3

those are pointer arithmetics marks is an <<<;ADDRESS;>>>>> assume 0x10000000 it points to an integer whose size is 4 in 32 bit machine so the next integer will be at 0x10000004 , and the next will be at 0x10000008 and so on &marks[0] = 0x10000000 &marks[1] = 0x10000004 &marks[2] = 0x10000008,c,10,14,18,.....nn each of ...


3

This is compiled to simple jump-table. Firstly it subtracts 1 from the a variable, so now your switch-case is for values in range <0;4> inclusive (instead of <1;5>). Next it checks if a is > 4, if so it jumps to the default label at 0A1109F. Note that the JA instruction is for the unsigned values, so it will jump to the default label in case ...


3

Although these terms are being used interchangeably, There is an intrinsic difference between disassembler and decompiler definitions traditionally. Lets first consider common steps involved in converting low level code to high level human readable code. This is similar to compilation where you convert high level code to low level machine code or an ...


1

It depends on the reverse engineering, most use decompilers to speed up your work, this helps a lot to locate necessary calls, let's say you are at your job and need to quickly find an X algorithm to deliver your work, so if you were to use only one disassembler you would take much more work time analyzing and converting the small assembly instructions and ...


Only top voted, non community-wiki answers of a minimum length are eligible