Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

Filter by
Sorted by
Tagged with
0 votes
1 answer
17 views

vivisect get assembly instructions

I was going through Vivisect Documentation which seems limited. I wanted to create a tool that gets the functions and then get the assembly code or just assembly instruction (mnemonics ) in a given ...
Aditya's user avatar
  • 1
0 votes
0 answers
25 views

Using __usercall convention in IDA with non-x86 architecture

I'm working on SPARC binary in IDA Pro and need to use __usercall convention, but can't make it work. For example, I've tried to use the following function declaration to reflect the fact that the ...
Vadim  Yakovlev's user avatar
1 vote
1 answer
169 views

What are the substantive differences between radare2 and rizin?

Rizin was forked from Radare2 several years ago, mainly due to human factors. At the time, there weren't any important differences in features between the two. I understand that Rizin has rewritten ...
SRobertJames's user avatar
0 votes
0 answers
70 views

from executable to assembly source code?

let's say i have an ".exe program" and i want to disassemble it and get "disassembled code" . my question is => can i maintain and organize that "disassembled code" ...
0x00001F's user avatar
1 vote
0 answers
108 views

Trying To Understand DOS Game Assembly Instructions

I am trying to understand assembly language instructions, for a DOS Game. I have looked at the following Link :- https://atrevida.comprenica.com/atrtut07.html reading about how VGA Graphics work in ...
Edward Winch's user avatar
0 votes
1 answer
71 views

How can I tell ghidra what structure an address register points to?

I am reversing a raw bare-metal binary firmware for a tricore processor (TC1762/TC1766). In many functions i'm currently reversing there is access to offsets of the address stored in the a0 register. ...
user103675's user avatar
-1 votes
1 answer
123 views

Simple Question About Reversing a Python

So, detect it easy, shows that the .exe is a python 3.9 compiled on visual studio and the compiler was MS Visual C/C++. Trying to unpack it using pyinstxtractor fails, and shows me the error of ...
Roy Guzman's user avatar
1 vote
1 answer
136 views

UPX Unpacking tool

Firstly, thank you for your answer. What is the best unpacking tool to use to unpack - UPX 0.89.6 - 1.02 / 1.05 - 1.24 ->[Overlay] could you please provide a link so i can obtain as such. Thank ...
Alan's user avatar
  • 11
1 vote
0 answers
39 views

Where can I find the files from Ghidra symbol tree?

I have decompiled a .dll file with Ghidra. At the left, I see the symbol tree. In the symbol tree, there is a tab imports. This tab contains external .dll files. Where can I find the location of these ...
Riemann's user avatar
  • 81
2 votes
2 answers
188 views

How can I find the buffer of CryptGenRandom?

I am trying to analyze the CryptGenRandom algorithm on my Windows 10 laptop. According to Niels Ferguson's Whitepaper called 'The Windows 10 random number generation infrastructure', the ...
Riemann's user avatar
  • 81
0 votes
1 answer
57 views

How to pass an SVD file as an argument to IDA Pro in the command line (batch mode)?

I am trying to disassemble a few Arm Cortex-M3 .elf binaries and run a custom IDAPython script (script.py) from the command line (in batch mode). I have been able to do that with the following command:...
Konstantinos's user avatar
0 votes
0 answers
86 views

What obfuscator do this?

So, first if i try to use DnSpy all the methods are empty and some of them returns decompiler exceptions like System.ArgumentOutOfRangeException: Non-negative number required. (Parameter 'length') ...
SilverStitch's user avatar
0 votes
0 answers
70 views

How do I properly decode the .bin files (RLE compression)? (DOS game - 1988)

Does anyone know what tools should I use to extract the backgrounds and sprites of this very rare old game: Armorik the Viking? The files are in .BIN format. Compression is RLE The game is from 1988 ...
The Thinker's user avatar
1 vote
2 answers
208 views

How do I extract sprites and backgrounds from .BIN files? (dos game - 1988)

Does anyone know what tools should I use to extract the backgrounds and sprites of this very rare old game: Armorik the Viking? The files are in .BIN format. No idea how to open them. I tried Game ...
Fab's user avatar
  • 11
1 vote
0 answers
101 views

Reversing Assembly to C

I've read the open letter addressing students asking for help with their homework and I agree with it, therefore I will try to be less of a pain in the *** ;) I need to reverse the x86-64 (AT&T) ...
mikealexx's user avatar
1 vote
1 answer
178 views

Dumpbin show function names

Is there any way I can use dumpbin like objdump, where I can just look at the functions machine instructions that I implemented in my Source.c file, which I compiled to source.exe? If I use dumpbin \...
killertoge's user avatar
3 votes
1 answer
243 views

How to reverse Engineer a Struct in IDA Pro?

How to identify and define a struct in IDA pro Decompiling during reverse engineering? Please explain the easiest way to figure out the struct in IDA Pro decompilation! To make life easier are there ...
Jose I. Hughes's user avatar
2 votes
1 answer
126 views

Identify mod operation in ARM firmware with IDA

I have the firmware in which mod operation must be done. I want to find this part of instructions. Assume the following logic exist in the firmware: res = var % 17 I have tried to make search by % ...
ALEX's user avatar
  • 21
2 votes
0 answers
69 views

IDA Pro Exports Table Corrupted!

I've been analyzing a dll file and naming the functions, structs, variables, and so on. A lot of information has been changed and saved, but after the following message appears, the address column of ...
short dragon's user avatar
2 votes
1 answer
74 views

Stuck decompiling ARM64 function

I am trying to figure out how this function squashes quaternion (double[4], dvar5..6 in the disassembly) data into the 2 int outputs vertexX and vertexY. As far as I can tell, it reads the raw sensor ...
duckblaster's user avatar
5 votes
2 answers
527 views

How can I disassemble/decompile an immediate value to multiplication/summation of two values with IDA Pro?

Is it possible to force IDA to show "5 * 20" instead of "100" in the below disassembled and decompiled lines? MOV R1, #100 -> MOV R1, #(5 * 20) LDR R8, =var | ...
E.A's user avatar
  • 171
4 votes
3 answers
307 views

Help disassembling a simple 16-bit NE function

I am currently attempting to reverse engineer a simple function from within a 16-Bit Windows 3.1 (NE) DLL, which from what I can tell is used to display a message box when required. I would assume ...
jttri777's user avatar
  • 165
1 vote
0 answers
155 views

Get all names of functions from an iOS-App binary (headless)

Setup: I want to get a list of all (apple built-in) function and variable names that are used in an arbitrary iOS App by headless analysis. So given the .ipa file of any iOS-App, I unpack it and can ...
Kühlhausvogel's user avatar
2 votes
0 answers
37 views

Please help with striped binary reverse

Not so long ago I was engaged in reverse and pwn, I came across such a task This is a normal task with a vulnerability on the heap, but it is striped and I don’t understand where which functions are I ...
K05t1K_RWX's user avatar
2 votes
0 answers
64 views

Angr considers REP instruction as the end of a basic block

I'm developing a python script for angr that has to find all the basic blocks present in each function in a binary. I have noticed that angr splits the basic blocks when it finds a REP instruction, I'...
Luca's user avatar
  • 121
2 votes
1 answer
67 views

why some functions push data before the prologue

i am a newbie in the world of RE , i start to explorer a main entry of a classic game from 90's and i start to see something confuse me as a newbie this main entry function start with pushing stuff to ...
0x00001F's user avatar
1 vote
1 answer
91 views

IDAPython doesn't recognize function

I'm developing a python script for IDA Pro that analyzes 32 bit PE files containing an anti-disassembly technique, the problem is that the function that contains the technique isn't being listed in ...
Luca's user avatar
  • 121
4 votes
0 answers
136 views

How to assemble back a disassembled Linux kernel?

I have a Linux kernel file and I need to tweak the contents of its corresponding initramfs. I did it in the past for standard distros where kernel and initramfs were separate. However, this specific ...
Peter's user avatar
  • 141
1 vote
0 answers
102 views

IDA pro Error how to resolve this error

52C187F5: The instruction at 0x52C187F5 referenced memory at 0x4. The memory could not be read -> 00000004 (exc.code c0000005, tid 672) How to Solve this. I have seen sandbox reports in those the ...
Satyam Singh's user avatar
2 votes
1 answer
128 views

What are the prerequisite knowledge needed to start solving crackmes?

I started by reading a book on C language and then moved on to "Programming From Ground Up," which teaches basic programming in x86. School just ended, I'm working on cracking a game called ...
buffednerdkid's user avatar
1 vote
1 answer
356 views

Get friendly disassemble hex file

I'd like to know if there is a way to have a more friendly way to get disassemble hex file coming from Adafruit board. Let me explain actually I'm working with Adafruit feather 32u4 running with ...
simon's user avatar
  • 131
2 votes
0 answers
55 views

Calculate Function Call To Imported Function In Dumpbin Output

What is the easiest way to determine the function called in dumpbin output. No PDBs available. The disassembly: 004028E2: 8B 1D 70 42 40 00 mov ebx,dword ptr ds:[00404270h] 004028E8: 55 ...
chentiangemalc's user avatar
2 votes
0 answers
100 views

I trying rewrite asm to c++ [closed]

This code generates an API key. I use it in an android app as .so file, but I need to rewrite it to java from c++. How do I translate? push rbp push r15 push r14 push r13 push r12 push ...
Master's user avatar
  • 21
2 votes
0 answers
61 views

Tracing odd variant of call analysis failed

Disclaimer before I get flogged: I'm playing with a commercial app, for which I have a license, for my own education because building toy C apps has run out of challenge (and I know whats inside). ...
XeroxDucati's user avatar
3 votes
1 answer
50 views

How to Combine 2 .hex to one

I have a Ensoniq Synthesizer with broken buttons,my idea is to simulate the input over sysex. Unfortunately the sysex exclusive is set off by default. There are 2 ROM files upper.bin and lower.bin ...
Maurizio Vanzella's user avatar
2 votes
1 answer
77 views

IDA mov dword ptr with non-existent addresses

This might be obvious, but I'm baffled.. I opened a random .so library to poke around and learn IDA a bit better, and I hit something I've never seen. IDA has these instructions: mov eax, [esp+4Ch+...
XeroxDucati's user avatar
2 votes
1 answer
185 views

armv7 disassemble thumb instructions from raw binary snippet

I have a portion of a raw binary file that contains ARM instructions, specifically in Thumb mode (and I've manually disassembled a few instructions using the Architecture Manual, and they seemed ...
Sittin Hawk's user avatar
2 votes
2 answers
166 views

Reverse engineer a calculation rule from a video game

I have recently bought an economic simulation video game, but neither the docs not the game UI describe how to estimate some costs; the user needs to actually invest and spend their money, then ...
devio's user avatar
  • 121
3 votes
0 answers
145 views

What computer components improve the speed of disassembly in IDA Pro and plugins like BinDiff?

I’m disassembling binaries in IDA Pro. It usually takes 15+ minutes just to pre-process/open one binary, Then another 20-30 min before IDA is fully done disassembling and finally becomes idle. ...
Jacob Wheeler's user avatar
3 votes
0 answers
45 views

How can I quickly tell which ARM Thumb version a particular piece of code is using?

I'm working with an ARM processor: an STM32F407VGT6 board, which IIUC powers a 32-bit Arm® Cortex®-M4. I need to inspect the binary weight of some instruction, so I used objdump like this: arm-none-...
Alessandro Bertulli's user avatar
3 votes
1 answer
185 views

Reading memory values in IDA

Want to get 32 bits from 0x8000 adress as 8 bytes MEM_EXT:00008000 db 54h MEM_EXT:00008001 db 53h, 57h, 20h MEM_EXT:00008004 dd 322E3256h, 31332030h, ...
dev's user avatar
  • 133
2 votes
1 answer
67 views

Overclock CPU in BIOS - ARM/C/C++/Py

new guy here. Working on Bi0S script, adding as many features as possible. It is possible to change fan speeds, advanced security, manipulate voltages, etc. How do you overclock the microprocessor ...
Calculus Lui YaleTessy's user avatar
2 votes
0 answers
94 views

How to decrypt data during runtime before executing and then encrypting it back

I was doing some research and came across the term protectors. From my understanding is they encrypt a file to be protected but run it without an issue. During its execution it is able to decrypt the ...
soqq's user avatar
  • 21
2 votes
1 answer
74 views

How to interpret this __ctype_b based predicate?

I am getting this simplified function from the decomplication results of Ghidra, and I am having a hard time interpreting what the predicate would evaluate to since I do not have access to __ctype_b ...
Anis LOUNIS aka AnixPasBesoin's user avatar
2 votes
0 answers
46 views

How to obtain import name from disassembled assembly

I'm trying to create my own tools for reverse engineering PE. I have some assembly codes that I fetched from a clone of objdump for a program. Sometimes I see call instructions such as : callq *...
onerom's user avatar
  • 21
1 vote
1 answer
105 views

Unable to understand x86 instruction(s)

Recently I have been given a set of assembly instructions which I must learn to understand. I know an extremely basic level of x86 assembly but I'm starting to come across more nuances that are very ...
guest1's user avatar
  • 13
2 votes
1 answer
96 views

Clean Angr disassemble output

I'm developing a python script for Angr that has to print as output something in the form of: Instruction_disassembled opcode_bytes_of_instruction This is my python script: f = open(sys....
Luca's user avatar
  • 121
4 votes
0 answers
590 views

Extract disassembly from Ghidra for reassembling

How can I extract a code listing from a Ghidra project such that I can reassemble with something like vasm? I have gone through a memory snapshot and disassembled the code and marked data sections etc....
Robin Elvin's user avatar
3 votes
0 answers
320 views

Specifying struct offsets in Ghidra

I'm using Ghidra to disassemble some 68000 code. I only want to look at the disassembly listing, and I have no interest in the decompilation view. Here's one instruction I'm looking at. ...
Tom Seddon's user avatar
2 votes
2 answers
72 views

Why does this code use multiple shifts instead of one?

I came across the following piece of 16-bit x86 code for multiplying a value by 40, using just shifts and additions: ; BX holds the value we want to multiply. ; The result is stored in AX. MOV AX, BX ...
lethal-guitar's user avatar

1
2 3 4 5
25