User Paweł Łukasik

14 votes

Why did Intel chose 90h machine code for their NOP instruction instead of a 0?

answered Oct 31, 2023 at 18:01

10 votes

Accepted

How to tell if a particular .NET assembly was written in C# or F#?

answered Apr 6, 2018 at 10:01

9 votes

Accepted

Shellcode challenge - shellcode works in test program, segfaults in actual binary

answered Jun 11, 2018 at 17:11

9 votes

Why does PE ImageBase address change in memory?

answered Aug 17, 2020 at 5:44

8 votes

Accepted

Viewing Radare keybindings for Visual Pane mode (Function hotkeys)?

answered May 30, 2018 at 4:36

8 votes

Accepted

What does this assembly language program output?

answered Oct 6, 2018 at 2:31

7 votes

Why doesn't this retn instruction return from the function?

answered Jul 24, 2018 at 12:06

6 votes

Accepted

grep -E with Radare2

answered Jul 25, 2018 at 6:09

6 votes

What are the difference syscall and int 0x2E instructions?

answered Sep 13, 2018 at 16:22

6 votes

Accepted

ASM working as is, but not in a C program

answered Sep 3, 2017 at 9:24

6 votes

Accepted

Why Ghidra doesn't load the disassembly correctly while radare2 does?

answered Jan 12, 2020 at 17:42

6 votes

Accepted

Way to get all the function prototype using Ghidra

answered Apr 4, 2020 at 19:38

6 votes

Accepted

Extracting Assembly line code from an executable in Ghidra

answered Jun 10, 2020 at 12:36

5 votes

Accepted

Ghidra what's the meaning of _0_4_

answered Jan 13, 2020 at 15:00

5 votes

Trace Method Calls in .NET/C# Binary

answered Oct 25, 2019 at 19:58

5 votes

Accepted

Confused about the use of the shl instruction in this disassembly

answered Apr 13, 2021 at 12:16

5 votes

How work this obfuscation, and how deobfuscate?

answered Jul 29, 2017 at 7:27

5 votes

Accepted

Radare using `pd` without the call graph lines?

answered Feb 22, 2018 at 19:19

5 votes

Accepted

Obfuscated code analysis - can unused variables be ignored?

answered Aug 14, 2018 at 22:15

5 votes

Accepted

Can I set more than 4 memory access breakpoints in WinDbg?

answered Jun 23, 2018 at 10:30

5 votes

How can breakpoint be set using offset in ELF file, not virtual address?

answered Jul 30, 2018 at 17:48

4 votes

Comparison between orginal and modified DLL files with x64dbg

answered Aug 8, 2018 at 4:48

4 votes

Addresses displayed in radare2

answered Sep 17, 2018 at 3:44

4 votes

Accepted

Using stdin when debugging with r2pipe

answered Dec 19, 2017 at 22:53

4 votes

Accepted

found easter egg (incl releasing trigger) in as code, but no clue how to fire it

answered Mar 10, 2018 at 10:58

4 votes

Accepted

Reverse code check

answered Sep 21, 2017 at 16:49

4 votes

Faster Kernel debugging for Windows

answered Oct 21, 2017 at 16:39

4 votes

Accepted

How to enlarge block in Ghidra's Function Graph View?

answered Sep 11, 2020 at 9:13

4 votes

Accepted

Structure of operand bytes in .NET call and data access IL instructions?

answered Sep 6, 2020 at 6:59

4 votes

Accepted

Radare2 - what does dot mean in disassembly

answered Jul 28, 2020 at 7:48

Stack Exchange Network

141 Answers

Why did Intel chose 90h machine code for their NOP instruction instead of a 0?

How to tell if a particular .NET assembly was written in C# or F#?

Shellcode challenge - shellcode works in test program, segfaults in actual binary

Why does PE ImageBase address change in memory?

Viewing Radare keybindings for Visual Pane mode (Function hotkeys)?

What does this assembly language program output?

Why doesn't this retn instruction return from the function?

grep -E with Radare2

What are the difference syscall and int 0x2E instructions?

ASM working as is, but not in a C program

Why Ghidra doesn't load the disassembly correctly while radare2 does?

Way to get all the function prototype using Ghidra

Extracting Assembly line code from an executable in Ghidra

Ghidra what's the meaning of _0_4_

Trace Method Calls in .NET/C# Binary

Confused about the use of the shl instruction in this disassembly

How work this obfuscation, and how deobfuscate?

Radare using `pd` without the call graph lines?

Obfuscated code analysis - can unused variables be ignored?

Can I set more than 4 memory access breakpoints in WinDbg?

How can breakpoint be set using offset in ELF file, not virtual address?

Comparison between orginal and modified DLL files with x64dbg

Addresses displayed in radare2

Using stdin when debugging with r2pipe

found easter egg (incl releasing trigger) in as code, but no clue how to fire it

Reverse code check

Faster Kernel debugging for Windows

How to enlarge block in Ghidra's Function Graph View?

Structure of operand bytes in .NET call and data access IL instructions?

Radare2 - what does dot mean in disassembly