Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

Filter by
Sorted by
Tagged with
1
vote
1answer
61 views

What's purpose of mov ebx, [esp+0]?

I'm disassembling one SO library for fun and was wondering what's purpose of following procedure: sub_3699 proc near mov ebx, [esp+0] retn sub_3699 endp It's widely used across entire library ...
0
votes
0answers
37 views

Why would compiler emit a null pointer assignment

I have been reversing a popular Windows application and ended up in a very interesting place while debugging. What I can clearly see as valid x86 instructions that eventually lead to some sort of &...
0
votes
1answer
33 views

x64dbg Crash on Dynamic Debugging Remove Anti-Debugging Protection

I am trying to run Dynamic code analysis using x64dbg for Windows 64 bit executable. I install the anti-debugging plugin for x64dbg from https://github.com/x64dbg/ScyllaHide. I still find the ...
0
votes
1answer
53 views

Reading from buffer and printing output to a text file

00001f10 2846 mov r0, r5 00001f12 6349 ldr r1, [pc, #0x18c] {data_20a0} 00001f14 7944 add r1, pc {data_ce5e, "OK:%16[^:]:%16[^:]:%d:%d:%d:%d:%…"} ...
0
votes
0answers
67 views

Starting out with reverse engineering. What assembly is disassembled code

I am new to reverse engineering and want to analyze my own exe/dll files. I took a look at nasm and masm and so far I have the feeling that this is unnecessary for me to learn in detail because it ...
1
vote
1answer
81 views

Code caves in arm assembly

In a disassembled elf binary i found these arm thumb instructions: function0 0x002cc3a8 8079 ldrb r0, [r0, #6] 0x002cc3aa 7047 bx lr In the codecave these were the initial hex ...
0
votes
2answers
99 views

Correct target of absolute jmp in IDA

In the firmware I am reversing (for a 16-bit MCU), there is code that copies the code of a function from flash memory to RAM, then jumps to it for execution: F000:FEFF : mmap'ed location of function ...
1
vote
1answer
165 views

jmp $+5, why the jump

I am looking at some code that has jmp $+5 instruction at the beginning of the entry code in a library, right after pushing registers to the stack. I understand that jmp $+5 puts IP at the next ...
0
votes
1answer
76 views

Translate ASM code x86 32 bits in C

I have a exercise which i can't resolve it, and i need help. If anyone can help me it would be great. I have the next ASM code in x86 32 bits which i need to translate in C language: Dump of assembler ...
1
vote
0answers
290 views

How to reverse engineer Electron V8 Snapshot Data Blobs?

Electron apps nowadays seem to have a snapshot_blob.bin and a v8_context_snapshot.bin. I am having a hard time trying to find specification of this file type. It doesn't match with .wasm. Files may be ...
1
vote
1answer
53 views

How to insert arm instructions into a function in a native library?

I am new and am still learning assembly languuage. In a native android app library that has been disassembled i found this function which had 1 instruction. addres hex arm instruction ...
-1
votes
0answers
38 views

Finding registry keys/values using IDA PRO

It's been a while since I've started optimizing my Windows 10 and the great way how to do it, is by using IDA PRO by looking for "strings" from .sys or .dll files. Problem is, that I need to ...
3
votes
1answer
143 views

Review a collection of executable binaries to determine similarity

I have a collection of different binaries I want to review for code similarity and classification, but I would rather not have to open each of them in IDA and manually review the code in 15 different ...
0
votes
2answers
58 views

Ollydbg - bytes in memory different than on disk

I have been analyzing an application and I'm getting confused about something. When I open an executable with OllyDbg, it shows 0xAA byte. The same executable opened with CFF explorer at the same ...
2
votes
1answer
53 views

When would a program normally transfer data between memory and coprocessor?

In the analysis of an ARM binary, when would one normally encounter transfer operations between memory and a coprocessor? These are encoded as the LDC and STC operators. Would it be common for ...
0
votes
1answer
32 views

ARM floating point register S0 used without initialization

The following code snippet is the first few assembly instructions of a function. The code runs on armv8a. SUB SP, SP, #0x170 is the first assembly instruction of the function. Please note the ...
2
votes
1answer
120 views

Finding AES Key in binary using Ghidra and FindCrypt

I would like to learn more about RE. I wrote a simple program on a STM32F107 which does nothing else than encrypting and decrypting a text once using AES128-ECB. Here is the C code (I intentionally ...
0
votes
0answers
49 views

Is it possible to detect that a function has been called from a loop? - Radare-2

is it possible to detect a function is calling from inside a loop in Radare-2. for (i = 0; i<n; i++) foo() foo() ==> 0x00402f90 // starting address Thanks
2
votes
2answers
82 views

Changing value of parameter with gdb

I have a file named exploit.c inside which: #include <stdbool.h> #include <stdio.h> const char y1 = 'a'; const char y2 = 'b'; const char y3 = 'x'; const char y4 = 'y'; const char y5 = 'i';...
1
vote
0answers
75 views

Pascal string representation in Hex-Rays Decompiler of IDA Pro

I'm trying to prettify a representation of Pascal-string "Could not access file "" in Hex-Rays decompiler's output. As you can see below, now its type is char[25] due to inclusion of ...
1
vote
0answers
53 views

Radare2 cannot open bin for writing

Im on Kali and im using Radare2 but it says r2 -d bin Killing child process 16151 due to an error Killing child process 16152 due to an error [w] Cannot open 'dbg://./bin' for writing. I tried chmod +...
2
votes
1answer
289 views

How to make IDA processor for file format with tree structure

Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on. However when it comes to tree-structured file format, I can't come up with a ...
1
vote
1answer
89 views

How use signature pattern for hooking

I like to replace the static function address: AddressOfHookSoundFunction = (DWORD)GetModuleHandleA("myfile.exe") + 0x0F3B65; // good: 4406117 (integer) using signature pattern: SigScan ...
0
votes
0answers
50 views

Ghidra - search for library usage?

Using Ghidra: if library A imports library B, is there a way to search for all function calls from A into B? And more specifically: if B exports function foo, how can I find where that specific ...
0
votes
1answer
185 views

Crackme assistance - change input of a function

Just as a preface, this is a crackme from https://hack.ainfosec.com/. I know you can submit these as part of a job app, I have no intentions of doing that. Very happy to have a job in a related, but ...
1
vote
3answers
5k views

Use GCC and objdump to disassemble any hex to assembly code

What would be the best way (also fewer steps) to generate assembly code for a given hex code ? For e.g., if we know the architecture is x86, and given hex value 0x55, what is the best way to generate ...
2
votes
1answer
146 views

What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump

I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array. First 6 headers are shown below from readelf Program Headers: Type Offset ...
0
votes
2answers
90 views

How to identify method order in disassembled C++ object

Here are some chunks: v13 = cocos2d::FileUtils::getInstance(v9); (*(void (__fastcall **)(char *))(*(_DWORD *)v13 + 64))(&v46); v19 = cocos2d::FileUtils::getInstance(fileHandle); v21 = *(...
3
votes
1answer
182 views

Reconstructing Assembly Truth Map

So I recently read [1] which evaluates several disassemblers. The truth/test binaries are generated by the SPEC CPU 2006 Benchmark suite. The authors provide detailed build instructions for the ELF ...
0
votes
1answer
19 views

How to convert string to a variable in IDA

I have the following string "CreatePipe" and I want to convert it to a variable so I can use x to find all its references: How can I do it? I am not sure what to choose here:
0
votes
0answers
16 views

Is there any way to find whether a software uses hasp api or hasp envelope?

Is there any method to know whether a software uses hasp envelope or api?
9
votes
0answers
623 views

Extracting strings from Go binaries

Is there an easy way to extract all of the strings from Go binaries that will work cross architecture? The problem with Go is that strings are stored without a null terminator, so you can't use the &...
1
vote
0answers
60 views

How to change how the calculated value is shown for registers in Ghidra

I'm currently working on reversing some Sparc code in Ghidra, and calculated register values are shown incorrectly. This is how the line looks in the listing: add o3, o0=>DAT_00007d88, o0 and I ...
0
votes
1answer
110 views

Why the disassembled code in IDA is different from in xcode? And How to solve unk_xxxx in IDA View?

I have built an executable file (the architecture is ARMv7, the base SDK is iOS), which depended on an xxx.a file in xcode; I don't have the source code of thexxx.a. I want to check some logic in `xx. ...
0
votes
2answers
56 views

Format of data in the .code/.text section

I'm attempting to dissect/disassemble a windows PE file under Linux using objdump. On surface analysis, the .code section was disassembled to : tmp.exe: file format pei-i386 Disassembly of ...
1
vote
1answer
272 views

Adding a static variable to Windows DLL

I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls. I ...
0
votes
0answers
32 views

How can I find out where relocated functions are in a Win16 executable in SoftICE?

Backstory: I'm poking through SimTower for Windows to discover the actual logic for how it decides how much alternative background is used for the SimTower lobby floors (the ones with the green ...
0
votes
0answers
66 views

radare2: Print strings in function for 32-bit binaries

I want to see the strings that are printed by the puts() function in the output of radare2's pdf, but it doesn't work. I have a similar problem as mentioned here, but I think it's somehow related to ...
0
votes
0answers
52 views

Ghidra: Identify and display a struct broken into multiple smaller fields

Me vs the 90s game, part two. I'm trying to figure out how the game detects the current date, since that part doesn't work correctly anymore. At some point, GetLocalTime() from kernel32.dll gets ...
1
vote
1answer
138 views

I'm having trouble understanding this specific notation in Ghidra

I'm reversing a code construct I created to learn Ghidra, and it looks different to what it is in GDB. I was wondering if anyone could clarify what the highlighted LEA instruction means: [I don't know ...
1
vote
1answer
203 views

How to find DOS Header and PE Header with an entry point in Radare2?

I am currently doing byte extraction from PE files using Radare2. I know how to find the byte sequence for DOS Header and PE Header when there is no entry point and the start is defaulted to 0x0. But ...
5
votes
1answer
182 views

Would hiring a RE service be worth it?

Before I clarify my question, I will explain the project I'm working on, and what I've done so far so there will be a better understanding of what I'm trying to do. I'm trying to modify the UI of a ...
0
votes
0answers
31 views

Indirect calls using registers (IDA)

I need some help. Using IDA for disasembling an executable PE file. It has several indirect calls using registers like call eax. Trying to add breakpoints and get the content of the registers, but ...
1
vote
1answer
111 views

How to jump to a new empty memory that related to the program to write another code there?

I have a line of code like that ex:MOV EAX, 100, I want to write a little bigger code instead of that code but I can't, so I want to write a jump instruction ex:jmp 0x123456 that jumps to another ...
16
votes
2answers
2k views

Is there an actively maintained collaboration plugin for IDA?

There are many IDA Pro plugins that assist with collaboration, but are any actively maintained and known to work with the latest version of IDA (version 6.9)? These are the tools that I'm aware of, ...
0
votes
2answers
80 views

What does the cs register do here?

I've come across this sequence of bytes: 2e 88 38. Hopper disassembles this as: mov byte [cs:rax], bh This online disassembler gives slightly different output: mov BYTE PTR cs:[rax],bh Either ...
0
votes
0answers
200 views

How to disassemble an obfuscated .NET DLL?

I asked earlier about unpacking a packed .NET exe. But now I need to see the source code for an obfuscated DLL: Any idea how to unpack it?
5
votes
0answers
979 views

I'm trying to debug small mips code snippets in IDA with QEMU as debugger, but only NOP instructions show when I start the process

I followed the tutorial IDA Help: Debugging code snippets with QEMU. It always worked with ARM code, but now I have to reverse some MIPS and only nops are displayed like this: Should I adjust ...
3
votes
2answers
103 views

The compiler adds a function call to user-defined functions. What does the function do? (x64 Windows executable)

Introduction I compiled a simple executable with Visual Studio in x64 Windows. Source code: long test(int a, int b, int c, int d, int e, int f, int g, int h, int i, int j) { printf("%d %d %d&...
0
votes
0answers
35 views

Is it possible to Direct3D 9 debug DLL in an app using the release version

I have an application using d3d9.dll, but I want to figure out which functions it calls to gain insight. Since online tools I have found are incompatible with my app (32-bit d3d9), is it instead ...

1
2 3 4 5
23