Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

Filter by
Sorted by
Tagged with
0
votes
2answers
84 views

Is it possible to use a program's GUI abilities without the GUI?

Is it possible to use/call programs' GUI abilities directly without using the GUI (programmatically, not by keyboarding)? For example, a program with abilities nested too deeply in cascading submenus:...
0
votes
0answers
28 views

Cisc/Risc in reverse engineering

What is the difference between Cisc/Risc when reverse engineer binary? I know the difference between then, but is there any difference while reversing? Is it easy to reverse Cisc than Risc?
2
votes
2answers
2k views

How to locate module_init() offset from ELF header of Linux kernel module?

The header is self explanatory but to explain myself better. I have an ELF binary - loadable kernel module, compiled with symbols. I want to know how to locate the offset of the module_init() function....
0
votes
0answers
19 views

Mark reset code in IDA

I have have firmware to processor that I need to find ram,rom and reset vector by datasheet to analyze it. I found this article (My cpu is not like this article) https://rdomanski.github.io/...
2
votes
0answers
26 views

submitting input into AFL fuzzer

I have some questions about the AFL Fuzzer: How does the AFL Fuzzer know where to inject the payload in the code I compile? For instance if I want to inject it in a specific parameter, how do I do it?...
1
vote
2answers
151 views

Difference between 32 bit and 64 bit disassemblers

As far as my level of understanding goes, the only difference between a 32 bit and 64 bit disassembler is that the produced assembler-code of a 32 bit disassembler is only using 32 bit assembly ...
1
vote
1answer
142 views

Python Script to get disassembled output of an EXE file

I'm pretty new to Ghidra, and looking to use it's API (headless analyzer) and get the assembled file through command line using python. Here is my code, which is likely far from the correct code. It ...
0
votes
0answers
80 views

How to recover randomly generated private key from a Program that implements Diffie Hellman Exchange

This program implements Diffie Hellman key Exchange, a pair of random private keys are generated every time the program runs. How should I go about finding the random number generation subroutine ...
0
votes
1answer
75 views

How can I navigate to the Disassembly address location?

I'm using x32dbg and I've set a hardware memory breakpoint. It triggers successfully for a specified module and the debugger pauses and a message on the bottom says: Hardware breakpoint (byte, read/...
0
votes
1answer
707 views

How to Modify this Branch in ARM64?

I try to modify the branch of this disassembly in a binary: SUB SP, SP, #0x60 STP X26, X25, [SP,#0x50+var_40] STP X24, X23, [SP,#0x50+var_30] STP X22, ...
0
votes
0answers
31 views

IDA Fails to Analyze Stack Pointer Correctly in Heavily Chunked Functions

I am currently dealing with obfuscated code in IDA. The obfuscation I am combating is control flow obfuscation, where a function is split up into hundreds of basic blocks spread across the entire ...
0
votes
0answers
12 views

reflection in objectiveC - method invocation return null value

I'm trying to reverse the way dpsconfigad extracting the current active directory domain. Notice : It's rather simple query that can be performed using OpenDirectory public framework but it requires ...
2
votes
1answer
51 views

How can I objdump the assembler code of dynamically linked functions in a dynamically linked executable?

Compiling a minimal C++ program: g++ -g -Wall -Wextra -std=c++17 -o prog main.cpp int main() { } Performing an objdump -C -D prog of all sections I am given the following output: prog: file ...
0
votes
0answers
39 views

Setting struct according to offset relative to struct base

I would like to know whether it's possible to define a struct according to offsets from base in Hopper. Assuming there is a register in the assembly code, that I believe it represent the instance ...
4
votes
2answers
11k views

What's the difference between a disassembler, debugger and decompiler?

I have heard of disassemblers like IDA and debuggers like OllyDbg but honestly, when you give both of them a binary file it gives me the assembly code. I know that the decompiler gives the source code ...
1
vote
0answers
40 views

TMS320VC5416 DSP firmware reversing

I have file with DSP firmware inside. Each chunk of code or data is preceded by header with format "page,offset,length".See below full list of headers: page: 0000 offset: 0080 len: 0149 page: 0000 ...
5
votes
2answers
1k views

How to load symbols from a symbol server in Ghidra?

I've been trying to learn Ghidra by attempting to reverse the comctl32.dll system library, which has many of its functions documented. I started the de-compilation analysis in it, and after a while it ...
1
vote
3answers
110 views

What is the difference between malware that is 'dumped' and one that is 'unpacked'?

On malware sharing communities, I have been noticing that the samples shared are marked as unpacked or dumped. I have tried to load the dumped malware in IDAFree, however, there is nothing in the ...
3
votes
3answers
183 views

Strange vtable setup in constructor disassembly

In a program I'm trying to recover data structures I've discovered the following strange (ARM) disassembly code: ctor_1: ldr r1, =vtable_base str r1, [r0] ;r0 always contains ...
0
votes
1answer
61 views

Abusing the strlen output

My question is related to the strlen function from the C and C++. I am reversing a program, that reads a byte data from allocated memory and sends to the strlen directly. To be completely honest ...
0
votes
1answer
85 views

ACCESS_VIOLATION when attaching a debugger

I'm debugging a software and it hits access violation on wcslen function under debugger but runs normally without it. First I thought It had some anti-debug trick, but I could not found any ...
2
votes
2answers
819 views

Are there IDA scripts/plugins to translate/comment instructions to/with pseudocode?

I'm not asking for a decompiler, as I'm aware that it does not produce accurate results all the time. I've tried Googling but all I found were decompilers. Problem I found it extremely inefficient ...
0
votes
1answer
52 views

How to use memory address information from IDAFree to set a breakpoint in x32dbg?

I have a DLL paused at EntryPoint in x32dbg. I am interested in examining memory following a specific API call that this DLL makes. I found the API call in the imports section when I open the DLL in ...
1
vote
1answer
67 views

Why is fastcall used for replacing thiscall functions in memory instead of cdecl?

Assume I were to be reversing some game which processes all of it's movement client side and have determined some function to be of the type: bool __thiscall Player::CanJump(Player *this) that I ...
3
votes
2answers
79 views

Get certain instruction count for multi-architecture binaries

I need to get an ELF binary's total count of Function call instruction conditional jump (branch) instruction The binary could be any CPU architecture, like x64, ARM, MIPS, Motorola 68K, etc. It ...
3
votes
1answer
373 views

Disassemble CC2541 firmware (TI SensorTag)

I'm digging into a BLE product based on a CC2541 MCU (similar to the Texas Instruments SensorTag). So for experimenting we can use an official firmware: http://processors.wiki.ti.com/images/1/10/...
0
votes
1answer
83 views

Can GUI elements of a running program be found/located in memory?

Is it possible for a particular GUI element of a running program (on Windows platform) to be located in memory, such as a text element from a dialog box? For example, locating title text of a drop-...
1
vote
0answers
37 views

Radare2 8051 code bank switching

Some of 8051 chips use bank switching to extend accessible code memory. Good example is Silabs C8051F12x. Another example is here. Code area in range 0x0000..0x7ffff is common always accessible code ...
0
votes
1answer
144 views

How to decrypt the password using radare2 or gdb?

.--------------------------------------------------. | [0x804851b] | ...
0
votes
0answers
26 views

Radare2 switch table walk for 8051

For 8051 target exist famous no-return function with body of d083d082f8e4937012740193700da3a393f8740193f5828883e4737402936860efa3a3a380df Function parse jump table following immediately after call ...
0
votes
1answer
293 views

Use GCC and objdump to disassemble any hex to assembly code

What would be the best way (also fewer steps) to generate assembly code for a given hex code ? For e.g., if we know the architecture is x86, and given hex value 0x55, what is the best way to generate ...
1
vote
0answers
35 views

Is it possible to define the adress of a function in assembly?

I am creating a PoC for anti-disassembly techniques, and I would like to know if there were ways to define the address of functions once compiled with gcc. Here is the PoC program : BITS 32 EXTERN ...
1
vote
1answer
139 views

Encoding method of float

I'm reversing this game and got stuck. To make it simple, You have some amount of coins in the game (float or double) and you can spend it on some things. I started sniffing network traffic and ...
0
votes
1answer
154 views

Trace back function call

I'm learning reverse engineering and I'm trying to find where an error message is called. I want to get in the part of the code, in the main module, where it decides to display the error message or ...
1
vote
1answer
68 views

Entry point of a program

im new to assembly and reverse engineering, i have a question regarding to how the address work. I examined the entry point of a program using varies PE tools, the result is 0x00043b33, but when i ...
1
vote
0answers
92 views

Trying to read/write an Renesas's M30626FHPGP flash memory

I need to make a little introduction: I'm a 37 years old man who is affected by multiple sclerosis. My neurologist gave me Rebif 44 (44mg) as a treatment. I started at full dose and went on for, ...
0
votes
2answers
124 views

Disassembling only given function

I'm looking for some disassembler that has feature similar to WinDbg uf function, it produces output that is really easy transferable to compilable NASM listing. The problem with WinDbg is that it's ...
2
votes
1answer
123 views

Unable to properly analyze a very simple C-compiled program

I'm a RE beginner and I decided to start writing my own simple code for practice. I wrote a simple code which uses a winAPI function called CreateProcess to start a calc.exe, I've wrote it in C and ...
0
votes
2answers
129 views

Where is the ESP after call instruction?

I've started learning the Reverse Engineering and when I read the Stack Operations and function invocation, there are an issue that I'm confused. -What is the address of ESP after "pop ebp" and "retn" ...
1
vote
2answers
99 views

Find a instruction in a binary file (PE) based on a virtual address of a string reference

English is not my first language, so I'm sorry if my text isn't so clear. I'm trying to program an automatic patcher for a PE binary that should work for multiple versions of this executable. For ...
0
votes
2answers
60 views

How to Calculate ds Pointer

How do I calculate the location of the string in this sample located at offset 0x1CAD8? The instruction at 0x140001A97 in the sample is: 0x140001A97 F2 0F1005 39C60100 movsd xmm0, qword [rip + ...
1
vote
0answers
98 views

Decrypting the Config file of a Huawei router “HG630 V2”

followed that post from Wordpress https://hg658c.wordpress.com/2017/12/04/decrypting-configuration-files-from-other-huawei-home-gateway-routers/ Extracted the 4 Hex strings needed. But, looks ...
0
votes
0answers
39 views

Which instruction at which address calls the address 0x1a95 or the address 0x204a in the following program or rather smart contract?

The Ethereum Virtual Machine uses a Virtual Instruction Set flavored for transaction processing that doesn’t use any registers and where all opcodes are a single byte long and have a single ABI for ...
3
votes
2answers
441 views

Edit an ELF file (language pack)

I have here an ELF file that contains a language pack (Englisch and Chinese) and I want to swap the chinese language to the german language. hex cannot represent Chinese :) here an excerpt from the ...
0
votes
0answers
149 views

How to bring the message box other than error message box

The program asks serial number. I've searched the API call which triggers the wrong password message box and force it into accepting an incorrect serial number in x64dbg’s string references. I found ...
3
votes
1answer
6k views

Making changes in ELF file after dissassembly [duplicate]

I am new to reverse engineering and after some research, I haven't found a clear way to do what I want to do. I have an ELF file, but not the original source code that generated it. It is really ...
1
vote
2answers
202 views

Local variables and addition not shown in Ghidra

I am having some troubles with my learning of Assembly and reverse engineering. Specifically, I am learning about Global vs Local variables. For Global variables I have managed to get insights in ...
2
votes
1answer
359 views

Simple C program disassembled with Ghidra

I am trying to figure out what is going on with my simple example programs, when I disassemble them with Ghidra. I am not sure whether this is some strange Ghidra behaviour or something that is set by ...
0
votes
1answer
79 views

The executable file makes a unique ID from each individual PC. Can anyone decipher from where the file makes these unique IDs?

The file generates random unique ID. It says hardware ID but I couldn't find it in product key, BIOS serial number or anywhere. I used IDA but I couldn't get from where the file creates the code. Even ...
-1
votes
1answer
167 views

What is the following assembly code doing? [closed]

str fp,[sp, -4]! add fp, sp, #0 sub sp, sp, #12 str r0, [fp, #-8] str r1 [fp, #-12] L5: ldr r3, [fp, #-8] ldrb r3, [r3] cmp r3, #0 beq .L2 ldr r3, [fp, #-12] ldrb r3, [r3] cmp r3, #0 beq .L2 ldr r3, [...