16

Main is usually a programmer-defined entry point, while entry is defined by the compiler, it's doing many other operations such as libc initializations, heap allocation, and so on, and eventually, call the user-defined main entry point. You can see main as a callback function that defined by the user and eventually called by entry.


4

From Ghidra.re: Sometimes you will see warnings in the decompiler view stating that there are too many branches to recover a jumptable. One reason for this is that there actually is a jump table, but the decompiler can’t determine bounds on the switch variable For your example, this is saying there may a jump table (which is really just an array of ...


4

This general pattern of exclusive-access instructions is usually seen when atomic variables are modified. C++ Example (C++11 or later) #include <atomic> void release( std::atomic<int>& refcount ) { refcount--; } You can see here on godbolt that GCC's ARM64 compilation of the above produces your assembly code. C Example (C11) #...


3

Okay, so let's start by converting the first four instructions to rough pseudocode. I'll include the instructions as comments so you can see what each one does. r5 = r4; // mov r5, r4 - Set R5 to equal the value in R4 r5 >>= 14; // shr r5, #14 - Shift R5 14 bits to the right r5 <<= 1; // shl r5, #1 - Shift ...


2

I assume you are using *nix based systems since you mentioned gdb. If you just want to print the stack/registers when you hit a break point, you can use command to set up some print statements. See here. Installing pwndbg makes it a lot less exhausting as it prints out the stack and registers every time you step, with labels on the stack identifying rbp and ...


2

Generic answer: When you want to unpack/decrypt files like this, the best idea is always to reverse the program that is able to read the file correctly. I think that in Windows operating system the most popular combo for reading files is probably CreateFile and ReadFile api calls. If you track every operation performed on the buffer filled using ReadFile ...


2

With a 256-byte table dscrc_table declared, the decryption loop is a one-liner: for( int i = 0; i < vNewByteArrayLen; ++i ) vNewByteArrayElts[i] ^= a4KeyByte ^ dscrc_table[vNewByteArrayLen]; See my gist on GitHub. Edit: is this thing really being used to protect your door from being opened by unauthorized people? Throw it away!


1

The Intel processors still support 16-bit real mode so the latest manuals do describe it as well, although not as prominently as protected or long mode. Look for mentions of “Real-Address or Virtual-8086 Mode”.


1

Borland's Turbo Debugger also has a text-window-based UI, with the stack in its own window and showing which values in which locations. It doesn't tell you what those values represent, but at least it's always visible.


1

If you're serious about RE-ing those .EXE files, then take a look into IDA. IDA https://www.hex-rays.com/products/ida/ There are other applications that work some what, such as Ollydbg


1

Typically, a register's value being used in a function prior to being initializing it is a hint that it may be a parameter. Here we see ecx being used for the first time in this function: 00893c1e 8bf1 mov esi,ecx There are a few different standard calling conventions that pass parameters in the ecx register such as fastcall. C++ compilers ...


1

The entry function you mentioned is the function where the entry point of the program is located. This entry function contains the first instructions of the program executed when you run the program. The main function recognized by disassemblers is the the function where the main function of the program which code is compiled directly from the the developer'...


1

That's how the concept of virtual address space works. Every process has their own address space which can be addressed. Thanks to this you can't directly read from/write to memory of another process. You can specify the address where the process base module will be mapped into process memory during compilation/linking process, for example for MSVC linker it ...


Only top voted, non community-wiki answers of a minimum length are eligible