Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

162 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
9
votes
0answers
623 views

Extracting strings from Go binaries

Is there an easy way to extract all of the strings from Go binaries that will work cross architecture? The problem with Go is that strings are stored without a null terminator, so you can't use the &...
6
votes
0answers
647 views

Reliable way to recognize STL template classes?

Since the template classes are different between instantiation, it is extremely difficult for library recognition using universal patterns. But the control flow graph and references to system call of ...
6
votes
0answers
461 views

How does my S62 engine utilize MAF sensors to convert voltage to mass flow?

We're trying to solve a puzzle on one of the automotive forums regarding how the BMW S62 engine utilizes its two MAF (mass air flow) sensors to determine the air mass flow entering the engine. This ...
5
votes
0answers
187 views

Radare2 8051 code bank switching

Some of 8051 chips use bank switching to extend accessible code memory. Good example is Silabs C8051F12x. Another example is here. Code area in range 0x0000..0x7ffff is common always accessible code ...
5
votes
0answers
979 views

I'm trying to debug small mips code snippets in IDA with QEMU as debugger, but only NOP instructions show when I start the process

I followed the tutorial IDA Help: Debugging code snippets with QEMU. It always worked with ARM code, but now I have to reverse some MIPS and only nops are displayed like this: Should I adjust ...
4
votes
0answers
257 views

Legality of publishing decompiled code

The situation is the following: Binary file of a computer game from the 1980s. The binary file ran on a platform that doesn't exist anymore (not x86). The binary file does not contain any symbols or ...
3
votes
0answers
2k views

Unpack, modify and rebuild an Android App Bundles (.aab) file

I would like to unpack an .aab file, decompile/recompile the classes.dex (baksmali/smali), edit the manifest and, finally, generate a new .aab file. Basically, I am looking for an apktool for .aab
3
votes
0answers
625 views

disassembly - bad results generated with ghidra but not with objdump and IDA

I am using Ghidra to analyze libpng-compat.1.5.10.so (downloaded from Fedora mirrors). But it didn't load the expected disassembly. Then I used Objdump and IDA to check the code and they get the same ...
3
votes
1answer
143 views

Review a collection of executable binaries to determine similarity

I have a collection of different binaries I want to review for code similarity and classification, but I would rather not have to open each of them in IDA and manually review the code in 15 different ...
3
votes
1answer
182 views

Reconstructing Assembly Truth Map

So I recently read [1] which evaluates several disassemblers. The truth/test binaries are generated by the SPEC CPU 2006 Benchmark suite. The authors provide detailed build instructions for the ELF ...
3
votes
0answers
518 views

Is there an existing tool to reverse engineer Xamarin AOTDATA files?

I am currently examining a xamarin application. It has used the "ahead of time compilation" feature, which has left some of the associated .net assemblies (.dlls) as lists of function signatures ...
3
votes
0answers
991 views

Reverse-engineering DOS game's data files

I would like to figure out the data format used by an old DOS game I used to play when I was a kid. That link includes a full download for all the files and it runs fine in DOSBox if you want to try ...
3
votes
0answers
188 views

Comparing two UEFI applications?

I have two x86-64 UEFI applications original.efi and patched.efi. I want to find out what have been changed in patched.efi and what these changes do. I have tried to use the Radare2 framework to ...
3
votes
0answers
151 views

Reading SCSI Command Description Block in software

I have made a hardware control interface for my vintage Yamaha CBX-D5 audio recording processor. using MIDI SysEx commands.I managed to find out most of it's inner workings. I programmed SysEx in ...
3
votes
0answers
243 views

Giving labels to local variables with GDB

In the GDB debugger of Linux, is it possible to give a local variable (at specific offset from the %esp register) a constant name, which I will see everytime I call disassemble instead of seeing the ...
3
votes
0answers
2k views

Analysing eCos image

I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step. This is the current uncompressed image: https://www.dropbox.com/s/...
3
votes
0answers
148 views

Tools and techniques for analyzing NaCL binaries?

Are there any tools, tutorials, or resources out there for helping to make sense of NaCL binaries? They have some features that should make things easier – most crucially, fully decidable disassembly ...
3
votes
1answer
567 views

Fixing ghidra decompilation

i am working a little bit with Ghidra. My assembly code doesn't match with the decompiled code: * FUNCTION * ...
2
votes
0answers
73 views

How can I extract working files (in the form of graphics) from these MZP executables?

There's a 1999 PC/Mac game that I'm hoping to extract assets from. All game data appears to be stored in various files with the extension .rsc. I've been able to extract all the game's audio from the ...
2
votes
2answers
82 views

Changing value of parameter with gdb

I have a file named exploit.c inside which: #include <stdbool.h> #include <stdio.h> const char y1 = 'a'; const char y2 = 'b'; const char y3 = 'x'; const char y4 = 'y'; const char y5 = 'i';...
2
votes
0answers
454 views

How to use Ghidra to work with VM obfuscated binaries?

By "VM obfuscated binary", I mean a binary that contains one or more implementations of a VM internally, and also some bytecode that can run on this VM. One of the reasons why this binary is this way, ...
2
votes
0answers
37 views

80188 relocation register mystery

I'm reverse engineering an embedded system using the 80C188 and the way the relocation register (RELREG) is used mystifies me. One of the first steps at initialization is to move the processor ...
2
votes
0answers
136 views

submitting input into AFL fuzzer

I have some questions about the AFL Fuzzer: How does the AFL Fuzzer know where to inject the payload in the code I compile? For instance if I want to inject it in a specific parameter, how do I do it?...
2
votes
1answer
289 views

How to make IDA processor for file format with tree structure

Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on. However when it comes to tree-structured file format, I can't come up with a ...
2
votes
1answer
146 views

What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump

I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array. First 6 headers are shown below from readelf Program Headers: Type Offset ...
2
votes
0answers
89 views

Determine what architecture a piece of shellcode targets

After some personal research I didn't find any possible way or a paper to explain how to determine what architecture a given piece of shellcode may targets. The only obvious way I found would be to ...
2
votes
0answers
252 views

Ghidra - Export namespaces

I am currently learning to use ghidra, and I found the Symbol Tree. Ghidra found some namespaces that I would like to export. These namespaces don't even have to be readable, just reusable, such that ...
2
votes
0answers
111 views

Which architecture is this firmware?

I am currently investigating GSL touch-screen controllers firmwares. A firmware example can be found here : https://github.com/onitake/gsl-firmware/blob/master/firmware/4good/t803i/silead_ts.fw In ...
2
votes
0answers
345 views

Unable to figure out how to map segments in IDA

I have a 2 MB executable that I'm attempting to reverse engineer. It's executed on a 16-bit 8086 CPU. The segments go from 4000 (0x140000) to F000 (0x1F0000). I'm attempting to map the segments in ...
2
votes
0answers
381 views

Show parameters stored in stack with __fastcall in IDA

This is an extension of my previous question. Here is a sample of assembly in x64 Windows executable using COM virtual function with __fastcall convention. mov [rsp+32], rdx ...
2
votes
0answers
141 views

Hopper: What does stack[xxxx] mean?

When using the 'decompiler' tool in Hopper on the start function of an application it shows this: What does the stack[2043] mean, is it 2043 bytes from the top of high memory and its assigning it to ...
2
votes
0answers
173 views

Radare2 - recursive traversal visual mode

I know that both pdf @ func and pdr @ func disassemble the function, the first using linear and the second recursive traversal disassembly. VV @ func shows the disassembled function in visual mode, ...
2
votes
0answers
1k views

Ducky Mini Firmware Hacking

This is my first reverse engineering project! I recently bought a Ducky Mini keyboard, which is controlled by an ARM Cortex-M3 SoC (to be specific, a Holtek HT32F1655,) and noticed that other ...
2
votes
0answers
470 views

How to propagate an enum type in IDA Pro?

I'd like to mark some data as being an enum, and have that automatically propagate to all uses of this piece of data. Both direct accesses to the data (e.g. cmp data_with_enum_type, enum_value), and ...
2
votes
0answers
942 views

IDA Pro user-defined offsets (again)

I'm disassembling a simple Z80 program and can't for the life of me work out how to - successfully - specify a user-defined offset. I have a line of code as: ld de, #0x6058 and FTR, this address ...
2
votes
0answers
246 views

How to include these exception handle symbols in x86 assembly code?

The test is on 32bit x86 Linux, with g++ 4.6.3. So basically I use a IDA pro script to recover the .gcc_excpt_table and .eh_frame sections from binary compiled from C++ language. Basically I want to ...
2
votes
0answers
2k views

Unpacking Inno Setup installers with InnoExtractor?

I want to know how to use the application InnoExtractor to unpack/extract the files of Inno Setup installers. Some good tutorial/video to learn? I get this application from here.
2
votes
0answers
2k views

Unpacking and disassembling mach-o binary

I am trying to reverse an OSX mach-o binary, Disassembling gives me a bullshit, seems its encrypted with some packer. I need to determine the encryption algorithm, and decrypt the binary. Load ...
2
votes
0answers
229 views

What is the difference between Software Architecture Recovery and Software Remodularization in the context of Reverse Engineering?

In the reverse engineering scenario, after extracting a representation of the code, it is often useful to recover/ reconstruct the architecture of the software (for eg. when reverse engineering java ...
2
votes
1answer
276 views

How to debug an application (exe) freeze and crash?

I have an app (and I don't know the source code), that freeze and crash everytime it loses focus (but the music continue). I've tried to debug it using windbg but it doesn't change anything, and I don'...
1
vote
0answers
75 views

Pascal string representation in Hex-Rays Decompiler of IDA Pro

I'm trying to prettify a representation of Pascal-string "Could not access file "" in Hex-Rays decompiler's output. As you can see below, now its type is char[25] due to inclusion of ...
1
vote
0answers
53 views

Radare2 cannot open bin for writing

Im on Kali and im using Radare2 but it says r2 -d bin Killing child process 16151 due to an error Killing child process 16152 due to an error [w] Cannot open 'dbg://./bin' for writing. I tried chmod +...
1
vote
0answers
60 views

How to change how the calculated value is shown for registers in Ghidra

I'm currently working on reversing some Sparc code in Ghidra, and calculated register values are shown incorrectly. This is how the line looks in the listing: add o3, o0=>DAT_00007d88, o0 and I ...
1
vote
0answers
29 views

Function Arguments/Name on Radare and IDA

I am starting with reverse engineering and Radare and I'm facing the following problem, on IDA Free I see the following code: mov ecx, 11h lea edi, [esp+1208h+StartupInfo] rep stosd lea ...
1
vote
1answer
111 views

How to jump to a new empty memory that related to the program to write another code there?

I have a line of code like that ex:MOV EAX, 100, I want to write a little bigger code instead of that code but I can't, so I want to write a jump instruction ex:jmp 0x123456 that jumps to another ...
1
vote
0answers
206 views

Getting value of local variable in Ghidra

I've been trying to solve a crackme challenge by examining it's decompiled version by Ghidra. So I figured the code where the strcmp is done as shown in the figure below. Now I need to to patch the ...
1
vote
0answers
152 views

radare2 unable to run a binary file

I've been trying to debug a binary file in radare2 but it throws me this error. $ r2 -d bin Killing child process 1688 due to an error Killing child process 1689 due to an error [...
1
vote
1answer
165 views

jmp $+5, why the jump

I am looking at some code that has jmp $+5 instruction at the beginning of the entry code in a library, right after pushing registers to the stack. I understand that jmp $+5 puts IP at the next ...
1
vote
0answers
73 views

How to add Instructions (OpCodes) after a If Statement in C#?

I hope someone can help me out with my problem. Currently I'm working with C# and use the library Mono.Cecil to add Instruction Code before a method exits. There is this one case, when a if statement ...
1
vote
0answers
41 views

Automotive engine management - reversing a PIN that has locked an MTX8 ECU

I'm after advice on how to identify a PIN that has been accidently entered and has locked an automotive ECU making it useless. The problem is resolvable by sending the computer back to the ...