Hot answers tagged

124

Such small snippets are not too hard to decompile manually. Let's try it. You have already figured out that cl holds a character, this means that eax where it's read from is a pointer to a character array. Let's call it p. Now, let's do a dumb translation for every assembly statement to C: l1: ; l1: mov cl, [eax] ; cl = *p; cmp cl, ' ' ; ...


38

There are several broad ways in which you could do this. Dynamic instrumentation Tools such as PIN, Valgrind, or DynamoRIO allow you to dynamically change the behavior of a program. For instance, you can add calls to new functions at particular addresses, intercept library calls and change them, and much more. The downside is that dynamic instrumentation ...


25

AFAIK that is not possible. There are other things you can keep in mind however: Use of the GCC optimization flags will help make the code look much less readable to a human. When you compile with the highest level of optimization gcc -O3 the compiler will move things around such that the "flow" might not be at all what you expect. You can also use the ...


21

Short answer: No. Long answer: On the (Im)possibility of Obfuscating Programs by Boaz Barak, Oded Goldreich, Rusell Impagliazzo, Steven Rudich, Amit Sahai, Salil Vadhan, and Ke Yang. Medium answer: If you give your program to a user that control the platform where your program will be executed, there is no way to prevent the reverse-engineering of it. The ...


18

It is very simple in some architectures, and not very obvious in others. I'll describe a few I'm familiar with. SystemV x86_64 (Linux, OS X, BSD) Probably the easiest to recognize. Because of the boneheaded decision to specify the number of used XMM registers in al, most vararg functions begin like this: push rbp mov rbp, rsp sub ...


17

Parameters Not only does it depend on the platform but different functions have different calling conventions. The calling convention basically tells you how you know where the arguments are. It says nothing about the local function stack frame layout. It's also extremely important to understand that when a function or method can be proven by the compiler ...


16

Very often, you can change the behavior of a program by carefully hooking into it. Whether you can add the functionality you want this way depends on how the program is constructed. It helps if the program comes in the form of one main executable plus several libraries. You can hook into any call that the program makes to shared libraries by linking your ...


15

The pc command will output n bytes from the current seek (s) as a C array, where n is the Block size (b) or the length mentioned in the command. The output is then can be used to, for example, manipulate the array outside of radare2, build a shellcode, decrypt a buffer and so on. Let's demonstrate it with a simple example. Here's a tiny HelloWorld.c ...


14

Here is the list of few decompilation tools / resources that you may find useful. IDA Pro + Hex-Rays decompiler Hopper disassembler (has a decompiler) ODA (Online Disassembler) Retargetable Decompiler


14

Register eax will contain the return code from strcmp, after the call. The test eax, eax is the same as and eax, eax (bitwise and) except that it doesn't store the result in eax. So eax isn't affected by the test, but the zero-flag is, for example. The test eax, eax is necessary to make the jne work in the first place. And jne is the same as jnz, just as je ...


13

GDB allows you to use C-style casts, so simply do this, if you know the address: (gdb) print/x (int[15])(*0x401ba0) An example output would be: $1 = {0x5241c031, 0x41535341, 0x41554154, 0x55574156, 0x48e58948, 0x31f0e483, 0x31f631ff, 0xe8c931d2, 0xfffffb08, 0xc0314850, 0x580f0174, 0x7c00f883, 0xec8948c7, 0x415f415d, 0x415d415e} If you have the address of ...


13

All Hex-Rays macros are defined in <IDA directory>\plugins\defs.h. It's also available at https://github.com/nihilus/hexrays_tools/blob/master/code/defs.h For BYTE3(x): ... #define BYTEn(x, n) (*((_BYTE*)&(x)+n)) ... #define BYTE3(x) BYTEn(x, 3) ... So BYTE3(x) yields (*((_BYTE*)&(x)+3)), which effectively means the fourth byte of the ...


13

If you look at the disassembly of authorize() I'm sure you'll find that the compiler is pushing and restoring more registers than just EBP or aligning the stack. I would recommend that you always look at the disassemly when dealing with overflows of various kinds. The compiler and decompiler, if you use one, hides a lot of details. The disassembly never lies ...


13

rECX = (rECX & 0xFFFFFF00) | ((rECX & 0xFF) >> 1)


13

These suggestions may help. One sure way of becoming a better reverse engineer is to become a better "forward engineer"! Here's what I would suggest: Examine the assembly output of various compilers. Write test programs of increasing complexity and examine the assembly language output so that you get a sense of what the compiler does for any given high ...


13

Here is exact answer to you question. Go to http://www.tutorialspoint.com/compile_assembly_online.php Doubleclick on main.asm in upper-left corner of the screen Copy your snippet to the text window. You'll need to add definition of data and make some tweaks, my resulting assembly code is section .text global main main: xor ebp,ebp mov dword [ebp+...


12

EDIT: @EnricoGhirardi Thanks for pointing the mul esi inaccuracy I previously posted! To start out, the first instruction mul esi zeroes out rax and rdx in the example below (this is only because rsi is 0 to begin with). The least significant bits will be stored in rax and the most significant bits will be stored in rdx. Both of these registers will be zero....


11

Why does the return address have to point to the shellcode in the same buffer? It doesn't, but generally, both the shellcode and the return address are delivered at the same time, so they are stuck together for that reason. If your exploit allows you to deliver them separately, then they can be separated. However, they are by necessity both local to the ...


11

functionpointer is declared before char buffer[50]; on the stack so How comes it overwrites it ??? The order of objects in the stack is implementation defined. C does not mention any stack and the direction of the stack growing is also implementation-defined (usually it grows downwards but in some systems it grows upwards). In your case functionpointer is ...


11

What you're seeing is an efficiency trick that compilers like to use. Internally, the CPU doesn't make a difference between numbers and addresses - 32 bit integers and pointers are the same thing. (Or 64 bit, if you're using newer architecture, but as your register names start with e, you're using 32 bit). The lea instruction loads the address of its ...


10

(My answer is x86-specific). Internally to the function, it looks just like any other function. The only difference being, at some point during the function, it will take the (stack) address of the last non-variable argument, and increment it by the word size on the platform; this is then used as a pointer to the base of the variable arguments. ...


10

You might be missing the fact that call strcmp will not set ZF for you - it returns the result in the EAX register. But JNE instruction tests ZF, and that test eax, eax serves to set ZF according to EAX. (actually, the opposite way, EAX=1 -> ZF=0). I recommend reading some easy book on x86 assembly, it will help you a lot.


9

Well, especially for that, Hex-Rays Decompiler was invented. It will decompile ASM code into pseudo-C, and from there You may write C-based logic of assembly code You have.


8

(gdb) dump binary memory dump.raw 0x401ba0 0x401bdc dump memory into file dump.raw from address 0x401ba0 until address 0x401bdc Another option would be examine: x/nfu <address> Print memory. n: How many units to print (default 1). f: Format character (like „print“). u: Unit. Unit is one of: b: Byte, h: Half-word (two bytes) w: Word (four bytes) g: ...


8

Some options which may or may not be applicable depending on your needs: Avoid using strings to leak out interesting information when possible. For example if you are using strings to display error information or logging information, this can give any reverse engineer valuable details as to what might be going on in your application. Instead replace these ...


8

My answer here is specific to common C/C++ compilers, but the principles behind the answer generalize to other scenarios. Compiler differences manifest themselves in many ways, some of them very subtle. If it was strictly a matter of attributes in the executable header, then we could easily imagine rewriting said header. However, each compiler has its own ...


8

The compiler did put the function pointer after the buffer. In the disassembly, check the memcpy call: 8048525: lea -0x58(%ebp),%eax 8048528: mov %eax,(%esp) 804852b: call 804838c <memcpy@plt> The first argument to memcpy (the buffer's address) is at [esp+0] and you can see that the value of ebp-0x58 is being put there. Next is the ...


8

It's a binary search. I've renamed several of the variables, and in one case, introduced a new variable, because one of the local variables was used for one thing in the first half of the function and something else in the second half of the function. The only tricky part is that once it finds an occurrence of the string to find, it iterates to find the ...


8

First it should be noted that there are so many architectures out there, each with its own instruction set. Here I assume you mean x86 (and you should indeed tag the proper architecture as 0xC0000022L said above). Most parts of the below answer would apply to other architectures as well, but they may use different mnemonics or lack some mentioned ...


7

Well, it might be impossible to RE the file to the exact original source code (e.g. there's no way to recover comments or preprocessor macros), but that's probably not what you meant to ask. It's definitely always possible (though sometimes difficult) to produce an equivalent source code, which behaves the same as the compiled code. With some extra work it ...


Only top voted, non community-wiki answers of a minimum length are eligible