New answers tagged disassembly
2
I'll present the steps that I would perform in such a case. Note that they aren't necessarily the most efficient and reliable ones although they should work in many cases. I'm assuming that the binary you want to examine isn't packed and obfuscated.
Look for the imports. Sometimes the code you are looking for is just taken from external library. In this ...
0
In not sure why you can’t just use several non overlapping segments but maybe the .pyc processor module from The IDA Pro book will be useful (I think it includes a loader)
1
if eax = 1000 ecx will be 1004 in first part
uf ebp = 1000 ecx will be *(dword *) 100c in second part
simply put in pseudo c
ecx = foo in first part it is simple assignment
ecx = * foo in second part it is dereferencing
notice the difference of & ( addressof operator) in both comments
the Function in Question Has A prototype of
NTSYSAPI ...
0
So I'm still looking for a better understanding but I found that the GNU_RELRO points from 0x03de8-0x04000, which tells me that this is somehow connected to dynamic relocation sections, and running objdump -R gives me this
DYNAMIC RELOCATION RECORDS
OFFSET TYPE VALUE
0000000000003de8 R_X86_64_RELATIVE *ABS*+0x0000000000001130
...
2
Looks like you also asked the question over on the Ghidra GitHub page and the answer there is the same.
Essentially, no, Ghidra does not do that. But you should investigate Angr, Klee, Bitblaze, or others.
3
The opcode you are interested in is a9 01 00 00 00 standing for test eax, 1.
The easiest way to get the opcode of assembly instruction is just to compile it and disassemble the result (for example using nasm and then objdump or simply this site) - this way you don't have to remember anything about the opcodes which are sometimes weird.
However, you want ...
Top 50 recent answers are included
