Questions tagged [disassembly]

Involves turning "compiled" code (such as machine code, byte code or IR code) back in higher-level assembly mnemonics.

Filter by
Sorted by
Tagged with
0 votes
0 answers
29 views

Show Disassembly without Debugging in MS Visual Studio [duplicate]

I can run my code and if debugger is halted I can show the disassembly of the current code. (Debugging->Window->Disassembly) But I want to see the disassembly of the compiled code without ...
powerpete's user avatar
  • 2,713
1 vote
1 answer
45 views

How to get related instruction code from instruction bytes?

I got the following error message when I run a Go program which contains some Go assembler codes: SIGILL: illegal instruction PC=0x508c04 m=0 sigcode=2 instruction bytes: 0xc4 0x42 0x68 0xf2 0xea 0xc5 ...
Emman Sun's user avatar
  • 363
0 votes
0 answers
32 views

how to Convert a .exe file to multiple assembly files at the function level?

I have an exe file and want to disassemble them. reverse engineering tools determine how many sections and functions this file consists of. enter image description here Now I want to have those ...
Homayoon Soleimani's user avatar
0 votes
0 answers
57 views

What is First Three Instructions in the Disassembled Code

What is the meaning of the first three commands being the same after most programs are disassembled? What is the meaning of the first three commands being the same after most programs are disassembled?...
P4WN3R's user avatar
  • 19
0 votes
0 answers
60 views

Why is function call terminating the debug process on IDA Freeware?

I am solving a Reverse Engineering capture the flag challenge where I have to find a flag in the format flag{thisistheflag}. Below is the link to a GitHub Repository that contains the given exe file ...
Dave Patel's user avatar
0 votes
1 answer
69 views

What are these x86 asm instructions (rex.x, rex.wx (bad))?

Re: the meaning of some instructions in disassembled C++ code (disassembled using gdb v. 13.2, compiled using g++ v.13.1.0, with the -std=c++23, -g and -o flags). Most of the instructions and their ...
Ashley Ben Story's user avatar
0 votes
0 answers
24 views

How can I layout gdb to show regs, src code, and disasm, at the same time?

gdb shows great information in layout regs and layout split. How can I get it to show both? I'd like to see regs, src code, disasm (and maybe memory) at the same time - ideally with resizeable ...
SRobertJames's user avatar
  • 8,403
0 votes
0 answers
44 views

Are executable files virtual addresses shown by disassemblers definitive? [duplicate]

I'm on a macOS x86_64 system. I have this little C program in a file named test.c : void fx(){ int y = 20; y++; } int main(){ int x = 10; x++; fx(); } If I ...
alessio solari's user avatar
0 votes
1 answer
43 views

How to calculate offset line

I want to inject x-code into the PE header (for the sake of experience) that outputs the string to the console. I almost reached my goal, there was only one touch left... I want to put offset of the ...
Ruslan Valerievich's user avatar
0 votes
0 answers
14 views

How to set a breakpoint and then show the data After running the programm with pwndbg?

Im learning how to use pwndbg and I want to know how to set a breakpoint and then after running the programm it shows the stack, Register etc. Like Crypto Cat did. And I want to make that as well but ...
Anon's user avatar
  • 1
1 vote
1 answer
47 views

Why doesn't objdump stop at the end of function?

I am trying to generate a call graph of called functions starting from an (ARM)ELF file. Currently I call objdump, parse the output for call instructions, and recursively repeat. However, I noticed a ...
Alessandro Bertulli's user avatar
0 votes
0 answers
21 views

No yellow highlight in VS Code's Disassembly View while debugging C++ on MacOS

Debugging C++ in VSCode on MacOS works perfectly fine and when I hit "Open Disassembly View" by right-clicking the line the debugger's on (highlighted in yellow with an arrow of the same ...
Solus's user avatar
  • 11
3 votes
0 answers
47 views

Swift ARM64: Understanding how types such as URL and String are stored in memory

Im trying to understand how string parameters get passed into Foundation.URL.init and also how the resulting URL is stored in memory. I've captured a few screenshots that demonstrate what im working ...
Chris Birch's user avatar
  • 2,041
0 votes
0 answers
32 views

How to successfully installing IDA patching plugin

I'd like to use the plugin: Tool Release: IDA Patcher text but when i follow the instructions and just copy the idapatcher.py to IDA/plugins i get: C:\Users\...\IDA PRO 7.5 SP3\plugins\idapatcher.py: ...
Darox99's user avatar
  • 19
0 votes
1 answer
39 views

Where is the data string located in this disassembly?

I am going through the OS-dev book by Nick Blundell and I am disassembling the code in section 5.1.4. Specifically, I have this c code stored in string.c: void my_function() { char* str = "...
Alexander the Great's user avatar
0 votes
0 answers
44 views

Decomplie, edit and rebuild .NET DLL

I have .NET 6 WPF builded application with one .DLL file (named as VS Project) and .EXE file. In short, this app get data from database. I dont have source codes, but I known, that somewhere in code ...
big4oot's user avatar
  • 13
0 votes
1 answer
36 views

When debugging, how can I ask GDB to interpret the code directly from the binary, and not the source?

I need to follow the execution of some binary code I have. Since it is compiled from a version of some code I have (but which is not the same), GDB warns me that the source is newer than the code, and ...
Alessandro Bertulli's user avatar
2 votes
0 answers
50 views

cmpl of a constant to the value in the register looks correct but fails

I am debugging some assembly code and have a comparison that fails even though the constant value of 1 is equal to the value in the register it is being compared to. Here is the compare: => ...
themetalmystic's user avatar
1 vote
0 answers
35 views

Use Visual Studio 2022 to debug linux exe, why would MaxSpeed suppress disassembly view?

I'm using Visual Studio 2022, v17.6.2(current latest release) to build and debug an executable running on Ubuntu Linux 22.04. I find that when I enable <Optimization>MaxSpeed</Optimization>...
Jimm Chen's user avatar
  • 3,417
0 votes
0 answers
17 views

How to geneate asm and bytes from a benign and malicious software?

I've been working on a project about analyzing a random software. But I've failed on generating automatically an PE file from samples. I've tried using radare2 but I could just get a asm file ...
NicoaTheSix's user avatar
1 vote
2 answers
68 views

How to interpret the code produced by the `.ascii` directive in x86 assembly?

How does the .ascii directive in x86 assembly work? When does it place the ASCII in memory? I would assume the text is part of the machine code that gets placed in main memory, but what exactly is ...
Loogai's user avatar
  • 113
0 votes
0 answers
22 views

how to adjust the font size of disassembly view when debuging C++ project in vscode?

As the title, How to adjust the font size of disassembly view when debuging C++ project in vscode? Like the following pic, the left window is for source code view, and right is disassembly view. The ...
ken.w's user avatar
  • 1
0 votes
0 answers
37 views

How do I help GDB disassembler view to synchronize correctly on the instructions?

I am disassembling the memory of the following Python program. The disassembly should start with int 3 instruction, or 0xcc, but GDB (running through either clion or qt develop) does not see it and ...
user7610's user avatar
  • 25.5k
0 votes
0 answers
42 views

"Syntax Error" in Hopper Disassembler while assembling instruction

I am trying to follow this tutorial https://dhiyaneshgeek.github.io/mobile/security/2021/12/25/hopper-disassembler/ which shows how to bypass the jailbreak detection in a sample demo app named "...
node_analyser's user avatar
0 votes
0 answers
15 views

rasm2 doesn't return results or errors when disassembling an intel hex file

I'm running rasm2 to disassemble an intel hex file in Arm M0 32-bit processor format. When I run rasm2 it doesn't return any results or any error messages. It simply just does a CRLF and that is it. ...
Coleman's user avatar
0 votes
0 answers
43 views

Dissasembling msdos 6.22, stack override prefix

Edit: Ok, I found what I was looking for. My bad. I had some errors in my injected code. Now all register values are correct. :) --+--+--+--+--+--+--+-- This is my first post. :) I want to learn ...
Nassau's user avatar
  • 463
0 votes
0 answers
67 views

x86 Assembly on Linux and Windows

I was wondering if there would be any major difference between disassembling c-code on a Linux and Windows machine. I have an okay understanding of c and 32-bit assembly-intel syntax. (I'll need to do ...
JDDoe 's user avatar
  • 19
-4 votes
1 answer
112 views

What would the original C code of an assembler instruction loading a (half)word from an array of chars have looked like?

I'm decompiling an old video game. Originally written in 68000 assembly, it was rewritten in C to port it to the PC in 1995. This version was then ported to the Sony PlayStation 2, and somehow the ...
user16316067's user avatar
0 votes
0 answers
342 views

What is the purpose of the pacibsp and retab instructions?

I'm trying to learn ARM64 architecture using macOS (running on the Apple's M2 chip.) I'm studying this small function (that checks OS version): libswiftCore.dylib`Swift._stdlib_isOSVersionAtLeast(...
c00000fd's user avatar
  • 21.2k
1 vote
1 answer
94 views

What is the purpose of this construct in ARM64 assembly, compiled from Swift on macOS - sequence of adrp, ldr, br instructions

While looking through disassembly of the SwiftUI app, I keep seeing these constructs: -> 0x100237af4 <+0>: adrp x16, 29 0x100237af8 <+4>: ldr x16, [x16, #0xcb0] ...
c00000fd's user avatar
  • 21.2k
3 votes
1 answer
208 views

How do I switch Ghidra to showing canonical register names instead of aliases?

I am new to Ghidra SRE. How do I switch Ghidra's view mode to display canonical (real world) register names instead of such aliases as param_1 and param_2 ? Here is a screenshot of a CodeBrowser ...
user avatar
1 vote
0 answers
70 views

how to detect the instruction boundary while designing a disassembler?

If I want to write a disassembler program, how can I determine the boundaries of instructions? By "boundaries," I mean the rule of separating a sequence of bytes into individual instructions....
Evan's user avatar
  • 430
1 vote
1 answer
35 views

x86 loope/z instruction should be sign extended according to address size prefix

Hey I'm wondering if the LOOPE LOOPZ instructions should be sign extended by the address size prefix. In the intel manual it's written: Performs a loop operation using the RCX, ECX or CX register as ...
Jorayen's user avatar
  • 1,757
0 votes
0 answers
12 views

CS:APP practice problem 2.18 - Representation of Two's complement number [duplicate]

I am going through Computer Systems: A Programmer's perspective (CS:APP) and I had a doubt in the following practice problem - Solution to line B - Here the disassembler states in line B -0x58. ...
Kumaravel Rajan's user avatar
0 votes
0 answers
31 views

Change code segment with disassemblers like IDA

I already have asked this question on ReverseEngineering Exchange, but didn't get any answers, so the question: Do disassemblers like IDA or Ghidra change write rules on code segment of a process to ...
Balora's user avatar
  • 31
0 votes
0 answers
66 views

Redundant lines in disassembly file generated by arm-none-eabi toolchain

I'm working on an embedded program for an ARM Cortex-M0 microcontroller using the arm-none-eabi toolchain and standard GNU make. I'm noticing some redundant .word lines in the disassembly output, and ...
Matej Gomboc's user avatar
0 votes
1 answer
115 views

How to find references to a string constant in a disassembled program code?

I'm trying to disassemble a program using ndisasm. I've found out that it does not distinguish between constants, metadata, and program instructions. I.e.: 00020CA3 00426F add [edx+0x6f],...
Emil Viesná's user avatar
1 vote
0 answers
44 views

Angr considers REP instruction as the end of a basic block

I'm developing a python script for Angr that has to find all the basic blocks present in each function in a binary. I have noticed that Angr splits the basic blocks when he finds a REP instruction, I'...
Luca's user avatar
  • 105
1 vote
1 answer
109 views

Disassembling C to Assembly x86_64 with GCC 32 bit vs 64 bit Instructions

I am trying to learn assembly x86_64 by reverse engineering programs to see how assembly works. I do this by disassembling my C code into assembly with the gcc compiler. The command I use for this is ...
Dremond Williams's user avatar
0 votes
0 answers
41 views

Why does lea instruction load address that is different from the source address to destination? [duplicate]

In the below example I expect that the value of rax should be equal to 0x555555555ffd. But after I execute the instruction the rax shows the address of 0x555555556004. How lea instruction calculates ...
lambdavary's user avatar
2 votes
1 answer
76 views

Can you remove and add instructions in a disassembler (e.g dbg)?

Recently I decided to learn a new skill - Reading disassembled code. I want to know if it's possible to remove and add instructions within disassemblers like dbg? I struggle to find that information ...
Dawid Wawrzynczyk's user avatar
0 votes
0 answers
26 views

No quick info in disassembly view

I'm trying to write an extension for Visual Studio based on https://github.com/microsoft/VSSDK-Extensibility-Samples/tree/master/AsyncQuickInfo. I want to show quick info if mouse hover on mnemonics ...
Just Fancy's user avatar
0 votes
0 answers
89 views

IDA pro - what does the invert sign mean in -> mov eax, [ecx-14h]?

This is my first question on StackOverflow, and I hope I find an answer. I'm a newbie in reverse-engineering, I still have a lot to learn. I started to reverse-engineer a C++ DirectX game a couple of ...
Ibrahim Mohamed's user avatar
0 votes
0 answers
99 views

Disassemble an ipa file and reassemble it back

Is there any way that I can disassemble an ipa file, change some configuration, then reassemble it back with a different name? (All of this using command line would be preferable). I know this is ...
Abdul Majeed's user avatar
0 votes
1 answer
237 views

Using objdump on ARM architecture: Disassembling to INTEL arch

I have an object file and am trying to disassemble it. When I use: objdump -d example.o I get an assembly in code in the file format of elf64-littleaarch64. I am trying to disassemble this into INTEL ...
Helix's user avatar
  • 9
0 votes
0 answers
50 views

How can I disassemble a runtime code using python?

Through capstone library i can easily disassemble a PE static code with all the instructions but i need to disassemble a runtime code of a PE file is this possible? import pefile import binascii ...
Satyam Singh's user avatar
3 votes
1 answer
69 views

Discrepancy in outputs of `size` and `objdump`?

I have compiled the following C function (in sum.c) into object code: int sum(int a, int b) { return (a + b); } using gcc -c sum.c When I check the sizes of different sections using size: size ...
First User's user avatar
-1 votes
1 answer
71 views

In python on x86-64, are the first 6 arguments typically passed on registers?

To the best of my knowledge, in low level languages such as C, it is generally advisable to keep the number of arguments to functions to 6 or lower, since then there is no need to pass arguments on ...
alonj's user avatar
  • 3
0 votes
0 answers
33 views

How to decode or encode cmp instruction in x86 (ATT syntax)? R/M =100? [duplicate]

I was trying to decode the following hex numbers: 3b 5c 78 f6 I checked the manual of Intel, and 3b refers to the opcode of CMP Gv,Ev. 5c is 01 011 100in binary, meaning MOD=01, REG =011, R/M=100. MOD ...
Chen Yao's user avatar
0 votes
0 answers
154 views

ARM Assembly Question Regarding printf and registers x8 and x9 [duplicate]

I am new to learning about assembly and find it very interesting. I am trying to dissect what the purpose of setting registers x8 and x9 are in this example. Specifically, I am unsure as to why x8 and ...
Griffin Baker's user avatar

1
2 3 4 5
33