Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

3
votes
1answer
203 views

What kind of assembly language construct is this?

I am reversing an ELF64 executable created on AMD X86-64. I encountered this line near the end of the file and am puzzled to its meaning: nop WORD PTR cs:[rax+rax*1+0x0] In this case rax contains ...
4
votes
1answer
229 views

What does adding 4.294967296e9 to a double do?

I'm reverse engineering an application which commonly adds 4.294967296e9 to a double if the number is negative. Part of the disassembly: mov eax, label_to_memory fild label_to_memory test ...
0
votes
1answer
138 views

Change URL a program sends data to

I'm pretty new to reverse engineering, and I have several times seen that programs make requests to certain websites with specific host names. I tried to use a debugger and checked for the URL it ...
0
votes
0answers
38 views

find entry for a specific symbol inside the GOT

I am currently doing some code injection. I know that we can find the start address of the GOT inside the address space of a process, but it seems that we cannot locate the entry for a specific symbol ...
2
votes
2answers
721 views

Need help disassembling Qualcomm QDSP6

Im trying to disassemble a qualcomm QDSP6 modem file. According to the ELF header, there should be 26 sections(modem.b00-b25). However after dumping the device, b.16,b.17,b.25 are missing, making the ...
4
votes
1answer
143 views

Weird looking assembly-code bunch

I am currently analysing some crackme with Olly and IDA. Initially it was packed. I managed to find the OEP (a JMP soon after POPAD and right before a bunch of nulls): 0040E978 . 53 ...
4
votes
0answers
79 views

Reconstructing Assembly Truth Map

So I recently read [1] which evaluates several disassemblers. The truth/test binaries are generated by the SPEC CPU 2006 Benchmark suite. The authors provide detailed build instructions for the ELF ...
22
votes
4answers
3k views

Knowledge about CPU hardware

Recently, I have taken the computer organization course that explains in the logic gate level how a CPU works and etc... Up until now I have been treating the CPU as a black box that runs assembly ...
0
votes
1answer
77 views

Does chrome still use NSS libraries [closed]

Is NSS Libraries still present on recent version of chrome. When I reverse Chrome using API monitor, I tend to see Netscape security service (NSS) Libraries present.
2
votes
1answer
489 views

APK Tools for Tinder 7.4.0 [closed]

I wanted to make some Tinder tools, and found some already made APIs. I would like go through the process of discovering this private API by myself, since most of the articles are a bit out of date. ...
0
votes
1answer
104 views

IDA: Two calls of a same function

I was reversing some executable and came across to this code: As I found out later, it's using function pointer to call function sub_4011C0 and that could be the reason. My question is why does ...
3
votes
2answers
578 views

What could be the purpose of XORing esp with a global variable? (stack canary protection)

I am currently looking at a function inside a Win32 executable's main module. After allocating memory on the stack (sub esp) and saving some registers on the stack, the value of esp is XORed with a ...
2
votes
2answers
160 views

PDP-11 pure executable - version 16

PDP-11 pure executable reverse engineering: Dont have access to Ida pro. Ollydbg, Immunity doesnt open it. radare2 with MIPS, a lots of errors. file: # file lightning-tp.b lightning-tp.b: PDP-...
4
votes
2answers
353 views

IDA Pro: Define local variables from non-standard powerpc stack register

I am using IDA pro 6.95 (paid version) to RE some PowerPC code. The PowerPC normally uses r1 as the stack pointer, so IDA builds the stack frame and local variables from r1. Parameters are passed in ...
1
vote
2answers
416 views

Calling a function of a game inside a function hook

How can you call a game function inside a function hook? For example, I hooked the recv function of winsock. Then, I examined a packet. This packet has the value of my current hp. I check the hp. If ...
0
votes
1answer
598 views

Disassembling Hikvision DVR firmware?

The firmware update page on Hikvision provide .dav files. I've been trying to disassemble these files, but to no success. Binwalk isn't helping here as well. This is what it outputs: Here's a link ...
2
votes
1answer
318 views

IDA PRO: Monitor variable during execution

I'm new with IDA. Say I have a variable which is created in some function and it is argument to other functions. My question is how to monitor this variable? In monitor I mean is there any way to set ...
0
votes
0answers
65 views

What is the best way to determine what part of game code determines time step?

I'd like to alter the way time step works on a game (in order for it to work at a normal game speed at different FPS values (I know it may add bugs)). I have access to the PPC assembly of it or Cheat ...
10
votes
2answers
2k views

Why does IDA add “db” statements between disassembled code

I'm trying to analyze a MS-DOS COM file that I wrote a few years ago with IDA Free 5.0, I've since renamed the segment to code_and_data and named constants and set data types correctly. However, when ...
5
votes
1answer
720 views

Reverse engineering the virtual machine based crackme

I am currently working on some crackme, that has implemented an obfuscation technique, virtualisation. The virtual machine inside this crackme is a huge switch-case block (over 130 cases in it). I ...
4
votes
1answer
543 views

ARM “add” instruction with shift

I'm trying to understand how ARM add with shift is implemented e.g. sym.imp.__libc_start_main : ...
0
votes
1answer
132 views

Finding variable reference in cpp

Let's bring example We have string 0000000000bd2906 db "CurrentKey", 0 ; DATA XREF=sub_555670+3390 And it's used here 00000000005563ae lea rsi, qword [0xbd2906] ; "CurrentKey" Disassembler ...
1
vote
1answer
1k views

Disassembling MIPS 32 version 1 binary with the Radare2 Framework

I am trying to disassemble a MIPS 32 version 1 binary with the Radare2 framework. Here is the full output of the file command: ELF 32-bit LSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically ...
3
votes
1answer
299 views

Disassembled code: Find out command-line arguments of program

Imagine a program is launched (on windows) with a few starting parameters, for example a number and a string. When disassembling the program (With PEiD for example), how can I find out the starting ...
5
votes
1answer
733 views

Radare2 doesn't display the whole function

I am using radare2, I have disassembled the function: sym.loop, it contains a switch witch has 4 cases that calls different functions. After any of the function call, the program exits the loop ...
1
vote
2answers
525 views

Understanding an if statement in assembly

I have written two simple C programs (one with an if and one without). Looking at the assembly differences there are a few lines that I can't manage to explain and was hoping to get some assistance. ...
7
votes
2answers
2k views

idapython - Get Xrefs to a stack variable

I am trying to write an IDAPython script that will return a list of references to a local stack-frame variable. However, I couldn't find any API that does so. What I am trying to achieve is a code ...
1
vote
1answer
514 views

Reverse Packet Encryption with server side checks

My problem is the packets are encrypted. And, the server checks every packet sent from the client. If the packet that the server expect does not match from what the client sent, the server will ...
1
vote
0answers
57 views

Trying to read/write an Renesas's M30626FHPGP flash memory

I need to make a little introduction: I'm a 37 years old man who is affected by multiple sclerosis. My neurologist gave me Rebif 44 (44mg) as a treatment. I started at full dose and went on for, ...
2
votes
2answers
156 views

Exports that redirects to other library

I'm writing an analog of GetProcAddress function. When looking inside the export table I see the exports like this in advapi32.dll for example: .text:4C362BAA aEventregister db 'EventRegister',0 ;...
0
votes
1answer
124 views

Can anyone help me identify and decode this string? [closed]

Below is a part of a code that I reversed with repy2exe and I want to understand what it does and especially how to decode the value in the "secret" variable: using = [ 'Mg==\n', 'MTA1\n', ...
3
votes
1answer
606 views

How to detect JNI calls from smali code?

In Android, JNI calls could be used to load native code from other sources. From the link http://bobao.360.cn/learning/detail/3765.html, the following sample code shows how a smali code would look ...
0
votes
1answer
239 views

Idenifying far call target in protected mode (x86 assembly)

I am currently analysing a regular Windows x86 executable (-> protected mode) and I came across several far call instructions in the disassembly. I know that far calls, for example, are used in WOW64 ...
1
vote
1answer
82 views

How to edit a type of sound file used with a fruit machine emulator?

I have two files that have the extension .P1 and .P2 These files are ROM sound files from a particular 'real world' fruit machine (also known as a slot machine). There is some Fruit Machine ...
1
vote
2answers
125 views

Real-time changes of executable on IDE/Assembler

I'm new on this, sorry for bad usage of terms or overextending an explanation. I'm learning code languages and the way I found to bring it to my world so I can learn it better was coding for/with ...
2
votes
2answers
259 views

Running machine code that I need to execute with arguments. How?

There is a program which I expect to run to generate a seed, but I don't know how to proceed and I am new to reversing. I have the machine code of a program which is built for x86 architecture. I ...
1
vote
1answer
179 views

How can I debug this binary (which I suspect does encryption)?

I have a snippet of binary code which performs some encryption algorithm (most likely modified RC4). I have four variables associated with the encryption (seed_key_arg [1-3] and a seed_key) and ...
3
votes
1answer
2k views

my question is what means proc near?

sub_123434 proc near mov esi, [ebp-1Ch] sub_123434 endp What means proc near? Can someone possibly explain also the whole function?
1
vote
3answers
1k views

Can apk files have protection against being debugged?

As part of a bug bounty program, I am trying to reverse engineer the bumble android mobile application via dynamic analysis. I find that if I use apktool to disassemble the apk and reassemble it again ...
0
votes
1answer
112 views

Information about packers

i was trying to search for some information about packers just to learn more about it, there is a lot of stuff out there but its hard to find something that really explain that good and clear, I would ...
5
votes
2answers
280 views

Inverse And operation

I'm trying to write a keygen to a crack me that I'm learning from and I got stuck. What happens there is pretty simple: Let's say that I entered the password: "12121212" XOR DWORD PTR DS:[ECX+EAX],...
1
vote
0answers
315 views

Is there an existing tool to reverse engineer Xamarin AOTDATA files?

I am currently examining a xamarin application. It has used the "ahead of time compilation" feature, which has left some of the associated .net assemblies (.dlls) as lists of function signatures ...
1
vote
2answers
443 views

Changing the format of IDA's Produce file -> Create ASM file

OK, so I know this is path is not recommended but it is a situation I have been forced into. I have a tool not created by me which takes the exported asm file from IDA and processes the exported ...
0
votes
1answer
99 views

How does the different types of executable packing work?

Reference to this thread: What are the different types of packers? Q1: How do packing methods like compression, protection, and encryption work, how do they differ, and which is more secure? Q2: ...
0
votes
2answers
96 views

Function Address Changes When Gets Referenced elsewhere

i have been trying to get the address of a function and use that hex number for other calculations. I have read that you cannot get the address of a function like you get the address of a variable in ...
0
votes
1answer
73 views

Changing NSUserDefaults of a mac or iOS binary executable

I have an executable of a mac or ios app. This app uses a value stored for a key in NSUserDefaults to change app's flow. It looks something like below code, If( value set in user details ) ...
1
vote
1answer
92 views

68k: Adding 0x100 to 9-bit register and doing BEQ.s - how does it make sense?

During my current project I found such code: move.w (0xFFFC0C).l, d0 | read SCSR andi.w #0x100, d0 | add 256 to d0 beq.s location | branch if LSB = 0x00 I cannot get the idea of ...
2
votes
1answer
514 views

Unknown CRC calculation

I am seeking for a CRC calculation on EEPROM content. I try to add options to my car with BOSCH ECU. MCU in this ECU is Tricore TC1793 and EEPROM content seems to be divided into blocks of 128 bytes ...
0
votes
0answers
189 views

Removing code signature from Mac binary executable using objective c

How to remove code signature from a mac binary executable using objective C. I came across this question here. It shows a way to remove code signature of mac binary executable using terminal but I'm ...
1
vote
2answers
1k views

Reverse Engineering visual basics programs

I am a beginner and I am doing a few crackme stuff, I'm pretty okay when it comes to system calls such as user32. But there is one crackme which uses msvbvm50.dll (Visual Basic) and it has weird ...