1 vote

What does the code do?

This is somewhat of a symbolic simplification. If you execute code from start of the procedure, then just before ret these are the relevant changes to the state of the program - ignoring registers ...
user avatar
  • 2,345
1 vote

Mov instruction from a pointed location at the beginning of a program

In Intel assembly commonly a leading semi-colon (;) is used to introduce a comment. The comment then continues to the end of the line. The ; can also occur after an instruction, but not in its middle. ...
user avatar
  • 10.5k
1 vote
Accepted

Understanding disassembly information from Visual Studio's dumpbin and GNU's objdump

Let's break it down. The first and most obvious difference is Intel syntax (dumpbin) vs. AT&T syntax (objdump) for the output you give. That's be the part of your question: Also why is the ...
user avatar
  • 10.5k
1 vote
Accepted

How to set a variable as "pointer to struct" in IDA in order to automatically replace offsets by field names?

The Hex-Rays decompiler will automatically respond to changes in local or global variable types, and automatically display the memory dereferences as proper structure references. The same is not true ...
user avatar
  • 7,814
1 vote
Accepted

What are these Device Object Characteristics / Flags in Windows 10 ntoskrnl!IopParseDevice

Hmm, not sure which WDK you were using, but at least the Windows Kits\10\Include\10.0.22000.0\km\ntifs.h and Windows Kits\10\Include\10.0.22000.0\km\ntddk.h of the newest (non-preview/beta) WDK list: #...
user avatar
  • 10.5k

Only top scored, non community-wiki answers of a minimum length are eligible