Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

Filter by
Sorted by
Tagged with
3
votes
1answer
2k views

Understanding unknown in IDA

What is this instruction trying to do? .text:4044A5EC LDR R5, =(unk_40885080 - 0x4044A5F8) Looking at the value of unk_40885080 it holds a value of 20 in the .data segment.
2
votes
1answer
359 views

What values do I use for Freescale ARM imx233 μP in IDA Pro “memory layout dialog” for RAM and ROM?

What is the memory address information I should plug into IDA for this BIN file? GOAL: To disassemble a BIN file extracted from firmware.sb This BIN file contains the low level board initialization,...
2
votes
1answer
89 views

What is the mdisp field in RTTI for throw used for?

First of here is the article from which I'm looking up the fields. I was trying out different combinations to see how they affect the RTTI for a C++ throw. It seems that having a virtual base class ...
2
votes
2answers
331 views

Getting the algorithm used inside this .so file

I'v been trying to reverse-engineer a BLE "Smartlock" to open it using Python instead of the App that it came with. I progressed quite far with disassembling the SDK they provide, ...
2
votes
1answer
87 views

Garbage Assembly Code Generationat at random offsets

Recently I've been working on a project. The main purpose of the project is to generated statically undetectable PE samples. Where each time one generates a PE sample, each generated sample is going ...
2
votes
1answer
343 views

How to detect only external-module calls?

I'm debugging one module which draws some letters using either GDI or most possibly Direct Draw. I want to trace where this happens so for the reason I need to trace only instances of code, which ...
2
votes
1answer
8k views

How does scanf interact with my code in assembly

I have recently started getting into assembly for the purpose of reverse engineering. I started small with understanding basic datatypes, but I want to move on to more complex datatypes and functions. ...
2
votes
1answer
626 views

Convert Mach-O VM Address To File Offset

this maybe total no brainer but i'm really new to this and i'd really appreciate some help! Basically i'm trying to patch(out aka nop) a obj-c function inside an iOS Application. I've successfully ...
2
votes
0answers
443 views

How to use Ghidra to work with VM obfuscated binaries?

By "VM obfuscated binary", I mean a binary that contains one or more implementations of a VM internally, and also some bytecode that can run on this VM. One of the reasons why this binary is this way, ...
2
votes
3answers
639 views

What are the .cpp files in IDA disassembly [duplicate]

I opened wsl.exe in IDA Pro v7 and follow some strings. I saw some strings with .cpp extension. Can anyone explain what are those .cpp file in that disassembly? Where can I find it? Are those hidden ...
2
votes
1answer
2k views

Disassemblers resolving (ELF) section names

I'm working with linux executables and was just wondering how it is that section names are resolved to addresses upon disassembly of an ELF. For example take some random disassembly output from ...
1
vote
2answers
217 views

How to decompile /usr/bin/ls

How to decompile the following assembly instructions ? Note: this could be reproduced using /usr/bin/ls binary inside ghidra
1
vote
2answers
691 views

How to disassemble VBX files?

I have a 16 bit VBX file for Visual Basic 3 which I'd like to disassembly. Which program can analyze it? I tried IDA Free, but it seems only OCX are supported.
1
vote
2answers
2k views

Convert IDA listings to assembly without using IDA non-free

I'm currently working with a huge set of IDA Pro listings (~1TiB). For a project I need to perform analyses on the mnemonics and operands on a subroutine level. Therefor I want to convert the IDA ...
1
vote
1answer
746 views

How can I change the values in esp?

0x08048785 <+344>: movl $0x0,0xc(%esp) 0x0804878d <+352>: movl $0x804896c,0x8(%esp) 0x08048795 <+360>: movl $0x8048973,0x4(%esp) 0x0804879d <+368>: movl ...
1
vote
1answer
198 views

Failure at finding the value of the dereferenced pointer

000007FEEC55CF58| 48 8D 0D F1 A7 0B 00 | lea rcx,qword ptr ds:[7FEEC617750] | ;7FEEC617750:"500117367" I see the above line in the ollyDBG which has the value of "500117367" according to the comment ...
1
vote
2answers
3k views

How to add/find parameters to a function declaration in IDA/HexRays?

I've a binary opened in IDA. It uses a function pointer from a COM vtable. I found that the COM method has 13 parameters (including this). But IDA shows only 4 parameters as shown in this pseudocode: ...
1
vote
1answer
2k views

Dump value of register using frida

I'm new with frida and came to this problem. I have dll that I want to reverse engeneer(there are no debug symbols). Specifically I want to dump some data from a function. So I have this big function ...
1
vote
0answers
402 views

Trying to identify block of code which generates 256 bit key

I'm reversing a C++ program using IDA PRO to examine how the some data is stored, encrypted and decrypted. I've managed to identify the data is encrypted with AES CBC 16 block and 256 bit key. I have ...
0
votes
0answers
184 views

How to access and modify data segment when doing hardware breakpoint crashes the application?

I want to modify the data segment in the x64_DBG, however, I don't know how to access it. lea r8,qword ptr ds:[7FEF0CA6AD8] In the above code, the address 7FEF0CA6AD8 is loaded in r8 register. I ...
0
votes
0answers
111 views

Loading a U-Boot ARM flash image into IDA Pro

I have a U-Boot image file which was extracted from flash memory of a board with an Hi3520D ARM CPU. I would like to load this file into IDA Pro and dig out the password that is required for accessing ...
0
votes
2answers
284 views

Can Radare2 support word-oriented architectures?

I'd like to write a Radare2 plugin for a legacy 48-bit word-oriented CPU which has two 24-bit instructions per word, and, naturally, uses word addressing. I wrote a disassembler plugin which prints ...
0
votes
0answers
65 views

Using GDB to find the address of a buffer in a stripped C binary

I am working with a crackmes binary called Simple Overflow. It has two buffers with sizes 0x10 and 0x8, and it uses malloc to allocate two contiguous memory blocks (see <+25> and <+39> on ...
0
votes
1answer
1k views

Anti-kernelmode functions (specifically zwquerysysteminformation) [closed]

I'm working on a program that has lots of checks, and I've decided to start by disabling their anti-kernel mode, as it'd surely be more easy to isolate than normal anti-debugging. After poking around ...
0
votes
1answer
239 views

How to track output parameters in disassembly?

I have the following disassembly of winload!CmpFindNlsData function and I need to check the output parameters of this function. P.S.: CmpFindNLSData(int a1<eax>, int a2, PUNICODE_STRING ...
0
votes
1answer
3k views

Translation from ARM assembly to LLVM IR [closed]

Is there publicly available solution for translation of ARM assembly to LLVM IR?
0
votes
2answers
110 views

Where do arguments 5 and 6 go in this Microsoft x64 function call?

I'm disassembling a working-as-expected compiled C program (MS/Windows x64, MinGW gcc 10.1.0). In the main function, I have the following call which passes 6 arguments to the function DotProduct: ... /...
-3
votes
1answer
256 views

The C166 family code meaning

What the meaning of this code with an explanation? sub_37C2: mov r5, r4 shr r5, #14 shl r5, #1 mov r5, [r5+0FE00h] ; DPP0 bmov r4.14, r5.0 bmov r4.15, r5.1 shr r5, #2 rets ; ...

1 2
3