Hot answers tagged

21 votes
Accepted

Purpose of test eax,eax after a strcmp

Register eax will contain the return code from strcmp, after the call. The test eax, eax is the same as and eax, eax (bitwise and) except that it doesn't store the result in eax. So eax isn't affected ...
user avatar
  • 10.5k
16 votes

Radare2 C output

The pc command will output n bytes from the current seek (s) as a C array, where n is the Block size (b) or the length mentioned in the command. The output is then can be used to, for example, ...
user avatar
  • 8,639
16 votes
Accepted

Difference between Main and Entry

Main is usually a programmer-defined entry point, while entry is defined by the compiler, it's doing many other operations such as libc initializations, heap allocation, and so on, and eventually, ...
user avatar
14 votes
Accepted

Becoming A Better Reverse Engineer

These suggestions may help. One sure way of becoming a better reverse engineer is to become a better "forward engineer"! Here's what I would suggest: Examine the assembly output of various ...
user avatar
  • 2,416
14 votes
Accepted

Translate ASSEMBLY to C

Here is exact answer to you question. Go to http://www.tutorialspoint.com/compile_assembly_online.php Doubleclick on main.asm in upper-left corner of the screen Copy your snippet to the text window....
user avatar
  • 7,720
12 votes
Accepted

What do the 20 lines of executable code in this exploit do?

EDIT: @EnricoGhirardi Thanks for pointing the mul esi inaccuracy I previously posted! To start out, the first instruction mul esi zeroes out rax and rdx in the example below (this is only because rsi ...
user avatar
  • 420
12 votes

Purpose of test eax,eax after a strcmp

You might be missing the fact that call strcmp will not set ZF for you - it returns the result in the EAX register. But JNE instruction tests ZF, and that test eax, eax serves to set ZF according to ...
user avatar
  • 251
11 votes
Accepted

Question about LEA instruction

What you're seeing is an efficiency trick that compilers like to use. Internally, the CPU doesn't make a difference between numbers and addresses - 32 bit integers and pointers are the same thing. (...
user avatar
10 votes
Accepted

Which operators use sal, shl, sar or shr

First it should be noted that there are so many architectures out there, each with its own instruction set. Here I assume you mean x86 (and you should indeed tag the proper architecture as 0xC0000022L ...
user avatar
  • 466
8 votes
Accepted

C What kind of sorting algorithm is this?

It's a binary search. I've renamed several of the variables, and in one case, introduced a new variable, because one of the local variables was used for one thing in the first half of the function ...
user avatar
  • 96
8 votes

How to effectively bypass GCC stack smashing detection

You don't need to bypass gcc's stack smashing detection. If you overwrite key correctly, you get an interactive shell before the stack check is performed at the end of func(). Here's the proof in the ...
user avatar
8 votes
Accepted

How to effectively bypass GCC stack smashing detection

The answer from Jason is the correct solution. However, I wanted to give an alternative answer without Python, but from the terminal. IMO Python is always preferred for better automation, but ...
user avatar
  • 196
8 votes

Purpose of test eax,eax after a strcmp

prototype of strcmp() int strcmp( const char *string1, const char *string2 ); the function returns an int whose interpretation is as follows so i think that answers your question of when it ...
user avatar
  • 14.9k
8 votes
Accepted

What does this assembly language program output?

This is such a small program so this could be followed without converting it back to C. Let's break it down what happens when it's being called with asm(0xb6, 0xc6). push ebp mov ebp, esp ...
user avatar
8 votes

Best way to protect source code of .exe program running on Python?

There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose. ...
user avatar
  • 5,850
7 votes

Where is the code for a global variable declaration in Ollydbg?

The C compiler doesn't create any assembly code to declare and initialize global fundamental data types, so you won't see anything like MOV ..., 3 in OllyDbg for your program above. In the ...
user avatar
7 votes

What do the 20 lines of executable code in this exploit do?

The answer above is correct for the most part but it includes some inaccuracies. I can't comment so I'll add the corrections in this answer. First I don't think this is a good shellcode since it ...
user avatar
7 votes

When do rep and stos appear in compiled C?

Let's start by explaining what each instruction does. REP OPD works as follows : for (; ecx > 0; ecx--) OPD This instruction will repeat the operand while decrementing ECX until it ...
user avatar
  • 2,603
7 votes

Android- hiding private keys in .so file

If your application can decrypt the files, then you should assume that anyone sufficiently interested can do so as well. End of story. Obfuscation can slow people down, but it won't stop everyone, ...
user avatar
  • 1,972
7 votes
Accepted

How to convert assembly to pseudo code?

Although rewriting assembly to pseudo C is not technically reverse engineering, I'll try to help init: mov eax, [ebp+8] push eax mov eax, [ebp+0xc] push eax mov eax, [ebp+0x10] ...
user avatar
  • 2,389
6 votes
Accepted

IDA Pro C dump for Decryption function

As you expected, it's doing a very simple XOR. The equivalent code looks something like this: int mystery(char *buff, int bufsize, int nonce1, int nonce2) { int result = 0; // ch is the next ...
user avatar
  • 2,416
6 votes
Accepted

How can a format string vulnerability be used to write a specific string into memory?

It's a lot of questions, here are a few answers: How can we write something in memory with a format string vulnerability ? For this, you need to know two specific features used in the printf format ...
user avatar
  • 18.1k
6 votes
Accepted

Insert jmp detour into a compiled program

I compiled your program on Ubuntu 14.04 and put it on https://mega.co.nz/#!gdRRxRzZ!dw08GEHvXeTxXqurcpMLOxpXVjZa807TJN0PH60h4Rg; you might want to use that binary if you want to retrace the following ...
user avatar
6 votes
Accepted

How to find the size of an array in binary?

There's no easy way to do this, C doesn't have a concept of array sizes (at execute time), so the size isn't stored anywhere. You'll have to read the assembly code and (try to) understand it. Take ...
user avatar
6 votes

what's the function of LODWORD and HIDWORD?

This pattern is typical for assigning a 64-bit value to a variable on a 32 bit system - you calculate each 32-bit value separately, then push them into the high and low 32 bits of the 64 bit value. ...
user avatar
6 votes
Accepted

64-bit integers on 32-bit machines

1: See the Immediates section on this 64 bit assembly reference. Immediate values inside instructions remain 32 bits and their value is sign extended to 64 bits There just isn't an instruction to ...
user avatar
6 votes

Returning a C function to its grandfather

I'm on a 64-bit machine. Your code in function_b() treats pointers as 32-bit values instead of 64-bit values. You should be using uint64_t* instead of uint32_t*.
user avatar
6 votes

How to effectively bypass GCC stack smashing detection

first, you should disable ASLR system-wide, you can do this as follows: echo "0" > /proc/sys/kernel/randomize_va_space second, compile your program using flag with -zexecstack -fno-stack-...
user avatar
6 votes
Accepted

Retrieving the contents of PE file sections

As per the comments above, the SECHDROFFSET() macro formula is not reliable. You should instead use the macro IMAGE_FIRST_SECTION().
user avatar
6 votes
Accepted

Good foundation for reverse engineering malware

Knowing how things in C work under the hood will help you if you're familiar with C and use it as your primary programming language, otherwise it's perfectly fine to have x86 asm as your first ...
user avatar
  • 11.4k

Only top scored, non community-wiki answers of a minimum length are eligible