Skip to main content
22 votes
Accepted

Purpose of test eax,eax after a strcmp

Register eax will contain the return code from strcmp, after the call. The test eax, eax is the same as and eax, eax (bitwise and) except that it doesn't store the result in eax. So eax isn't affected ...
0xC0000022L's user avatar
  • 10.9k
20 votes

Radare2 C output

The pc command will output n bytes from the current seek (s) as a C array, where n is the Block size (b) or the length mentioned in the command. The output is then can be used to, for example, ...
Megabeets's user avatar
  • 8,999
16 votes
Accepted

Difference between Main and Entry

Main is usually a programmer-defined entry point, while entry is defined by the compiler, it's doing many other operations such as libc initializations, heap allocation, and so on, and eventually, ...
macro_controller's user avatar
12 votes

Purpose of test eax,eax after a strcmp

You might be missing the fact that call strcmp will not set ZF for you - it returns the result in the EAX register. But JNE instruction tests ZF, and that test eax, eax serves to set ZF according to ...
Edheldil's user avatar
  • 251
11 votes
Accepted

Which operators use sal, shl, sar or shr

First it should be noted that there are so many architectures out there, each with its own instruction set. Here I assume you mean x86 (and you should indeed tag the proper architecture as 0xC0000022L ...
phuclv's user avatar
  • 476
8 votes
Accepted

How to effectively bypass GCC stack smashing detection

The answer from Jason is the correct solution. However, I wanted to give an alternative answer without Python, but from the terminal. IMO Python is always preferred for better automation, but ...
BitParser's user avatar
  • 196
8 votes

Purpose of test eax,eax after a strcmp

prototype of strcmp() int strcmp( const char *string1, const char *string2 ); the function returns an int whose interpretation is as follows so i think that answers your question of when it ...
blabb's user avatar
  • 16.4k
8 votes
Accepted

What does this assembly language program output?

This is such a small program so this could be followed without converting it back to C. Let's break it down what happens when it's being called with asm(0xb6, 0xc6). push ebp mov ebp, esp ...
Paweł Łukasik's user avatar
8 votes

Best way to protect source code of .exe program running on Python?

There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose. ...
0xec's user avatar
  • 6,090
8 votes
Accepted

Is there a way to name a flag for a bit field in Ghidra?

select SCALAR in decompiler window right click ->Set Equate ("E" short cut) type or select if available a sample EQUATE as below uVar6 = *(ushort *)param_2 & THIS_IS_MY_BAD;
blabb's user avatar
  • 16.4k
7 votes

When do rep and stos appear in compiled C?

Let's start by explaining what each instruction does. REP OPD works as follows : for (; ecx > 0; ecx--) OPD This instruction will repeat the operand while decrementing ECX until it ...
yaspr's user avatar
  • 2,673
7 votes

Android- hiding private keys in .so file

If your application can decrypt the files, then you should assume that anyone sufficiently interested can do so as well. End of story. Obfuscation can slow people down, but it won't stop everyone, ...
Antimony's user avatar
  • 2,012
7 votes
Accepted

How to convert assembly to pseudo code?

Although rewriting assembly to pseudo C is not technically reverse engineering, I'll try to help init: mov eax, [ebp+8] push eax mov eax, [ebp+0xc] push eax mov eax, [ebp+0x10] ...
sudhackar's user avatar
  • 2,709
7 votes
Accepted

Elf x86_64 adding function

It is possible to do what you want. There are some difficulties you may encounter though. I'll show you a short instruction how it can be done in several different cases. Have a look at ELF ...
bart1e's user avatar
  • 3,409
6 votes
Accepted

Good foundation for reverse engineering malware

Knowing how things in C work under the hood will help you if you're familiar with C and use it as your primary programming language, otherwise it's perfectly fine to have x86 asm as your first ...
NirIzr's user avatar
  • 11.8k
6 votes
Accepted

Is there a way to find out which hash standard by studying the source code?

This is quite likely either a botched RIPEMD128 or something very similar, as otus also commented. You wanted to know how to approach such a task so I'll explain what I did. Typically, when trying ...
Johann Aydinbas's user avatar
6 votes
Accepted

Understanding Program Arguments on the Stack in Assembly

First of all, you have to understand that there is a specification for all these things. These specifications differ from one assembly language to another and from one operating system to the other. ...
perror's user avatar
  • 19.1k
6 votes
Accepted

Reverse a call to mmap()

The signature for mmap is void *mmap(void *addr, size_t length, int prot, int flags, int fd, off_t offset); 4294967295 is same as -1 when treated as a signed integer. The mmap calls actually looks ...
0xec's user avatar
  • 6,090
5 votes
Accepted

Hex Rays - strange functions __ROL4__ and __ROR4__

Check out IDA directory\plugins\defs.h. ... // Macros to represent some assembly instructions // Feel free to modify them #define __ROL__(x, y) __rotl__(x, y) // Rotate left #define __ROR__(x, ...
mikfig's user avatar
  • 66
5 votes
Accepted

Identifying possible structs in C/C++ disassembly

There is nothing strange in structures or objects with large arrays or other structures inside.In addition I see that most of the large offsets are counted from ecx register, which fits to the ...
w s's user avatar
  • 8,508
5 votes

Inverse And operation

The answer is no. Unlike bitwise XOR, bitwise AND can't be reversed: 0 & 1 = 0 0 & 0 = 0 Both AND and OR are not reversible. This is in contrast to XOR and NOT operators which are reversible....
Megabeets's user avatar
  • 8,999
5 votes
Accepted

help needed to understand this pseudo code from ida and possibly recreate it

The thing about "decompiled" code is, it doesn't really say much about what the author was trying to do. It is simply the compiler's view on what the code meant, and the compiler will optimize away ...
cHao's user avatar
  • 166
5 votes

Is there any decompiler, which can produce a compilable result?

Unfortunately no, there is no such decompiler publicly available. All decompilers have to guess the missing information and just one wrong answer is enough to spoil the result. Second, re-...
Ilfak Guilfanov's user avatar
5 votes
Accepted

Reverse engineering a compression algorithm to decompress ASCII text (LZ-variant?)

The code isn't easy to read since one has to do that statically and it doesn't seem to respect a standard EABI. So, instead of trying to fully reverse engineer the code, I tried to search for the used ...
wisk's user avatar
  • 1,164
5 votes

GetWindowLongPtr with undocumented nIndex of -1

I think I got it. GetWindowLongPtr(hWnd, -1) returns a pointer to a nested struct that is a part of the WND struct (that contains main information about a window.) There's really no official name for ...
c00000fd's user avatar
  • 1,711
5 votes
Accepted

Simple C program disassembled with Ghidra

Program entry point != main You're seeing disassembly of a few of the functions automatically linked to the program by the compiler toolchain that are responsible for setting up the C Run-Time (CRT) ...
julian's user avatar
  • 7,176
5 votes
Accepted

Why is fastcall used for replacing thiscall functions in memory instead of cdecl?

This question is a bit confusing. Both __fastcall and __thiscall share that they use ecx as the first storage point. So either you implicitly say the class pointer will be in ecx (__thiscall) or you ...
Johann Aydinbas's user avatar
5 votes
Accepted

Confused about the use of the shl instruction in this disassembly

Let's break it down line by line. Assuming x is the thing you want to multiply by 21 and it's stored in eax (as it is in this example after line 34). <39>: mov edx, eax ; so copy the x to edx &...
Paweł Łukasik's user avatar
4 votes
Accepted

Can a keygen be created for this protection algorithm?

Short, slightly snarky answer: yes, there must be a way to make a keygen. If there wasn't, the creators of the software themselves wouldn't be able to create keys to sell. Longer answer: If the ...
Guntram Blohm's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible