All Questions
15 questions
3
votes
1
answer
983
views
What is the meaning of jmp dword ptr off_XXXXXXXX + 8 in IDA?
What is the meaning of this kind of jmp instruction in x86 assembly in IDA?
Does it mean that we should jump to the address [6CA2E9B0] + 8 or [6CA2E9B0+8]?
When I follow that off_XXX, I get to the ...
- 31
1
vote
2
answers
185
views
Why eax is assigned to 'variable looked' like addresses
#include <stdio.h>
int main() {
int number1, number2, sum;
printf("Enter two integers: ");
scanf("%d %d", &number1, &number2);
sum = number1 + ...
- 323
0
votes
2
answers
695
views
IDA Pro, replace exit() with continue;
This is the function:
loc_BA060: ; status
xor edi, edi
call _exit
How can one replace exit with continue?
- 23
2
votes
1
answer
889
views
Can Ghidra do backward symbolic execution?
I am searching for a tool which can do backwards symbolic execution on x86 binaries. More specifically, I would like to give the tool a program state(PC value + registers + memory content) and have it ...
1
vote
1
answer
479
views
Find Reference To Resource String In Windows 3.1 16-bit DLL with IDA Pro
Experimenting Visual Basic 4 in DosBox + Windows 3.1 running on Windows 10. While I have installed SHARE.exe from MS-DOS 6.22 and it seems to run OK, it still fails to detect it.
The error I get is : ...
- 1,267
0
votes
1
answer
172
views
Why Ida pseudo-code translate test as AND?
In IDA when disassembling a x86 EXE file there is a line
test byte ptr [ebp+XXX], cl
Before this line cl has a value of 0x11
The Hex-Rays decompiler plugin translates it as if (v10 &0x11).
Why ...
- 27
1
vote
1
answer
699
views
What purpose of MOVZX EAX,AX after MOVZX EAX, WORD PTR [RBP+ADDR.SA_DATA]?
I thought it was strange when I was looking at the code below. The first instruction clearly has completed the task of data transfer and expansion into 16 bits. Why is there a "mov Eax,ax" in the ...
- 13
4
votes
2
answers
2k
views
How do you look for a a particular value at address in IDA
So, I was trying to load some binary and in the main function, I saw instructions such as
mov edi, [esi+1Ch]
...
lea eax, [esi+18h]
So, what are these values at [esi+1Ch] and [esi+18h]. How do ...
- 41
5
votes
2
answers
355
views
Flare-ON#3: Problem understanding some parts in the program
I was trying the flare on challenge. When trying the challenge#3 I got into some trouble and could not solve it. After looking into solutions wrote by other I now do know how the program works, but i ...
-1
votes
1
answer
315
views
where the variable and it's size are stored inside windows executabe file?
i am beginner in reverse engineering. i want to understand where the variables and it's size are stored inside an windows executable file.
somehow i can able to find the values of variables i ...
4
votes
1
answer
253
views
What is the pictured x86 technique/area called?
I've been reverse-engineering Windows PE files and I've discovered this pattern used quite often, making it a little more difficult to follow API calls. First, I'll go to the file's imports and then I ...
- 1,880
0
votes
1
answer
411
views
Some help with disassembled code understanding
I've got some windows dll file. This dll-file exports a couple of functions to read HDD with some unknown (to me) filesystem. So, I've launched IDA disassembler and started an investigation on how ...
- 103
0
votes
1
answer
155
views
When might a compiler generate JG/JS/JP conditional jumps?
I was wondering where i might encounter JO/JS/JP JCCs (and their not-counterparts) in compiler generated code? What would it mean? I scrolled through a lot of random code, but wasnt able to find a ...
- 463
7
votes
1
answer
1k
views
understanding the stack
I have de-assembled a x86 application use ida, it generates
the following code
.text:1084FF10 push ebp
.text:1084FF11 mov ebp, esp
.text:1084FF13 ...
- 226
4
votes
1
answer
384
views
Take A Snippet of Assembly and Make All Side Effects Explicit?
I came across a small function whose only side effects were to modify the state of some processor flags. When I decompiled this function using the Hex Rays decompiler, I simply got an empty function, ...
- 1,537