Hot answers tagged

22 votes
Accepted

Purpose of test eax,eax after a strcmp

Register eax will contain the return code from strcmp, after the call. The test eax, eax is the same as and eax, eax (bitwise and) except that it doesn't store the result in eax. So eax isn't affected ...
0xC0000022L's user avatar
  • 10.9k
20 votes

Radare2 C output

The pc command will output n bytes from the current seek (s) as a C array, where n is the Block size (b) or the length mentioned in the command. The output is then can be used to, for example, ...
Megabeets's user avatar
  • 8,919
16 votes
Accepted

Difference between Main and Entry

Main is usually a programmer-defined entry point, while entry is defined by the compiler, it's doing many other operations such as libc initializations, heap allocation, and so on, and eventually, ...
macro_controller's user avatar
14 votes
Accepted

Translate ASSEMBLY to C

Here is exact answer to you question. Go to http://www.tutorialspoint.com/compile_assembly_online.php Doubleclick on main.asm in upper-left corner of the screen Copy your snippet to the text window....
w s's user avatar
  • 8,408
12 votes

Purpose of test eax,eax after a strcmp

You might be missing the fact that call strcmp will not set ZF for you - it returns the result in the EAX register. But JNE instruction tests ZF, and that test eax, eax serves to set ZF according to ...
Edheldil's user avatar
  • 251
11 votes
Accepted

Question about LEA instruction

What you're seeing is an efficiency trick that compilers like to use. Internally, the CPU doesn't make a difference between numbers and addresses - 32 bit integers and pointers are the same thing. (...
Guntram Blohm's user avatar
11 votes
Accepted

What do the 20 lines of executable code in this exploit do?

EDIT: @EnricoGhirardi Thanks for pointing the mul esi inaccuracy I previously posted! To start out, the first instruction mul esi zeroes out rax and rdx in the example below (this is only because rsi ...
itsbriany's user avatar
  • 440
11 votes
Accepted

Which operators use sal, shl, sar or shr

First it should be noted that there are so many architectures out there, each with its own instruction set. Here I assume you mean x86 (and you should indeed tag the proper architecture as 0xC0000022L ...
phuclv's user avatar
  • 476
8 votes

How to effectively bypass GCC stack smashing detection

You don't need to bypass gcc's stack smashing detection. If you overwrite key correctly, you get an interactive shell before the stack check is performed at the end of func(). Here's the proof in the ...
Jason Geffner's user avatar
8 votes
Accepted

How to effectively bypass GCC stack smashing detection

The answer from Jason is the correct solution. However, I wanted to give an alternative answer without Python, but from the terminal. IMO Python is always preferred for better automation, but ...
BitParser's user avatar
  • 196
8 votes

Purpose of test eax,eax after a strcmp

prototype of strcmp() int strcmp( const char *string1, const char *string2 ); the function returns an int whose interpretation is as follows so i think that answers your question of when it ...
blabb's user avatar
  • 16.3k
8 votes
Accepted

What does this assembly language program output?

This is such a small program so this could be followed without converting it back to C. Let's break it down what happens when it's being called with asm(0xb6, 0xc6). push ebp mov ebp, esp ...
Paweł Łukasik's user avatar
8 votes

Best way to protect source code of .exe program running on Python?

There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose. ...
0xec's user avatar
  • 6,040
7 votes
Accepted

Retrieving the contents of PE file sections

As per the comments above, the SECHDROFFSET() macro formula is not reliable. You should instead use the macro IMAGE_FIRST_SECTION().
Jason Geffner's user avatar
7 votes

When do rep and stos appear in compiled C?

Let's start by explaining what each instruction does. REP OPD works as follows : for (; ecx > 0; ecx--) OPD This instruction will repeat the operand while decrementing ECX until it ...
yaspr's user avatar
  • 2,663
7 votes

Android- hiding private keys in .so file

If your application can decrypt the files, then you should assume that anyone sufficiently interested can do so as well. End of story. Obfuscation can slow people down, but it won't stop everyone, ...
Antimony's user avatar
  • 2,002
7 votes
Accepted

How to convert assembly to pseudo code?

Although rewriting assembly to pseudo C is not technically reverse engineering, I'll try to help init: mov eax, [ebp+8] push eax mov eax, [ebp+0xc] push eax mov eax, [ebp+0x10] ...
sudhackar's user avatar
  • 2,629
7 votes
Accepted

Elf x86_64 adding function

It is possible to do what you want. There are some difficulties you may encounter though. I'll show you a short instruction how it can be done in several different cases. Have a look at ELF ...
bart1e's user avatar
  • 3,369
7 votes
Accepted

Is there a way to name a flag for a bit field in Ghidra?

select SCALAR in decompiler window right click ->Set Equate ("E" short cut) type or select if available a sample EQUATE as below uVar6 = *(ushort *)param_2 & THIS_IS_MY_BAD;
blabb's user avatar
  • 16.3k
6 votes

What do the 20 lines of executable code in this exploit do?

The answer above is correct for the most part but it includes some inaccuracies. I can't comment so I'll add the corrections in this answer. First I don't think this is a good shellcode since it ...
Enrico Ghirardi's user avatar
6 votes

How to effectively bypass GCC stack smashing detection

first, you should disable ASLR system-wide, you can do this as follows: echo "0" > /proc/sys/kernel/randomize_va_space second, compile your program using flag with -zexecstack -fno-stack-...
Febriyanto Nugroho's user avatar
6 votes
Accepted

Good foundation for reverse engineering malware

Knowing how things in C work under the hood will help you if you're familiar with C and use it as your primary programming language, otherwise it's perfectly fine to have x86 asm as your first ...
NirIzr's user avatar
  • 11.7k
6 votes
Accepted

Is there a way to find out which hash standard by studying the source code?

This is quite likely either a botched RIPEMD128 or something very similar, as otus also commented. You wanted to know how to approach such a task so I'll explain what I did. Typically, when trying ...
Johann Aydinbas's user avatar
6 votes
Accepted

Understanding Program Arguments on the Stack in Assembly

First of all, you have to understand that there is a specification for all these things. These specifications differ from one assembly language to another and from one operating system to the other. ...
perror's user avatar
  • 18.9k
6 votes
Accepted

Reverse a call to mmap()

The signature for mmap is void *mmap(void *addr, size_t length, int prot, int flags, int fd, off_t offset); 4294967295 is same as -1 when treated as a signed integer. The mmap calls actually looks ...
0xec's user avatar
  • 6,040
5 votes

Basic help for reverse engineering for a newbie

When I started with reversing about 3 years ago I used the following books: Reversing:Secrets of Reverse Engineering Practical Malware Analysis Both of these books have some really good newbie ...
ubnix's user avatar
  • 1,063
5 votes
Accepted

Writing an exploit for sample-application

Why is it not working. This example is basically from an older book I'm reading. But theoretically it should work so I think.... It's because you're overwriting the return address on the stack ...
Jason Geffner's user avatar
5 votes
Accepted

Hex Rays - strange functions __ROL4__ and __ROR4__

Check out IDA directory\plugins\defs.h. ... // Macros to represent some assembly instructions // Feel free to modify them #define __ROL__(x, y) __rotl__(x, y) // Rotate left #define __ROR__(x, ...
mikfig's user avatar
  • 66
5 votes
Accepted

Identifying possible structs in C/C++ disassembly

There is nothing strange in structures or objects with large arrays or other structures inside.In addition I see that most of the large offsets are counted from ecx register, which fits to the ...
w s's user avatar
  • 8,408

Only top scored, non community-wiki answers of a minimum length are eligible