Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

Filter by
Sorted by
Tagged with
0
votes
1answer
634 views

How does WinLoad.exe load the rest of the operating system?

I have disassembled the file WinLoad.exe as a 32-bit PE for i386 ISA, and I'll show some of the instructions I do not get are for: call 0x00408b6d <--- test al,al je 0x0040109f lea ...
1
vote
1answer
749 views

Cannot find the caller of the main function in a disassembled firmware

I am looking at an unstripped ARM elf firmware file using IDA Pro. There is an init() function and a main() function. From my understanding of the logic, it's probably structured like this: init() ...
1
vote
1answer
683 views

Are jump instructions targeting addresses in ntdll a sign of malware?

For fun I downloaded an installer from a "driver downloads" website. I do NOT intend on installing it, but I was interested to check it out just to see what it looked like. I tossed it into Ollydbg (...
41
votes
1answer
85k views

Decompiling iPhone App

I've been searching this site and more, but I haven't had much luck. I want to decompile an app to see how part of it works, and I've tried multiple programs. I've tried Hopper, IDA, and some other ...
4
votes
1answer
4k views

Why ther are some many padding/leading nop instructions in my binary code?

The test platform is on Linux 32bit, x86. So basically I wrote a simple C program like this: void main() { double a = 10.0; printf("hello world %f\n", a); } I use gcc to compile to ...
1
vote
2answers
600 views

How to disassemble VBX files?

I have a 16 bit VBX file for Visual Basic 3 which I'd like to disassembly. Which program can analyze it? I tried IDA Free, but it seems only OCX are supported.
6
votes
2answers
5k views

Any way to fix misinterpreted case jump tables in Ida Pro?

I'm disassembling a function that seems to use a switch statement, resulting in an indexed indirect jump, in two different places (same function!): 0005FA58 mov al, [eax+112h] ...
2
votes
1answer
584 views

Are there ANY supported Fermi Disassemblers out there?

I've recently started exploring the world of GPU-based malware. Academia doesn't have a ton of papers here, but there's some powerful ones. I'm looking at trying to improve the communities tools in ...
4
votes
4answers
9k views

Disassembling MIPS Binaries

I am searching for security vulnerabilities in the firmware of this router, its architecture is mips. I have successfully unpacked the file system. I would like to disassemble the http daemon, located ...
5
votes
2answers
2k views

Assembly Code - GCC optimized vs not

I want to learn more about how GCC optimizes C programs. I have did a disas of a random function both optimized and unoptimized and I want to look at some of the differences. Off the top of my head, ...
1
vote
2answers
1k views

what does the imediate value of the BKPT opcode is being used for?

Assembler syntax BKPT # where: See Standard assembler syntax fields on page A6-7. Specifies an 8-bit value that is stored in the instruction. This value is ignored by the ARM hardware, but can be ...
4
votes
3answers
4k views

Can not continue debugging after SIGTRAP

I am trying to debug an iOS app with gdb and when I hit a breakpoint I get this error, and can not continue. Program received signal SIGTRAP, Trace/breakpoint trap. [Switching to process 190 thread ...
1
vote
4answers
2k views

GUI-based x86 assembly editor

Is there a tool that disassembles x86 executables, presents it in a GUI where you can edit the assembly commands, and reassembles it when you want to save/patch the exe? All it would need is a tool ...
6
votes
1answer
3k views

Disassembling an unknown DOS MZ executable using radare2

How do I specify to radare2 that what I'm disassembling when I know it is a DOS MZ executable? As it does not auto-detect this for me.
2
votes
3answers
663 views

Concept of location local variables in memory using disassembly window and registers?

I'm trying to understand how to locate local variables in memory. I have disassembled a c code and I have the address of the instructions. I want the memory location where that variable is stored. I ...
3
votes
1answer
554 views

What is the proper way to deal with an x86/64 instruction containing multiple prefixes from the same group?

Olly, specifically, will only accept the last prefix it finds if there are more than one from the same group. For example lock rep add dword ptr[eax],eax ; f0 f3 01 00 becomes ??? ...
5
votes
2answers
1k views

GCC Loop optimization

I have been looking at some simple C code and the different output from GCC using different optimization levels. C code #include <stdio.h> int main() { int i = 0; while(i<10) { ...
2
votes
1answer
372 views

What C construct could generate this assembly sequence?

I have the following disassembly: mov BL, [EAX] inc EAX mov [EDX], BL inc EDX I could see this being the result of: uint8_t foo = bar; ++bar; uint8_t tmp = foo; ++foo; But this assumes C99. Is ...
30
votes
5answers
8k views

Why there are not any disassemblers that can generate re-assemblable asm code?

I am struggling on this problem for around three months: How to use disassemblers (IDA Pro and others...) to generate re-assemblable asm code and assemble it back My experience is that: There is NO ...
3
votes
1answer
431 views

Trouble analyzing a ransomware

I got this fake-av sample , and I want to reverse it . But the problem is that it exits after few commands . Here are the steps : When loaded in Ollydbg it pauses at: 00401000 > $ 8D9404 7713210&...
6
votes
4answers
117k views

Converting assembly code to c

I have the following assembly code over Linux distro: # using the .data section for write permission # instead of .text section .section .data .globl _start _start: # displaying some characters ...
2
votes
3answers
797 views

Why IDA Pro generate define-lack code like this?

Basically I us IDA Pro 6.1 on Windows 32 bit, dealing with binaries from SPEC 2006. I use IDA Pro to generate asm code from the binaries, and in the .data section, I see data define like this: ...
3
votes
0answers
300 views

I want to know more about how a particular exploit works. How do I do that? [closed]

I am given a VM of a server running a vulnerable version of ProFTP and a attacker VM which exploits the server using an exploit provided with MetaSploit. I need to write a Snort rule to detect ...
2
votes
1answer
1k views

How to find memory addresses which are read from but not written to

Analysing a bootmanager : I'm trying to track all variables which are only read from, and not written to... which will give me the external variables it uses... Is there any such functionality in IDA ...
1
vote
3answers
560 views

What exactly do assemblers translate macros into?

I have dug in simple binaries, such as though like x86 bootloaders, Sega video game binaries, etc. I know that these files tend to use assembler macros to define data, etc. What I am having trouble ...
1
vote
2answers
5k views

How to extract all the rodata data and bss section using IDC script in IDA Pro?

test Platform is 32 bit Linux ELF and 32 bit Windows PE. I use IDC script to extract all the functions from binary and dump into a file, then do the analysis based on the examples in IDA Pro book. ...
2
votes
1answer
1k views

What is the meaning of this code generated by IDA Pro?

Test platform is Linux 32 bit. I use IDA Pro to disassembly the basename from coreutils 8.5 compiled by gcc 4.6.3 Here is a code snippet generated by IDA Pro call ...
1
vote
1answer
1k views

Why IDA Pro will generate this kind of code(mess up macro name and variable name)?

I use IDA Pro 6.1 to disassembly ELF file, which is compiled on 32 bit Linux, gcc 4.6.3 I modified the code and try to make it reassemble, and I find a problem here(this is directly created by IDA ...
6
votes
1answer
830 views

How to get IDA Pro Free to automatically change segment on retf?

I have been unable to get IDA pro to do a simple disassembly of a flat 16-bit binary (bootloader) file. I'm just getting started, and it seems to be harder than it should be. There's a simple set of ...
3
votes
2answers
3k views

How to determine if binary has symbol table

Is there a practical way to find if the raw binary (firmware image for example) has symbol table ? Finding start or end of it ? And if it exists is it a single block or can it be seperate multiple ...
20
votes
5answers
8k views

What tools exist for excavating data structures from flat binary files?

Problem Statement I have a file composed entirely of data structures; I've been trying to find a tool that will enable me to open this file, and declare (perhaps) a type and offset such that i may ...
5
votes
2answers
7k views

What is the difference between static disassembly and dynamic disassembly?

I am told that tools like IDA Pro are static disassembly tool, and tools like OllyDbg are dynamic disassembly tool. But from the using experiences on these tools, I don't think there is any ...
1
vote
2answers
4k views

How to find how global variables defined in binary

In Visual Studio I have written simple code, int pranit = 2; int& sumit = pranit; int main(int argc, char** argv) { sumit++; return sumit; } I used OllyDbg to Disassamble, but I am not ...
3
votes
3answers
18k views

Could not find main function in IDA pro?

I have newbie question that concerns IDA pro and Visual studio 2010. Basically I started a new "Empty Project" in VS 2010 and added a main function to the .cpp file. Then I compiled it to binary and ...
15
votes
4answers
3k views

Open-Source library for Complete Binary Disassembly

One of the major hurdles of x86 disassembly is separating code from data. All available open-source disassembly library only perform a straight line disassembly (starts from the top and skips errors ...
5
votes
1answer
1k views

Why IDA Pro generated a “j_printf” function call?

Test platform is windows 32 bit. IDA pro 64 So, basically I use IDA pro to disassemble a PE file, and do some transformation work on the asm code I get, to make it re-assemblable. In the ...
0
votes
1answer
3k views

Translation from ARM assembly to LLVM IR [closed]

Is there publicly available solution for translation of ARM assembly to LLVM IR?
9
votes
9answers
5k views

Is it “theoretically” possible/impossible to reverse any binary?

I know that reverse engineering from binary to source code (e.g. C++) is generally considered hard or impossible but has any computer scientist actually proven "mathematically" that it's impossible or ...
-2
votes
4answers
2k views

Does learning Metasploit help me in reverse engineering and malware analysis?

I learned basis of assembly language with, both, AT&T and Intel style. After that I gone through buffer overflow and how to use shellcode with it. Should I go for Metasploit now?
47
votes
7answers
109k views

How to know in which language/technology program (.exe) is written?

How to understand if exe/dll is written in C++/.Net/Java or in any other language. I tried to use Dependency walker but not able to get required information.
5
votes
2answers
9k views

Decompiling Modem Firmware (firmware.bin) with unknown results on binwalk

I'm just new to these field. So bare with me. These is the result when I run binwalk. When I try to extract it using binwalk, it just give endless archives and files to analyse. Any ideas if it is ...
3
votes
2answers
5k views

Recompile the asm file IDA pro created

currently I am trying to use IDA pro to generate assembly code from PE file and recompile it. Firstly basically I know this way: File -> Produce File -> Create ASM File and it seems the asm ...
8
votes
3answers
15k views

Reverse engineer Android native code

I am looking for an reverse engineering tool or a way to decompile the existing android native code to an human understandable format rather than Assembly language. Can anyone please suggest me as i ...
1
vote
0answers
29 views

Means of different call label formats in IDA [duplicate]

What is of different label formats of call instruction means in IDA? Like: call Cla$ENABEL call ds:Cla$PushString call ds:GETNAME@Folosososososos Thanks
8
votes
1answer
1k views

Mapping an external module's source code to assembly - extracting information from source code

The situation is the following: I'm reversing an application, In which I found a lot of functions that belongs to the OpenSSL library. Since I have the source code for this module, I was wondering if ...
-5
votes
1answer
696 views

Is possible to translate this MIPS assembly subroutine to C? [closed]

Can somebody tell if this MIPS assembly code uses some RSA libraries or what info is precisely extracted? .text:00088090 # =============== S U B R O U T I N E ======================================= ...
1
vote
2answers
4k views

The debugger could not attach to the selected process

I want to debug an application which when opened, it will open a fork from it. e.g. program.exe will run 2 program.exe in the task manager the software is EMS SQL Management Studio for PostgreSQL ...
1
vote
0answers
175 views

Reassembling Silverlight runtime

I'm trying to insert some instrumentation into libraries such as System.Windows.Browser.dll. I tried to use ildasm+ilasm and Reflexil and both failed - reassembled library causes browser crashes, ...
11
votes
1answer
20k views

Looking for exported symbols in a DLL with objdump?

I am a man full of contradictions, I am using Unix and, yet, I want to analyze a Microsoft Windows DLL. Usually, when looking for symbols in a dynamic or static library in the ELF World, one can ...
3
votes
1answer
3k views

How do I find out entry point in mips or sh4 bin firmware?

Would be great to know where the entry point is after decompress bootloader from a bin firm, mips based or os21.. I mean, is always in same offset or it depends on compilation made? I think is a very ...