Questions tagged [disassembly]
Involves turning "compiled" code (such as machine code, byte code or IR code) back in higher-level assembly mnemonics.
1,545
questions
0
votes
0
answers
10
views
Patch a Game for hooking with detours
I have created a c++ wrapped version of "winmm.dll" that use hook some games.
To do it I use detours and until now I have succefully hook 32 and 64 bit games.
Unfortunatenly I have found ...
-1
votes
1
answer
51
views
what does so many hexadecimal values mean to print a string in the assembly?
I'm new to the assembly world and I study converting code in C to better understand the logic. I use objconv to do the conversion and I use Windows. I converted the following C code:
#include <...
0
votes
0
answers
72
views
How to resolve "An error has occurred. See error log for more details. " in Eclipse
I use Eclipse-2022-06-R in ubuntu 20.04.4 to debug stm32. I would like to change Ruler background color of Disassembly page. When I click Apply, Problem Occurred dialog comes out. It says "An ...
0
votes
1
answer
37
views
disassemble ELF file (Linux/ubuntu)
I want disassemble ELF file and then add my assemblies then reassemble it
I used :
objdump -D hello.elf > hello.asm ----> fasm hello.asm hello.elf -m 1000000
I have an error:
flat assembler ...
1
vote
1
answer
46
views
What does "=>address" mean in Ghidra's disassembly, at the end of an instruction?
I am new to assembly & Ghidra and I am seeing a => on some lines for PUSH in a binary I am looking at and I cant seem to find what Ghidra is doing for instructions like this:
0040298b 56 PUSH ...
0
votes
0
answers
23
views
Relative jump not pointing to in-range address [duplicate]
Note: Binary is obfuscated. I know that i can take the qword address and use that with the 0x1b0 but I'm confused as to why my approach below isn't working.
So I have this disassembly here. I'm trying ...
0
votes
1
answer
22
views
What is the rva and base address in the portable executable format?
I need help to understand these concepts.
I understand that the rva is an offset from the base address. But Its relative to what in a file? I understood it was from where the image will be loaded in ...
4
votes
2
answers
82
views
Why is accessing elements using `tolist` faster than accessing it directly through the pandas series?
I have a dataframe and I wanted to apply a certain function on a set of columns. Something like:
data[["A","B","C","D","E"]].apply(some_func, axis=1)
...
0
votes
1
answer
58
views
__builtin_sinf What is it? Where is it? How do I obtain the dissassembly of it?
I was curious this morning to see if I could obtian and understand the machine instructions generated for calculating a mathematical function such as sin, which as far as I am aware there is no ...
0
votes
1
answer
54
views
In which register does the scanf function store input values?
I have the following disassembly of a main function in which a user input is stored using scanf function (at address 0x0000089c). Due to the comparison that is made, I suppose that the user input is ...
4
votes
2
answers
58
views
Function call in the assembly language before linking
I was going through the assembly code generated by the compiler. I am using the C programming language and GCC compiler.
I wrote a function in C which adds two numbers by calling another function and ...
0
votes
1
answer
31
views
Disassemble components
I would like to simulate the disassembly of electronic components. For example, an electronic component should be disassembled into its individual parts. Afterwards it should be traceable by barcode, ...
3
votes
1
answer
91
views
Assembly showing a lot of repeating code?
So I'm working on some binary to assembly to c++ code. It's for a project.
When I disassemble the binary I'm getting a lot of repeating assembly code and I'm not sure what it's doing. It's almost like ...
0
votes
1
answer
77
views
How does the transfer of parameters between functions work in assembly?
So I'm trying to understand how assembly programming works with stack frames etc.
I did some exercises and disassembled some C-code with GDB. The task now is to find out how the transfer of parameters ...
0
votes
0
answers
34
views
C Disassembly - Function Preamble on windows with Visual Studio
I created the following C library so I can look through the assembly and learn more about it by practical examples.
#include "pch.h"
#include "paramtest.h"
__int64 test(...
0
votes
0
answers
19
views
In this frame i cannot understand which line is for RBP and which line is for RIP
i am learning buffer overflow but could not identify which line is for RIP and RBP?
It will be very helpful if you describe me the whole frame , what for is each address, thank you.
0x7fffffffe010: ...
1
vote
0
answers
33
views
Deciphering an SIB encoding from Intel x86-64
Here's a simple hello world file
#include <stdio.h>
int main() {
printf("hello, world\n");
return 0;
}
Here is the instruction to load the address of a ...
0
votes
1
answer
56
views
Choose Intel syntax for perf report assembly
My perf report shows everything in AT&T syntax:
...
0,18 │ pop %rax
0,14 │ ← retq
0,18 │a9: vmovsd -0x8(%rdi,%rsi,8),%...
2
votes
0
answers
25
views
What register is riz? [duplicate]
I was disassembling a program and I don't understand what "riz" means here.
I don't know of a register with this name.
or cl,BYTE PTR [rcx+riz*2+0x65]
Can someone explain it to me?
...
0
votes
0
answers
35
views
gdb disassembly output: negative relative addresses
Occasionally I want to analyse the assembler produced by gcc for a function, and have long used a little script that fires up gdb with expect, fetches the disassembly, and postprocesses the result to ...
1
vote
1
answer
84
views
Extracting IDA view-A data or Assembly from IDApython
I'm a newbie in IDApro.
I'd like to save the assembly code or IDA view-A(not a graph view) text through IDApro.
I know the how to save using GUI, but there are so many files i have to change.
So I ...
0
votes
0
answers
64
views
How disassembler files with Ghidra in cmd
How disassembler for example .elf file in Ghidra with cmd. I am trying do this with
./analyzeHeadless -import /my/path/file
But in arguments required a Ghidra project. I want to disassembler just ...
1
vote
2
answers
39
views
Where does a compiled function get its globals()?
I've discovered that if I write something like:
code = f"lambda a, b: add(a, b)"
my_globals = globals().copy()
my_globals['add'] = operator.__add__
result = eval(code, my_globals, {})
Then ...
0
votes
0
answers
10
views
Ghidra: What controls the Window Height/Width for this exe
so I'm fairly new to disassembling.
I am trying to create a resolution patch for Hotel Giant. A game released in 2002.
The game is so basic it has no options to choose resolution and barely any ...
0
votes
0
answers
59
views
Does inline ASM in C change disassembly?
I tried my best to search for this question before asking, but could not find an answer. Perhaps this question would be better suited to ask on the Reverse Engineering SE.
I am examining a 32-bit C ...
0
votes
1
answer
62
views
Why does "gdb> disas /s main" not show me source code?
I start with a binary executable and I want to see the source code, not just the assembly code. Is this possible? The documentation at "https://sourceware.org/gdb/onlinedocs/gdb/Machine-Code....
0
votes
1
answer
268
views
Can machine code executables be transpiled to other operating systems and architectures? [closed]
My novice understanding of the different machine code / binary executables is that they are specific to the operating system and the architecture they have been compiled for. Nevertheless, it appears ...
0
votes
1
answer
19
views
Does the %rax register contain the return value of function right after the 'call' instruction?
this is a simple disassembly code.
push %rbp
mov %rsp,%rbp
sub $0x10,%rsp
movq $0x0,-0x8(%rbp)
mov $0xf,%edi
callq 1070 <malloc@plt>
mov %rax,-0x8(%rbp)
mov -0x8(%rbp),%rax
...
0
votes
1
answer
58
views
Safely modify opcodes in x86 binary
Given a binary analyzed with gdb for example, I want to "patch" the binary by modifying some bytes in it (so that some custom code is executed). For example, the following :
leave
ret
push ...
1
vote
0
answers
26
views
libzydis_linux_amd64.syso: file format not recognized; treating as linker script go-zydis
i have a error when i want to install go-zydis
error:
[bryton@BRYTON scrap]$ go get go.jpap.org/zydis
# go.jpap.org/zydis
/usr/bin/ld:/home/bryton/go/pkg/mod/go.jpap.org/zydis@v0.0.0-20210718235710-...
5
votes
1
answer
594
views
What to do with "DWARF error: section .debug_info is larger than its filesize!"?
Looking for ways to see generated assembler of a specific function in my binary (an .so to be exact), just as I can see similar on Compiler Explorer, I found How to disassemble one single function ...
2
votes
1
answer
60
views
The compiled code is different from the assembly code when single-step debugging
I am writing a shabby OS on Bochs, a x86 virtual machine tool, with assembly and c language. Everything was ok, but I find a bug. After debugging the code, I found that the Assembly code compiled by ...
6
votes
1
answer
127
views
Motorola 68000 assembler syntax for Program Counter Indirect with Index
I've been putting together my own disassembler for Sega Mega Drive ROMs, basing my initial work on the MOTOROLA M68000 FAMILY Programmer’s Reference Manual. Having disassembled a considerable chunk of ...
0
votes
0
answers
15
views
Why is the function prolog used sometimes, and sometimes there is a naked function in x86-64? [duplicate]
When disassembling programs, I've noticed that sometimes the function prolog is omitted. I've read this this was called a naked function. For example:
push rbp
mov rbp, rsp
sub 24h
; rest of function
...
1
vote
1
answer
95
views
Abnormal presence of code after __stack_chk_fail
I have an 64-bits ELF binary. I don't have its source code, don't know with which parameters it was compiled, and am not allowed to provide it here. The only relevant information I have is that the ...
0
votes
0
answers
41
views
Finding entry point/device loading address in firmware for Renesas 7144 Series?
We need to find out how some logic, created by others, work. Logic is implemented in firmware for 64F7144F50V SH2 CPU (probably, part from Renesas SH7144 family).
Device firmware is unencrypted (clear)...
1
vote
0
answers
41
views
Is there a way to disassemble the current running file?
So we all know it's possible to disassemble a function using
dis.dis(f)
but the problem I am having is figuring out how to disassemble a whole module aka the main "function". We can get the ...
-1
votes
1
answer
62
views
does windows handle the opcode different?
(btw this ist my first question here, so I dont know any guidelines)
Im trying to learn reading the pure opcodes (I do not know the exact term) of Programms on x-86-architectur (intel i5-7400) but if ...
1
vote
0
answers
52
views
Register values in ARM exec trace results (from GEM5) when compared with disassembly of the executable
I tried running a simple hello world on ARM and went through the "exec" debug trace. I also used the disassembly of the executable to compare the sequence and register values. While doing so,...
0
votes
0
answers
28
views
What does the ptr operator do as part of operand to lea
I met this piece of disassembly that I am unsure about what it does
lea rsi, ptr [rip+0x26b0f]
I know that the ptr operator together with size such as "dword ptr [...adress]" will ...
-1
votes
1
answer
84
views
How can one overwrite the return address without buffers on on the stack?
In the below program, I have a few buffers, but they are global variables, not stored on the stack. Thus, I'm not seeing a viable way of overwriting the return address to execute a shellcode.
Is ...
1
vote
0
answers
127
views
Debugging Backtrace gives weird line numbers
NOTE: While I mainly focus on using GDB as a debugger in this question, I've noticed the same behavior in other debugging tools (Forge DDT does the same thing as well)
I'm trying to troubleshoot some ...
1
vote
1
answer
92
views
What are these "abundant" assembly codes used for and why are they compiled out?
I'm not familiar with the implementation of C++ compilers and I'm writing a C++ snippet like this (for learning):
#include <vector>
void vector8_inc(std::vector<unsigned char>& v) {
...
0
votes
1
answer
142
views
How to check the CRC of the function in C++
Is it possible to count the CRC of code in the memory of the function in the runtime?
I have a function that compares user's password with the secret password. If I check the CRC of all commands in ...
-1
votes
1
answer
132
views
How can I determine this string value based on the C disassembly?
So I am working on a "find the password" type binary disassembly problem and cannot quite figure it out.
The assembly is as follows:
function checkpw
****************...
0
votes
1
answer
184
views
How do I interpret this disassembled code in IDA?
I am working on a "figure out the password" type problem and believe I'd found the functions in question. What I am struggling with is understand what is happening in them.
int __cdecl ...
0
votes
0
answers
20
views
What does jmp ds:dword mean [duplicate]
I'm trying to understand what this subroutine does.
It goes like this:
sub_407690 proc near
jmp ds:dword_415764
sub_407690 endp
dword is defined as
dword_415764 dd 1702Ch
So what I understand ...
0
votes
1
answer
51
views
Is instruction encoded differently from .so file to runtime memory?
I have an Android .so file that uses ARM-V7A instruction set.
I drag it into IDA, and there is one line that shows :
0x1000: b #0x102c
And the hex window shows that the binary code of b #0x102c is 14 ...
2
votes
1
answer
69
views
C++ odd assembly output query
Using Windows 10 Pro with Visual Studio 2022, Debug mode, X64 platform, I have the following code...
int main()
{
int var = 1;
int* varPtr = &var;
*varPtr = 10;
return 0;
}
In ...
1
vote
1
answer
146
views
Increase size of the BSS section in the elf and other file formats
I want to add a 4KB space to the bss section of an executable elf file. How can this be done?
If not bss section, can I increase the size of the data section or define a new data section
and ...