Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

Filter by
Sorted by
Tagged with
92 votes
9 answers
310k views

How do I reverse-engineer .so files found in Android APKs?

I know how to reverse-engineer normal Android APKs using tools like apktool and dex2jar, but I don't know how to work with obfuscation. When I extract everything from APK, I get some Smali files (I ...
Pervy Sage's user avatar
  • 1,195
71 votes
3 answers
14k views

What is the purpose of 'mov edi, edi'?

I see this instruction in the beginning of several Windows programs. It's copying a register to itself, so basically, this acts as a nop. What's the purpose of this instruction?
Mellowcandle's user avatar
  • 4,795
56 votes
7 answers
157k views

How to know in which language/technology program (.exe) is written?

How to understand if exe/dll is written in C++/.Net/Java or in any other language. I tried to use Dependency walker but not able to get required information.
Pranit Kothari's user avatar
42 votes
1 answer
93k views

Decompiling iPhone App

I've been searching this site and more, but I haven't had much luck. I want to decompile an app to see how part of it works, and I've tried multiple programs. I've tried Hopper, IDA, and some other ...
user94584392's user avatar
39 votes
8 answers
7k views

What are the targets of professional reverse software engineering?

At the professional level, for what purpose is reverse software engineering used? What software is targeted and why? For reasonably complex compiled code that's doing something novel, making ...
Praxeolitic's user avatar
37 votes
3 answers
12k views

How can I reverse optimized integer division/modulo by constant operations?

When compiling a division or modulo by a constant, my compiler (LLVM GCC) generates a series of instructions that I don't understand. When I compile the following minimal examples: int mod7(int x) { ...
Dougall's user avatar
  • 1,789
32 votes
5 answers
5k views

Why is disassembly not an exact science?

Newbie here. From Wikipedia Disassembly is not an exact science: on CISC platforms with variable-width instructions, or in the presence of self-modifying code, it is possible for a single ...
Einar's user avatar
  • 421
32 votes
5 answers
11k views

Why there are not any disassemblers that can generate re-assemblable asm code?

I am struggling on this problem for around three months: How to use disassemblers (IDA Pro and others...) to generate re-assemblable asm code and assemble it back My experience is that: There is NO ...
lllllllllllll's user avatar
30 votes
1 answer
56k views

What does mov qword ptr ds:[rax+18], r8 mean?

mov qword ptr ds:[rax+18], r8 In the above code, where are we copying the value of r8 register into? I know that ds means data segment which is a segment in memory, but what does exactly [rax+18] ...
FreeMind's user avatar
  • 629
27 votes
3 answers
4k views

Why are special tools required to ascertain the differences between two related binary code files?

How comes that text diffing tools like diff, kdiff3 or even more complex ones usually fail at highlighting the differences between two disassemblies in textual form - in particular two related binary ...
0xC0000022L's user avatar
  • 10.9k
27 votes
6 answers
3k views

Tools to work cooperatively on the same binary

What's a working tool/methodology to work cooperatively on the same binary (if possible in parallel), that is proven to work? I used various methods long ago to share information with others, but not ...
Ange's user avatar
  • 6,694
24 votes
1 answer
59k views

Objdump - How to output text (eg ASCII strings) alongside assembly code?

Aim: I want to take hex and ascii data (derived from a binary file using xxd) and use Objdump (or a suitable other tool that Linux comes with) to output the memory addresses / offsets, assembly code, ...
unseen_rider's user avatar
23 votes
4 answers
4k views

Knowledge about CPU hardware

Recently, I have taken the computer organization course that explains in the logic gate level how a CPU works and etc... Up until now I have been treating the CPU as a black box that runs assembly ...
user4906231's user avatar
23 votes
5 answers
10k views

What tools exist for excavating data structures from flat binary files?

Problem Statement I have a file composed entirely of data structures; I've been trying to find a tool that will enable me to open this file, and declare (perhaps) a type and offset such that i may ...
gal's user avatar
  • 335
18 votes
6 answers
2k views

In what industries is [code] reverse engineering used?

While we all know what fun reverse engineering of code can be, I am wondering what legitimate industries, besides the anti-X industry, reverse engineer code? While this may sometimes be needed in many ...
dyasta's user avatar
  • 4,188
18 votes
4 answers
177k views

Converting assembly code to c

I have the following assembly code over Linux distro: # using the .data section for write permission # instead of .text section .section .data .globl _start _start: # displaying some characters ...
MLSC's user avatar
  • 331
18 votes
3 answers
5k views

What are nullsub_ functions in IDA?

In nearly every dis-assembly created by IDA, there are several functions that are marked nullsub_ which according to IDA, return null nothing (just ret instruction). So, what are those and why are ...
PhoeniX's user avatar
  • 3,022
18 votes
3 answers
15k views

Which IDA Pro Signature should be used for Borland Delphi 6.0-7.0 binaries as reported in PEiD?

I am currently reverse engineering a binary written in Borland Delphi 6.0-7.0 as reported by PEiD. Is there a recommended signature to use when looking at this binary in IDA Pro? I currently am using ...
b_r0g's user avatar
  • 191
18 votes
1 answer
30k views

How to re-analyse a function in IDA Pro?

I am working on an obfuscated binary. IDA did pretty good job distinguishing code from junk. However, I had started messing around with a function changing from code to data and vice versa and ...
PSS's user avatar
  • 3,088
18 votes
2 answers
5k views

In which language is the BIOS written?

As I understand, the BIOS code/bitstream that held in the ROM should be generic (work alongside with multiple CPU types or ISAs). In addition, I saw mentions in the web that claim to have the ...
Reflection's user avatar
17 votes
2 answers
23k views

What purpose of mov %esp,%ebp?

When execution enters a new function by performing call I do often see this code template (asm list generated by Gnu Debugger when in debugging mode): 0x00401170 push %ebp 0x00401171 mov %esp,...
PaulD's user avatar
  • 433
17 votes
1 answer
5k views

COM interface methods

I'm reversing malware and it uses COM, which I evidently don't know. My question is how to find out what method is called using ppv (and objectstublessclient?) push offset ppv ; Address of ...
astrophonic's user avatar
16 votes
5 answers
1k views

Are there any open source test suites for testing how well a disassembler performs?

A key tool in reverse engineering is a good disassembler, so to ensure that a disassembler is performing properly, are there any good test suites available for use to test the correctness of a ...
WilliamKF's user avatar
  • 927
16 votes
4 answers
4k views

Open-Source library for Complete Binary Disassembly

One of the major hurdles of x86 disassembly is separating code from data. All available open-source disassembly library only perform a straight line disassembly (starts from the top and skips errors ...
3asm_'s user avatar
  • 506
16 votes
4 answers
5k views

How to recover variables from an assembly code?

Assuming we have an assembly code, what are the known techniques that could be used to recover the variables used in the original high-level code ? Edit: By recovering variables, I do not mean ...
perror's user avatar
  • 19k
16 votes
1 answer
6k views

IDA EBP variable offset

Let's take a look of how IDA displays address of local variable. For instance: MOV EAX, [EBP + var_4] As we all know as far as local variables go, they are located at lower addresses of EBP. Though,...
PSS's user avatar
  • 3,088
16 votes
2 answers
2k views

Is there an actively maintained collaboration plugin for IDA?

There are many IDA Pro plugins that assist with collaboration, but are any actively maintained and known to work with the latest version of IDA (version 6.9)? These are the tools that I'm aware of, ...
Reverser's user avatar
  • 179
15 votes
4 answers
35k views

Purpose of test eax,eax after a strcmp

This is my first program i am trying to reverse and my intro to this field. The C program will test if two strings match, and it will printf() a message for each occasion. This is what the reversed ...
user1584421's user avatar
15 votes
1 answer
8k views

How can BIOS routines be disassemblied?

There was once a disassembler on DOS named Sourcer that can disassembly BIOS routines. However, how do we access to BIOS ROM from software to do such a thing?
Amumu's user avatar
  • 253
14 votes
2 answers
2k views

How do you set registers as structs within a function in IDA?

For example, in the following disassembly: .text:007C6834 014 mov eax, [esi+4] .text:007C6837 014 mov dword ptr [esi], offset ??_7CAvatar@@6B@ ; const CAvatar::...
Avery3R's user avatar
  • 1,248
14 votes
1 answer
30k views

Looking for exported symbols in a DLL with objdump?

I am a man full of contradictions, I am using Unix and, yet, I want to analyze a Microsoft Windows DLL. Usually, when looking for symbols in a dynamic or static library in the ELF World, one can ...
perror's user avatar
  • 19k
13 votes
2 answers
3k views

How can I find the source of a string in an old DOS game?

I am attempting to amend some strings in an old DOS game (FIFA International Soccer), specifically the names of players. In the past it hasn't been too hard to pull off such a task on post-DOS games ...
user avatar
13 votes
1 answer
3k views

Extracting strings from Go binaries

Is there an easy way to extract all of the strings from Go binaries that will work cross architecture? The problem with Go is that strings are stored without a null terminator, so you can't use the &...
Drxxd's user avatar
  • 231
12 votes
5 answers
3k views

Artifacts similar to "@YAXPAX@" within memory and IDA sessions

When reversing binaries and parsing memory, I often run across strings like "@YAXPAX@" used to reference procedures. Is there a name for this type of convention? I believe theses strings are symbol ...
rekav0k's user avatar
  • 123
12 votes
2 answers
14k views

Why I can not directly get the content of `.bss` section?

Test is on Linux 32bit. I use this command to get the context of .text .rodata and .data section: objdump -s -j .text elf_binary objdump -s -j .rodata elf_binary objdump -s -j .data elf_binary But ...
lllllllllllll's user avatar
12 votes
3 answers
2k views

Why is JMP used with CALL?

I am trying to analyze an old malware sample in OllyDbg. It has instruction of the format CALL <JMP.&KERNEL32.SetUnhandledExceptionFilter> I am not an expert in Assembly. I know that CALL ...
TheRookierLearner's user avatar
12 votes
3 answers
4k views

Hooking functions in Linux and/or OSX?

I want to hook functions in a library (lib.so or lib.dylib) from another process. I know that unlike windows libraries, libraries in Linux and Mac still have their symbols (function names and ...
TerryW's user avatar
  • 121
12 votes
3 answers
9k views

Reverse engineer an old DOS QBasic executable

I recently decided to try my hand at reverse engineer an old DOS text based game that was coded in QBasic. I found some info online about old DOS games disassembly but mostly for Wacom compiled C/C++ ...
ricardojoaoreis's user avatar
12 votes
2 answers
16k views

How to find arrays of objects (entities, enemies) in a game I'm reversing with Cheat Engine?

I am reversing a game using Cheat Engine and OllyDBG, through this memory addresses within an FPS game are read and monitored, these addresses will contain the coordinates(xyz) of enemies. My ...
Daniel Filipe's user avatar
12 votes
2 answers
3k views

Encrypted Mach-o binary cannot be disassembled/traced with GDB

I'm trying to analyze an encrypted Mach-O binary (non-iPhone one), and I am observing the following strange behaviors: when I load this binary into GDB and try to disassemble the code at the address ...
user1815381's user avatar
12 votes
3 answers
2k views

Why is there in a nop in the while loop

So I have the following C code I wrote: #include <stdio.h> int main() { int i = 1; while(i) { printf("in loop\n"); i++; if(i == 10) { break; ...
Sindre Smistad's user avatar
12 votes
3 answers
15k views

How to detect thumb mode in ARM disassembly?

I try to build a small disassembler for ARM, and I would like to know how do objdump manage to sort out the normal mode instructions (32-bits instruction wide) from the thumb mode instructions (16-...
perror's user avatar
  • 19k
12 votes
1 answer
3k views

Delphi Pascal Try..Except..Finally block

I'm having trouble reverse-engineering a specific Delphi Pascal .exe (old vsn., pre-1995 so probably v.3). From the system calls I understand this is probably a try..except..finally block, but I am at ...
Jongware's user avatar
  • 2,364
12 votes
1 answer
11k views

Where can I find tools for reverse engineering Lua

Since Lua is an interpreted/compiled language that its own compilers and isn't usually translated/compiled with a C compiler. What tools should be used to reverse engineer an application written in ...
cb88's user avatar
  • 2,320
12 votes
1 answer
6k views

What makes CDMs such as Widevine hard to reverse engineer?

According to this PDF, Widevine has three security levels. The least secure one, and the one used by Chrome on desktops is level 3 in which all decryption is done outside of a Trusted Execution ...
abcd's user avatar
  • 121
11 votes
2 answers
1k views

Is there a collaborative reversing forum for people that deal with firmware?

The question pretty much says it. Beyond knowing people that are interested in the same things, is there a collaborative reversing dumping ground for documenting specifically disassembly of closed ...
RobotHumans's user avatar
11 votes
2 answers
5k views

What to do when IDA cannot provide a function name?

For learning (and fun) I have been analyzing a text editor application using IDA Pro. While looking at the disassembly, I notice many function calls are made by explicitly calling the name of the ...
clark's user avatar
  • 215
11 votes
3 answers
9k views

Are there any ARM disassemblers that provide structured output?

Are there any ARM (or other non-x86) disassemblers that decompose an instruction into its component parts in a machine-friendly structure? Ideally it would be something like XED or distorm3, which ...
Brendan Dolan-Gavitt's user avatar
11 votes
1 answer
13k views

What is the difference between step into and step over when debugging?

I am using EDB and stepping through the program but I do not even know what the difference in behavior is when doing this. I feel like this is something I should know if I ever have hope of reverse ...
user avatar
11 votes
1 answer
662 views

Tracing message passing instead of a call stack

In a microkernel, much of the interesting functionality happens not with traditional function calls, but instead through message passing between separate entities. Is there a structure that OS ...
Daniel W. Steinbrook's user avatar

1
2 3 4 5
26