Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

188 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6 votes
0 answers
872 views

Reliable way to recognize STL template classes?

Since the template classes are different between instantiation, it is extremely difficult for library recognition using universal patterns. But the control flow graph and references to system call of ...
Misty's user avatar
  • 428
6 votes
0 answers
579 views

How does my S62 engine utilize MAF sensors to convert voltage to mass flow?

We're trying to solve a puzzle on one of the automotive forums regarding how the BMW S62 engine utilizes its two MAF (mass air flow) sensors to determine the air mass flow entering the engine. This ...
Zaid's user avatar
  • 111
5 votes
0 answers
7k views

Unpack, modify and rebuild an Android App Bundles (.aab) file

I would like to unpack an .aab file, decompile/recompile the classes.dex (baksmali/smali), edit the manifest and, finally, generate a new .aab file. Basically, I am looking for an apktool for .aab
Simone Aonzo's user avatar
5 votes
0 answers
325 views

Radare2 8051 code bank switching

Some of 8051 chips use bank switching to extend accessible code memory. Good example is Silabs C8051F12x. Another example is here. Code area in range 0x0000..0x7ffff is common always accessible code ...
kimstik's user avatar
  • 159
5 votes
0 answers
1k views

I'm trying to debug small mips code snippets in IDA with QEMU as debugger, but only NOP instructions show when I start the process

I followed the tutorial IDA Help: Debugging code snippets with QEMU. It always worked with ARM code, but now I have to reverse some MIPS and only nops are displayed like this: Should I adjust ...
Attila Szasz's user avatar
4 votes
0 answers
183 views

How to assemble back a disassembled Linux kernel?

I have a Linux kernel file and I need to tweak the contents of its corresponding initramfs. I did it in the past for standard distros where kernel and initramfs were separate. However, this specific ...
Peter's user avatar
  • 141
4 votes
0 answers
954 views

Extract disassembly from Ghidra for reassembling

How can I extract a code listing from a Ghidra project such that I can reassemble with something like vasm? I have gone through a memory snapshot and disassembled the code and marked data sections etc....
Robin Elvin's user avatar
4 votes
0 answers
445 views

Legality of publishing decompiled code

The situation is the following: Binary file of a computer game from the 1980s. The binary file ran on a platform that doesn't exist anymore (not x86). The binary file does not contain any symbols or ...
trunklop's user avatar
  • 149
4 votes
1 answer
542 views

How to make IDA processor for file format with tree structure

Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on. However when it comes to tree-structured file format, I can't come up with a ...
Misty's user avatar
  • 428
3 votes
0 answers
111 views

Reverse DLL and EXE at the same time?

I started reversing a 32-bit x86 EXE that led me down the path of finding the structure and core functions I needed inside of a DLL. I'm currently using Binary Ninja 3.5 as my disassembler, decompiler,...
TyCobb's user avatar
  • 131
3 votes
0 answers
237 views

What computer components improve the speed of disassembly in IDA Pro and plugins like BinDiff?

I’m disassembling binaries in IDA Pro. It usually takes 15+ minutes just to pre-process/open one binary, Then another 20-30 min before IDA is fully done disassembling and finally becomes idle. ...
Jacob Wheeler's user avatar
3 votes
0 answers
63 views

How can I quickly tell which ARM Thumb version a particular piece of code is using?

I'm working with an ARM processor: an STM32F407VGT6 board, which IIUC powers a 32-bit Arm® Cortex®-M4. I need to inspect the binary weight of some instruction, so I used objdump like this: arm-none-...
Alessandro Bertulli's user avatar
3 votes
0 answers
424 views

Specifying struct offsets in Ghidra

I'm using Ghidra to disassemble some 68000 code. I only want to look at the disassembly listing, and I have no interest in the decompilation view. Here's one instruction I'm looking at. ...
Tom Seddon's user avatar
3 votes
0 answers
45 views

Data placement in memory

I am playing with buffer overflow attacks in C. I have the following code: int foo(void*, void*); // Calculates the distance (in bytes) between two addresses in memory int main(int argc, char**...
Stone Paul's user avatar
3 votes
0 answers
100 views

How can I manually figure out stack variable/buffer sizes from stripped x86-64 disassembly?

I am looking at the following CTF challenge: 0x56555779 <+0>: lea ecx,[esp+0x4] 0x5655577d <+4>: and esp,0xfffffff0 0x56555780 <+7>: push DWORD PTR [ecx-0x4] ...
the_endian's user avatar
  • 1,830
3 votes
0 answers
623 views

Disassembly of raw binary of AARCH64 using Ghidra not complete

I am trying to disassemble a raw binary with AARCH64:LE:64:v8A​:default (as per below mentioned specs). Architecture: aarch64 CPU op-mode(s): 32-bit, 64-bit Byte Order: Little Endian CPU(s): 8 On-...
sharma21's user avatar
3 votes
0 answers
52 views

Image decompression: Reconstructed LZW dictionary somewhat, not exactly matches original dictionary

I am attempting to reverse an animation format that uses (I think) some form of LZW for each of the frames. I have determined that a 12-bit code is used throughout the image. Here is a short target ...
Nathanael Gentry's user avatar
3 votes
0 answers
279 views

Borland C++ 3.0 - Which code might produce this strangely convoluted ASM sequence?

I'm reverse-engineering a DOS binary that was compiled with Borland C++ 3.0, and I'm trying to create C code that will produce the same assembly as the original when compiled with the same compiler. ...
lethal-guitar's user avatar
3 votes
0 answers
1k views

disassembly - bad results generated with ghidra but not with objdump and IDA

I am using Ghidra to analyze libpng-compat.1.5.10.so (downloaded from Fedora mirrors). But it didn't load the expected disassembly. Then I used Objdump and IDA to check the code and they get the same ...
xiaoyao Don's user avatar
3 votes
0 answers
934 views

How to use Ghidra to work with VM obfuscated binaries?

By "VM obfuscated binary", I mean a binary that contains one or more implementations of a VM internally, and also some bytecode that can run on this VM. One of the reasons why this binary is this way, ...
auspicious99's user avatar
3 votes
0 answers
652 views

Is there an existing tool to reverse engineer Xamarin AOTDATA files?

I am currently examining a xamarin application. It has used the "ahead of time compilation" feature, which has left some of the associated .net assemblies (.dlls) as lists of function signatures ...
MrSynAckSter's user avatar
  • 1,256
3 votes
0 answers
1k views

Reverse-engineering DOS game's data files

I would like to figure out the data format used by an old DOS game I used to play when I was a kid. That link includes a full download for all the files and it runs fine in DOSBox if you want to try ...
André Borie's user avatar
3 votes
0 answers
245 views

Comparing two UEFI applications?

I have two x86-64 UEFI applications original.efi and patched.efi. I want to find out what have been changed in patched.efi and what these changes do. I have tried to use the Radare2 framework to ...
NSwroy's user avatar
  • 39
3 votes
0 answers
166 views

Reading SCSI Command Description Block in software

I have made a hardware control interface for my vintage Yamaha CBX-D5 audio recording processor. using MIDI SysEx commands.I managed to find out most of it's inner workings. I programmed SysEx in ...
adriaanhendrik's user avatar
3 votes
0 answers
315 views

Giving labels to local variables with GDB

In the GDB debugger of Linux, is it possible to give a local variable (at specific offset from the %esp register) a constant name, which I will see everytime I call disassemble instead of seeing the ...
Reflection's user avatar
3 votes
0 answers
2k views

Analysing eCos image

I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step. This is the current uncompressed image: https://www.dropbox.com/s/...
tnas's user avatar
  • 31
3 votes
0 answers
163 views

Tools and techniques for analyzing NaCL binaries?

Are there any tools, tutorials, or resources out there for helping to make sense of NaCL binaries? They have some features that should make things easier – most crucially, fully decidable disassembly ...
Brendan Dolan-Gavitt's user avatar
3 votes
1 answer
2k views

Fixing ghidra decompilation

i am working a little bit with Ghidra. My assembly code doesn't match with the decompiled code: * FUNCTION * ...
AndiYo's user avatar
  • 49
2 votes
0 answers
136 views

Trying To Understand DOS Game Assembly Instructions

I am trying to understand assembly language instructions, for a DOS Game. I have looked at the following Link :- https://atrevida.comprenica.com/atrtut07.html reading about how VGA Graphics work in ...
Edward Winch's user avatar
2 votes
0 answers
107 views

IDA Pro Exports Table Corrupted!

I've been analyzing a dll file and naming the functions, structs, variables, and so on. A lot of information has been changed and saved, but after the following message appears, the address column of ...
short dragon's user avatar
2 votes
0 answers
38 views

Please help with striped binary reverse

Not so long ago I was engaged in reverse and pwn, I came across such a task This is a normal task with a vulnerability on the heap, but it is striped and I don’t understand where which functions are I ...
K05t1K_RWX's user avatar
2 votes
0 answers
70 views

Angr considers REP instruction as the end of a basic block

I'm developing a python script for angr that has to find all the basic blocks present in each function in a binary. I have noticed that angr splits the basic blocks when it finds a REP instruction, I'...
Luca's user avatar
  • 121
2 votes
0 answers
67 views

Calculate Function Call To Imported Function In Dumpbin Output

What is the easiest way to determine the function called in dumpbin output. No PDBs available. The disassembly: 004028E2: 8B 1D 70 42 40 00 mov ebx,dword ptr ds:[00404270h] 004028E8: 55 ...
chentiangemalc's user avatar
2 votes
0 answers
76 views

Tracing odd variant of call analysis failed

Disclaimer before I get flogged: I'm playing with a commercial app, for which I have a license, for my own education because building toy C apps has run out of challenge (and I know whats inside). ...
XeroxDucati's user avatar
2 votes
0 answers
158 views

How to decrypt data during runtime before executing and then encrypting it back

I was doing some research and came across the term protectors. From my understanding is they encrypt a file to be protected but run it without an issue. During its execution it is able to decrypt the ...
soqq's user avatar
  • 21
2 votes
0 answers
54 views

How to obtain import name from disassembled assembly

I'm trying to create my own tools for reverse engineering PE. I have some assembly codes that I fetched from a clone of objdump for a program. Sometimes I see call instructions such as : callq *...
onerom's user avatar
  • 21
2 votes
0 answers
289 views

Dumping .NET Dynamic Methods

I have a .NET exe that creates DynamicMethods whose bodies are built from a byte array and later called. I'm able to access the array, and even to disassemble it "raw" starting from the ...
Net_Newb's user avatar
2 votes
1 answer
2k views

How do I Decompile .Pyd file made with python, cython and pyinstaller 3.6

I created an app in 2018 with python and then used Cython and pyinstaller v 3.6. I am wondering how to decompile it. I have tried uncompyle6 + pyinstxtractor however this only works for python files,...
Cave Johnson123's user avatar
2 votes
0 answers
399 views

Finding the main function on Windows compiled executables

For a C/C++ program compiled on Windows using the x86 architecture, what is the best way to find the main function within disassembled code without relying on signatures such as FLIRT? I've found ...
Soyboii's user avatar
  • 41
2 votes
0 answers
83 views

jump to invalid address when emulating

I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect ...
Ayyware's user avatar
  • 41
2 votes
0 answers
114 views

Assemby reverse engineering

I'm new to assembly and need some help understanding what this program does. This program takes a username and serial. If the combination is correct, it prints the magic words. I need to write a ...
TN_stud's user avatar
  • 21
2 votes
0 answers
192 views

how to find address in memory using ADRP and ADD (ARM64) instructions?

This part of the disassembler code takes the symbol "1" from memory to change i I need to know what address is assigned to the "x1" register, but the debugger does not work for me. ...
qazwsx135's user avatar
2 votes
0 answers
58 views

How do I read/edit a .xuk file extension?

I am trying to reverse engineer a license key for some software, the company that made it went out of business. In doing so, if you didn't already have the key their $50,000 machines become ...
Xalen's user avatar
  • 21
2 votes
0 answers
178 views

What hints can x86 disassembly give as to GCC/G++ compiler version and options?

I've taken an interest to disassembling binaries and attempting to recreate 1:1 source code (logic) in C and C++ compiled with GCC. I say "logic" because this question does not pertain to ...
Matthew Tingum's user avatar
2 votes
0 answers
94 views

Force IDA to redo SP analysis?

I had a function which I was unable to decompile due to a positive SP value, I tried to change it manually but accidentaly made everything worse, is there a way to restore/make IDA redo the original ...
Alexey's user avatar
  • 69
2 votes
0 answers
1k views

Radare2 cannot open bin for writing

Im on Kali and im using Radare2 but it says r2 -d bin Killing child process 16151 due to an error Killing child process 16152 due to an error [w] Cannot open 'dbg://./bin' for writing. I tried chmod +...
JyanJohn's user avatar
2 votes
0 answers
378 views

How to change how the calculated value is shown for registers in Ghidra

I'm currently working on reversing some Sparc code in Ghidra, and calculated register values are shown incorrectly. This is how the line looks in the listing: add o3, o0=>DAT_00007d88, o0 and I ...
Tahg's user avatar
  • 21
2 votes
0 answers
224 views

How can I extract working files (in the form of graphics) from these MZP executables?

There's a 1999 PC/Mac game that I'm hoping to extract assets from. All game data appears to be stored in various files with the extension .rsc. I've been able to extract all the game's audio from the ...
lemniscate's user avatar
2 votes
0 answers
2k views

Getting value of local variable in Ghidra

I've been trying to solve a crackme challenge by examining it's decompiled version by Ghidra. So I figured the code where the strcmp is done as shown in the figure below. Now I need to to patch the ...
Nimrod's user avatar
  • 151
2 votes
0 answers
195 views

How do I disassemble mips .o object files in ida elf 64bit

So I’m trying to disassemble some object files in mips. I use IDA 7 on windows. These object files are loadable kernel modules. Mipself64 Is What ida auto sets to when they are dropped in. I’d like to ...
Peter Robertson's user avatar