Questions tagged [disassembly]
Involves turning "compiled" code (such as machine code, byte code or IR code) back in higher-level assembly mnemonics.
1,648
questions
0
votes
0
answers
29
views
Show Disassembly without Debugging in MS Visual Studio [duplicate]
I can run my code and if debugger is halted I can show the disassembly of the current code. (Debugging->Window->Disassembly)
But I want to see the disassembly of the compiled code without ...
1
vote
1
answer
45
views
How to get related instruction code from instruction bytes?
I got the following error message when I run a Go program which contains some Go assembler codes:
SIGILL: illegal instruction
PC=0x508c04 m=0 sigcode=2
instruction bytes: 0xc4 0x42 0x68 0xf2 0xea 0xc5 ...
0
votes
0
answers
32
views
how to Convert a .exe file to multiple assembly files at the function level?
I have an exe file and want to disassemble them. reverse engineering tools determine how many sections and functions this file consists of.
enter image description here
Now I want to have those ...
0
votes
0
answers
57
views
What is First Three Instructions in the Disassembled Code
What is the meaning of the first three commands being the same after most programs are disassembled? What is the meaning of the first three commands being the same after most programs are disassembled?...
0
votes
0
answers
60
views
Why is function call terminating the debug process on IDA Freeware?
I am solving a Reverse Engineering capture the flag challenge where I have to find a flag in the format flag{thisistheflag}. Below is the link to a GitHub Repository that contains the given exe file ...
0
votes
1
answer
69
views
What are these x86 asm instructions (rex.x, rex.wx (bad))?
Re: the meaning of some instructions in disassembled C++ code (disassembled using gdb v. 13.2,
compiled using g++ v.13.1.0, with the -std=c++23, -g and -o flags).
Most of the instructions and their ...
0
votes
0
answers
24
views
How can I layout gdb to show regs, src code, and disasm, at the same time?
gdb shows great information in layout regs and layout split. How can I get it to show both? I'd like to see regs, src code, disasm (and maybe memory) at the same time - ideally with resizeable ...
0
votes
0
answers
44
views
Are executable files virtual addresses shown by disassemblers definitive? [duplicate]
I'm on a macOS x86_64 system.
I have this little C program in a file named test.c :
void fx(){
int y = 20;
y++;
}
int main(){
int x = 10;
x++;
fx();
}
If I ...
0
votes
1
answer
43
views
How to calculate offset line
I want to inject x-code into the PE header (for the sake of experience) that outputs the string to the console.
I almost reached my goal, there was only one touch left...
I want to put offset of the ...
0
votes
0
answers
14
views
How to set a breakpoint and then show the data After running the programm with pwndbg?
Im learning how to use pwndbg and I want to know how to set a breakpoint and then after running the programm it shows the stack, Register etc. Like Crypto Cat did. And I want to make that as well but ...
1
vote
1
answer
47
views
Why doesn't objdump stop at the end of function?
I am trying to generate a call graph of called functions starting from an (ARM)ELF file. Currently I call objdump, parse the output for call instructions, and recursively repeat.
However, I noticed a ...
0
votes
0
answers
21
views
No yellow highlight in VS Code's Disassembly View while debugging C++ on MacOS
Debugging C++ in VSCode on MacOS works perfectly fine and when I hit "Open Disassembly View" by right-clicking the line the debugger's on (highlighted in yellow with an arrow of the same ...
3
votes
0
answers
47
views
Swift ARM64: Understanding how types such as URL and String are stored in memory
Im trying to understand how string parameters get passed into Foundation.URL.init and also how the resulting URL is stored in memory. I've captured a few screenshots that demonstrate what im working ...
0
votes
0
answers
32
views
How to successfully installing IDA patching plugin
I'd like to use the plugin: Tool Release: IDA Patcher text but when i follow the instructions and just copy the idapatcher.py to IDA/plugins i get:
C:\Users\...\IDA PRO 7.5 SP3\plugins\idapatcher.py: ...
0
votes
1
answer
39
views
Where is the data string located in this disassembly?
I am going through the OS-dev book by Nick Blundell and I am disassembling the code in section 5.1.4.
Specifically, I have this c code stored in string.c:
void my_function()
{
char* str = "...
0
votes
0
answers
44
views
Decomplie, edit and rebuild .NET DLL
I have .NET 6 WPF builded application with one .DLL file (named as VS Project) and .EXE file.
In short, this app get data from database. I dont have source codes, but I known, that somewhere in code ...
0
votes
1
answer
36
views
When debugging, how can I ask GDB to interpret the code directly from the binary, and not the source?
I need to follow the execution of some binary code I have. Since it is compiled from a version of some code I have (but which is not the same), GDB warns me that the source is newer than the code, and ...
2
votes
0
answers
50
views
cmpl of a constant to the value in the register looks correct but fails
I am debugging some assembly code and have a comparison that fails even though the constant value of 1 is equal to the value in the register it is being compared to.
Here is the compare:
=> ...
1
vote
0
answers
35
views
Use Visual Studio 2022 to debug linux exe, why would MaxSpeed suppress disassembly view?
I'm using Visual Studio 2022, v17.6.2(current latest release) to build and debug an executable running on Ubuntu Linux 22.04.
I find that when I enable <Optimization>MaxSpeed</Optimization>...
0
votes
0
answers
17
views
How to geneate asm and bytes from a benign and malicious software?
I've been working on a project about analyzing a random software.
But I've failed on generating automatically an PE file from samples.
I've tried using radare2 but I could just get a asm file ...
1
vote
2
answers
68
views
How to interpret the code produced by the `.ascii` directive in x86 assembly?
How does the .ascii directive in x86 assembly work? When does it place the ASCII in memory? I would assume the text is part of the machine code that gets placed in main memory, but what exactly is ...
0
votes
0
answers
22
views
how to adjust the font size of disassembly view when debuging C++ project in vscode?
As the title, How to adjust the font size of disassembly view when debuging C++ project in vscode?
Like the following pic, the left window is for source code view, and right is disassembly view.
The ...
0
votes
0
answers
37
views
How do I help GDB disassembler view to synchronize correctly on the instructions?
I am disassembling the memory of the following Python program. The disassembly should start with int 3 instruction, or 0xcc, but GDB (running through either clion or qt develop) does not see it and ...
0
votes
0
answers
42
views
"Syntax Error" in Hopper Disassembler while assembling instruction
I am trying to follow this tutorial https://dhiyaneshgeek.github.io/mobile/security/2021/12/25/hopper-disassembler/ which shows how to bypass the jailbreak detection in a sample demo app named "...
0
votes
0
answers
15
views
rasm2 doesn't return results or errors when disassembling an intel hex file
I'm running rasm2 to disassemble an intel hex file in Arm M0 32-bit processor format. When I run rasm2 it doesn't return any results or any error messages. It simply just does a CRLF and that is it.
...
0
votes
0
answers
43
views
Dissasembling msdos 6.22, stack override prefix
Edit: Ok, I found what I was looking for. My bad. I had some errors in my injected code. Now all register values are correct. :)
--+--+--+--+--+--+--+--
This is my first post. :) I want to learn ...
0
votes
0
answers
67
views
x86 Assembly on Linux and Windows
I was wondering if there would be any major difference between disassembling c-code on a Linux and Windows machine. I have an okay understanding of c and 32-bit assembly-intel syntax. (I'll need to do ...
-4
votes
1
answer
112
views
What would the original C code of an assembler instruction loading a (half)word from an array of chars have looked like?
I'm decompiling an old video game.
Originally written in 68000 assembly, it was rewritten in C to port it to the PC in 1995. This version was then ported to the Sony PlayStation 2, and somehow the ...
0
votes
0
answers
342
views
What is the purpose of the pacibsp and retab instructions?
I'm trying to learn ARM64 architecture using macOS (running on the Apple's M2 chip.) I'm studying this small function (that checks OS version):
libswiftCore.dylib`Swift._stdlib_isOSVersionAtLeast(...
1
vote
1
answer
94
views
What is the purpose of this construct in ARM64 assembly, compiled from Swift on macOS - sequence of adrp, ldr, br instructions
While looking through disassembly of the SwiftUI app, I keep seeing these constructs:
-> 0x100237af4 <+0>: adrp x16, 29
0x100237af8 <+4>: ldr x16, [x16, #0xcb0]
...
3
votes
1
answer
208
views
How do I switch Ghidra to showing canonical register names instead of aliases?
I am new to Ghidra SRE.
How do I switch Ghidra's view mode to display canonical (real world) register names instead of such aliases as param_1 and param_2 ?
Here is a screenshot of a CodeBrowser ...
1
vote
0
answers
70
views
how to detect the instruction boundary while designing a disassembler?
If I want to write a disassembler program, how can I determine the boundaries of instructions? By "boundaries," I mean the rule of separating a sequence of bytes into individual instructions....
1
vote
1
answer
35
views
x86 loope/z instruction should be sign extended according to address size prefix
Hey I'm wondering if the LOOPE LOOPZ instructions should be sign extended by the address size prefix.
In the intel manual it's written:
Performs a loop operation using the RCX, ECX or CX register as ...
0
votes
0
answers
12
views
CS:APP practice problem 2.18 - Representation of Two's complement number [duplicate]
I am going through Computer Systems: A Programmer's perspective (CS:APP) and I had a doubt in the following practice problem -
Solution to line B -
Here the disassembler states in line B -0x58. ...
0
votes
0
answers
31
views
Change code segment with disassemblers like IDA
I already have asked this question on ReverseEngineering Exchange, but didn't get any answers, so the question:
Do disassemblers like IDA or Ghidra change write rules on code segment of a process to ...
0
votes
0
answers
66
views
Redundant lines in disassembly file generated by arm-none-eabi toolchain
I'm working on an embedded program for an ARM Cortex-M0 microcontroller using the arm-none-eabi toolchain and standard GNU make. I'm noticing some redundant .word lines in the disassembly output, and ...
0
votes
1
answer
115
views
How to find references to a string constant in a disassembled program code?
I'm trying to disassemble a program using ndisasm. I've found out that it does not distinguish between constants, metadata, and program instructions. I.e.:
00020CA3 00426F add [edx+0x6f],...
1
vote
0
answers
44
views
Angr considers REP instruction as the end of a basic block
I'm developing a python script for Angr that has to find all the basic blocks present in each function in a binary. I have noticed that Angr splits the basic blocks when he finds a REP instruction, I'...
1
vote
1
answer
109
views
Disassembling C to Assembly x86_64 with GCC 32 bit vs 64 bit Instructions
I am trying to learn assembly x86_64 by reverse engineering programs to see how assembly works. I do this by disassembling my C code into assembly with the gcc compiler. The command I use for this is
...
0
votes
0
answers
41
views
Why does lea instruction load address that is different from the source address to destination? [duplicate]
In the below example I expect that the value of rax should be equal to 0x555555555ffd. But after I execute the instruction the rax shows the address of 0x555555556004. How lea instruction calculates ...
2
votes
1
answer
76
views
Can you remove and add instructions in a disassembler (e.g dbg)?
Recently I decided to learn a new skill - Reading disassembled code.
I want to know if it's possible to remove and add instructions within disassemblers like dbg? I struggle to find that information ...
0
votes
0
answers
26
views
No quick info in disassembly view
I'm trying to write an extension for Visual Studio based on https://github.com/microsoft/VSSDK-Extensibility-Samples/tree/master/AsyncQuickInfo.
I want to show quick info if mouse hover on mnemonics ...
0
votes
0
answers
89
views
IDA pro - what does the invert sign mean in -> mov eax, [ecx-14h]?
This is my first question on StackOverflow, and I hope I find an answer. I'm a newbie in reverse-engineering, I still have a lot to learn.
I started to reverse-engineer a C++ DirectX game a couple of ...
0
votes
0
answers
99
views
Disassemble an ipa file and reassemble it back
Is there any way that I can disassemble an ipa file, change some configuration, then reassemble it back with a different name? (All of this using command line would be preferable).
I know this is ...
0
votes
1
answer
237
views
Using objdump on ARM architecture: Disassembling to INTEL arch
I have an object file and am trying to disassemble it. When I use:
objdump -d example.o
I get an assembly in code in the file format of elf64-littleaarch64.
I am trying to disassemble this into INTEL ...
0
votes
0
answers
50
views
How can I disassemble a runtime code using python?
Through capstone library i can easily disassemble a PE static code with all the instructions but i need to disassemble a runtime code of a PE file is this possible?
import pefile
import binascii
...
3
votes
1
answer
69
views
Discrepancy in outputs of `size` and `objdump`?
I have compiled the following C function (in sum.c) into object code:
int sum(int a, int b)
{
return (a + b);
}
using
gcc -c sum.c
When I check the sizes of different sections using size:
size ...
-1
votes
1
answer
71
views
In python on x86-64, are the first 6 arguments typically passed on registers?
To the best of my knowledge, in low level languages such as C, it is generally advisable to keep the number of arguments to functions to 6 or lower, since then there is no need to pass arguments on ...
0
votes
0
answers
33
views
How to decode or encode cmp instruction in x86 (ATT syntax)? R/M =100? [duplicate]
I was trying to decode the following hex numbers:
3b 5c 78 f6
I checked the manual of Intel, and 3b refers to the opcode of CMP Gv,Ev.
5c is 01 011 100in binary, meaning MOD=01, REG =011, R/M=100.
MOD ...
0
votes
0
answers
154
views
ARM Assembly Question Regarding printf and registers x8 and x9 [duplicate]
I am new to learning about assembly and find it very interesting. I am trying to dissect what the purpose of setting registers x8 and x9 are in this example. Specifically, I am unsure as to why x8 and ...