Questions tagged [disassembly]
The translation of machine code into a human readable assembly code, also the result of such translation.
1,116
questions
2
votes
1answer
28 views
When would a program normally transfer data between memory and coprocessor?
In the analysis of an ARM binary, when would one normally encounter transfer operations between memory and a coprocessor? These are encoded as the LDC and STC operators.
Would it be common for ...
0
votes
1answer
18 views
ARM floating point register S0 used without initialization
The following code snippet is the first few assembly instructions of a function.
The code runs on armv8a.
SUB SP, SP, #0x170 is the first assembly instruction of the function. Please note the ...
1
vote
1answer
64 views
Finding AES Key in binary using Ghidra and FindCrypt
I would like to learn more about RE.
I wrote a simple program on a STM32F107 which does nothing else than encrypting and decrypting a text once using AES128-ECB.
Here is the C code (I intentionally ...
0
votes
0answers
29 views
Is it possible to detect that a function has been called from a loop? - Radare-2
is it possible to detect a function is calling from inside a loop in Radare-2.
for (i = 0; i<n; i++)
foo()
foo() ==> 0x00402f90 // starting address
Thanks
1
vote
0answers
63 views
Pascal string representation in Hex-Rays Decompiler of IDA Pro
I'm trying to prettify a representation of Pascal-string "Could not access file "" in Hex-Rays decompiler's output. As you can see below,
now its type is char[25] due to inclusion of ...
1
vote
0answers
40 views
Radare2 cannot open bin for writing
Im on Kali and im using Radare2 but it says
r2 -d bin
Killing child process 16151 due to an error
Killing child process 16152 due to an error
[w] Cannot open 'dbg://./bin' for writing.
I tried chmod +...
0
votes
0answers
47 views
Ghidra - search for library usage?
Using Ghidra: if library A imports library B, is there a way to search for all function calls from A into B?
And more specifically: if B exports function foo, how can I find where that specific ...
0
votes
1answer
16 views
How to convert string to a variable in IDA
I have the following string "CreatePipe" and I want to convert it to a variable so I can use x to find all its references:
How can I do it? I am not sure what to choose here:
0
votes
0answers
13 views
Is there any way to find whether a software uses hasp api or hasp envelope?
Is there any method to know whether a software uses hasp envelope or api?
1
vote
0answers
58 views
How to change how the calculated value is shown for registers in Ghidra
I'm currently working on reversing some Sparc code in Ghidra, and calculated register values are shown incorrectly. This is how the line looks in the listing:
add o3, o0=>DAT_00007d88, o0
and I ...
0
votes
2answers
50 views
Ollydbg - bytes in memory different than on disk
I have been analyzing an application and i'm getting confused about something.
When i open an executable with ollydbg; it shows 0xAA byte.
The same executable opened with CFF explorer at same ...
0
votes
1answer
104 views
Why the disassembled code in IDA is different from in xcode? And How to solve unk_xxxx in IDA View?
I have built an executable file (the architecture is ARMv7, the base SDK is iOS), which depended on an xxx.a file in xcode; I don't have the source code of thexxx.a.
I want to check some logic in `xx. ...
0
votes
2answers
48 views
Format of data in the .code/.text section
I'm attempting to dissect/disassemble a windows PE file under Linux using objdump. On surface analysis, the .code section was disassembled to :
tmp.exe: file format pei-i386
Disassembly of ...
0
votes
2answers
87 views
How to identify method order in disassembled C++ object
Here are some chunks:
v13 = cocos2d::FileUtils::getInstance(v9);
(*(void (__fastcall **)(char *))(*(_DWORD *)v13 + 64))(&v46);
v19 = cocos2d::FileUtils::getInstance(fileHandle);
v21 = *(...
0
votes
0answers
28 views
How can I find out where relocated functions are in a Win16 executable in SoftICE?
Backstory: I'm poking through SimTower for Windows to discover the actual logic for how it decides how much alternative background is used for the SimTower lobby floors (the ones with the green ...
0
votes
0answers
49 views
Ghidra: Identify and display a struct broken into multiple smaller fields
Me vs the 90s game, part two.
I'm trying to figure out how the game detects the current date, since that part doesn't work correctly anymore. At some point, GetLocalTime() from kernel32.dll gets ...
0
votes
0answers
63 views
radare2: Print strings in function for 32-bit binaries
I want to see the strings that are printed by the puts() function in the output of radare2's pdf, but it doesn't work. I have a similar problem as mentioned here, but I think it's somehow related to ...
0
votes
0answers
27 views
Indirect calls using registers (IDA)
I need some help. Using IDA for disasembling an executable PE file. It has several indirect calls using registers like call eax. Trying to add breakpoints and get the content of the registers, but ...
5
votes
1answer
176 views
Would hiring a RE service be worth it?
Before I clarify my question, I will explain the project I'm working on, and what I've done so far so there will be a better understanding of what I'm trying to do. I'm trying to modify the UI of a ...
0
votes
0answers
174 views
How to disassemble an obfuscated .NET DLL?
I asked earlier about unpacking a packed .NET exe. But now I need to see the source code for an obfuscated DLL:
Any idea how to unpack it?
0
votes
2answers
76 views
What does the cs register do here?
I've come across this sequence of bytes: 2e 88 38.
Hopper disassembles this as:
mov byte [cs:rax], bh
This online disassembler gives slightly different output:
mov BYTE PTR cs:[rax],bh
Either ...
0
votes
0answers
33 views
Is it possible to Direct3D 9 debug DLL in an app using the release version
I have an application using d3d9.dll, but I want to figure out which functions it calls to gain insight.
Since online tools I have found are incompatible with my app (32-bit d3d9),
is it instead ...
3
votes
2answers
100 views
The compiler adds a function call to user-defined functions. What does the function do? (x64 Windows executable)
Introduction
I compiled a simple executable with Visual Studio in x64 Windows. Source code:
long test(int a, int b, int c, int d, int e, int f, int g, int h, int i, int j) {
printf("%d %d %d&...
1
vote
1answer
124 views
I'm having trouble understanding this specific notation in Ghidra
I'm reversing a code construct I created to learn Ghidra, and it looks different to what it is in GDB. I was wondering if anyone could clarify what the highlighted LEA instruction means: [I don't know ...
1
vote
0answers
28 views
Function Arguments/Name on Radare and IDA
I am starting with reverse engineering and Radare and I'm facing the following problem, on IDA Free I see the following code:
mov ecx, 11h
lea edi, [esp+1208h+StartupInfo]
rep stosd
lea ...
1
vote
1answer
110 views
How to jump to a new empty memory that related to the program to write another code there?
I have a line of code like that ex:MOV EAX, 100, I want to write a little bigger code instead of that code but I can't, so I want to write a jump instruction ex:jmp 0x123456 that jumps to another ...
0
votes
1answer
72 views
Understanding the basics of Reverse Engineering a segment of code
Currently trying to understand the following code and what it is doing.
mov eax, 1
test eax, eax
jz loc_411503
mov esi, esp
call ds:_kbhit
cmp esi, esp
call sub_411159
test ...
2
votes
1answer
49 views
Reversing uboot on an aarch64 Hi3559AV target problems
I am trying to reverse uboot for an ARM aarch64 Hi3559AV target.
I've dumped the binary uboot.bin.gz, and have loaded it in IDA at the correct address. IDA seems to see a lot of strings (and ...
2
votes
0answers
71 views
How can I extract working files (in the form of graphics) from these MZP executables?
There's a 1999 PC/Mac game that I'm hoping to extract assets from. All game data appears to be stored in various files with the extension .rsc. I've been able to extract all the game's audio from the ...
0
votes
0answers
35 views
what do these assembly codes doing? [duplicate]
I tried to reverse engineer an apk app, and it was loading a native code. I have observed that the app was using the native code like this
public static String v = sUQWWyTBEs().toString().substring(32,...
1
vote
0answers
168 views
Getting value of local variable in Ghidra
I've been trying to solve a crackme challenge by examining it's decompiled version by Ghidra.
So I figured the code where the strcmp is done as shown in the figure below. Now I need to to patch the ...
1
vote
0answers
118 views
radare2 unable to run a binary file
I've been trying to debug a binary file in radare2 but it throws me this error.
$ r2 -d bin
Killing child process 1688 due to an error
Killing child process 1689 due to an error
[...
2
votes
1answer
247 views
How to make ghidra display the real offset from rbp
How to make ghidra display the actual offset from rbp in assembly? For the same program, ghidra shows mov dword [rbp + local_c], edi
I want to see the actual offset from rbp instead of local_c
In ...
3
votes
2answers
117 views
Find the entry point in Interrupt Vector Table ARM9
I'm analyzing the firmware of a device that has the cpu ARM946E-S. It has not a file system, just assembly code and strings.
I've disassembled the firmware using ida pro, but I couldn't find the entry ...
1
vote
1answer
145 views
jmp $+5, why the jump
I am looking at some code that has jmp $+5 instruction at the beginning of the entry code in a library, right after pushing registers to the stack. I understand that jmp $+5 puts IP at the next ...
1
vote
0answers
69 views
How to add Instructions (OpCodes) after a If Statement in C#?
I hope someone can help me out with my problem. Currently I'm working with C# and use the library Mono.Cecil to add Instruction Code before a method exits. There is this one case, when a if statement ...
0
votes
0answers
58 views
Assembly to C decompiler
I need an assembly to C decompiler, I tried this one https://onlinedisassembler.com/odaweb/ but my code looks like this:
#include <p16F887.inc>
cblock 0x20
Delay1 ; Assign an ...
1
vote
0answers
39 views
Automotive engine management - reversing a PIN that has locked an MTX8 ECU
I'm after advice on how to identify a PIN that has been accidently entered and has locked an automotive ECU making it useless. The problem is resolvable by sending the computer back to the ...
3
votes
2answers
188 views
What does this ARM assembly code do?
I'm trying to figure out the password that is used to access the U-Boot shell, as mentoined in my previous question.
I'm having trouble understanding how exactly the code works.
Here is an image of ...
0
votes
1answer
90 views
A question about moving data with LEA and MOV
Given the above code, i am struggling to understand what happens in line 5 and 6
As i understand it, in line 5 the Adress of the ESP is loaded into the EAX register. While there may be the value 4 ...
0
votes
0answers
29 views
Ghidra Using __stdcall for all my Mips64 functions do I have to manually change them all?
Compiled in mips4 this is a unix driver elf object.
*************************************************************
* ...
0
votes
0answers
105 views
Loading a U-Boot ARM flash image into IDA Pro
I have a U-Boot image file which was extracted from flash memory of a board with an Hi3520D ARM CPU. I would like to load this file into IDA Pro and dig out the password that is required for accessing ...
1
vote
1answer
282 views
devirtualize? or what is this obfuscator? and how to get rid of this
from previous question i still dont get any info or any process at all... now i asking again with this question is this virtualize code or something? i try many thing and it still didnt work [i unpack ...
1
vote
1answer
60 views
IDA Pro - How to remove multi-line bit definitions for register
I've just started reversing some microcontroller code and have the RAM, ROM, and SFR (Special Function Registers) segments set up. I've selected my processor architecture and it has named most of the ...
1
vote
0answers
34 views
How do I disassemble mips .o object files in ida elf 64bit
So I’m trying to disassemble some object files in mips. I use IDA 7 on windows. These object files are loadable kernel modules. Mipself64 Is What ida auto sets to when they are dropped in. I’d like to ...
2
votes
2answers
80 views
Changing value of parameter with gdb
I have a file named exploit.c inside which:
#include <stdbool.h>
#include <stdio.h>
const char y1 = 'a';
const char y2 = 'b';
const char y3 = 'x';
const char y4 = 'y';
const char y5 = 'i';...
3
votes
1answer
49 views
Confused about the use of the shl instruction in this disassembly
I created a code construct in C to see how it looks in x86. I'm confused about the use of the shl instructions. I'm confused about what is happening in between the lines <+39> and <+51> I ...
1
vote
1answer
86 views
Disassembly call function offset from RIP
I am writing a program where I map an .exe PE file in memory and I "dissect" it.
I am disassembling the .text section of the target executable, using the distorm disassembler.
CALL ...
2
votes
1answer
154 views
Help regarding XOR game decryption algorithm
I'm currently trying to reverse engineer the decryption algorithm for an old online game, using a chat message packet, as it contains text which is easily recognizable.
I used a packet sniffer to get ...
1
vote
2answers
65 views
I'm confused about parameter in Printf function
I'm trying to understand call conventions and such. I created a function with the source code
#include <stdio.h>
int main() {
int x = 9;
printf("%d\n", x);
}
The above screenshot ...