#3: Problem understanding some parts in the program

I was trying the flare on challenge. When trying the challenge#3 I got into some trouble and could not solve it. After looking into solutions wrote by other I now do know how the program works, but i ...
1
vote
0answers
105 views

Pointer disassembly

I'm using the Capstone engine to develop an ELF disassembler. I have implemented a linear sweep algorithm as the most basic version. My goal is to implement the recursive traversal now. Consider ...
2
votes
1answer
341 views

Strange instructions pattern (lw) in MIPS binary

I'm trying to reverse a binary and I'm having trouble understanding a pattern that keeps showing in almost half of the functions in the binary. This is how one particular function looks like: Why is ...
1
vote
0answers
169 views

Stack buffer overflow SIGSEGV help

I've been going at this for a couple of days now working through trial and error but I can't seem to pinpoint exactly why I'm still getting a SIGSEGV. Here's the stdout of me stepping through the ...
1
vote
1answer
249 views

Is it possible to completely reset a cached graph layout for a function in IDA Pro?

I'm reversing a binary dump of an older embedded target using IDA Pro 7.0. Now I have somehow managed to introduce a "pseudo graph node" that I for the love of god cannot make go away. The ...
0
votes
0answers
247 views

dumpbin /DISASM doesn't show symbol names

dumpbin /DISASM has trouble resolving function names and instead only displays addresses: 000000014016D68E: E8 1D 24 00 00 call 000000014016FAB0 000000014016D693: EB 3C jmp ...
1
vote
1answer
133 views

What does this instruction pairs mean?

I don't know if it is asked but, I couldn't find it anything despite this question. Is it because of disassembler's fault? Or if it is right, why compiler generates this code? ; int __cdecl main(int ...
-1
votes
1answer
258 views

Shells CTF segfault - wrong address

PicoCTF 2017 Shells I have a binary and source: #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/mman.h> #define AMOUNT_OF_STUFF 10 //TODO: Ask IT ...
3
votes
3answers
970 views

Exe protection by TLS callback, trying to understand the behaviour

I have an app, obfuscated by FSG protector. When i tried to unpack it, the first thign that i had is, when i start the process with the debugger/or attach debugger later, i immediatly receive ACCESS ...
2
votes
1answer
793 views

Disassemblers resolving (ELF) section names

I'm working with linux executables and was just wondering how it is that section names are resolved to addresses upon disassembly of an ELF. For example take some random disassembly output from ...
0
votes
1answer
360 views

DCD data in IDA disassmbed file

There is some DCD data in a disassembled binary using IDA as shown the image description. The binary is an ELF of ARM processor type. I want to know what are these data? Is it possible they be code ...
1
vote
2answers
400 views

how data types and variables are converted to machine code?

I know that every x86 instruction has an opcode for that, but I don't know how data types and variables are converted to machine code. So I tried to figure out. I wrote a simple C program and ...
0
votes
1answer
313 views

ARM ELF Obfuscation [closed]

Metamorphic is a technique to obfuscate a binary and change the opcode sequence and create new samples with same functionality. In my case, I have some elf binary of ARM processor type and their ...
0
votes
1answer
819 views

Unpacking firmware

I have a ROM dump firmware which must be reversed (as a task). Binwalk output: DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------...
3
votes
1answer
128 views

Why does this function calls offset move when I restart windows

Every time I restart windows it breaks the patch I've made to an executable where I've called a function from the dll user32.dll. Currently the offset for the function call resides at 0x76E3CDB4, but ...
5
votes
1answer
1k views

Disassembling VxWorks Firmware

I am trying to disassemble the firmware for the Cisco Sx300 switch as found here: https://software.cisco.com/download/release.html%3Fmdfid%3D283019611%26softwareid%3D282463181%26release%3D1.2.7.76 ...
1
vote
1answer
676 views

How can I convert a .bin file to either assembly or C?

I have a .bin file (It's a firmware belongs to a hardware (Cisco Access-Point) ). All I need to do is modifying that .bin file. As you know, .bin files aren't human readable. I need to convert it to ...
0
votes
0answers
43 views

Function Call to function not in file?

Trying to reverse engineer an ARMv7 ELF file. There seems to be a function, that populates a ptr, but, the function does not seem to be located within the file. I know the ptr is in fact populated, ...
4
votes
2answers
846 views

Is there a method for “guessing” the addresses for unknown areas in bare metal firmware binaries?

Imagine this: You have a binary for a piece of ARM firmware. You are nearly 100% it is ARM, and that it runs on the bare metal. You obtained this firmware from a manufacturers update page. However, ...
5
votes
2answers
484 views

Reversing Self-Modifying Malware

recently i got my hands on one sample that self-modifies its .text section. So, I placed a breakpoint on .text section on write operation and then continued. I found out that it zeroes out the .text ...
0
votes
1answer
294 views

Getting MobileCoreServices.framework binary in iOS11 [closed]

I'd like to try and fix some open source GitHub project that uses the allApplications from LSApplicationWorkspace call from private API which list all installed application on the device. The method ...
0
votes
1answer
180 views

Help with LDRD Instruction

According to documentation, the LDRD instruction works, as follows LDRD R8, R9, [R3, #0x20]; load r8 from a word 32 bytes above the address in R3, and load r9 from a word 36 bytes above the ...
1
vote
1answer
96 views

possible to get reference assembly address in file for special memory address?

Hello I try to learn reverse engineering, so i use from process hacker to view dynamic strings in the process's memory... (more info) i get something like this : Address Length Result --------------...
4
votes
2answers
562 views

Disassembling at a memory address

I started to use radare2 to debug a PE file because it stops working as soon as I run it. When I attach my debugger and continue execution to the point where the exception is thrown I get a memory ...
2
votes
3answers
602 views

Building a control flow graph from machine code

I want to write my own soft, that can disassemble code, and turn it into conrol flow graph. Now i know the basics of graph theory, but i don't get where i should start, do i need to basically keep the ...
6
votes
1answer
926 views

Understanding gdb output

So I was messing with gdb and came across something rather interesting. I ran the following code into gdb: int i, g = 1; for (i = 0; i < 100; i++) g++; Before execution, disas main ...
0
votes
0answers
268 views

Finding source files from dll

I've been given an Excel model who's back-end has been written in c++ and linked via a dll file. The project file directory has the following structure: model | | - excel-model.xlsb | - excel-...
-1
votes
0answers
144 views

gdb: How to determine if a function in a .so is ever used in an app

Newbie question about using gdb: I know how to set a breakpoint for a function in a .so file that is actually called from the app using the .so file. This can be done, for instance, using: b ...
0
votes
1answer
147 views

Bypass DLL by returning correct values? Or alternative technique

If this is the wrong spot for this, or is a duplicate, let me know. I'm a computer professional getting started with decompiling and reverse engineering just for fun and resume building. I have a ...
5
votes
1answer
673 views

OLLYdbg is stopping on 7000000 addresses on the ntdll and not the entry point of the application

i am solving the leena's 4th binary challenge.but the ollydbg is unable to stop at Entry point which some around 400000 or above.Application stops working and start with some around 700000 check the ...
1
vote
1answer
246 views

What does __CFSHL__ do?

unsigned __int8 v2; // cf@1 v2 = __CFSHL__(v3, 28); What does the CFSHL function mean? I can't seem to find any documentation on it.
0
votes
0answers
616 views

How to access this offset location with GDB?

I am reversing an Intel ELF64 file on Linux and encountered the following snippet which appears to be performing a stack integrity check. 0x400cbd <main+463>: mov rdi,QWORD PTR [rbp-...
1
vote
1answer
164 views

Understanding ARM64 Obj-C Prolog

I'm trying to understand the differences between the following function prologs of a number of obj-c function decompilations. I know they store variables for the caller to use when the function ...