A message from our CEO about the future of Stack Overflow and Stack Exchange. Read now.

Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

101 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
1
vote
0answers
243 views

Stack buffer overflow SIGSEGV help

I've been going at this for a couple of days now working through trial and error but I can't seem to pinpoint exactly why I'm still getting a SIGSEGV. Here's the stdout of me stepping through the ...
1
vote
0answers
92 views

Trying to read/write an Renesas's M30626FHPGP flash memory

I need to make a little introduction: I'm a 37 years old man who is affected by multiple sclerosis. My neurologist gave me Rebif 44 (44mg) as a treatment. I started at full dose and went on for, ...
1
vote
0answers
467 views

Why does clang use ebp relative offsets to put function arguments on the stack?

I've been looking at disassembly of x86 32-bit code generated by GCC vs Clang. Environment is Ubuntu Server 16.04.2 32bit running in VMware. Both are compiled with the same options. No optimizations ...
1
vote
0answers
74 views

Understanding IE11's Ineterprocess Communication via COM

I'm quite new to COM object reversing (Windows Platform). I'm trying to reverse Internet Explorer on Windows 8.1, where child IE process communicates with Parent IE process via com (Due to Protected ...
1
vote
0answers
173 views

rebuilding a java application

I wish to rebuild MotiveWave, a charting tool, from its jars. This application has a feature (probably in one of the class files but I don't know which) that i want to build upon. I mean I want to ...
1
vote
0answers
856 views

IDA: Extracting functions arguments from stripped binary

This thread describes method for extracting function arguments from ida. However this method is not working for stripped binaries (funcdata.size() is always 0). Is it possible to extract such ...
1
vote
0answers
242 views

Reversing apps with statically linked libraries

another newbie question from me. Assuming I know that the application I'm reversing uses certain third party libraries that are publicly available, but it links them statically, is there any easy ...
1
vote
0answers
182 views

How to call DebugActiveProcessStop from disassembled code?

I am debugging an application. Another process is debugged by this application. Here is the call 00705435 FF15 C0007500 CALL DWORD PTR DS [<&KERNEL32.ContinueDebugEvent>] I want to ...
1
vote
0answers
1k views

Create key generator algorithm from validation algo

I understand that this question will be rather vague, but I'm unsure how to process from here. I'm trying to see how a key generator can be made. I have been toying with IDA and managed to ...
1
vote
0answers
1k views

Unpacking Inno Setup installers with InnoExtractor?

I want to know how to use the application InnoExtractor to unpack/extract the files of Inno Setup installers. Some good tutorial/video to learn? I get this application from here.
1
vote
0answers
172 views

Reassembling Silverlight runtime

I'm trying to insert some instrumentation into libraries such as System.Windows.Browser.dll. I tried to use ildasm+ilasm and Reflexil and both failed - reassembled library causes browser crashes, ...
0
votes
0answers
29 views

Decompile/Disassemble an OCX file

We have an OCX file running in IE as ActiveX object. The control is sending some stuff. I need to decompile/disassemble the OCX file. How can I?
0
votes
0answers
60 views

Why does this execve shellcode work with this argv?

I wrote the following program in fasm, and am using Evan's Debugger on Ubuntu to debug it: format ELF64 executable 3 segment readable executable entry $ mov rbp, rsp sub rsp, 32 mov rax, 'this a t' ...
0
votes
0answers
84 views

How to recover randomly generated private key from a Program that implements Diffie Hellman Exchange

This program implements Diffie Hellman key Exchange, a pair of random private keys are generated every time the program runs. How should I go about finding the random number generation subroutine ...
0
votes
0answers
34 views

IDA Fails to Analyze Stack Pointer Correctly in Heavily Chunked Functions

I am currently dealing with obfuscated code in IDA. The obfuscation I am combating is control flow obfuscation, where a function is split up into hundreds of basic blocks spread across the entire ...
0
votes
0answers
13 views

reflection in objectiveC - method invocation return null value

I'm trying to reverse the way dpsconfigad extracting the current active directory domain. Notice : It's rather simple query that can be performed using OpenDirectory public framework but it requires ...
0
votes
0answers
42 views

Setting struct according to offset relative to struct base

I would like to know whether it's possible to define a struct according to offsets from base in Hopper. Assuming there is a register in the assembly code, that I believe it represent the instance ...
0
votes
0answers
57 views

Radare2 jump/switch table walk for 8051

For 8051 target exist famous no-return function with body of d083d082f8e4937012740193700da3a393f8740193f5828883e4737402936860efa3a3a380df which correspond to ?C?CCASE function: / 38: fcn.00000000 ...
0
votes
1answer
82 views

How can I navigate to the Disassembly address location?

I'm using x32dbg and I've set a hardware memory breakpoint. It triggers successfully for a specified module and the debugger pauses and a message on the bottom says: Hardware breakpoint (byte, read/...
0
votes
1answer
91 views

Can GUI elements of a running program be found/located in memory?

Is it possible for a particular GUI element of a running program (on Windows platform) to be located in memory, such as a text element from a dialog box? For example, locating title text of a drop-...
0
votes
0answers
39 views

Which instruction at which address calls the address 0x1a95 or the address 0x204a in the following program or rather smart contract?

The Ethereum Virtual Machine uses a Virtual Instruction Set flavored for transaction processing that doesn’t use any registers and where all opcodes are a single byte long and have a single ABI for ...
0
votes
1answer
447 views

Use GCC and objdump to disassemble any hex to assembly code

What would be the best way (also fewer steps) to generate assembly code for a given hex code ? For e.g., if we know the architecture is x86, and given hex value 0x55, what is the best way to generate ...
0
votes
0answers
70 views

Reverse engineering complex GUI desktop application

I have an old program written in WinDev which connects to a HFSQL local database. Unfortunately, the developer of this app is unavailable, and I need access to the DB. the program folder contains ...
0
votes
1answer
93 views

The executable file makes a unique ID from each individual PC. Can anyone decipher from where the file makes these unique IDs?

The file generates random unique ID. It says hardware ID but I couldn't find it in product key, BIOS serial number or anywhere. I used IDA but I couldn't get from where the file creates the code. Even ...
0
votes
0answers
64 views

Frida: Make executable immune to updates

I have few questions which are related to each other so I'm going to ask all of them here. I have a dll which has no debug symbols(ASLR and relocation is disabled). The functions have names like ...
0
votes
0answers
151 views

How to bring the message box other than error message box

The program asks serial number. I've searched the API call which triggers the wrong password message box and force it into accepting an incorrect serial number in x64dbg’s string references. I found ...
0
votes
0answers
76 views

IDA free : How to find a string reference in .text

To begin with, I'd like to point out that I'm very new to this. Here's the simple thing I'd like to do : The program I want to mess around with displays a msgbox with the string "Please run the ...
0
votes
0answers
101 views

find a video file in memory dump of a process

I have a player that plays encrypted video files and works like this: I open an encrypted video file with it it decrypts the video file and writes it to its memory and plays the file from the memory ...
0
votes
1answer
93 views

ACCESS_VIOLATION when attaching a debugger

I'm debugging a software and it hits access violation on wcslen function under debugger but runs normally without it. First I thought It had some anti-debug trick, but I could not found any ...
0
votes
0answers
84 views

Why decrement a hex value in assembly code?

I am running a disassembly of a firmware image for a Cortex-M4 and the entry point is doing something strange. EntryPoint: 00001000 db 0x00 ; '.' 00001001 db 0xff ; '.' 00001002 ...
0
votes
0answers
155 views

Turning p-code generated by VBA (Visual Basic for Applications) back into VBA

According to the README in https://github.com/bontchev/pcodedmp : "As each VBA line is entered into the VBA editor, it is immediately compiled into p-code" "when you open the source of a macro ...
0
votes
0answers
317 views

Disassembling ARM binary

I am trying to disassemble a firmware binary which I am interested in. Yet I don't have much experience in this field, which is why I would like some input from you guys. My current state is that I ...
0
votes
0answers
100 views

Help reverse engineering a small (60kb) .exe file used for extracting .tga images from a custom container

The executable grabs the specified container format and extracts .tga images from it. It was community-made to satisfy a certain niche, unfortunately I cannot get into contact with the original ...
0
votes
0answers
30 views

Changing pseudocode based on FPU fmul behaviour

A 3D software was compiled in which a typical x/4096f was translated as: fmul ds:f4096 where f4096 equals to: 0.00024414062 Example decompiled pseudocode as-is: skeletonMemoryPointer[i].pos = *(...
0
votes
1answer
384 views

How to find functions in IDA Pro/x64dbg

i created a program for testing, very simple in c++. is ask for password if it is match is print correct, if no it is print "bad". i try to find with ida where is the function of what i made. but i ...
0
votes
1answer
105 views

Finding function at offset loaded with ADRP/ADD

I have this assembly: ADRP X8, #off_FFFFFFF006F1E960@PAGE ADD X8, X8, #off_FFFFFFF006F1E960@PAGEOFF LDR X0, [X8] ; qword_FFFFFFF0077F08A8 LDR X8, [X0] ...
0
votes
0answers
129 views

How to disassemble .mbn files?

I can't disassemble .mbn files using ida pro 7+ if I use some scripts from GitHub than I can't disassemble any function, any help ? I want to reverse qcom bootloader
0
votes
1answer
165 views

Trace back function call

I'm learning reverse engineering and I'm trying to find where an error message is called. I want to get in the part of the code, in the main module, where it decides to display the error message or ...
0
votes
0answers
102 views

Handling __int64 in IDA?

This is probably something very easy that I'm missing. I have this operation length_of_userInput = (signed int)(unsigned __int8)userInput >> 1; And length_of_userInput is currently reading '...
0
votes
0answers
32 views

How to generate .TEXT only asm output in IDM?

So I tried to do File -> Produce File -> Create ASM File. There are lots of dd stuff that I don't want. So now, what I need is, either an android app where I can view that .asm file ...
0
votes
0answers
206 views

How is DS register interpreted in x86-64 assembly instructions?

IDA disassembled an x86-64 instruction as below: 0000000000000761 lea rdx, ds:0[rax*4] What I know is, segment registers are only relevant in in segmented memory model, while in ...
0
votes
0answers
160 views

How to access and modify data segment when doing hardware breakpoint crashes the application?

I want to modify the data segment in the x64_DBG, however, I don't know how to access it. lea r8,qword ptr ds:[7FEF0CA6AD8] In the above code, the address 7FEF0CA6AD8 is loaded in r8 register. I ...
0
votes
0answers
739 views

How to change the DLL name in the already compiled application?

I am trying to change the name of the DLL file I had specified for my application before compiling it. When I change the DLL file name I get the error message like: System.IO.FileNotFoundException: ...
0
votes
0answers
793 views

hidden module when debug with ollydbg 2.01 with size?

i try reversing program with ollydbg2.01, but i Noticed strange thing with ollydbg when try debug program in log file i have 76FC0000 Module <Mod_76FC>(anonymous) and when press alt+E i have ...
-1
votes
1answer
159 views

How can I convert the following assembly code to pseudo code?

I got the following disassembly code in IDA pro. I really find it hard to convert it into pseudo code. push ebp mov ebp, esp sub esp, 14h mov dword ptr [ebp-14h], 1 mov dword ptr [ebp-10h], 2 mov ...
-1
votes
1answer
206 views

Strange Message after manipulating an exe file

i debugged und reversed an exe file with x64dbg I simply changed an assembly command (je) into nop , patched the file and saved it under a different name. (only one line was changed) When i tried to ...
-1
votes
1answer
397 views

A newbies question about CFF explorer screen

I am a bit confused about the CFF explorer quick disassembler options shown in my screen , Can somebody explain what those hex values are underneath the Opcode part ? updated the question part , ...
-1
votes
1answer
340 views

Disassembling code with Hopper

I'm trying to figure out what this code is doing. The first thing that I don't understand is the condition that tests if arg0's value is 0x2. I read that 0x2 in ASCII is STX (Start of text). Here's ...
-1
votes
1answer
501 views

IDA Pro: Converting structure to decimal

I'm new with IDA pro and have little problem. Right click on some data in .rdata brings options in which I can convert, In that window D means decimal B means binary and so on, but I have multiple Ds ...
-1
votes
1answer
319 views

winmain reversing the assembly to c code

this is I got so far #include <windows.h> int WinMain(HINSTANCE hlnst,HINSTANCE hPrev, LPSTR lpCmd,int nShow){ int k =0; int j= 0 ; MessageBox(0,"crackname","",0); int i; ...