Questions tagged [disassembly]
Involves turning "compiled" code (such as machine code, byte code or IR code) back in higher level assembly mnemonics.
-5
votes
0answers
36 views
exe cannot start or run due to incompatibity with 64-bit versions of Windows [on hold]
We have an EXE (developed by company internal resources in 1997) and we do not have source code for that.
It is running fine so far on 32 bit machines. However, we forced to upgrade to 64 bit ...
-6
votes
0answers
59 views
What is this tool? It can trace flow of function, I have a screenshot [on hold]
Please tell me, What's name this tool?
0
votes
0answers
26 views
Where to start to understand assembly code? [on hold]
I'd like to understand assembly code. But I don't know where to start.
https://eli.thegreenplace.net/2011/11/03/position-independent-code-pic-in-shared-libraries
What am confused about are
there ...
-1
votes
0answers
8 views
How to manually JIT a function that calls another function?
I have followed the following example to JIT manually.
https://eli.thegreenplace.net/2013/11/05/how-to-jit-an-introduction
But I am stuck when I try to extend it to JIT a function that calls another ...
-1
votes
0answers
28 views
how to patch assembley call using python script [duplicate]
How disassembler calculate the call from assembly to Hex.
for example:
call 0x0804847D
in Hex:
E8061efdff
if I have this data about the functions, how to get the hex value of the ...
0
votes
1answer
21 views
How to just print the binary code of a function in an object file?
I am able to disassemble an object file like below. But I'd like to just dump the raw number like 55, 48, ... of instructions in a binary format for a specific function, e.g., add4, to a file.
I ...
-1
votes
0answers
50 views
How to encode assembler code to binary (and vice versa)? [closed]
I've got a task in my university that I cannot solve
1. What is the encoding of 'xor $32, %AL'?
* given table 8x6 *
╔══╦══╦══╦══╦══╦══╦══╦══╗
║ ║ ║ ║ ║ ║ ║ ║ ║
╠══╬══╬══╬══╬══╬══╬══╬══╣
║ ║ ...
0
votes
1answer
48 views
x86 assembly - Encoding a relative jmp
I'm a bit confused by how gcc encodes relative jumps. I have the following:
int main(void)
{
__asm__ __volatile__(
"jmp label\n"
"label:\n"
"nop\n"
);
return 0;
}
...
1
vote
1answer
26 views
Avoid disabling certificate pinning Android
I am developing an Android application that uses Certificate Pinning (in a similar fashion such this).
However, I've came across dynamic instrumentation libraries such as Frida, or worse yet, ...
-1
votes
1answer
32 views
C++ Y86 Disassembler - How to interpret .quad
So, for a class assignment we are writing a Y86 (toy processor) disassembler in C++. Easy enough, I have almost everything done, except for disassembling instructions into a .quad directive.
The quad ...
0
votes
1answer
43 views
Change one function call for another
I have a closed-source win32 executable which plays a sound; the sound is hardcoded in, what I'm trying to do is get it to play a different sound.
I'm using x32dbg and I can find the function call I ...
0
votes
2answers
61 views
bomb lab phase_3, don't know how to find the starting address for switch block
I am taking this software security class, but I have never done c before, I have taken some computer organization class, but not confident in assembly at all. I commented all the lines in the file ...
0
votes
0answers
9 views
get memory output from qemu-user
I'm running this command to run myprog one assembly instruction at a time:
$ qemu-mips -singlestep -d cpu,in_asm,exec,nochain myprog
This shows me a disassembly of the current instruction and ...
0
votes
1answer
42 views
what does “Detected assembler with broken .inst” mean?
While I try to install kernel from sources, I get
arch/arm64/Makefile:48: Detected assembler with broken .inst; disassembly will be unreliable
I tried rebuilding bin-utils but the message won't go.
...
1
vote
1answer
55 views
What are some compiler options that I can use to get this disassembly?
I have found that the executable from the code
int main(int argc, char** argv) {
printf("Hello World\n");
return 0;
}
can be disassembled into (compiled using gcc -m32)
This code is from ...
0
votes
1answer
49 views
Is this intel pipelining instruction?
In my knowledge, intel 8086 pipelining is technique
that fetching the next instruction when the present instruction is being executed.
This article said that one of Advantage of pipelining is
...
0
votes
1answer
32 views
Hexadecimal Meaning in Hopper Disassembler iOS Files
When opening certain IOS files such as the kernel (can apply to other situations, just specifying this) a list of hexadecimal values appear on the left on the program (usually Hopper Disassembler).
...
0
votes
0answers
49 views
Intel-syntax Assembly in Xcode debugger
I am trying to get Xcode to display the assembly code while debugging in the Intel format. I have tried to add the flag -masm=intel in the "Other C Flags" section under Build Settings but it doesn't ...
0
votes
0answers
25 views
Using immunity debugger to find stack based overflows
This is a question for people who know how to use immunity debugger
I am new to immunity debugger and have been trying to understand how to use it and understand how everything works. I attached a ...
2
votes
0answers
26 views
Radare2 Disassembler How Do You Organize Visual Panels (V!)?
I would like to use Radare2 to learn about how C is assembled into assembly but I am having trouble with the layout. I think the V! mode would be very handy as you can watch the registers update as ...
5
votes
0answers
62 views
“??” bytes in Visual Studio disassembly view when debugging
I'm currently using the disassembly view of VS to debug some C# code. There are some memory regions that look like this when both bytes and disassembly are shown:
24E2822A ?? ?? ??
...
3
votes
1answer
33 views
Linux perf_events annotation frame pointer confusion
I ran sudo perf record -F 99 find / followed by sudo perf report and selected "Annotate fdopendir" and here are the first seven instructions:
push %rbp
push %rbx
mov %edi,%esi
mov %edi,%ebx
...
1
vote
1answer
140 views
Understanding CIL & the workings of ldelem.ref
I would like an explanation of what ldelem.ref does. So far I have that it loads the element at index onto the top of the stack as an O.
What is the index? And I am thinking that the type O means ...
0
votes
1answer
35 views
What is the middle column stands for in the output of “gdb-> info register”?
In the book of Art of Exploitation by Erickson, at page 28, the following output of dgb is given,
I understand that the left most column gives the name of the registers, and the rightmost column ...
-1
votes
1answer
44 views
capstone disassembler - disassembling single function without knowing length
I am interested in using the capstone disassembler library.
https://github.com/aquynh/capstone
My motivation for using this is that I need to be able to disassemble functions at run-time while my ...
0
votes
3answers
79 views
How does one opcode byte decode to different instructions depending on the “register/opcode” field? What is that? [duplicate]
How can I determine what an array of bytes will translate into in machine code?
I understand that if I see 0f at the start it's a 2 byte instruction, but I see other prefixes and in some disassembly ...
0
votes
0answers
25 views
How to extract the disassembly of a specific file using objdump?
I have a binary that comprises of multiple large object files including several .S files. When running my program under gdb, I get the current pc and I want to look up the disassembly of a file which ...
8
votes
1answer
74 views
x86 BSWAP instruction REX doesn't follow Intel specs?
I've been assembling (and disassembling) the BSWAP x64 instruction with both NASM and GAS, and both assemble the instruction BSWAP r15 as 490FCF in hex. Disassemblers also disassemble this to the same ...
0
votes
0answers
17 views
How to create a listview with the undetermined numbers of elements
How can I create a listview with the undetermined(or variable)numbers of elements?
I am developing a disassembler which supports x86, arm, etc. It shows the disassembly in a listview. It correctly ...
1
vote
1answer
65 views
MIPS Instruction Decoding
I'm trying to understand how to decode MIPS binary instructions.
I compiled a hello world program in C on a Debian MIPS system with gcc and objdump shows me that the first instruction in the .text ...
0
votes
1answer
29 views
how to tell the difference between lc3 opcodes and lc3 processor directives
I've been learning lc3 and I'm writing a disassembler. I have a question about how, when reading assembled lc3 code, to tell the difference between an opcode and a processor directive (for example, a ....
0
votes
1answer
100 views
Why the function got by idapython is not the same as displayed in function window using IDA?
I was trying to use IDA Pro to analyse a binary writen and compiled by myself on Linux. In the function window, IDA displayed the function experiment(std::string,int,std::string) .text ...
0
votes
0answers
30 views
How to make Immunity Debugger Color Scheme look like OllyDbg Color Schemes?
I want to make Immunity Debugger look like default OllyDbg in Color and Style.
Here is how default Olly looks:
Here is how default Immunity Debugger looks:
Changing anything in the color schemes ...
0
votes
1answer
110 views
IDA disassembly produces completely different code to ASM file for exe compiled in Visual Studio 2017
I compiled a simple program using Visual Studio 2017
#include <stdio.h>
int main()
{
printf("hello, world\n");
return 0;
}
I compile it with command line
cl 1.cpp /Fa1.asm
This ...
0
votes
0answers
60 views
PowerPC ASM: insrdi instruction
The IBM documentation defines this operation as "Insert double word from right immediate", but does not really clarify what it does.
I am trying to understand what the following operation does:
...
1
vote
0answers
47 views
objdump mips u-boot.bin can't disassembly 1000013f which is branch instruction
I tried disassembly u-boot.bin
$ mips-unknown-linux-gnu-objdump -b binary -m mips:isa32
--adjust-vma=0x81000000 -D output/u-boot-2018.09/u-boot.bin
it out the raw instruction, can't recognize ...
1
vote
0answers
57 views
Differences in disassembling 32 bit and 64bit
I started my adventure with reverse engineering but I have some problems which I can't solve from the very beginning. I'm following tutorials on YT and I meet some differences. So, when I work with ...
0
votes
0answers
21 views
How SIC object code of this will be after pass2?
I have this SIC program
** START 2000
2000 ** LDA FIVE
2003 ** STA ALPHA
2006 ** LDCH STRING
2009 ** STCH C1
2012 ALPHA RESW 1
2015 FIVE WORD 5
2018 ...
0
votes
0answers
36 views
After tcc_compile_string, is there a way to get the length of the code region?
For exploration and demonstration, tried mixing a little tcc and udis86. This is from GnuCOBOL, so there is no real access to C headers, or members of the TCCState struct, but it can be done with a ...
1
vote
1answer
67 views
What does parenthesis BEFORE register mean in x86?
While debugging an application with IDA Pro and WinDbg, I came across following statement.
mov esi, ds:(dword_16C6 - 16B2h)[esi]
To simplify, let's say
mov esi, ds:(ABC)[esi]
What does (ABC) ...
0
votes
0answers
33 views
Assembly Modulo and Divide in IDA [duplicate]
I'm having a little trouble about understanding how Division and Modulo work in Assembly when compiled from C Code:
Source C Code:
int k1=55,k2=33;
int k3=0,k4=0;
k3=k1/4;
k4=k2/13;
int v1=30,v2=40,...
1
vote
1answer
93 views
debug SIGSEGV signal handler function
I made small assembly code about registering signal handler.
.section .data
.set SIGSEGV, 11
.set SA_SIGINFO, 4
.section .bss
.lcomm my_sigaction, 140 # size of sigaction struction is 140
....
0
votes
0answers
15 views
Assembly exception handling [duplicate]
I created a assembly referencing invalid address.
.global main
main:
push %eax
call 0x12341234 # invalid address
I compiled and run it on linux, and the result was segmentation fault of course. ...
0
votes
0answers
27 views
How can convert Keystone's output to an executable file
I'm trying to setup a binary rewriting framework. I'm using Capstone to disassemble a binary file and then assemble it by Keystone. Keystone will output encoded data which he calls that compiled code. ...
1
vote
1answer
93 views
How do I install radare2 plugins in offline installation?
I understand how to normally install the plugins with
$ r2pm init
$ r2pm update
$ r2pm -i r2snow
$ r2pm -i r2dec
But how would I install r2dec when I am on a system that has radare2 installed ...
-1
votes
2answers
48 views
How are rs1 & rs2 fields for floating point registers (f0-f31) encoded in RISC-V Instructions?
The Integer register encoding corresponds to their numeric names (0-31, for x0-x31). What is this encoding for f0-f31?
I am trying to write a disassembler.
0
votes
1answer
101 views
How to pass parameters to ARM assembly language?
I have the following assembly language program for A76 core. As you can see that the value I am loading to X0 is hard coded. How can I pass parameters and run the code in a loop for this program:
...
1
vote
1answer
107 views
Why does the C# release build contain debug info
While disassembling my C# program (release build), I noticed that it contained the names of the functions and the variables I used in the project (that I believe to be debug info, correct me if I'm ...
0
votes
1answer
85 views
How to read assembly code output from objdump [closed]
I have a C code that swaps two numbers.
#include<stdio.h>
void swap(int,int);
void main( )
{
int n1,n2;
printf("Enter the two numbers to be swapped\n");
scanf("%d%d",&n1,...
0
votes
1answer
52 views
what is the difference between ds:0x402000 and DWORD PTR ds:0x402000 in x86 assembly?
as you can see in the picture, i can't understand the difference between DWORD PTR ds:0x402000 and ds:0x402000. what is the syntactical difference between them. both fetches 4 bytes from 0x402000 and ...