All Questions
17 questions
2
votes
0
answers
88
views
jump to invalid address when emulating
I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect ...
- 41
1
vote
1
answer
351
views
List instructions to fix wrong IDA analysis
I don't want to get too much into detail, but a disastrous chain of events that began with a boolean of incorrect size forced the IDA analyzer to discard a lot of instruction sections of many ...
- 197
1
vote
2
answers
185
views
Why eax is assigned to 'variable looked' like addresses
#include <stdio.h>
int main() {
int number1, number2, sum;
printf("Enter two integers: ");
scanf("%d %d", &number1, &number2);
sum = number1 + ...
- 323
2
votes
2
answers
123
views
X86 access to global strings pattern
While reversing some x86 executables, I came across a pattern of addressing globals, that I don't familiar with, but it looks like IDA is, and I would like to know more about it.
.text:00002560 ...
- 1,858
2
votes
1
answer
889
views
Can Ghidra do backward symbolic execution?
I am searching for a tool which can do backwards symbolic execution on x86 binaries. More specifically, I would like to give the tool a program state(PC value + registers + memory content) and have it ...
2
votes
1
answer
3k
views
Finding address in IDA from address found in Cheat Engine
I found a pointer's address, 0x485FE058, in Cheat Engine. However, when I load up the exe in IDA, the addresses are smaller and start from 0x00401000. I read up somewhere that this was called virtual ...
- 21
1
vote
1
answer
138
views
Data moved after program rebase
Consider the following piece of code:
.text:00F74B42 call sub_12D1130
.text:00F74B47 mov eax, dword_15A0C80
Now, I want to add a sanity check but as I don't have enough space to do that I ...
- 21
4
votes
2
answers
2k
views
How do you look for a a particular value at address in IDA
So, I was trying to load some binary and in the main function, I saw instructions such as
mov edi, [esi+1Ch]
...
lea eax, [esi+18h]
So, what are these values at [esi+1Ch] and [esi+18h]. How do ...
- 41
1
vote
2
answers
163
views
How is the IV generated from a timestamp based on this function?
Background: I am currently looking to make some diagnostic software interoperable with other software, but all communication that occurs in this software is encrypted with AES-128-CBC. A sample ...
- 13
5
votes
2
answers
355
views
Flare-ON#3: Problem understanding some parts in the program
I was trying the flare on challenge. When trying the challenge#3 I got into some trouble and could not solve it. After looking into solutions wrote by other I now do know how the program works, but i ...
10
votes
2
answers
6k
views
Why does IDA add "db" statements between disassembled code
I'm trying to analyze a MS-DOS COM file that I wrote a few years ago with IDA Free 5.0, I've since renamed the segment to code_and_data and named constants and set data types correctly. However, when ...
- 203
0
votes
1
answer
1k
views
Stack pointer values in IDA Pro
I wonder why the values of the stack pointer in IDA Pro have similar values.
Can anyone explain their meaning?
- 333
6
votes
2
answers
7k
views
Question about LEA instruction
i'm learning to reverse engineer. So i'm coding some programs and try to understand their assembly.
I stumbled upon a curious case and i think i can't solve it alone.
Here's the c code:
#include &...
- 193
0
votes
1
answer
411
views
Some help with disassembled code understanding
I've got some windows dll file. This dll-file exports a couple of functions to read HDD with some unknown (to me) filesystem. So, I've launched IDA disassembler and started an investigation on how ...
- 103
0
votes
1
answer
155
views
When might a compiler generate JG/JS/JP conditional jumps?
I was wondering where i might encounter JO/JS/JP JCCs (and their not-counterparts) in compiler generated code? What would it mean? I scrolled through a lot of random code, but wasnt able to find a ...
- 463
32
votes
5
answers
12k
views
Why there are not any disassemblers that can generate re-assemblable asm code?
I am struggling on this problem for around three months:
How to use disassemblers (IDA Pro and others...) to generate re-assemblable asm code and assemble it back
My experience is that:
There is NO ...
- 2,485
7
votes
1
answer
1k
views
How to get IDA Pro Free to automatically change segment on retf?
I have been unable to get IDA pro to do a simple disassembly of a flat 16-bit binary (bootloader) file. I'm just getting started, and it seems to be harder than it should be.
There's a simple set of ...
- 203