Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

Filter by
Sorted by
Tagged with
2
votes
0answers
95 views

Hopper: What does stack[xxxx] mean?

When using the 'decompiler' tool in Hopper on the start function of an application it shows this: What does the stack[2043] mean, is it 2043 bytes from the top of high memory and its assigning it to ...
1
vote
2answers
386 views

How identify witch cpu run assembly [duplicate]

I have around 300 bytes of binary machine code. I don't know which instruction set the code is for so I can't open it with IDA. Is there any tool that can help identify the instruction set?
1
vote
2answers
988 views

How to add/find parameters to a function declaration in IDA/HexRays?

I've a binary opened in IDA. It uses a function pointer from a COM vtable. I found that the COM method has 13 parameters (including this). But IDA shows only 4 parameters as shown in this pseudocode: ...
3
votes
2answers
140 views

How do you look for a a particular value at address in IDA

So, I was trying to load some binary and in the main function, I saw instructions such as mov edi, [esi+1Ch] ... lea eax, [esi+18h] So, what are these values at [esi+1Ch] and [esi+18h]. How do ...
3
votes
2answers
107 views

ARM Thumb2 register usage

I am reversing ARM Thumb2 code. I am looking for a table that shows which registers are used to pass arguments to functions, and which registers must be saved after the function ends. By the way, if ...
3
votes
1answer
244 views

Instruction set for code snippet?

I'm looking for the CPU/Instruction-Set of a closed embedded system. Code snippet: E6 F2 F3 15 E6 F3 0A EF E6 F8 9B 7F E6 F9 5B D5 0D 32 49 94 EA 30 60 71 What I know: E6 Fx is "LDR 16-Bit-...
0
votes
3answers
347 views

Explain struct access in assembly?

I am having trouble understanding working with structs in assembly from disassembly. can you please explain the code below. Disassembly below: Source code:
4
votes
1answer
1k views

How to simplify C++ standard template library in IDA?

I've a X64 DLL file which uses C++ standard library heavily. I've loaded the PDB symbol file in IDA and all the subroutines names sub_xxyz changes to std::xyz, which is as expected. But there are many ...
0
votes
1answer
192 views

Help me to understand disassembly MFC or Win32

I am trying to reverse engineer an application. I don't understand is this MFC framework. Should i learn MFC to understand the following code. or is it Win32 code developing. But how Win32 works with ...
1
vote
1answer
131 views

help me to understand array?

Question #1 is the lea edx, [esp+24] start of array ? and eax, [esp+140] index? then whats add eax, edx doing here and this source code mean ? can you please explain? I am confused about array ...
1
vote
0answers
50 views

how can i get real hex values of vdso outputs [closed]

I'm trying to get an algorithm in a program but i can't see the hex codes. At the moment i break all debug checks it fully debugging but i can't see how it creates the request.
1
vote
1answer
491 views

Would it be possible to reverse engineer a game's rom file to get source code?

More specifically, could you get low level code from a rom, and piece it together and translate it to a higher level language?
2
votes
2answers
545 views

Parse Opcodes from Binary Code

I have been using the Distorm library, using the distorm_decode() function in x64 to retrieve Opcode and Operands from binary code. For example, 44 0F45 C8 is decoded to cmovne r9d,eax. I would like ...
3
votes
2answers
99 views

Hardcoded addresses in dumped PEs

I have taken a dump of a game using Explorer Suite, and while looking at some obfuscated parts of the game PE's text section in IDA, I've seen code that follows this form: mov rbp, 7FF633CE2790h jmp ...
-1
votes
1answer
74 views

Why would MSVC pass a constant “2” for an unused this parameter?

Hex-Rays decompiled (with the assistance of pdb symbols) a piece of code as such: XPerfAddIn::CFramesInfoSource::MatchEventDescriptor( (XPerfAddIn::CFramesInfoSource *)2 And by my following of the ...
0
votes
1answer
79 views

What does _PAIR_ macro do with standard handles?

I've seen this question which says __PAIR__ macro does some conditional computation. But I can not relate that with standard I/O handles. Here is the pseudocode in IDA: if ( (char *)hConout - 1 <= ...
3
votes
1answer
6k views

objdump: can't disassemble for architecture UNKNOWN!

I am trying to use objdump -d fileName on a s-rec file and it returns unknown architecture, however it recognizes fileName: file format srec I looked at objdump --help and under supported targets ...
0
votes
1answer
244 views

What are these sub_XXX things in IDA's disassembly?

What are these things I marked in red circles on the screenshot? In this program which i tried to disassemble there are 1427 of them. Is there any other application to view it in a better way ?
1
vote
1answer
920 views

What does _mm_store_si128() actually do?

I've a binary (openend in IDA v7) that uses GUID variables to manipulate something. Whenever I see any variable with GUID data type there always be a _mm_store_si128() or _mm_storeu_si128() functions. ...
3
votes
1answer
160 views

Disassemble/decompile arbitrary JVM bytecode

I have an obfuscated java binary which does runtime code injection using java reflection like this. Object o = "a long string"; ((Method)o).invoke(params..); (If I write this in a java file, it ...
5
votes
3answers
3k views

What exactly is binary disassembly and what it produces?

The first time I heard about binary disassembly I thought that it is something what can be called as perfect decompilation tool to assembly code and I still don't understand why it is not. I thought ...
1
vote
1answer
135 views

CFF explorer quick dissassembler not showing function name like IDA pro

I can't see the _set_app_type function name in the CFF explorer , Why is that ?
-3
votes
1answer
435 views

Identification of AES portion code in binary

I want to locate AES code portion in binary after reverse engineering. I have tried to locate manually and using plugin findcrypt2 but I was not successful. Kindly show me a direction so that I can ...
0
votes
1answer
257 views

Know which bytes are opcode and which operands in IDA

I want to extract a generic signature of a function in IDA and wanted to use just the opcodes of the instructions without its operands. Example: From the first instruction I want to know the bytes ...
1
vote
2answers
84 views

How is the IV generated from a timestamp based on this function?

Background: I am currently looking to make some diagnostic software interoperable with other software, but all communication that occurs in this software is encrypted with AES-128-CBC. A sample ...
1
vote
1answer
53 views

During compiling does the compiler add more functions to the code?

Where does these functions comes from usually ? Compiler Include files DLL ?? #include <stdio.h> int f(int a) { int b=5; char c; c = a + b; return c; } int main(int ...
4
votes
2answers
220 views

General x86 to C tips?

I'm currently trying to finish an assignment for one of my classes that requires a sequence of ten Hexadecimal numbers for it not to blow up. The task is to find these numbers and input them in the ...
-1
votes
1answer
279 views

A newbies question about CFF explorer screen

I am a bit confused about the CFF explorer quick disassembler options shown in my screen , Can somebody explain what those hex values are underneath the Opcode part ? updated the question part , ...
0
votes
1answer
218 views

Stripped elf executable with ~3000 unnamed functions

Reversing a malware sample and have identified the elf as stripped which seems to be why none of the functions are explicitly named. Also, there are no specified imports listed for some reason. Does ...
1
vote
3answers
424 views

Question relating to learning Assembly through CTF challenges

I've just started to dip into Assembly for CTF reversing challenges, and am having a great time. A loop structure in the current challenge I'm working on has me stumped, however - hoping someone can ...
-1
votes
1answer
82 views

Understanding what is represented by function pointers to a block of hex

I'm working on a disassembly project for my class where I'm trying to bypass a license check, but when I throw the executable into Binary Ninja this is what I see: And when I look at those pointers, ...
1
vote
1answer
294 views

identifying function prototype from dll

I have an exe file and a dll file. This exe file uses the dll to decode input file. This exe file is gui based and does not support command line execution. So my requirement is to create a program ...
3
votes
2answers
376 views

Can I provide bytes to Radare to be disassembled?

Let's say I want to check this guys work. He says that he is getting 8d 15 c8 90 04 08 lea 0x80490c8,%edx ba c8 90 04 08 mov $0x80490c8,%edx Is there an easy way with Radare to ...
2
votes
2answers
462 views

ASM code hook/patching with trampoline function

I am stuck on making (my little self-task for learning) that thing: Basically it should be something like Themida or VMProtect (do mutation, virtualization, etc.), but in my case, i want to take ASM ...
0
votes
2answers
2k views

gdb not opening exe file

I'm trying to open an exe with gdb but although it seems to run I'm unable to list or disas anything. The file is obfuscated, and I may be answering my own question here, with nine rays .net ...
-2
votes
2answers
473 views

How can I export only the mnemonics from objdump (or any other program)?

I want to do an analysis with the mnemonics. I can export everything to text but I only need the last column. Any idea on how can I solve this? In other words of this output of objdump (objdump -d ...
2
votes
2answers
972 views

IDA Pro - how to export a listing file in batch mode

I am using IDA Pro 6 and I'm looking for a way to automatically export an analysed file into a listing (.lst) file. The interface of IDA enables to do this action using the menu File > Produce File > ...
1
vote
0answers
117 views

How would I begin REing this proprietary model format?

Disclaimer: This is both my first post, and my first time approaching reverse engineering. Overview: Need for Speed 5 is a classic (1990 era) racing game that was extremely unique in that it featured ...
2
votes
1answer
1k views

Got `Source Code does not match bytecode` debug a Reversed Android app

Reverse an .apk file following This Article Open ApkStudio, edit AndroidManifest.xml to allow debug and Build a new Apk file Got source code with dex2jar and jd-gui Create an project in Android ...
2
votes
1answer
1k views

How does r2dec compare to pdc?

Radare has a command pdc pdc pseudo disassembler output in C-like syntax I'm curious to know how the plugin r2dec-js compares to pdc it seems like they do the same thing.
0
votes
1answer
169 views

Arm function save registers r0 and r1

I see arm 32 bits assembly code. Usually each function do push { r4-r9,lr} ( save 6 registers on stack ). And in the end of function pop them . I see function that save push {r0,r1,r4-r9,lr} but ...
0
votes
1answer
542 views

How to convert pointer and offsets to array in IDA?

Here is an example of a subroutine as pseudocode in IDA: HRESULT __stdcall func(PCWSTR name, PCWSTR command, BOOL folder, DWORD *pCode) { _OWORD *v4; __int128 v5, v12, v13; __int64 v6; ...
1
vote
1answer
67 views

Is there an IDA disassembler module for IBM 360/370/390?

Has anyone written an IDA disassembler module for IBM 360/370/390 or higher processors? Would like to examine one even though i cannot afford IDA Pro.
0
votes
2answers
933 views

Why does IDA show wrong function arguments in pseudocode?

I've open a DLL in IDA v7. In one subroutine, there is a PathAllocCombine() function. The pesudocode shows six arguments in it. But the documentations shows there are four arguments i.e. ...
0
votes
1answer
354 views

How ida choose arm Thumb/Thumb2

I load binary file to ida and choose arm cpu. How can I see if ida choose on arm/arm Thumb2 / arm Thumb? and how can I change it? Bytes translate is depend witch arm is it(arm/arm Thumb2 / arm ...
0
votes
1answer
74 views

Why IDA shows return statement in separate subroutine?

IDA shows this following code in separate subroutine. Assembly: sub_180049410 proc near jmp rax sub_180049410 endp Pseudo-Code: __int64 __usercall sub_180049410@<rax>(__int64 (*a1)(void)...
2
votes
2answers
3k views

How is a keygen made by reversing a software? [closed]

I know that a software is cracked by reverse engineering it and reading it's assembly code... My question is how and what do crackers look for in the assembly code? And how do they know what algorithm ...
0
votes
1answer
334 views

Radare2 create section

Radare2 has S* commands, that can show, delete, modify sections. Is it possible to create new section in executable file and save it?
1
vote
1answer
637 views

Tracing function calls in x64dbg

I'm new with x64dbg and want to know if there is any way to get the trace of a functions inside a module? I've used trace over option, but basically it just traces all the insturctions but doesn't "...
1
vote
1answer
112 views

Static Offset in PE

I am making a crackme, that get's hexadecimal values and converts it to ASCII to get the password. The problem is I use a part of code into the main function to search the opcodes from .text section ...