16

Main is usually a programmer-defined entry point, while entry is defined by the compiler, it's doing many other operations such as libc initializations, heap allocation, and so on, and eventually, call the user-defined main entry point. You can see main as a callback function that defined by the user and eventually called by entry.


12

In C, and many other low-level programming languages the term NULL is equivalent to 0. The C standard requires NULL to be #defined to an "implementation defined value", however all implementations have chosen (for obvious reasons) to use 0 for that purpose. For that reason if you'll attempt to "See definition" for NULL, many IDEs will ...


6

This is most likely code that was compiled without optimizations (-O0 ). In such code redundant operations are very common as the compiler faithfully translates individual statements to machine code but does not try to perform optimizations to remove or simplify redundant ones.


6

Your physical RAM size doesn't say too much about what your memory addresses will look like. What matters is your system architecture and how many bits there are (usually 64 or 32). Virtual memory also makes RAM insignificant; each process has virtual memory space covering possibly the entire address space but mapped to a limited section of physical memory. ...


6

It takes the file name, but IDA doesn't recognise it. In this example, IDA interpreted 4-byte string NUL\x00 (4E 55 4C 00) as an offset (address 0x004C554E) in the code. You may force it to interpret it as an ascii string simple by pressing a when the cursor is on the line 006A5D8C. The reason that the byte order is reversed is that x86 architecture uses ...


6

From Ghidra.re: Sometimes you will see warnings in the decompiler view stating that there are too many branches to recover a jumptable. One reason for this is that there actually is a jump table, but the decompiler can’t determine bounds on the switch variable For your example, this is saying there may a jump table (which is really just an array of ...


5

There is no problem, the comment is simply informational. The TMS320C6 is a DSP and like many DSPs the architecture is optimized for fast data processing. In particular, it has a very deep pipeline and the branches have not one or two, but up to five delay slots. You can see that after the B .S2X A3 instruction there are five other instructions before the ...


5

When looking at Windows API calls or disassembly of C/C++ code, NULL Is always 0, in Visual Studio this is defined in vcruntime.h #ifndef NULL #ifdef __cplusplus #define NULL 0 #else #define NULL ((void *)0) #endif #endif However if you are looking at higher level languages NULL will not necessarily be zero, for example within ....


5

ISO C and C++ allow implementations to use a non-zero bit-pattern as the object representation for a null pointer, despite requiring that a literal 0 or (void*)0 in the source (in a pointer context) is evaluated as a null pointer, equivalent to NULL. Reasoning based on source definitions like #define NULL 0 is not sufficient in C or C++. But fortunately for ...


4

After a bit more research, and help from a friend, I figured it out. the movss and mov are opcodes and its usually in the form of a float (for movss atleast) So, hence, you CAN change its value. Simply write movss [..address..],(float)### replace ### with your number. As for my question, it works, I have disabled the entire game's health decrement. ...


4

In binaries compiled with Visual C++, functions which use SEH (Structured exceptions handling), usually use var_4 ([ebp-4]) for the try level value (value specifying the current SEH scope block). The value 0FFFFFFFFh (or -1) is used for the outermost, global function scope (i.e. before and after any __try blocks). For more info check my OpenRCE article.


4

This is function dflt (or __aeabi_i2d) from the ARM compiler libraries. It performs a conversion of a 32-bit signed integer in R0 into a a soft-float double (64-bit floating point value) in R0:R1. An IEEE 754 double consists of a sign bit, 11-bit exponent and 52-bit fraction: 63 62 52 51 0 +------------...


4

Since the number of bytes in the instructions can be different and they had to put some limit on the column width, this is how it is indicated that there are more bytes in the instruction that those that you see on the screen. A '.' indicates that there's more and it doesn't mean it's always zero(s)- it can be anything. If this bothers you there are flags ...


4

This general pattern of exclusive-access instructions is usually seen when atomic variables are modified. C++ Example (C++11 or later) #include <atomic> void release( std::atomic<int>& refcount ) { refcount--; } You can see here on godbolt that GCC's ARM64 compilation of the above produces your assembly code. C Example (C11) #...


4

Okay, so let's start by converting the first four instructions to rough pseudocode. I'll include the instructions as comments so you can see what each one does. r5 = r4; // mov r5, r4 - Set R5 to equal the value in R4 r5 >>= 14; // shr r5, #14 - Shift R5 14 bits to the right r5 <<= 1; // shl r5, #1 - Shift ...


4

to search String you cant be using disassemble-all look at the bytes in both commands if you disassemble how can you find the string objdump -s sample.exe |grep -i sample sample.exe: file format pei-i386 404040 00000000 53616d70 6c652100 20634000 ....Sample!. c@. objdump -M intel --disassemble-all sample.exe --start-address=0x404044 --stop-address=...


3

Kevin, ls comes in coreutils. The best way to experiment with these programs is to download and manually build the binaries (in this way you can give your favorite options like -g, -O3 during compilation). Anyways, coming back to your question, assuming you want to decompile /usr/bin/ls (that's what I get from your comments on Pawel's answer), then open ...


3

From the decompiler view it cleary states there's no function. Decompiler works when you have one - it shows code of a function. So, if that's the beginning of a function (it might be) just create it by pressing F (or right click, Create Function) while your cursor is on the line that is the beginning of this function. After that the decompiler view should ...


3

So, the answer was provided in the OP's ticket #1994, just transferring it here for the future seekers: from ghidra.program.model.listing import CodeUnitFormat, CodeUnitFormatOptions codeUnitFormat = CodeUnitFormat(CodeUnitFormatOptions(CodeUnitFormatOptions.ShowBlockName.ALWAYS,CodeUnitFormatOptions.ShowNamespace.ALWAYS,"",True,True,True,True,True,...


3

when you are here 4017ff: 55 push rbp your 5th argument will be available at [rsp+28] (8 bytes for return address and 20 bytes for HOMEPARAMS (space for saving the 4 args passed via register) two pushes and one subtract will make your argument no 5 available at 0x28 + 0x8 +0x8 +0x48 = 0x80 so rbp+0 will hold the address of 5th ...


3

ropper bases the binary at address 0. This can be changed using the -I flag. This value of the base can be picked up from Ghidra to reflect in ropper's output In Ghidra go to Window > Memory Map. In this case libc is loaded at base address 0x100000. From ropper $ ropper -I 0x100000 --nocolor --file ./libc.so.6 Now the output can be directly used with G ...


3

Since local variables are usually placed on the stack in x86 and esp register can change during function execution, it is more convenient to save the value of esp register on function entry and access data relatively to that value. ebp register is used for this purpose. So you will often see push ebp mov ebp, esp lines at the begining of functions. In the ...


3

This is probably because *ledTimer is volatile. Here's a short bit of code that produces a similar result: int main() { volatile unsigned short *ledTimer{(unsigned short *)0x14f36}; for (--(*ledTimer); *ledTimer; --(*ledTimer)); } Now compile with gcc 8.3.1 with -march=armv7 -O1 and we get something that starts to resemble what you've listed: main: ...


3

This sounds analogous to given a document, infer the language. I'd compare the frequency (count for each value in the file) of instructions with the frequency of instructions derived from files for known processor types. Effectively a unigram model. If you source the files in a common format I can give you a hand.


3

Last year, I released an IDB for a piece of large, complex malware written in C++, which made regular use of virtual functions, which produce patterns of indirect call instructions like the ones your question discusses. I conducted that analysis purely statically, and I may release more IDBs like it later this year that were also done via static analysis. ...


3

It's not calling itself; you're overlooking the * dereferences at the beginning of the call expression. As in: result = (**(__int64 (__fastcall ***)(volatile signed __int32 *))lambda)(lambda); Notice the two ** inside of the first parenthesis? It's dereferencing the address held in the variable named lambda, which the assembly makes clear: .text:...


3

From the looks of it that's an easy one. Yes, these are variables on the stack and the magic number in EAX is used to denote uninitialized values. Quote: CCCCCCCC Used by Microsoft's C++ debugging runtime library and many DOS environments to mark uninitialized stack memory. CC resembles the opcode of the INT 3 debug breakpoint interrupt on x86 processors. ...


3

This is compiled to simple jump-table. Firstly it subtracts 1 from the a variable, so now your switch-case is for values in range <0;4> inclusive (instead of <1;5>). Next it checks if a is > 4, if so it jumps to the default label at 0A1109F. Note that the JA instruction is for the unsigned values, so it will jump to the default label in case ...


3

those are pointer arithmetics marks is an <<<;ADDRESS;>>>>> assume 0x10000000 it points to an integer whose size is 4 in 32 bit machine so the next integer will be at 0x10000004 , and the next will be at 0x10000008 and so on &marks[0] = 0x10000000 &marks[1] = 0x10000004 &marks[2] = 0x10000008,c,10,14,18,.....nn each of ...


2

To write the string "foo" into the memory address 0xdeadbeef: w foo @ 0xdeadbeef To write the hex 0x41414141 to the memory address 0xdeadbeef: w \x41\x41\x41\x41 @ 0xdeadbeef I recommend also taking a look at the various options for writing using the command w?.


Only top voted, non community-wiki answers of a minimum length are eligible