Questions tagged [disassembly]
The translation of machine code into a human readable assembly code, also the result of such translation.
1,074
questions
0
votes
0answers
37 views
Replacing a memory block in Ghidra
I've loaded a program into Ghidra and done a few hours' worth of work on it. The loader created a memory block for RAM, but all the uninitialized areas contain nonsense. Unfortunately there isn't ...
0
votes
0answers
16 views
Opened up a stick-blender to retrieve its motor but the circuit board broke. What is the circuit I should reproduce?
See question title and pictures. It’s plugged into 230v and has quite high rpm and torque. I’m trying to see if I can reuse this motor in a different application.
Edit: Looks like there is a diode ...
0
votes
0answers
41 views
Patching a program in IDA
I've opened a simple Hello World program in IDA (Pro 7.5) like that:
global _main
extern _printf
section .text
_main:
push message
call _printf
add esp, 4
push ...
0
votes
0answers
41 views
Understand the AES encryption mode
I am reverse engineering a software that implements its own encryption over HTTP. The implementation is very simple, the client has the server's public key which it uses to encrypt the data it sends ...
1
vote
1answer
122 views
Arrays assembly
I'm reversing my C array's programs where I'm storing numbers in arrays like this...
int marks[5];
marks[0] = 1;
marks[1] = 3;
marks[2] = 2;
marks[3] = 7;
marks[4] = 9;
so the compiler showing me the ...
2
votes
2answers
108 views
Why this ASM represents Virtual Function call?
I'm referring to this question that was asked previously:
Virtual functions call asm
I'm wondering how is it possible to know whether this ASM listing represents Virtual Functions calls? What's in the ...
0
votes
1answer
39 views
Expanding .data section at particular area
I have a program which creates a hard-coded number of objects. I patched the binary so that now it can attempt to create more objects than the limit allows, however when it does it allocates them to ...
0
votes
1answer
55 views
Why compiler is doing this?
While I was disassembling my own C code for practice I saw an interesting point which I want to share with you guys and needs to know the answer as I always get from here. Now, the interesting point ...
2
votes
1answer
71 views
Not able to understand the C-switch statement in disassembly
While I'm trying to disassemble my own C code I am stuck in a problem of not understanding how this Switch statement is implemented in assembly code. Can anyone please help to figure it out? This the ...
0
votes
0answers
38 views
IDA adding a new code
Is it possible to add a new assembler code lines in IDA to a opened, disassembled pe file?
For e.g. having such disassembled code in IDA:
global _main
extern _printf
section .text
_main:...
0
votes
1answer
49 views
Disassembling Hello World program in IDA
I've de-compiled in IDA 7.0 (freeware version) such a simple c program (compiled in the Microsoft Visual Studio Community 2019):
#include <stdio.h>
#include <string.h >
char* sayHello(...
0
votes
1answer
51 views
Is the code like this reverse able? (from Assembly - UnityScript)
i try to reverse this code but cant figure it out what is this number mean or how to call it...
0
votes
1answer
54 views
Difference between \n, \0, \x00 and data from /dev/zero when performing a buffer overflow?
I am working with a binary that involves a buffer overflow on two contiguous memory blocks allocated with malloc. The binary filles up the first buffer with whatever the user inputs and hardcodes the ...
0
votes
0answers
39 views
Using GDB to find the address of a buffer in a stripped C binary
I am working with a crackmes binary called Simple Overflow. It has two buffers with sizes 0x10 and 0x8, and it uses malloc to allocate two contiguous memory blocks (see <+25> and <+39> on ...
1
vote
2answers
95 views
Why eax is assigned to 'variable looked' like addresses
#include <stdio.h>
int main() {
int number1, number2, sum;
printf("Enter two integers: ");
scanf("%d %d", &number1, &number2);
sum = number1 + ...
0
votes
0answers
34 views
IDA error: “write access to const memory has been detected”
I'am a newbie of IDA and after disassably a file I get this error on some subroutine:
"write access to const memory has been detected"
// write access to const memory has been detected, the ...
0
votes
1answer
52 views
How to simplify a function “calling itself's reference”
I encounter often a function calling itself (in the pseudo code) such as:
result = (**(__int64 (__fastcall ***)(volatile signed __int32 *))lambda)(lambda);
Since the disassembly is call qword ptr [...
3
votes
2answers
70 views
How to figure out functionality when doing Static Code Analysis in ASM?
When doing Static code analysis on a disassembled app, I usually end up seeing many calls to registers (CALL EAX for example), which is constructed in runtime, which leaves me clueless on how to ...
2
votes
1answer
56 views
How to debug an application (exe) freeze and crash?
I have an app (and I don't know the source code), that freeze and crash everytime it loses focus (but the music continue). I've tried to debug it using windbg but it doesn't change anything, and I don'...
1
vote
2answers
44 views
Cannot disassemble exported functions
I want to disassemble a function from Kernel32.dll to see what it does, but every single function I try looks like this in the decompiler:
Function:
jmp ds:Function_0
Where is the function? ...
0
votes
1answer
53 views
How to export arm64 and x86-64 binary into one?
I am trying to export a binary that contains both AARCH64-64 and x86-64 in Ghidra. I only opened the x86-64 counterpart to perform some changes.
When I tried to export it, it exported a .bin file that ...
0
votes
2answers
71 views
Correct target of absolute jmp in IDA
In the firmware I am reversing (for a 16-bit MCU), there is code that copies the code of a function from flash memory to RAM, then jumps to it for execution:
F000:FEFF : mmap'ed location of function ...
0
votes
0answers
40 views
How to print disassembly of predecessor and successor block of blocks containing 'RET' in Ghidra?
I am using ghidra to do reverse engineering of a binary. I am using the following script to get the disassembly of the blocks containing instruction 'RET' across all functions:
from ghidra.program....
0
votes
0answers
20 views
How do I get the disassembly of basic blocks for all functions containing a special instruction like 'RET" using python in Ghidra? [duplicate]
I am using Ghidra to do reverse engineering of an ARM binary. I want to print the disassembly of all blocks across all functions containing a specific instruction like 'CALL' or 'RET'. How do I do ...
0
votes
0answers
25 views
IDA Windows determine programming language used? or even narrow down to compiler
[Python] So basically if something is written in python it basically screams at you "Hey this is python" if you go to a hexview and see tons of 'py' at the start of a module (pySpark, ...
1
vote
1answer
55 views
Using windows 10 for malware analysis
I want to ask can I use windows 10 for malware analysis, I'm asking this because I see many reversers and analysts using windows 7 for this purpose. Can anyone please guide me?
1
vote
4answers
85 views
finding sequence of opcode in binary
I have dis-assmebled binary and want to check if it contains particular sequence of opcodes(obtained from other reference binary). how to do that . i know plain byte
level comparison wont work as as ...
0
votes
1answer
37 views
Link decompiled C code to Assembly (retdec decompiled object into C code, but with many errors, i found the kill switch which i need to edit)
I am using retdec to decompile a piece of software. It has a "kill switch" to detect if it's being run in an untrusted environment, in the decompiled code it just a simple
if (env_untrusted()...
3
votes
2answers
105 views
How can I find out what type of processor an Intel Hex file belongs to?
I have a text file and I know that it is a firmware of a device. This file have Intel Hex Format as below:
:03:8000:00:028100FA
:02:8003:00:XXXXXX
:02:800B:00:XXXXXX
:02:8013:00:XXXXXX
:01:801B:00:...
2
votes
3answers
70 views
Where Can I Get .PDB files for Windows OS Components?
I want to take a look at some components of the Windows OS in IDA, such as ntoskrnl.exe and some of the Windows API .DLLs. I understand there is a Microsoft symbol server, but I am not sure how to ...
1
vote
0answers
79 views
Right way to reverse a VM
I'm currently reversing a virtualized sample that uses a custom VM bytecode. After defeating the anti-disassembly tricks I'm finally faced with the vm_dispatch function. I have to figure out the ...
1
vote
0answers
27 views
Edit ASCII value in Assembler (using Immunity Debugger)
I am trying to edit ASCII String via Immunity Debugger:
However when I right click to do binary edit and then I click ok, the MOV DWORD instruction is replaced with some random instruction which ...
0
votes
1answer
29 views
Why would just two bits of the SP be used here?
This is the section of disassembled code in question. It’s from a Linux kernel module compiled for 4.4.16 on ARMv7.
; Registers used:
; - r3 : unsigned long argp
0000005c mov r1, ...
3
votes
1answer
59 views
Understanding ARMv7 seemingly overly verbose disassembly
I’m working with a disassembled ARMv7 binary. There are several instances where groups of instructions seem sub-optimal, but this one really caught my attention:
00009086 movw r3, #...
0
votes
1answer
34 views
Visual c compiler options
I ask if exist some c compiler option that can "keep" some imformation after compile that can be visible when I disassamble with IDA.
This because I need to find a particular funciton with ...
1
vote
0answers
208 views
Unpack, modify and rebuild an Android App Bundles (.aab) file
I would like to unpack an .aab file, decompile/recompile the classes.dex (baksmali/smali), edit the manifest and, finally, generate a new .aab file.
Basically, I am looking for an apktool for .aab
0
votes
0answers
49 views
What does this short confusing piece of ARM64 (aarch64) assembly do?
I arrived at the following piece of ARM assembly while debugging a Golang binary:
main.go:55 0x4a9300 3f1800f1 CMP $6, R1
main.go:60 0x4a9304 e1434139 MOVBU 80(RSP), R1
main.go:60 ...
0
votes
0answers
20 views
IPCamera based on RA5350 CRC error on startup
I have an old IP camera that no longer works, doesn't start the ipcamn executable (application that also listens for port 80 connections).
Therefore I cannot access it via the network and the camera ...
0
votes
1answer
51 views
How use signature pattern for hooking
I like to replace the static function address:
AddressOfHookSoundFunction = (DWORD)GetModuleHandleA("myfile.exe") + 0x0F3B65; // good: 4406117 (integer)
using signature pattern:
SigScan ...
1
vote
0answers
40 views
Weird x86 function calling convention [duplicate]
I have come across some weird function. It's in an x86 LE Windows executable compiled with Visual Studio and linking to v100 runtime.
The function seems to be an __stdcall as it ends with a move into ...
2
votes
1answer
214 views
Correct way to understand local_ in ghidra disassembly
Attached is the part of a disassembled main from a x86 binary file, generated by ghidra.
**************************************************************
...
3
votes
1answer
83 views
Decoding algorithm with checksum
I'm a newbie, so I'm asking for your help.
I have to decode dumped data from an appliance because I wanted to try understand the data.
The data are in this format and some information are known:
7E 00 ...
0
votes
1answer
29 views
how can I disassemble a Nand binary file from an iPod nano?
Ive got a Nand image in bin format not encrypted armv4, cpu 80 MHz ARM 7TDMI processor it is a iPod nano 1st generation I want to see what calls the Nand makes because it is married to the motherboard....
0
votes
1answer
115 views
Crackme assistance - change input of a function
Just as a preface, this is a crackme from https://hack.ainfosec.com/. I know you can submit these as part of a job app, I have no intentions of doing that. Very happy to have a job in a related, but ...
0
votes
0answers
105 views
How to reverse engineer Electron V8 Snapshot Data Blobs?
Electron apps nowadays seem to have a snapshot_blob.bin and a v8_context_snapshot.bin. I am having a hard time trying to find specification of this file type. It doesn't match with .wasm. Files may be ...
4
votes
3answers
2k views
Is Null in Windows equal to zero?
(This question refers to assembly language.) I'm a little bit confused. I've encountered many times Windows functions that are supposed to return a Handle, and if they don't they return NULL. Why ...
3
votes
2answers
72 views
BRANCH OCCURS in IDApro
Recently I work on TMS320C6xx Arch and when I reverse this firmware I saw functions graph nodes are separated. I have shown in below:
As you see, BRANCH OCCURS wrote at the end of each node. I guess ...
0
votes
0answers
23 views
Is it possible to somehow derive the decryption key for iOS app binaries?
While disassembling an IPA downloaded directly from the App Store CDN, I noticed that the binary had an unusually large entropy. Looking this occurrence up confirmed my suspicion that it was encrypted,...
1
vote
1answer
105 views
Finding Ropper/ROPgadget offsets in Ghidra disassembly
How is the offsets returned from ROP gadget finders related to the files they come from? For example, if the ROP gadget finder says that a certain gadget is at offset 0x0002ae74 in libuClibc.0.9.3.so ...
0
votes
0answers
34 views
Remapping Branch Instructions After Obfuscation
Recently I've been working on a project. I've already got a hint for a problem that I had here: (Garbage Assembly Code Generationat at random offsets)
however, the accepted answer's solution doesn't ...
