New answers tagged assembly
1
If you don't need assembly, just read the source file (main.c). objdump is a debug tool and by using it you can check what assembly instructions correspond to source lines. If you don't need this functionality, why are you using objdump at all?
4
LDRD R8, R9, [R3, #0x20] - I'm guessing they meant to write 8 words (where a word is 4 bytes long). The same goes for 9 words (instead of bytes)
LDRNE R2, [R5, #960]! -
960 is added to the address contained in R5, the value (4 bytes) contained at resulting address is then loaded into R2.
Following the load the address which was accessed previously is stored ...
0
This topic has been explored by Rolf Rolles in this OpenRCE article (reposted here).
Briefly, when the cases are close together, the compiler can use the switch variable to index a jump table. However, when cases are further apart, it would have to generate a huge table with many empty cases which would blow up the binary size. Although the sequence of cmp ...
0
You did not understand why your code is using an obfuscador, first you need to remove the obfuscador used by the developer to only then start the process of reconstructing the algorithm, use appropriate tools for this task like DIE (Detect It Easy), after discovering the name of the obfuscador look for a way to clear its torque, there are many ways for ...
2
if visual studio 2017 community is generating the pattern fill
then compiler option /RTCsu is being used
this also switches on Incremental linking (*.ilk files will be generated)
earlier versions of compiler used /GZ option which if used now will generate a deprecation warning
your code is also not using scanf_s a secure version of vulnerable scanf();
that ...
0
What you are really looking for is a code stud. A code cave uses unused space to sort of jump add your own code and jump back. The problem with code caves is that there is a size constraint in the PE binary that won't give you a lot of space.
A code stud on the other hand is adding an addition .TEXT section. With this method you can avoid the pitfalls of DEP ...
0
You are asking how to insert a "code cave" or a "balcony" into existing code. You could proceed like so:
Select a location in the code from where you like to branch into your code cave. You should be prepared to replace existing code with five bytes, a JMP code and four offset bytes, and possible following surplus bytes with NOP ...
Top 50 recent answers are included
