Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

Filter by
Sorted by
Tagged with
3
votes
1answer
267 views

How can I convert this assembly code (x64) to C?

I have the following assembly (x64) function: 400700: sub rsp,0x18 400704: mov QWORD PTR [rsp+0x8],rdi 400709: cmp QWORD PTR [rsp+0x8],0x0 40070f: jne 400718 <bar+0x18> 400711: mov eax,0x0 ...
1
vote
1answer
155 views

Figuring out what a segment of assembly code does

I have the following assembly code: 0000000000400711 <foo>: 400711: 55 push rbp 400712: 48 89 e5 mov rbp,rsp 400715: 48 89 7d e8 ...
-1
votes
1answer
313 views

How can I decompile the CC2650 .hex file to C?

I want to decompile it to C, or at least assembly the CC2650 hex file (Bluetooth Low Energy Sensor Tag), that provide TI. My goal is to know the specific way used by CC2650 to generate the LTK. I'll ...
4
votes
1answer
269 views

Need help identifying main processor for Roland synthesizer

I desperately need help figuring out the ic chips in this unit so I can view the firmware in ida pro. So the unit is a roland gr-55 guitar synthesizer and i'm trying to disassemble the firmware into ...
1
vote
2answers
412 views

.NET assembly IDA PRO, using LDSTR IL op code, how to patch a string?

I'm trying to patch a string. So right now I'm trying to replace instruction LDSTR with LDSTR "mystring"; however, I have been unsuccessful. After assembling the LDSTR op code, I don't quite ...
3
votes
2answers
317 views

Move twice, from and to the same location

I'm trying to reverse a function and I came across these lines inside the function: 1. call ds:HeapAlloc 2. mov [ebp+var_4], eax 3. mov eax, [ebp+var_4] Why is line 3 needed? If I need to ...
3
votes
2answers
222 views

replacing static value with variable

I'm trying to replace a static value: MOV DWORD PTR SS:[EBP-30],4c With a value from a specific address: MOV DWORD PTR SS:[EBP-30],400400 // MOV DWORD PTR SS:[EBP-30],OFFSET 400400 But SS:[EBP-30] ...
1
vote
2answers
330 views

Getting opcode Length , How to

I am apparently not very good with assembly as I am novice to somethings! Hence i wanted to make a question again. Now i got this from here to make something like a LDE (Length Disassembly Engine) ...
4
votes
4answers
2k views

Calculation of jmp address through subtraction

I don't get why the two addresses of the functions are subtracted in order to get the jump destination. mov eax, [ebp+func1] sub eax, [ebp+func2] sub eax, 5 mov [ebp+var_4], eax Which ...
1
vote
2answers
983 views

Can't find the password anywhere in the binary

This is my first post here. I was recently involved in a capture the flag preparation test which involved decompiling an ELF 32-bit LSB executable, Intel 80386 file for Linux compiled with GCC. The ...
0
votes
1answer
307 views

What is the password to this file? I can't figure it out with radare2 or gdb

Here is the binary file. https://drive.google.com/file/d/1ywN60yZYIhPPRyZMGbQudZRYoLYBhkeJ/view?usp=sharing I am able to figure out some of the assembly, but can't get the correct password. I know ...
1
vote
1answer
707 views

How detect version of VMProtect

I have a binary with VMProtect. Some tools giving info that this is 2.x, some that 3.x. How I could check it? Thanks.
3
votes
1answer
180 views

Disassembly - Why the CMP instruction is multiplying by 2 the value being compared

I'll get right to the point, I have a crack me program, that is a program with a password inside that needs to be found so that you can complete the challenge. I easily found the cmp instruction ...
2
votes
1answer
127 views

Remove Binary from IDA Database

I saw the File -> Load File -> Additional Binary File option and tried it out. Now I want my original IDA database back (with just one binary), but can't afford to lose the comments I have saved ...
4
votes
2answers
190 views

Prevent game from pausing on lost focus (Fallout New Vegas)

I am trying to modify a game (Fallout New Vegas) to not show a pause menu when the window loses focus. I thought of two approaches: Find the code that is called when focus changes and nop the call ...
8
votes
2answers
233 views

How did this 80286 detection code work?

I'm poking through a disassembled 16-bit DOS game circa 1992. The original system requirements state that the game needs an IBM AT-compatible machine or later, with the 286 processor, to run. And ...
2
votes
3answers
141 views

What is _bittest macro?

Here is an example of the bt instruction in a X64 Windows binary: bt eax, 18h jnb short loc_a lea rcx, String call cs:__imp_wprintf mov eax, [rbx+40h] In pseudocode: if ( ...
7
votes
4answers
8k views

Purpose of test eax,eax after a strcmp

This is my first program i am trying to reverse and my intro to this field. The C program will test if two strings match, and it will printf() a message for each occasion. This is what the reversed ...
1
vote
3answers
143 views

How to identify the purpose behind a bitmask?

The bitmask is used to manipulate the value of the integer variable. From debugging, I guessed that the bitwise operation generates nearest even integer. Here is the assembly: mov r8d, 0FFFFFFF8h ...
2
votes
1answer
97 views

Why do we need to know the address of shellcode?

I have read many articles regarding the buffer overflow exploit. Everywhere its written as follow. "It's difficult to know the starting address of the shellcode" Why do we need to know the address ...
2
votes
1answer
287 views

What does this magic number do? [duplicate]

I've opened a 64 bit DLL file in IDA. One function has this pseudocode: unsigned __int64 output; ULONG input; output = (unsigned __int64)(input * (unsigned __int128)0xE38E38E38E38E38Fui64 >> 64)...
1
vote
0answers
162 views

Trying to identify block of code which generates 256 bit key

I'm reversing a C++ program using IDA PRO to examine how the some data is stored, encrypted and decrypted. I've managed to identify the data is encrypted with AES CBC 16 block and 256 bit key. I have ...
5
votes
1answer
71 views

Passing a (string) argument via the return address?

I'm debugging an old PC BIOS and it has most of its constant strings interspersed directly with the code, like this: As the comment notes, the function putsc will take the string as its argument, ...
2
votes
1answer
97 views

Why are these 0-byte jumps used as a delay?

I'm debugging an old PC BIOS and see a lot of what I assume are delay sequences, using 0-byte jump instructions (EB 00 = jmp short $+2). Why this particular instruction? I'm guessing it must have ...
0
votes
2answers
270 views

How to interpret disassembled MIPS code?

I have disassembled MIPS binary with raw opcodes. How to interpret, for example, these lines: Disassembly of section .data: 00000000 <.data>: ... ... f864: 30a5ffff sd ra,-23248(...
2
votes
0answers
121 views

Show parameters stored in stack with __fastcall in IDA

This is an extension of my previous question. Here is a sample of assembly in x64 Windows executable using COM virtual function with __fastcall convention. mov [rsp+32], rdx ...
1
vote
1answer
101 views

Data moved after program rebase

Consider the following piece of code: .text:00F74B42 call sub_12D1130 .text:00F74B47 mov eax, dword_15A0C80 Now, I want to add a sanity check but as I don't have enough space to do that I ...
1
vote
1answer
203 views

Reversing video protocol for chinese drone so i can view the stream outside of the app

I am trying to view the video stream of the vento protocol air drone on my computer. The final goal is to get the video stream into python or c++ for opencv; however, if i can just view it in a ...
3
votes
2answers
120 views

IDA function never called and only cross-referenced as data

When I press the X key (list x-refs) on a function (sub_xyz) to see which functions call it, I only saw dd offset sub_xyz twice, with no call sub_xyz instructions. There is no another place that ...
3
votes
2answers
582 views

Reverse Engineering Challenge 2 from challenges.re

I am trying to solve reverse engineering problem(s) from https://challenges.re/2/ - this is challenge 2 and the target is to get the highest possible level of understanding what the code does. <f&...
0
votes
1answer
85 views

What are zero terminated strings below vftable in RTTI?

I am reversing a class, which has RTTI information. It has 2 virtual functions in its vftable, and in IDA Pro I can see some kind of zero terminated strings below the last vfunction. Here's how it ...
1
vote
0answers
58 views

Trace back Offset Function

I have 2 armv7-m (Thumb) branch instructions (in Hex) which call one function. Can you tell me how can I caculate the offset of this function, so that I can call it at other position. Thanks! Offset ...
2
votes
1answer
504 views

How to find start of .text section?

i made a random console application and loaded into IDA. The start of .text section shown is 00BA1000. Then i loaded the application into CFF explorer. The address of entry point was 000110AA. Is it ...
0
votes
1answer
478 views

How to Modify this Branch in ARM64?

I try to modify the branch of this disassembly in a binary: SUB SP, SP, #0x60 STP X26, X25, [SP,#0x50+var_40] STP X24, X23, [SP,#0x50+var_30] STP X22, ...
1
vote
1answer
105 views

Could someone explain how this ARM instructions works compared to the actual Objective-C code?

I'm trying to understands how it works by decompiling my own Objective-C code. Here's the decompiled instruction: var_8= -8 var_4= -4 SUB SP, SP, #8 MOVS R2, #1 STR ...
1
vote
2answers
319 views

Lea instruction on datasegment

I wrote simple program(was built in release mode(x86)) to practise re skills but I can not understand one part of it. C++ program: int doSub(int a, int b) { int result = a + b; result -= 2;...
0
votes
2answers
57 views

Addition Function Parameter Location in Assembly Stack Memory

So my C program looks like: int main() { int a = 5; int b = 1; int c = add(a, b); printf("%d", c); return 0; } int add(int a, int b){ return a + b; } And I am trying to ...
1
vote
0answers
68 views

ODBC Finding the password an application uses to access the database

I have a program which uses ODBC to access an accdb database. I can open it in access but it asks for a password. The application accesses it through a DSN string. I have found the string using ODBC ...
-3
votes
1answer
173 views

How does array indexing works at the assembly level?

Can anyone give me an example to understand how array indexing is working in assembly. For example, in C: char s[1000]; for (int = 0; i < 5; i++) { s[i] = i; } And, in x86 assembly: add ...
3
votes
1answer
97 views

Getting to the specific offset in assembly code

I try to reverse engineering an application and I came to the point that I don't understand. I have the following disassembled code with gdb: │0x7ffff76f7e4b <_ZN16CRRegistratorImp8RegisterEbPv+...
3
votes
0answers
68 views

more memory allocated on the stack than seems to be needed [duplicate]

Im working on the bof challange in http://pwnable.kr/play.php. the source code has a function func: void func(int key){ char overflowme[32]; printf("overflow me : "); gets(overflowme); // ...
-1
votes
1answer
539 views

index of array in assembly? [duplicate]

In the following picture the line i want to mention is: mov [esp+eax*4+0Ch], edx Here eax is the index in the array. But, where is the address of the array to access? what does mean this line of ...
-2
votes
1answer
239 views

Understand help me array in assembly? [duplicate]

Can anyone explain the following code as it's an array in assembly. I can't understand can you help me to figure it out line by line. Thanks Q.1) what does the 401024 & 40102E line does ?
1
vote
1answer
87 views

Visual Win32 (UI) style?

what is the following image is about ? Is it design using win32 (UI) ? the following image contains functions are being output from a DLL. Can you help me to understand. Suggest me anything which ...
1
vote
1answer
533 views

Radare2 - Insert asm instructions without overwriting

In order to patch a x86 elf file on Linux, I'm struggling to insert a specific assembler instruction into the binary file without overwriting any of the preexisting instructions. I've been reading ...
3
votes
1answer
609 views

How to unpack Inno Setup bundles with Arc+SREP data?

I've stumbled upon Inno Setup installer with additional separate Arc archives (commonly with .bin extension) that I was unable to extract using normal methods: the installer didn't work for an ...
2
votes
0answers
94 views

Hopper: What does stack[xxxx] mean?

When using the 'decompiler' tool in Hopper on the start function of an application it shows this: What does the stack[2043] mean, is it 2043 bytes from the top of high memory and its assigning it to ...
1
vote
2answers
379 views

How identify witch cpu run assembly [duplicate]

I have around 300 bytes of binary machine code. I don't know which instruction set the code is for so I can't open it with IDA. Is there any tool that can help identify the instruction set?
1
vote
2answers
981 views

How to add/find parameters to a function declaration in IDA/HexRays?

I've a binary opened in IDA. It uses a function pointer from a COM vtable. I found that the COM method has 13 parameters (including this). But IDA shows only 4 parameters as shown in this pseudocode: ...
3
votes
2answers
140 views

How do you look for a a particular value at address in IDA

So, I was trying to load some binary and in the main function, I saw instructions such as mov edi, [esi+1Ch] ... lea eax, [esi+18h] So, what are these values at [esi+1Ch] and [esi+18h]. How do ...