New answers tagged

3

those are pointer arithmetics marks is an <<<;ADDRESS;>>>>> assume 0x10000000 it points to an integer whose size is 4 in 32 bit machine so the next integer will be at 0x10000004 , and the next will be at 0x10000008 and so on &marks[0] = 0x10000000 &marks[1] = 0x10000004 &marks[2] = 0x10000008,c,10,14,18,.....nn each of ...


0

This topic has been explored by Rolf Rolles in this OpenRCE article (reposted here). Briefly, when the cases are close together, the compiler can use the switch variable to index a jump table. However, when cases are further apart, it would have to generate a huge table with many empty cases which would blow up the binary size. Although the sequence of cmp ...


3

This is compiled to simple jump-table. Firstly it subtracts 1 from the a variable, so now your switch-case is for values in range <0;4> inclusive (instead of <1;5>). Next it checks if a is > 4, if so it jumps to the default label at 0A1109F. Note that the JA instruction is for the unsigned values, so it will jump to the default label in case ...


1

its very hard to understand what you want How to get machine code of a file(mainly executables) in C? so you want a C program that loads an executable file (for example dos,windows,linux exucutable) and showing you the whole or parts of the image (that normaly contains machine code and data)? so there are several documented file formats that can contain ...


1

from binascii import * from pefile import * from capstone import * if(sys.argv[1]): pe = PE(sys.argv[1]) entry = pe.OPTIONAL_HEADER.AddressOfEntryPoint base = pe.OPTIONAL_HEADER.ImageBase OEP = base+entry bytes = pe.get_data(entry,17) print(hexlify(bytes)) for i in (Cs(CS_ARCH_X86,CS_MODE_64).disasm(bytes,OEP)): ...


1

You can make a program that interprets machine code using an engine like Capstone-engine, this is the easiest way to do something that gives you good results in an optimized way easily, keep in mind that this is not an easy task, it is much better to use a ready-made tool, we have many free and very good options and constantly updated like Ghidra, but if you ...


Top 50 recent answers are included