New answers tagged


“No such file or directory” is often printed by the shell when the dynamic interpreter of the executable is not found. You can find out which one it expects by using readelf-l.


PC = current Instruction pointer + instruction length PC = IP + 4 PC = 0x176E4 + 4 == 176E8 destination = 0x1768C offset is encoded as a signed number of ((destination - PC)>>1) :\>python -c "print(hex((0x1768c-0x176e8)>>1)) -0x2e unconditional jump B can be encoded from E0 00 to E7 FF ==> E + (0x0 to 0x7ff ) == 0b1110 + (...


This is an unconditional branch (thumb) It is encoded as 11100|signed 11-bit immediate offset E 7 D 2 1110 0111 1101 0010 so your 11-bit offset is 0b11111010010. This is sign extended to -46 The operation is: PC = PC + (SignExtend(signed_immed_11) << 1) where the first PC contains the address of the branch plus 4. 0x176E4 + 4 + (-46 * 2) ==...


The thing that is unclear to me is what happens in the code block from 00088868 to 00088898. In a plausible scenario, the flow should continue from 000888BE. In that case, this is a TEA encryption function, as can be seen from the 0x9E3779B9 signature, characteristic of the TEA cipher and its modifications like XTEA, and the code at 000888E0, which is ...

Top 50 recent answers are included