Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

Filter by
Sorted by
Tagged with
7
votes
2answers
3k views

How to recover information stored in .ctors section?

Test is on x86, 32-bit Linux. I am using g++ 4.6.3 and objdump 2.22 Here is a simple C++ code I am working on: #include <iostream> using namespace std; main() { cout << "Hello ...
5
votes
1answer
9k views

How to find main() in binary?

Given a binary and only using a tool like ndisasm, how can I find main()? I don't want to use smart tools like IDA Pro because I'm doing this exercise to learn.
5
votes
2answers
3k views

Rebuild symbol table

I would like to load a function I have decompiled in IDA Pro. All I have is the IDA Pro function name sub_xxxx() and obviously the address. I had thought about using dlopen to load the binary but ...
5
votes
2answers
4k views

Ida Pro: parsig complex operand expression using Idapython

Say given the following line in Ida Pro: mov [rsp+3F8h+var_3F8], 0 How can I parse and access the items inside the [ ]? What I tried: idc.GetOpnd(addr, n) # returns a string '[rsp+3F8h+...
2
votes
1answer
485 views

Reversing video protocol for chinese drone so i can view the stream outside of the app

I am trying to view the video stream of the vento protocol air drone on my computer. The final goal is to get the video stream into python or c++ for opencv; however, if i can just view it in a ...
7
votes
1answer
2k views

String extraction from an iNES ROM dump

I want to extract the strings in Shadowgate for NES. I ran file on the image and then strings, no luck. I found some information about the NES cartridge file format. The docs mention the use of “Name ...
7
votes
1answer
2k views

Parsing IDA Pro .asm files

Does anyone know of projects that parse the disassembly from IDA Pro using a lexer and/or parser generator library? But I would also totally be fine with JSON or XML format. So far, I have been able ...
7
votes
2answers
984 views

IL for decompiler to human-readable format

After writing my own disassembler, I am now looking to making its assembly listing more human readable, e.g. from an (artificial) example push ebp mov ebp, esp sub esp, 10h mov eax, ...
5
votes
2answers
2k views

Assembly Code - GCC optimized vs not

I want to learn more about how GCC optimizes C programs. I have did a disas of a random function both optimized and unoptimized and I want to look at some of the differences. Off the top of my head, ...
5
votes
1answer
3k views

Disassembling VxWorks Firmware

I am trying to disassemble the firmware for the Cisco Sx300 switch as found here: https://software.cisco.com/download/release.html%3Fmdfid%3D283019611%26softwareid%3D282463181%26release%3D1.2.7.76 ...
5
votes
1answer
1k views

Are there any free disassemblers for the NEC 78K0R family of processors?

Another slightly esoteric microcontroller in a product I'm looking at - the NEC 78K0R microcontroller. This is a 16-bit extension of the 78K0. The 78K0 can be disassembled in IDA Pro, but not the ...
5
votes
4answers
41k views

Modify code with ILSpy

I want to modify an exe a little bit. With ILSpy I see all the code that I need but I don't know how to modify the code. I tried "save code" on ILSpy that exports a .cs file, but when I open the .cs ...
4
votes
1answer
795 views

Getting list of opcodes from PANDA trace

As answer to the post "Using QEmu monitor interface to extract execution traces from a binary?", one of the PANDA authors outlined how QUEMU may be used to record execution traces. I would like to do ...
3
votes
1answer
2k views

How to dissassemble Motorola/Freescale/NXP PowerQUICC excutable

I have a probably executable file for Motorola/Freescale/NXP PowerQUICC MPC860 and cannot disassemble it with IDA Pro since I cannot find the correct processor type in IDA?! IDA list MPC860 as ...
3
votes
1answer
2k views

How to find start of .text section?

i made a random console application and loaded into IDA. The start of .text section shown is 00BA1000. Then i loaded the application into CFF explorer. The address of entry point was 000110AA. Is it ...
3
votes
1answer
970 views

Good foundation for reverse engineering malware

I have been intrigued by reverse engineering recently and just finished Paul Carter's PC Assembly Language book (http://pacman128.github.io/static/pcasm-book.pdf) which was a great primer for x86. My ...
2
votes
2answers
9k views

OllyDbg: How to set conditional breakpoint on a register value?

I want to set a breakpoint when the register EAX references a specific Unicode string, e.g. "Enter". In Ollydbg there is usually right beside the EAX value a string that says "ASCII: Enter ". I read ...
11
votes
1answer
9k views

Where can I find tools for reverse engineering Lua

Since Lua is an interpreted/compiled language that its own compilers and isn't usually translated/compiled with a C compiler. What tools should be used to reverse engineer an application written in ...
11
votes
3answers
8k views

Reverse engineer an old DOS QBasic executable

I recently decided to try my hand at reverse engineer an old DOS text based game that was coded in QBasic. I found some info online about old DOS games disassembly but mostly for Wacom compiled C/C++ ...
4
votes
1answer
8k views

What do the following ARM instructions mean?

I have some ARMv7 instructions that I do not understand, despite reading the reference at: ARM Information Center In the context of: a7a4d8: b530 push {r4, r5, lr} a7a4da: 466c ...
4
votes
1answer
438 views

Reverse Engineering bios of ATM Machine

I bought an Hyosung NH1500 off Offer-up and it boots up and initializes some peripherals and then spits out and error of "COM download is failed". I've searched Google and 0 results came up, I've been ...
4
votes
4answers
1k views

Why addresses of variable on stack are not consecutive?

The code below is generated by gcc from a simple scanf program. My question is that Why these 3 addresses of variables are not consecutive when allocated? If not, when could I speculate the number ...
3
votes
1answer
260 views

Instruction set for code snippet?

I'm looking for the CPU/Instruction-Set of a closed embedded system. Code snippet: E6 F2 F3 15 E6 F3 0A EF E6 F8 9B 7F E6 F9 5B D5 0D 32 49 94 EA 30 60 71 What I know: E6 Fx is "LDR 16-Bit-...
3
votes
1answer
309 views

ELF x86 - Why is return address pushed twice?

I reverse an ELF x86, and I would like to understand why the return address is pushed again on the stack? It should be already present there. main: lea ecx, [esp+0x4 {argc}] and esp, 0xfffffff0 ...
3
votes
0answers
2k views

Analysing eCos image

I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step. This is the current uncompressed image: https://www.dropbox.com/s/...
2
votes
1answer
2k views

disassemble elf file created by msfvenom

i create elf with this command: (Dowanlod file - is elf32) msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=127.0.0.1 LPORT=5150 -f elf -o ./rt and it works nicely, and i want disassemble it but ...
1
vote
1answer
99 views

Trying to reverse engineer CmpFindNlsData of winload

I have a basic understanding of assembly language and I'm unable to perfectly define the algorithm of winload!CmpFindNlsData looking at the disassembly. Basically I need to understand how NLS data is ...
1
vote
1answer
2k views

How to Modify this Branch in ARM64?

I try to modify the branch of this disassembly in a binary: SUB SP, SP, #0x60 STP X26, X25, [SP,#0x50+var_40] STP X24, X23, [SP,#0x50+var_30] STP X22, ...
1
vote
1answer
63 views

How to turn off XREF comments in Ghidra's disassembly view?

Sometimes a function will have a series of XREF comments next to it in the disassembly view such as in the following example: ******************************************************...
1
vote
2answers
2k views

how data types and variables are converted to machine code?

I know that every x86 instruction has an opcode for that, but I don't know how data types and variables are converted to machine code. So I tried to figure out. I wrote a simple C program and ...
1
vote
2answers
161 views

Real-time changes of executable on IDE/Assembler

I'm new on this, sorry for bad usage of terms or overextending an explanation. I'm learning code languages and the way I found to bring it to my world so I can learn it better was coding for/with ...
1
vote
2answers
2k views

Find messagebox string with ollydbg

For some reason i can't find any string matching the MessageBox text of a program when searching with "search all reference strings" , why is that?
0
votes
1answer
489 views

Dumpbin: Correlating thunk jumps in .reloc to disassembly

I have an application that I am auditing that runs code from an imported DLL. Said DLL itself has imports. Specifically, during execution there's a point where the following is called (EIP is in said ...
0
votes
1answer
382 views

Can GUI elements of a running program be found/located in memory?

Is it possible for a particular GUI element of a running program (on Windows platform) to be located in memory, such as a text element from a dialog box? For example, locating title text of a drop-...
-1
votes
2answers
8k views

Reverse engineering zip file

Is it possible to reverse engineer ZIP file with password, and get the password or the data that is containing. I'm wondering because there is challenge in hacking lab which is to extract file from ...
7
votes
1answer
5k views

BYTE3, does it mean the third or fourth byte of an int? IDB file that's already supplied

I've got a program that i'm trying to debug a little bit by trying to make sense of a function or two, there's already some info that i've downloaded via a idb file and it's helped me get somewhere. ...
6
votes
1answer
914 views

How to get IDA Pro Free to automatically change segment on retf?

I have been unable to get IDA pro to do a simple disassembly of a flat 16-bit binary (bootloader) file. I'm just getting started, and it seems to be harder than it should be. There's a simple set of ...
5
votes
1answer
538 views

How can the problem posed for disassembly by the mixture of executable code and literal pools in ARM firmware be overcome?

Context and Background Information Part 1: ARM firmware compared to firmware for other architectures I looked at the ARM firmware in these two questions: Running a binary identified as an ARM ...
5
votes
2answers
1k views

Optimization of strcpy at the assembler level

I'm writing small C programs to teach myself how to use GDB to disassemble code. The C in question is: void function( char **pointer ) { *pointer = malloc(100); strcpy(*pointer,"This is text");...
4
votes
1answer
837 views

How to figure out method argument sizes and types in elf32-i386 disasembly?

Consider folowing example code: program code build/program-x86: file format elf32-i386 Disassembly of section my_text: 080a9dfc <subroutine_fnc>: 80a9dfc: 55 push ...
4
votes
1answer
2k views

How to display the CFG of a function in Ghidra?

I am currently trying Ghidra and, I am looking at a specific function. I have the assembly code and the decompiled version of it. But, I am looking to see if I can have it as a CFG... Does someone ...
4
votes
1answer
286 views

How to make Freescale imx233 mp3 player boot with identical type player firmware.sb?

Goal: 1 - To load a older version of the firmware on the device because it has features the newer version does not. 2 - To set the player up as a multi-boot (U-boot). key press for original OS or my ...
4
votes
1answer
1k views

Insert jmp detour into a compiled program

I've seen references on Stack Exchange and elsewhere to inserting detours into compiled code. My understanding is that essentially a jmp instruction is inserted and then somehow the patched program is ...
4
votes
1answer
393 views

How to deal with this "error" instructions generated by objdump?

So basically I am using objdump to disassemble a binary from GNU Coreutils, on 32-bit Linux x86. In the disassembled code, I found one "broken" instruction like this: 804b4db: ff 24 85 e4 09 ...
3
votes
2answers
768 views

Can I provide bytes to Radare to be disassembled?

Let's say I want to check this guys work. He says that he is getting 8d 15 c8 90 04 08 lea 0x80490c8,%edx ba c8 90 04 08 mov $0x80490c8,%edx Is there an easy way with Radare to ...
3
votes
2answers
696 views

Translating a Korean Exclusive PS2 game ~ hangeul encoding?

I got my hands on a copy of Mystic Nights, a survival horror game for the PS2 realeased exclusively in Korea. The game's text is all in Hangeul (Korean writting system). I extracted the ISO and ...
3
votes
3answers
4k views

Detecting packed 64-bit Windows Portable Executable (EXE) files

What programs are the most useful to detect if a 64-bit PE file has been packed (main focus is on EXE files). I am not interested in the packer used I would just like to know if the file is packed or ...
3
votes
3answers
5k views

Exe protection by TLS callback, trying to understand the behaviour

I have an app, obfuscated by FSG protector. When i tried to unpack it, the first thign that i had is, when i start the process with the debugger/or attach debugger later, i immediatly receive ACCESS ...
3
votes
1answer
2k views

Understanding unknown in IDA

What is this instruction trying to do? .text:4044A5EC LDR R5, =(unk_40885080 - 0x4044A5F8) Looking at the value of unk_40885080 it holds a value of 20 in the .data segment.
3
votes
1answer
2k views

How does r2dec compare to pdc?

Radare has a command pdc pdc pseudo disassembler output in C-like syntax I'm curious to know how the plugin r2dec-js compares to pdc it seems like they do the same thing.