Hot answers tagged

1

This is an unconditional branch (thumb) It is encoded as 11100|signed 11-bit immediate offset E 7 D 2 1110 0111 1101 0010 so your 11-bit offset is 0b11111010010. This is sign extended to -46 The operation is: PC = PC + (SignExtend(signed_immed_11) << 1) where the first PC contains the address of the branch plus 4. 0x176E4 + 4 + (-46 * 2) ==...


1

ADRL is a pseudo instruction and is normally encoded as two instructions according to documentation so probably it is a different convention being followed by both those tool ida is probably showing the pseudocoded ADRL while the other one is showing a split double instruction adrp,add also note ida's dispaly does not have the ...c8 while the other has it


1

The main problem of your code is that you expect the md parameter to be a string. In C the unsigned char * is not an indicator for a string. Instead it is often for storing binary data. In this case md is also just a pointer where the MD5 functions stores it's 16 byte of binary data. If you want to print the content you have to encode it e.g. hexadecimal or ...


1

The gist contains some old (create 3 yrs ago) r2 instructions and according to, also outdated, r2 book, it looks like /c command was responsible for "search for asm code matching the given string". Currently (radare2 5.2.0-git 26093 @ linux-x86-64 git.5.1.1) the similar instruction could be one from /a group Usage: /a[?] [arg] Search for assembly ...


1

It's very likely that Ghidra doesn't know how to read the symbols from the dyld_shared_cache. You can try to use a different tool like IDA PRO, Rizin or radare2 or Cutter, etc. But, which binary are you trying to reverse? Do you know which functions do you want to trace? You can use the tool jtool, read more on jtool - Taking the O out of otool(1), and so ...


1

If you have stripped binaries there's little you can do regardless of the platform you're on. To view disassembled code on Linux, os you would with Otool on Mac, you can use objDump: objdump --disassemble-all thebinary


Only top voted, non community-wiki answers of a minimum length are eligible