Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

Filter by
Sorted by
Tagged with
0
votes
0answers
37 views

Replacing a memory block in Ghidra

I've loaded a program into Ghidra and done a few hours' worth of work on it. The loader created a memory block for RAM, but all the uninitialized areas contain nonsense. Unfortunately there isn't ...
0
votes
0answers
16 views

Opened up a stick-blender to retrieve its motor but the circuit board broke. What is the circuit I should reproduce?

See question title and pictures. It’s plugged into 230v and has quite high rpm and torque. I’m trying to see if I can reuse this motor in a different application. Edit: Looks like there is a diode ...
0
votes
0answers
41 views

Patching a program in IDA

I've opened a simple Hello World program in IDA (Pro 7.5) like that: global _main extern _printf section .text _main: push message call _printf add esp, 4 push ...
0
votes
0answers
41 views

Understand the AES encryption mode

I am reverse engineering a software that implements its own encryption over HTTP. The implementation is very simple, the client has the server's public key which it uses to encrypt the data it sends ...
1
vote
1answer
122 views

Arrays assembly

I'm reversing my C array's programs where I'm storing numbers in arrays like this... int marks[5]; marks[0] = 1; marks[1] = 3; marks[2] = 2; marks[3] = 7; marks[4] = 9; so the compiler showing me the ...
2
votes
2answers
108 views

Why this ASM represents Virtual Function call?

I'm referring to this question that was asked previously: Virtual functions call asm I'm wondering how is it possible to know whether this ASM listing represents Virtual Functions calls? What's in the ...
0
votes
1answer
39 views

Expanding .data section at particular area

I have a program which creates a hard-coded number of objects. I patched the binary so that now it can attempt to create more objects than the limit allows, however when it does it allocates them to ...
0
votes
1answer
55 views

Why compiler is doing this?

While I was disassembling my own C code for practice I saw an interesting point which I want to share with you guys and needs to know the answer as I always get from here. Now, the interesting point ...
2
votes
1answer
71 views

Not able to understand the C-switch statement in disassembly

While I'm trying to disassemble my own C code I am stuck in a problem of not understanding how this Switch statement is implemented in assembly code. Can anyone please help to figure it out? This the ...
0
votes
0answers
38 views

IDA adding a new code

Is it possible to add a new assembler code lines in IDA to a opened, disassembled pe file? For e.g. having such disassembled code in IDA: global _main extern _printf section .text _main:...
0
votes
1answer
49 views

Disassembling Hello World program in IDA

I've de-compiled in IDA 7.0 (freeware version) such a simple c program (compiled in the Microsoft Visual Studio Community 2019): #include <stdio.h> #include <string.h > char* sayHello(...
0
votes
1answer
51 views

Is the code like this reverse able? (from Assembly - UnityScript)

i try to reverse this code but cant figure it out what is this number mean or how to call it...
0
votes
1answer
54 views

Difference between \n, \0, \x00 and data from /dev/zero when performing a buffer overflow?

I am working with a binary that involves a buffer overflow on two contiguous memory blocks allocated with malloc. The binary filles up the first buffer with whatever the user inputs and hardcodes the ...
0
votes
0answers
39 views

Using GDB to find the address of a buffer in a stripped C binary

I am working with a crackmes binary called Simple Overflow. It has two buffers with sizes 0x10 and 0x8, and it uses malloc to allocate two contiguous memory blocks (see <+25> and <+39> on ...
1
vote
2answers
95 views

Why eax is assigned to 'variable looked' like addresses

#include <stdio.h> int main() { int number1, number2, sum; printf("Enter two integers: "); scanf("%d %d", &number1, &number2); sum = number1 + ...
0
votes
0answers
34 views

IDA error: “write access to const memory has been detected”

I'am a newbie of IDA and after disassably a file I get this error on some subroutine: "write access to const memory has been detected" // write access to const memory has been detected, the ...
0
votes
1answer
52 views

How to simplify a function “calling itself's reference”

I encounter often a function calling itself (in the pseudo code) such as: result = (**(__int64 (__fastcall ***)(volatile signed __int32 *))lambda)(lambda); Since the disassembly is call qword ptr [...
3
votes
2answers
70 views

How to figure out functionality when doing Static Code Analysis in ASM?

When doing Static code analysis on a disassembled app, I usually end up seeing many calls to registers (CALL EAX for example), which is constructed in runtime, which leaves me clueless on how to ...
2
votes
1answer
56 views

How to debug an application (exe) freeze and crash?

I have an app (and I don't know the source code), that freeze and crash everytime it loses focus (but the music continue). I've tried to debug it using windbg but it doesn't change anything, and I don'...
1
vote
2answers
44 views

Cannot disassemble exported functions

I want to disassemble a function from Kernel32.dll to see what it does, but every single function I try looks like this in the decompiler: Function: jmp ds:Function_0 Where is the function? ...
0
votes
1answer
53 views

How to export arm64 and x86-64 binary into one?

I am trying to export a binary that contains both AARCH64-64 and x86-64 in Ghidra. I only opened the x86-64 counterpart to perform some changes. When I tried to export it, it exported a .bin file that ...
0
votes
2answers
71 views

Correct target of absolute jmp in IDA

In the firmware I am reversing (for a 16-bit MCU), there is code that copies the code of a function from flash memory to RAM, then jumps to it for execution: F000:FEFF : mmap'ed location of function ...
0
votes
0answers
40 views

How to print disassembly of predecessor and successor block of blocks containing 'RET' in Ghidra?

I am using ghidra to do reverse engineering of a binary. I am using the following script to get the disassembly of the blocks containing instruction 'RET' across all functions: from ghidra.program....
0
votes
0answers
20 views

How do I get the disassembly of basic blocks for all functions containing a special instruction like 'RET" using python in Ghidra? [duplicate]

I am using Ghidra to do reverse engineering of an ARM binary. I want to print the disassembly of all blocks across all functions containing a specific instruction like 'CALL' or 'RET'. How do I do ...
0
votes
0answers
25 views

IDA Windows determine programming language used? or even narrow down to compiler

[Python] So basically if something is written in python it basically screams at you "Hey this is python" if you go to a hexview and see tons of 'py' at the start of a module (pySpark, ...
1
vote
1answer
55 views

Using windows 10 for malware analysis

I want to ask can I use windows 10 for malware analysis, I'm asking this because I see many reversers and analysts using windows 7 for this purpose. Can anyone please guide me?
1
vote
4answers
85 views

finding sequence of opcode in binary

I have dis-assmebled binary and want to check if it contains particular sequence of opcodes(obtained from other reference binary). how to do that . i know plain byte level comparison wont work as as ...
0
votes
1answer
37 views

Link decompiled C code to Assembly (retdec decompiled object into C code, but with many errors, i found the kill switch which i need to edit)

I am using retdec to decompile a piece of software. It has a "kill switch" to detect if it's being run in an untrusted environment, in the decompiled code it just a simple if (env_untrusted()...
3
votes
2answers
105 views

How can I find out what type of processor an Intel Hex file belongs to?

I have a text file and I know that it is a firmware of a device. This file have Intel Hex Format as below: :03:8000:00:028100FA :02:8003:00:XXXXXX :02:800B:00:XXXXXX :02:8013:00:XXXXXX :01:801B:00:...
2
votes
3answers
70 views

Where Can I Get .PDB files for Windows OS Components?

I want to take a look at some components of the Windows OS in IDA, such as ntoskrnl.exe and some of the Windows API .DLLs. I understand there is a Microsoft symbol server, but I am not sure how to ...
1
vote
0answers
79 views

Right way to reverse a VM

I'm currently reversing a virtualized sample that uses a custom VM bytecode. After defeating the anti-disassembly tricks I'm finally faced with the vm_dispatch function. I have to figure out the ...
1
vote
0answers
27 views

Edit ASCII value in Assembler (using Immunity Debugger)

I am trying to edit ASCII String via Immunity Debugger: However when I right click to do binary edit and then I click ok, the MOV DWORD instruction is replaced with some random instruction which ...
0
votes
1answer
29 views

Why would just two bits of the SP be used here?

This is the section of disassembled code in question. It’s from a Linux kernel module compiled for 4.4.16 on ARMv7. ; Registers used: ; - r3 : unsigned long argp 0000005c mov r1, ...
3
votes
1answer
59 views

Understanding ARMv7 seemingly overly verbose disassembly

I’m working with a disassembled ARMv7 binary. There are several instances where groups of instructions seem sub-optimal, but this one really caught my attention: 00009086 movw r3, #...
0
votes
1answer
34 views

Visual c compiler options

I ask if exist some c compiler option that can "keep" some imformation after compile that can be visible when I disassamble with IDA. This because I need to find a particular funciton with ...
1
vote
0answers
208 views

Unpack, modify and rebuild an Android App Bundles (.aab) file

I would like to unpack an .aab file, decompile/recompile the classes.dex (baksmali/smali), edit the manifest and, finally, generate a new .aab file. Basically, I am looking for an apktool for .aab
0
votes
0answers
49 views

What does this short confusing piece of ARM64 (aarch64) assembly do?

I arrived at the following piece of ARM assembly while debugging a Golang binary: main.go:55 0x4a9300 3f1800f1 CMP $6, R1 main.go:60 0x4a9304 e1434139 MOVBU 80(RSP), R1 main.go:60 ...
0
votes
0answers
20 views

IPCamera based on RA5350 CRC error on startup

I have an old IP camera that no longer works, doesn't start the ipcamn executable (application that also listens for port 80 connections). Therefore I cannot access it via the network and the camera ...
0
votes
1answer
51 views

How use signature pattern for hooking

I like to replace the static function address: AddressOfHookSoundFunction = (DWORD)GetModuleHandleA("myfile.exe") + 0x0F3B65; // good: 4406117 (integer) using signature pattern: SigScan ...
1
vote
0answers
40 views

Weird x86 function calling convention [duplicate]

I have come across some weird function. It's in an x86 LE Windows executable compiled with Visual Studio and linking to v100 runtime. The function seems to be an __stdcall as it ends with a move into ...
2
votes
1answer
214 views

Correct way to understand local_ in ghidra disassembly

Attached is the part of a disassembled main from a x86 binary file, generated by ghidra. ************************************************************** ...
3
votes
1answer
83 views

Decoding algorithm with checksum

I'm a newbie, so I'm asking for your help. I have to decode dumped data from an appliance because I wanted to try understand the data. The data are in this format and some information are known: 7E 00 ...
0
votes
1answer
29 views

how can I disassemble a Nand binary file from an iPod nano?

Ive got a Nand image in bin format not encrypted armv4, cpu 80 MHz ARM 7TDMI processor it is a iPod nano 1st generation I want to see what calls the Nand makes because it is married to the motherboard....
0
votes
1answer
115 views

Crackme assistance - change input of a function

Just as a preface, this is a crackme from https://hack.ainfosec.com/. I know you can submit these as part of a job app, I have no intentions of doing that. Very happy to have a job in a related, but ...
0
votes
0answers
105 views

How to reverse engineer Electron V8 Snapshot Data Blobs?

Electron apps nowadays seem to have a snapshot_blob.bin and a v8_context_snapshot.bin. I am having a hard time trying to find specification of this file type. It doesn't match with .wasm. Files may be ...
4
votes
3answers
2k views

Is Null in Windows equal to zero?

(This question refers to assembly language.) I'm a little bit confused. I've encountered many times Windows functions that are supposed to return a Handle, and if they don't they return NULL. Why ...
3
votes
2answers
72 views

BRANCH OCCURS in IDApro

Recently I work on TMS320C6xx Arch and when I reverse this firmware I saw functions graph nodes are separated. I have shown in below: As you see, BRANCH OCCURS wrote at the end of each node. I guess ...
0
votes
0answers
23 views

Is it possible to somehow derive the decryption key for iOS app binaries?

While disassembling an IPA downloaded directly from the App Store CDN, I noticed that the binary had an unusually large entropy. Looking this occurrence up confirmed my suspicion that it was encrypted,...
1
vote
1answer
105 views

Finding Ropper/ROPgadget offsets in Ghidra disassembly

How is the offsets returned from ROP gadget finders related to the files they come from? For example, if the ROP gadget finder says that a certain gadget is at offset 0x0002ae74 in libuClibc.0.9.3.so ...
0
votes
0answers
34 views

Remapping Branch Instructions After Obfuscation

Recently I've been working on a project. I've already got a hint for a problem that I had here: (Garbage Assembly Code Generationat at random offsets) however, the accepted answer's solution doesn't ...

1
2 3 4 5
22