All Questions

Tagged with
Filter by
Sorted by
Tagged with
0
votes
1answer
90 views

How to decrypt the password using radare2 or gdb?

.--------------------------------------------------. | [0x804851b] | ...
0
votes
1answer
68 views

Use GCC and objdump to disassemble any hex to assembly code

What would be the best way (also fewer steps) to generate assembly code for a given hex code ? For e.g., if we know the architecture is x86, and given hex value 0x55, what is the best way to generate ...
3
votes
1answer
96 views

Why EIP is being overwritten before local buffer ends?

I am doing a simple buffer overflow exercise, here is the source: //vuln.c #include <stdio.h> #include <string.h> int main(int argc, char* argv[]) { char buf[256]; strcpy(buf,...
2
votes
2answers
138 views

eip register address not matching with address at breakpoint (breakpoint set at main function)

I recently started reading a book about reverse engineering. In one of the examples it uses gdb (debugger) to disassemble the main. So I did it, and the output is below (gdb) disass main Dump of ...
2
votes
1answer
105 views

Why do we need to know the address of shellcode?

I have read many articles regarding the buffer overflow exploit. Everywhere its written as follow. "It's difficult to know the starting address of the shellcode" Why do we need to know the address ...
1
vote
0answers
220 views

Stack buffer overflow SIGSEGV help

I've been going at this for a couple of days now working through trial and error but I can't seem to pinpoint exactly why I'm still getting a SIGSEGV. Here's the stdout of me stepping through the ...
6
votes
1answer
1k views

Understanding gdb output

So I was messing with gdb and came across something rather interesting. I ran the following code into gdb: int i, g = 1; for (i = 0; i < 100; i++) g++; Before execution, disas main ...
1
vote
2answers
556 views

Understanding an if statement in assembly

I have written two simple C programs (one with an if and one without). Looking at the assembly differences there are a few lines that I can't manage to explain and was hoping to get some assistance. ...
-1
votes
1answer
308 views

Disassembling code with Hopper

I'm trying to figure out what this code is doing. The first thing that I don't understand is the condition that tests if arg0's value is 0x2. I read that 0x2 in ASCII is STX (Start of text). Here's ...
1
vote
1answer
475 views

How can I change the values in esp?

0x08048785 <+344>: movl $0x0,0xc(%esp) 0x0804878d <+352>: movl $0x804896c,0x8(%esp) 0x08048795 <+360>: movl $0x8048973,0x4(%esp) 0x0804879d <+368>: movl ...
1
vote
1answer
332 views

I have a problem with understanding the register %bl

0x080484ad <+0>: xor %ebx,%ebx 0x080484af <+2>: mov (%eax),%bl ***** 0x080484b1 <+4>: xor $0x52,%bl 0x080484b4 <+7>: cmp $0x11,%bl ...
2
votes
0answers
163 views

Giving labels to local variables with GDB

In the GDB debugger of Linux, is it possible to give a local variable (at specific offset from the %esp register) a constant name, which I will see everytime I call disassemble instead of seeing the ...
4
votes
1answer
869 views

Different disassembly for the same function?

I have this code: #include <stdio.h> int main() { printf("a=%d; b=%d; c=%d", 1, 2, 3); return 0; }; I compile it with gcc -g 3arg.cpp. Disassemble with objdump -d -M intel a.out. In the output ...
6
votes
1answer
2k views

How to get a full execution trace with Python gdb?

While trying to answer another question, I tried to set-up a Python script to automatize the extraction of an assembly execution trace. But, I am really not satisfied of this script and I would like ...
2
votes
2answers
6k views

Debug binary with GDB & disassembly: File format not recognized (elf headers corrupted)

I'm trying to reverse engineer a binary file using GDB and objdump. I can execute the binary in my linux shell, however the file seems to be changed in a way that it can't be debugged / reverse ...
2
votes
3answers
1k views

Books on reversing with GDB?

I'm getting started with some reverse engineering lately, especially on Linux and ELF format, but I'm struggling here. For now I'm only using GDB to disassemble binaries, and even though I can read ...
8
votes
1answer
742 views

Understanding segment prefixes in assembly for Linux

In looking at some assembly, I have come across a few instructions using segment prefixes. For example <address>: .... mov eax,DWORD PTR gs:0x20 I understand the basics of memory segments, ...
7
votes
1answer
6k views

What is the difference between step into and step over when debugging?

I am using EDB and stepping through the program but I do not even know what the difference in behavior is when doing this. I feel like this is something I should know if I ever have hope of reverse ...
4
votes
4answers
1k views

Tools to show the registers and memory locations in use during execution?

I am looking for something that is like gdb but maybe with a GUI that can show all registers current values ans the current values of memory and things on the stack? Freeware is preferred. I have a ...
4
votes
2answers
3k views

Can not continue debugging after SIGTRAP

I am trying to debug an iOS app with gdb and when I hit a breakpoint I get this error, and can not continue. Program received signal SIGTRAP, Trace/breakpoint trap. [Switching to process 190 thread ...
6
votes
1answer
771 views

How to perform SIGTRAP emulation with GDB?

I am trying to analyze a crackme file. When I open it with gdb, I firstly set its SIGTRAP handler with, e.g., int80.SIGTRAP handler address 0x8011111. I caught it through catch syscall signal in gdb....
11
votes
2answers
2k views

Encrypted Mach-o binary cannot be disassembled/traced with GDB

I'm trying to analyze an encrypted Mach-O binary (non-iPhone one), and I am observing the following strange behaviors: when I load this binary into GDB and try to disassemble the code at the address ...
3
votes
2answers
377 views

Why is this string on the stack not exactly the one I entered? [closed]

I was trying to understand buffer overflow attacks using the following C program #include"stdio.h" #include"string.h" void iwontprint() { printf("i wont be printed!"); } void ...