Questions tagged [disassembly]
The translation of machine code into a human readable assembly code, also the result of such translation.
1,074
questions
0
votes
1answer
89 views
What is copy_block struct in Tricore Arch?
Recently I work on Tricore Arch to reverse an algorithm. But I had a problem to find a constant value(4 byte). the line of code shown below:
ld32.w d4, [a0]-0x68D4
I know a0 = 0xD00032E0 but ...
0
votes
0answers
70 views
Delphi mt38 CRC (Tricore 1766 Arch)
I want to calculate CRC32 for Delphi mt38 and found the below assembly algorithm and converted it to C. It seems that this algorithm is defined for n = 256 or 1024. I want to calculate CRC32 for n = ...
1
vote
0answers
52 views
How to parse objdump output data?
I'm somehow newbe in reverse engineering and currently I'm reading RE4B book.
In the image above:
I can't figure out the role of s in the functions f1 and f2. As far as I know, based on the last ...
0
votes
0answers
28 views
Check indirect call function in Radare2
I'm working on a tool to construct control flow graph (CFG) from binary code (x86). For comparison purpose, I need to compare our tool with radare2.
How could we determine if an indirect call function ...
2
votes
1answer
79 views
Garbage Assembly Code Generationat at random offsets
Recently I've been working on a project. The main purpose of the project is to generated statically undetectable PE samples. Where each time one generates a PE sample, each generated sample is going ...
0
votes
0answers
82 views
Binary bomb lab, can't find starting number and having problem recognizing pattern
The following is the assembly dump of a binary bomb from bomb lab Basically, you have to come up with a 6 number sequence to defuse the bomb, however, I am having trouble finding the first number and ...
2
votes
1answer
122 views
Why can't find hardcoded string in the disassembled program?
I've wrote a simple program to print something on the screen as below:
ebra@him:/tmp/tuts$ cat sample.c
#include <stdio.h>
int main()
{
puts("Sample!");
}
ebra@him:/tmp/tuts$ ...
0
votes
0answers
40 views
Lexer and parser for .asm file produced by objdump
Is there any existing project that parses the x86 disassembly file or .asm produced by the objdump or IDA pro using the lexer and parser library in python or any other programming language?
3
votes
0answers
129 views
Legality of publishing decompiled code
The situation is the following:
Binary file of a computer game from the 1980s. The binary file ran on a platform that doesn't exist anymore (not x86).
The binary file does not contain any symbols or ...
1
vote
1answer
121 views
Statically Reverse Engineering Shellcode - IDA to Ghidra
I'm trying to follow along with this tutorial which is using IDA in it's example. https://0ffset.net/reverse-engineering/malware-analysis/common-shellcode-techniques/
Hash: ...
0
votes
1answer
86 views
A bit confusion with cheat engine function address and IDA subrutine
I have found a function with Cheat Engine that I like to show in IDA:enter image description here
but the function is not present in IDA.
Probably I have a bit confusion becouse I don't have ...
0
votes
0answers
54 views
Reverse an encryption algorithem in APK .so file
I try to reverse a cipher algorithm (I guess Tiny Encryption Algorithm (TEA)) in an android application. But I have a serious problem in initializing arguments. How I can understand that I have ...
0
votes
0answers
67 views
A way to detect a anti-cheating system
I have created a DLL for DLL inject injection to add a force feedback to a GOG game. The DLL Work perfectly. I have tried to see how work the Debug in CE with this script:
debugProcess() -- Attach ...
1
vote
0answers
67 views
CRC16 Reverse in C166 Arch
Before that I asked about piece of code that used in this algorithm (here). Now I have a bit problem with the rest of algorithm.
So I have to describe this with detail. Sorry if i vast your time for ...
1
vote
1answer
50 views
Where are the intel manual x86-16?
I was studying the code for x86-16 operating systems(como DOS),with a desassembler, but I can't find the intel manual on the intel website:
Searching on google, only unofficial sources.
Perhaps the ...
1
vote
1answer
524 views
What do these 2 Ghidra warnings mean?
When disassembling ARM binaries in Ghidra, I often see these warnings:
/* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */
/* WARNING: Treating ...
0
votes
2answers
82 views
ASM Debuggers that visualize the stack (beginner friendly)
(Cross-posted from Stack Overflow)
Are there any debuggers that constantly show a visual of the stack and where everything is within it? For example, taking some random image:
I use gdb for most ...
0
votes
0answers
42 views
understand how call __usercall function
I have disassable with ida this function:
int __usercall sub_4F314A@<eax>(char *Src@<ecx>, int a2@<edx>, int a3, int a4, int a5, int a6)
I attach the original assembly:
can you ...
-1
votes
2answers
102 views
How would I start to decode this? Asking for help from a friend (Alien Hominid Invasion)
I have literally no idea how to start to decode this kind of a file, but I really want these fonts and a decoder would be huge for the community, so any help would be great. Linked below is a google ...
0
votes
3answers
191 views
How to find if a function is using registers as parameters?
The disassembly of the function Winload!CmpFindNlsData whose prototype I'm trying to construct
00893c10 8bff mov edi,edi
00893c12 55 push ebp
00893c13 8bec ...
5
votes
2answers
980 views
Difference between Main and Entry
Sometimes, I see while disassembling a binary that there is the main function. but sometimes, instead of main, there is entry function.
I want to know what is the difference between entry and main.
-3
votes
1answer
188 views
The C166 family code meaning
What the meaning of this code with an explanation?
sub_37C2:
mov r5, r4
shr r5, #14
shl r5, #1
mov r5, [r5+0FE00h] ; DPP0
bmov r4.14, r5.0
bmov r4.15, r5.1
shr r5, #2
rets
; ...
0
votes
1answer
194 views
What is the meaning of ARM LDAXR/STLXR instructions?
Often while disassembling ARM files, I see some code snippet with the following pattern:
loc_BB30:
.text:C0 FE 5F 88 LDAXR WZR, W0, [X22]
.text:00 04 00 51 SUB W0, W0, #1
.text:...
1
vote
1answer
31 views
are address for instructions specified during compilation?
when following certain youtube tutorials, the address in memory for the instructions are same in my machine and the youtuber's machine. How is that possible? Are instructions provided with memory ...
0
votes
0answers
28 views
Decypher hw key generation process
This one is kinda tricky question, as it sounds a bit shady, I am well aware of that. Let me first explain the situation. I have this special software designed to read paired industrial sensors from ...
0
votes
0answers
28 views
C166 Memory and Addressing mode
Here I think I have some wrong in base concepts,
In the code shown below as you have seen, r4 is input argument for sub_37C2 where r4 is r0 + 6. And probably this function return r4 and r5.
So, we ...
0
votes
1answer
85 views
How to track output parameters in disassembly?
I have the following disassembly of winload!CmpFindNlsData function and I need to check the output parameters of this function.
P.S.: CmpFindNLSData(int a1<eax>, int a2, PUNICODE_STRING ...
2
votes
2answers
258 views
Getting the algorithm used inside this .so file
I'v been trying to reverse-engineer a BLE "Smartlock" to open it using Python instead of the App that it came with.
I progressed quite far with disassembling the SDK they provide, ...
0
votes
1answer
85 views
What is physical address on a pe reader?
What is physical address on a Pe file? I had search on the microsoft website article about pe files and don't have found anything.
0
votes
0answers
107 views
C166/C167 code analyzing
Recently I try to reverse piece of assembly code that written for C166/C167 Arch.
But I have a problem with some places for convert to C code, such as:
loc_1892:
mov r9, #4
add r9, r0
mov ...
1
vote
1answer
85 views
Trying to reverse engineer CmpFindNlsData of winload
I have a basic understanding of assembly language and I'm unable to perfectly define the algorithm of winload!CmpFindNlsData looking at the disassembly. Basically I need to understand how NLS data is ...
0
votes
0answers
49 views
Crash after hook a function
I have hooked a sound function that work within the game menu after, when the battle start, the game will crash.
The function at the first parameter get correctly the sound file name, before the ...
0
votes
1answer
59 views
Buffer space in C
I was wondering if there is some way to get information about buffer size via reversing the binary, created in C language. can we also know how many buffers we have created while writing that script.
...
1
vote
2answers
141 views
How to determine ARM architecture from the ELF file extracted from the firmware?
I have extracted the ELF file from the flash dump of a printer, I cannot find too much information about the SoC chip on the printer. What's the best practice to determine the ARM architecture (ARMv7-...
0
votes
1answer
90 views
ASLR in Linux Vs Windows
I am quite new in binary exploitation. I am doing a lot of beginners exercise here. I am confused about ASLR. I tried some binary exploitation thing in Linux. It was recommended that I should stop ...
3
votes
1answer
71 views
reason of padding in exploit
I was doing vulnserver bufferflow exploit. I saw a tutorial where the he makes a payload to exploit the server.
Take a look at the exploit:
#!/usr/bin/python
import socket
target_ip = "10.0.2....
0
votes
1answer
93 views
2 byte format string attacks
Protostar
I was doing the protostar format string (3rd challenge). where we have to change the value of a variable target with format string buffer overflow. so, I came up to this medium article: ...
0
votes
0answers
48 views
Access to variable never stored to
I'm disassembling a Microsoft dll in IDA Pro, and there's one point where a value is loaded to a register from a location that has never been written to (it's the first location on the variables stack)...
0
votes
0answers
28 views
Intercepting object value in a Frida intercepted method
Suppose I have a C# method with the following signature
public virtual void DoSomething(int index, int value, List<int> results)
I've had success so far using Frida to hook into the method call ...
1
vote
1answer
65 views
Confusion between different ARM architectures
I am trying to develop a machine learning model to help with the process of reverse engineering. As the first stage, we are currently trying to train an embedding model that understand the ...
0
votes
2answers
85 views
How does an executable’s static API differ from it’s dynamic API?
Running an executable in Cuckoo sandbox gives me its dynamic API information. How do these API calls differ from their static API information (eg. If I were to just put the executable through IDA Pro ...
0
votes
1answer
92 views
How can I modify these?
So I'm onto something interesting, I asked the less direct way but failed to meet the requirements in terms of explanation
So here it is, how would I go about editing these the same way I would go ...
3
votes
1answer
123 views
Radare2 - what does dot mean in disassembly
I've just started using radare2 and I've noticed a dot when I tried to disassamble one on my programs. The output is:
0x00000000 48b841000000. movabs rax, 0x41
I understand that 0x48 is the REX ...
0
votes
0answers
35 views
N64 ROM file index hacking issue
Alright, I downloaded the N64 SDK and compiled one of the samples provided by the SDK and dissembled the ROM with IDA and found the asset data is stored some way using index's so my question is.
What ...
0
votes
0answers
69 views
Relative/absolute addressing; RVA, ASLR, the relocation table and patching instructions
I've been trying to learn reverse-engineering for fun, cracking my own dummy games and whatnot and I just learned ASLR is a thing.
I'm now trying to re-conceptualize everything I've read so far ...
0
votes
1answer
191 views
How to find function start in stripped binary?
Given C code, are the function addresses from the ELF the same as those in the stripped version?
I don't have any specific code in mind. Just trying to learn in general how to find the function ...
0
votes
1answer
249 views
Why do those useless instruction are in Rust final binary?
I am currently reversing RUST binaries, and I often come across this block of instruction :
.text:000055F4BFB943F2 db 2Eh
.text:000055F4BFB943F2 nop word ptr [rax+rax+00000000h]
.text:...
0
votes
0answers
52 views
strange results with IDA (some function different Pseudo Code)
After show the pseudo code in IDA I see different results:
The function 4436C0 show different pseudo code.
For example:
result = sub_4376C0("vvcbb3.wav",v8,0);
and
result = sub_4376C0((int)...
1
vote
1answer
121 views
How do disassemblers work?
I have 2 questions regarding this, but feel free to elaborate more if you want to, I'm really interested in this topic:
Do they really just read byte by byte until they get a valid instruction? How ...
0
votes
2answers
75 views
Where do arguments 5 and 6 go in this Microsoft x64 function call?
I'm disassembling a working-as-expected compiled C program (MS/Windows x64, MinGW gcc 10.1.0). In the main function, I have the following call which passes 6 arguments to the function DotProduct:
...
/...
