Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

154 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
8
votes
0answers
266 views

Extracting strings from Go binaries

Is there an easy way to extract all of the strings from Go binaries that will work cross architecture? The problem with Go is that strings are stored without a null terminator so you can't use the "...
6
votes
0answers
628 views

Reliable way to recognize STL template classes?

Since the template classes are different between instantiation, it is extremely difficult for library recognition using universal patterns. But the control flow graph and references to system call of ...
6
votes
0answers
445 views

How does my S62 engine utilize MAF sensors to convert voltage to mass flow?

We're trying to solve a puzzle on one of the automotive forums regarding how the BMW S62 engine utilizes its two MAF (mass air flow) sensors to determine the air mass flow entering the engine. This ...
5
votes
0answers
152 views

Radare2 8051 code bank switching

Some of 8051 chips use bank switching to extend accessible code memory. Good example is Silabs C8051F12x. Another example is here. Code area in range 0x0000..0x7ffff is common always accessible code ...
5
votes
0answers
928 views

I'm trying to debug small mips code snippets in IDA with QEMU as debugger, but only NOP instructions show when I start the process

I followed this tutorial https://www.hex-rays.com/products/ida/support/idadoc/1588.shtml. It always worked with ARM code, but now I have to reverse some MIPS and only nops are displayed like this: ...
3
votes
0answers
129 views

Legality of publishing decompiled code

The situation is the following: Binary file of a computer game from the 1980s. The binary file ran on a platform that doesn't exist anymore (not x86). The binary file does not contain any symbols or ...
3
votes
0answers
403 views

disassembly - bad results generated with ghidra but not with objdump and IDA

I am using Ghidra to analyze libpng-compat.1.5.10.so (downloaded from Fedora mirrors). But it didn't load the expected disassembly. Then I used Objdump and IDA to check the code and they get the same ...
3
votes
1answer
117 views

Review a collection of executable binaries to determine similarity

I have a collection of different binaries I want to review for code similarity and classification, but I would rather not have to open each of them in IDA and manually review the code in 15 different ...
3
votes
1answer
135 views

Reconstructing Assembly Truth Map

So I recently read [1] which evaluates several disassemblers. The truth/test binaries are generated by the SPEC CPU 2006 Benchmark suite. The authors provide detailed build instructions for the ELF ...
3
votes
0answers
491 views

Is there an existing tool to reverse engineer Xamarin AOTDATA files?

I am currently examining a xamarin application. It has used the "ahead of time compilation" feature, which has left some of the associated .net assemblies (.dlls) as lists of function signatures ...
3
votes
0answers
912 views

Reverse-engineering DOS game's data files

I would like to figure out the data format used by an old DOS game I used to play when I was a kid. That link includes a full download for all the files and it runs fine in DOSBox if you want to try ...
3
votes
0answers
188 views

Comparing two UEFI applications?

I have two x86-64 UEFI applications original.efi and patched.efi. I want to find out what have been changed in patched.efi and what these changes do. I have tried to use the Radare2 framework to ...
3
votes
0answers
143 views

Reading SCSI Command Description Block in software

I have made a hardware control interface for my vintage Yamaha CBX-D5 audio recording processor. using MIDI SysEx commands.I managed to find out most of it's inner workings. I programmed SysEx in ...
3
votes
0answers
219 views

Giving labels to local variables with GDB

In the GDB debugger of Linux, is it possible to give a local variable (at specific offset from the %esp register) a constant name, which I will see everytime I call disassemble instead of seeing the ...
3
votes
0answers
1k views

Analysing eCos image

I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step. This is the current uncompressed image: https://www.dropbox.com/s/...
3
votes
0answers
143 views

Tools and techniques for analyzing NaCL binaries?

Are there any tools, tutorials, or resources out there for helping to make sense of NaCL binaries? They have some features that should make things easier – most crucially, fully decidable disassembly ...
3
votes
1answer
269 views

Fixing ghidra decompilation

i am working a little bit with Ghidra. My assembly code doesn't match with the decompiled code: * FUNCTION * ...
2
votes
0answers
263 views

How to use Ghidra to work with VM obfuscated binaries?

By "VM obfuscated binary", I mean a binary that contains one or more implementations of a VM internally, and also some bytecode that can run on this VM. One of the reasons why this binary is this way, ...
2
votes
0answers
32 views

80188 relocation register mystery

I'm reverse engineering an embedded system using the 80C188 and the way the relocation register (RELREG) is used mystifies me. One of the first steps at initialization is to move the processor ...
2
votes
0answers
107 views

submitting input into AFL fuzzer

I have some questions about the AFL Fuzzer: How does the AFL Fuzzer know where to inject the payload in the code I compile? For instance if I want to inject it in a specific parameter, how do I do it?...
2
votes
1answer
125 views

What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump

I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array. First 6 headers are shown below from readelf Program Headers: Type Offset ...
2
votes
0answers
71 views

Determine what architecture a piece of shellcode targets

After some personal research I didn't find any possible way or a paper to explain how to determine what architecture a given piece of shellcode may targets. The only obvious way I found would be to ...
2
votes
0answers
279 views

Unable to figure out how to map segments in IDA

I have a 2 MB executable that I'm attempting to reverse engineer. It's executed on a 16-bit 8086 CPU. The segments go from 4000 (0x140000) to F000 (0x1F0000). I'm attempting to map the segments in ...
2
votes
0answers
273 views

Show parameters stored in stack with __fastcall in IDA

This is an extension of my previous question. Here is a sample of assembly in x64 Windows executable using COM virtual function with __fastcall convention. mov [rsp+32], rdx ...
2
votes
0answers
123 views

Hopper: What does stack[xxxx] mean?

When using the 'decompiler' tool in Hopper on the start function of an application it shows this: What does the stack[2043] mean, is it 2043 bytes from the top of high memory and its assigning it to ...
2
votes
0answers
172 views

Radare2 - recursive traversal visual mode

I know that both pdf @ func and pdr @ func disassemble the function, the first using linear and the second recursive traversal disassembly. VV @ func shows the disassembled function in visual mode, ...
2
votes
0answers
1k views

Ducky Mini Firmware Hacking

This is my first reverse engineering project! I recently bought a Ducky Mini keyboard, which is controlled by an ARM Cortex-M3 SoC (to be specific, a Holtek HT32F1655,) and noticed that other ...
2
votes
0answers
448 views

How to propagate an enum type in IDA Pro?

I'd like to mark some data as being an enum, and have that automatically propagate to all uses of this piece of data. Both direct accesses to the data (e.g. cmp data_with_enum_type, enum_value), and ...
2
votes
0answers
900 views

IDA Pro user-defined offsets (again)

I'm disassembling a simple Z80 program and can't for the life of me work out how to - successfully - specify a user-defined offset. I have a line of code as: ld de, #0x6058 and FTR, this address ...
2
votes
0answers
242 views

How to include these exception handle symbols in x86 assembly code?

The test is on 32bit x86 Linux, with g++ 4.6.3. So basically I use a IDA pro script to recover the .gcc_excpt_table and .eh_frame sections from binary compiled from C++ language. Basically I want to ...
2
votes
0answers
2k views

Unpacking Inno Setup installers with InnoExtractor?

I want to know how to use the application InnoExtractor to unpack/extract the files of Inno Setup installers. Some good tutorial/video to learn? I get this application from here.
2
votes
0answers
2k views

Unpacking and disassembling mach-o binary

I am trying to reverse an OSX mach-o binary, Disassembling gives me a bullshit, seems its encrypted with some packer. I need to determine the encryption algorithm, and decrypt the binary. Load ...
2
votes
0answers
225 views

What is the difference between Software Architecture Recovery and Software Remodularization in the context of Reverse Engineering?

In the reverse engineering scenario, after extracting a representation of the code, it is often useful to recover/ reconstruct the architecture of the software (for eg. when reverse engineering java ...
2
votes
1answer
56 views

How to debug an application (exe) freeze and crash?

I have an app (and I don't know the source code), that freeze and crash everytime it loses focus (but the music continue). I've tried to debug it using windbg but it doesn't change anything, and I don'...
1
vote
0answers
79 views

Right way to reverse a VM

I'm currently reversing a virtualized sample that uses a custom VM bytecode. After defeating the anti-disassembly tricks I'm finally faced with the vm_dispatch function. I have to figure out the ...
1
vote
0answers
27 views

Edit ASCII value in Assembler (using Immunity Debugger)

I am trying to edit ASCII String via Immunity Debugger: However when I right click to do binary edit and then I click ok, the MOV DWORD instruction is replaced with some random instruction which ...
1
vote
0answers
209 views

Unpack, modify and rebuild an Android App Bundles (.aab) file

I would like to unpack an .aab file, decompile/recompile the classes.dex (baksmali/smali), edit the manifest and, finally, generate a new .aab file. Basically, I am looking for an apktool for .aab
1
vote
0answers
52 views

How to parse objdump output data?

I'm somehow newbe in reverse engineering and currently I'm reading RE4B book. In the image above: I can't figure out the role of s in the functions f1 and f2. As far as I know, based on the last ...
1
vote
0answers
67 views

CRC16 Reverse in C166 Arch

Before that I asked about piece of code that used in this algorithm (here). Now I have a bit problem with the rest of algorithm. So I have to describe this with detail. Sorry if i vast your time for ...
1
vote
1answer
106 views

How to find DOS Header and PE Header with an entry point in Radare2?

I am currently doing byte extraction from PE files using Radare2. I know how to find the byte sequence for Dos Header and PE Header when there is no entry point and the start is defaulted to 0x0. But ...
1
vote
0answers
45 views

IDA 7.0: Why does editing this function result in red-marked stack-pointer offsets?

I tried to fix the size of both the saved registers and the local variable area using IDA's "Edit function" option as IDA could not recognize it properly by itself. Unedited function: Corrected ...
1
vote
0answers
54 views

ARM chip gpio/ identification from firmware code

Device: i was able to recover bricked Chinese IOT a Sous Vide cooker. Replaced damaged capacitor. it works. it has ARM soc/mcu/processor WI-FI (broadcom) LCD touch screen + 16bit STM mcu. EEPROM ...
1
vote
0answers
59 views

What to do with a text file of disassembly code and binaries?

I am fairly new to software reverse engineering and I'd like to know how proceed with analyzing a program if I have a text file of disassembly code and a bin file of binary data. I understand ...
1
vote
1answer
70 views

What is the mdisp field in RTTI for throw used for?

First of here is the article from which I'm looking up the fields. I was trying out different combinations to see how they affect the RTTI for a C++ throw. It seems that having a virtual base class ...
1
vote
1answer
178 views

Adding a static variable to Windows DLL

I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls. I ...
1
vote
1answer
801 views

Renaming variables radare2

I have a variable called var_14h in disassemble code. I want to rename this variable. I try to rename the variable by using the following afvn var_14h i However, radare complains and returns an ...
1
vote
0answers
62 views

Strange function in Disassembly (IDA)

I was reversing one executable in IDA and found out the function with this structure: .text:0058A6E0 sub_58A6E0 proc near .text:0058A6E0 .text:0058A6E0 var_4 = dword ptr ...
1
vote
0answers
53 views

Find High Entropy VA (64-bit ALSR) Incompatibility in Disassembly

Have a 64-bit plugin DLL (no source code) and the host application in an update changed its DLL characteristic to include "high-entropy 64-bit address space layout randomization (ASLR)" When this is ...
1
vote
0answers
71 views

TMS320VC5416 DSP firmware reversing

I have file with DSP firmware inside. Each chunk of code or data is preceded by header with format "page,offset,length".See below full list of headers: page: 0000 offset: 0080 len: 0149 page: 0000 ...
1
vote
0answers
40 views

Is it possible to define the adress of a function in assembly?

I am creating a PoC for anti-disassembly techniques, and I would like to know if there were ways to define the address of functions once compiled with gcc. Here is the PoC program : BITS 32 EXTERN ...