New answers tagged disassembly
1
The Intel processors still support 16-bit real mode so the latest manuals do describe it as well, although not as prominently as protected or long mode. Look for mentions of “Real-Address or Virtual-8086 Mode”.
1
Borland's Turbo Debugger also has a text-window-based UI, with the stack in its own window and showing which values in which locations. It doesn't tell you what those values represent, but at least it's always visible.
4
From Ghidra.re:
Sometimes you will see warnings in the decompiler view stating that there are too many branches to recover a jumptable.
One reason for this is that there actually is a jump table, but the decompiler can’t determine bounds on the switch variable
For your example, this is saying there may a jump table (which is really just an array of ...
2
I assume you are using *nix based systems since you mentioned gdb. If you just want to print the stack/registers when you hit a break point, you can use command to set up some print statements. See here.
Installing pwndbg makes it a lot less exhausting as it prints out the stack and registers every time you step, with labels on the stack identifying rbp and ...
2
Generic answer:
When you want to unpack/decrypt files like this, the best idea is always to reverse the program that is able to read the file correctly. I think that in Windows operating system the most popular combo for reading files is probably CreateFile and ReadFile api calls. If you track every operation performed on the buffer filled using ReadFile ...
1
If you're serious about RE-ing those .EXE files, then take a look into IDA.
IDA
https://www.hex-rays.com/products/ida/
There are other applications that work some what, such as Ollydbg
0
This had me confounded for a bit... If this is documented, I'm unsure where. By guessing the following seems to work.
(type)reference
Example: (int[14])0xDEADBEEF
This would give you a representation of an integer array 14 deep at address 0xDEADBEEF independent without having to actually set 0xDEADBEEF to an integer array 14 deep.
This seems to work for ...
0
I think Radare2's 'agj' command only extract function call graph, which is different from CFG(control flow graph where a node represent a basic block).
0
ok it is _fastCall
so this function takes 5 arguments
2 in registers ecx,edx 3 in stack 8,12,16
and As I Commented edx is used as an argument to the First Indirect call [esi+4]
copy pasted the disassembly to notepad++
used the column editor to rip out the bytes from the paste
pasted the bytes in hxd to make a bin
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A ...
0
To determine if a function is using some registers as parameters: You could find the call references of the function, then see prior to the function call if those registers' values are copied from other operands and then later in the function, those values are used.
1
Typically, a register's value being used in a function prior to being initializing it is a hint that it may be a parameter.
Here we see ecx being used for the first time in this function:
00893c1e 8bf1 mov esi,ecx
There are a few different standard calling conventions that pass parameters in the ecx register such as fastcall. C++ compilers ...
1
The entry function you mentioned is the function where the entry point of the program is located. This entry function contains the first instructions of the program executed when you run the program.
The main function recognized by disassemblers is the the function where the main function of the program which code is compiled directly from the the developer'...
3
Okay, so let's start by converting the first four instructions to rough pseudocode. I'll include the instructions as comments so you can see what each one does.
r5 = r4; // mov r5, r4 - Set R5 to equal the value in R4
r5 >>= 14; // shr r5, #14 - Shift R5 14 bits to the right
r5 <<= 1; // shl r5, #1 - Shift ...
16
Main is usually a programmer-defined entry point, while entry is defined by the compiler, it's doing many other operations such as libc initializations, heap allocation, and so on, and eventually, call the user-defined main entry point. You can see main as a callback function that defined by the user and eventually called by entry.
4
This general pattern of exclusive-access instructions is usually seen when atomic variables are modified.
C++ Example (C++11 or later)
#include <atomic>
void release( std::atomic<int>& refcount ) {
refcount--;
}
You can see here on godbolt that GCC's ARM64 compilation of the above produces your assembly code.
C Example (C11)
#...
0
I had this same problem, except worse than you described, as the code that was in one of the broken former-groups was now nowhere to be seen on the graph. Attempting to go to that code's address directly would bring me out of graph view, and attempting to switch back from there would tell me "only instructions belonging to functions can be displayed in ...
1
That's how the concept of virtual address space works. Every process has their own address space which can be addressed. Thanks to this you can't directly read from/write to memory of another process.
You can specify the address where the process base module will be mapped into process memory during compilation/linking process, for example for MSVC linker it ...
0
Rolf Gave a nice Answer comparing his gist with a few minutes of ghidra on the file you edited in ghidra does give a nearly identical Pseudo Code
looking at JniEnv it is defined like
struct {
const struct func* Funcs;
jwhatever GetSomeJava(jsomething foo, jotherthing blah) {
return funcs->GetSomeJava(…...);
}
229 function ptrs like this
}
so creating a ...
2
With a 256-byte table dscrc_table declared, the decryption loop is a one-liner:
for( int i = 0; i < vNewByteArrayLen; ++i )
vNewByteArrayElts[i] ^= a4KeyByte ^ dscrc_table[vNewByteArrayLen];
See my gist on GitHub.
Edit: is this thing really being used to protect your door from being opened by unauthorized people? Throw it away!
Top 50 recent answers are included
