37
votes
Objdump - How to output text (eg ASCII strings) alongside assembly code?
It is assumed here that Linux ELF32 binaries are being analyzed.
Code and data such as strings are stored in separate parts of ELF binaries.
To disassemble the parts containing code, use objdump -...
- 7,246
14
votes
Accepted
Why do reversers nowadays reverse engineer using decompilers and not disassemblers?
Although these terms are being used interchangeably, there is an intrinsic difference between disassembler and decompiler definitions traditionally. Let's first consider common steps involved in ...
- 1,807
12
votes
What is the linux equivalent to OllyDbg and Ida Pro?
edb is a cross platform x86/x86-64 debugger. It was inspired by Ollydbg, but aims to function on x86 and x86-64 as well as multiple OS's.
https://github.com/eteran/edb-debugger
- 246
11
votes
Is there any disassembler to rival IDA Pro?
Just for completeness: one more disassembler, Binary Ninja:
As for now (9/26/2016) it has the following properties:
Commercial ($99 as introductory price for personal use license)
Handles x86, x64, ...
- 8,528
10
votes
How to obtain x86-64 pseudocode in IDA Pro?
The two other answers here are outdated.
From hex-rays website, in the page about the the hex-rays decompiler:
Currently the decompiler supports compiler generated code for the x86, x64, ARM32, ARM64,...
- 11.8k
8
votes
Accepted
idapython - Determine if item is code or data
IDA utilizes flags for checking the properties of locations.
Looking at the API you can use GetFlags(ea) and pass its output to isCode(flags) to check if a location is flagged as being code.
You can ...
- 2,906
8
votes
Accepted
Can AI be used to write better decompilers/disassemblers?
First, you cannot answer to this question without having to define what you mean by AI... Because this is probably the worst name for a domain in computer science. Where people think about "programs ...
- 19.2k
7
votes
Accepted
How to find obfuscated hidden command line parameters?
those command line switches seems to be plainly visible in several languages
kind:>kindlegen.exe -dont_append_source
Info:I9018:option: -donotaddsource: Source files will not be added
kind:>...
- 16.5k
7
votes
Accepted
What type of disassembler is distorm?
DiStorm does not implement recursive traversal, however you can use distorm (or others, e.g. capstone) to implement your own recursive traversal algortihm.
There are a range of tools available doing ...
- 2,906
7
votes
Accepted
idapython - Get Xrefs to a stack variable
There is one function that does this: build_stkvar_xrefs, defined in C++ but exposed via the Python SWIG bindings. IDA builds stack xrefs dynamically when you ask for it. In order to use the function, ...
- 436
6
votes
Decompiling a 1990 DOS application
The Reko Decompiler is updated regularly and works for 16-bit DOS executables.
It can generate C code from the disassembly.
It's written in C#/.NET so requires mono if you want to run it on linux ...
- 161
6
votes
What is the linux equivalent to OllyDbg and Ida Pro?
As an (2019) addition to all the other answers:
Try Ghidra.
It is the Software Reverse Engineering (SRE) suit of the NSA and it's free and open source. It was leaked as part of Wikileaks' "Vault 7" ...
- 161
6
votes
Accepted
Is it safe to load a virus to IDA Pro?
At first, it is always recommended to analyze viruses inside an Isolated environment. So, you could install IDA Pro in a Virtualized Environment such as VMWare Work Station and load the binary in IDA ...
- 176
6
votes
idapython - Get Xrefs to a stack variable
TL;DR: There's no simple API to achieve this, code is at the end of the answer or here.
As far as I know, there is no easy way to get the references to stack structure. It seems like calling idautils....
- 11.8k
6
votes
Do you need a 64 bit disassembler like IDA Pro to disassemble 64 bit code?
No, you don't.
Despite the name, "IDA Pro 64" allowed you to analyze 64-bit files but it was itself a 32-bit program (until version 7.0).
- 36.9k
6
votes
Accepted
Why there are only 8 hexa memory digits while my RAM is 16G
Your physical RAM size doesn't say too much about what your memory addresses will look like. What matters is your system architecture and how many bits there are (usually 64 or 32). Virtual memory ...
- 609
5
votes
Accepted
Getting past a whole lot of anti-debug measures for a windows exe
You can use something like Scylla Hide
https://github.com/nihilus/ScyllaHide
It has plugins for most popular debuggers. It has lots of hiding options and presets for advanced packers like Themida.
...
- 220
5
votes
What is the linux equivalent to OllyDbg and Ida Pro?
I would say radare2. It is opensource fast moving project, and it has analysis capibilites similar to that of ida, and supports many architectures like x86 and the 64bit version of x86 plus lots of ...
- 335
5
votes
Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll
One approach you might consider involves compiling different versions of metsrv.dll from source and then observing which ones are detected and which ones are not. For instance:
Comment out half the ...
- 73
5
votes
Accepted
Can you change the architecture in Ghidra after importing?
you can right click the file you import at Active Project tab in ghidra main window, and select Set Language
- 66
5
votes
4
votes
Decompiling a 1990 DOS application
Ghidra (which is free) is able to disassemble x86 16-bit applications and even to decompile them to C (something you can't do with IDA).
- 371
4
votes
Accepted
C++ to assembly, GCC vs CL
Given that you didn't specify any optimization flag and used -m32, GCC performed no optimization on your code. The -m32 flag specifies the generation of a 32 bit code for a compiler configured to ...
- 2,673
4
votes
Accepted
Radare produces a bunch of `add byte [rax], al`, but why?
I am adding another answer here because the comment by op is akin to a new question
this is a demo of code which is referenced but doing a pd on reference would yield a bunch of zeros and has ...
- 16.5k
4
votes
Radare produces a bunch of `add byte [rax], al`, but why?
add byte [eax], al
This instruction is falsly and accidentally blind-translated by disassemblers that don't distinguish between stored buffer/void spans and code segs, to explain what happens here ...
- 304
4
votes
Accepted
Capstone: What's the purpose of the 'address' argument in cs_disasm()?
that address is the virtual address you want to disassemble
for example you have a relative jump
the opcodes will be say 0x74 {imm } where {imm} is relative to the current address
either in ...
- 16.5k
4
votes
How to extract firmware from a chip ( snarfing)
Get the information about the chip. It may happen that firmware, that you need is stored in the external flash memory chip, not in CPU.
If it's still the CPU, that you want to dump, read the ...
- 1,850
4
votes
Accepted
Know which bytes are opcode and which operands in IDA
In general this is not solvable since the opcode and operands may be sharing the same bytes (e. g. some instructions encode part of their opcode in the mod R/M byte, which can also contain some of ...
- 36.9k
4
votes
Can AI be used to write better decompilers/disassemblers?
Although I initially voted to close this question as primarily opinion-based, given both answers side with the same general answer ("No!") I'll answer as well. I just love being the devil's advocate.
...
- 11.8k
4
votes
Accepted
Disassembly - Why the CMP instruction is multiplying by 2 the value being compared
The cmp instruction does not multiply anything by two. Instead, the piece of code seen in your ollydbg screen shot is the implementation of the following line from the poor quality source code image ...
- 11.8k
Only top scored, non community-wiki answers of a minimum length are eligible