Reverse Engineering Stack Exchange
Reverse Engineering Stack Exchange

Questions tagged [disassembly]

The translation of machine code into a human readable assembly code, also the result of such translation.

Disassembly refers to the translation of machine code into assembly code, that is a mnemonic form of the underlying machine code. The code generated from a disassembler is usually human readable and not formatted for input to an assembler. Unlike , disassembly operates on much lower-level languages.

Disassembling is not an exact science, so it is possible for a single program to have two or more reasonable representations in disassembly. Determining which instructions would actually be encountered during a run of the program reduces to the halting problem, which is currently proven to be unsolvable. Additionally it is a challenge to distinguish code from data during a disassembler run, which can be countered using heuristics in many cases and requires human interaction in other cases.

From Wikipedia on the disassembler:

A disassembler is a computer program that translates machine language into assembly language—the inverse operation to that of an assembler. A disassembler differs from a decompiler, which targets a high-level language rather than an assembly language. Disassembly, the output of a disassembler, is often formatted for human-readability rather than suitability for input to an assembler, making it principally a reverse-engineering tool.

Disassemblers

More can be found in the tag-wiki.

distorm

From the website:

diStorm is a lightweight, easy-to-use and fast decomposer library.

diStorm disassembles instructions in 16, 32 and 64 bit modes. Supported instruction sets: FPU, MMX, SSE, SSE2, SSE3, SSSE3, SSE4, 3DNow! (w/ extensions), new x86-64 instruction sets, VMX, AMD's SVM and AVX!

IDA

From the website:

IDA is a Windows, Linux or Mac OS X hosted multi-processor disassembler and debugger that offers so many features it is hard to describe them all. Just grab an evaluation version if you want a test drive.

An executive summary is provided for the non-technical user.

1262 questions
39
votes
8 answers

What are the targets of professional reverse software engineering?

At the professional level, for what purpose is reverse software engineering used? What software is targeted and why? For reasonably complex compiled code that's doing something novel, making meaningful insights into how that code operates via…
Praxeolitic
  • 535
  • 5
  • 9
17
votes
2 answers

What purpose of mov %esp,%ebp?

When execution enters a new function by performing call I do often see this code template (asm list generated by Gnu Debugger when in debugging mode): 0x00401170 push %ebp 0x00401171 mov %esp,%ebp 0x00401173 pop %ebp So what's the…
PaulD
  • 433
  • 1
  • 4
  • 10
12
votes
3 answers

Why is there in a nop in the while loop

So I have the following C code I wrote: #include int main() { int i = 1; while(i) { printf("in loop\n"); i++; if(i == 10) { break; } } return 0; } Compiled with gcc…
Sindre Smistad
  • 175
  • 7
9
votes
1 answer

How to find main() in binary?

Given a binary and only using a tool like ndisasm, how can I find main()? I don't want to use smart tools like IDA Pro because I'm doing this exercise to learn.
drum
  • 284
  • 1
  • 2
  • 9
7
votes
2 answers

Decompiling Modem Firmware (firmware.bin) with unknown results on binwalk

I'm just new to these field. So bare with me. These is the result when I run binwalk. When I try to extract it using binwalk, it just give endless archives and files to analyse. Any ideas if it is a false positive? I just want to access one web…
Thomson Bobby
  • 71
  • 1
  • 1
  • 2
6
votes
2 answers

Are there any active IRC channels for RCE discussion?

I enjoy idling in programming related IRC channels so I can research any topic which catches my interest. I have checked the channels for a few forums that I browse, but I can't seem to find an active community. What are some active RCE related…
question_asker_777
  • 155
  • 1
  • 6
6
votes
1 answer

What is the purpose of this sequence of HP PA-RISC instructions?

I'm looking at the startup code in an HP SOM executable. The disassembly looks like this: 00004010 b4 00 10 c2 addi,tr 61,r0,r0 00004014 e8 00 01 aa b,l,n 0x000040f0,r0 The addi instruction is…
John Källén
  • 1,070
  • 9
  • 17
6
votes
2 answers

Call to variable address

I have come across the following instructions: mov ecx, [ebp + var_4] imul ecx, 4 call dword_1423d4[ecx] Can someone explain to me what it possibly means or point me in the right direction? Why is the call made to a variable?
Cream Cracker
  • 145
  • 1
  • 6
6
votes
2 answers

objdump: can't disassemble for architecture UNKNOWN!

I am trying to use objdump -d fileName on a s-rec file and it returns unknown architecture, however it recognizes fileName: file format srec I looked at objdump --help and under supported targets srec and symbolsrec is listed. I have tried objdump…
0siris
  • 61
  • 1
  • 1
  • 7
5
votes
2 answers

GCC Loop optimization

I have been looking at some simple C code and the different output from GCC using different optimization levels. C code #include int main() { int i = 0; while(i<10) { printf("Hello\n"); i++; } i =…
Sindre Smistad
  • 175
  • 7
5
votes
2 answers

Optimization of strcpy at the assembler level

I'm writing small C programs to teach myself how to use GDB to disassemble code. The C in question is: void function( char **pointer ) { *pointer = malloc(100); strcpy(*pointer,"This is text"); } The disassembly is: 0x400620: push …
David Lee Braun
  • 53
  • 5
4
votes
2 answers

The compiler adds a function call to user-defined functions. What does the function do? (x64 Windows executable)

Introduction I compiled a simple executable with Visual Studio in x64 Windows. Source code: long test(int a, int b, int c, int d, int e, int f, int g, int h, int i, int j) { printf("%d %d %d", a, b, c); return 0x0123456789acdef; } int main() { …
Nopslide__
  • 239
  • 2
  • 8
4
votes
2 answers

Prevent game from pausing on lost focus (Fallout New Vegas)

I am trying to modify a game (Fallout New Vegas) to not show a pause menu when the window loses focus. I thought of two approaches: Find the code that is called when focus changes and nop the call which would show the pause menu. Find the code…
Stewart
  • 95
  • 3
3
votes
2 answers

Where are page permissions stored in an ELF binary?

Perhaps I am misunderstanding how this works, but to my knowledge ELF binaries can either have NX protections for the stack, or not. What I am assuming is that there is a place in the binary that spells this out, but I'm not sure exactly where this…
MrSynAckSter
  • 1,258
  • 1
  • 10
  • 24
3
votes
2 answers

Hikvision camera firmware reverse engineering

I have a camera with Hikvision firmware. The firmware file has clear text in it, for example, there's a shell script you can see in there that coincides with a shell script when I tellnet in. There's gzip tarball, but that's OK, that's how they are…
carl
  • 47
  • 1
  • 1
  • 2
1
2 3 4 5