disassembly

Determining Which Compiler Built a Win32 PE

為{幸葍}努か 提交于 2019-11-29 08:18:15
问题 How can one determine which C or C++ compiler was used to build a particular Windows executable or DLL? Some compilers leave behind version strings in the final executable, but this seems to be rarer on Windows than on Linux. Specifically, I'm interested in distinguishing between Visual C++ and the various MinGW compilers (usually fairly easy from the function signatures), and then between Visual C++ versions (6, 2002/2003, 2005, 2008; more difficult to do). Is there a tool out there that can

Reverse Engineering old paint programs

徘徊边缘 提交于 2019-11-29 03:45:48
I've got a couple of really old MSDos based paint programs. They work on palette indexed image buffers. They have a number of spectacular shape drawing tools, brushes and effects that simply do not exist in any modern paint program- Particularly not whilst staying within the "bounds" of a low color palette indexed image. I would like to reproduce many of these wonderful tools in a modern program, to perhaps make them more accessible to myself and the general public again, without having to boot up an emulator like dosbox. But I have a problem. While a lot of these brushes and tools and things

reverse engineering c programs

蹲街弑〆低调 提交于 2019-11-29 02:33:18
问题 every c program is converted to machine code, if this binary is distributed. Since the instruction set of a computer is well known, is it possible to get back the C original program? 回答1: You can never get back to the exact same source since there is no meta-data about that saved with the compiled code. But you can re-create code out from the assembly-code. Check out this book if you are interested in these things: Reversing: Secrets of Reverse Engineering. Edit Some compilers-101 here, if

Why does this MOVSS instruction use RIP-relative addressing? [duplicate]

主宰稳场 提交于 2019-11-28 14:16:09
This question already has an answer here: Why is the address of static variables relative to the Instruction Pointer? 1 answer I found the following assembly code in disassembler (floating point logic c++). 842: movss 0x21a(%rip),%xmm0 I understand that when process rip will allways be 842 and this 0x21a(%rip) will be const. It seems a little odd to use this register. I want to know is there any advantage of using rip relative address, instead other addressing. RIP is the instruction pointer register, which means that it contains the address of the instruction immediately following the current

Weird MIPS assembler behavior with jump (and link) instruction

给你一囗甜甜゛ 提交于 2019-11-28 12:16:22
So, we're studying MIPS architecture at school and we're implementing a MIPS32 architecture. I thought I'd use GNU cross-binutils as assembler but I'm getting weird output when dealing with instructions jal, j and jr. The assembler seems to insert the instructions at the wrong places. I have no idea why this happens, and I doubt the MIPS assembler would be that broken, so I assume this is supposed to happen. Here is my dummy assembly file: .section .text .globl __start __start: addi $a0, $0, 100 addi $a1, $0, 200 jal test test: add $v0, $a0, $a1 jr $ra However, when I disassemble I get this

What does a hexadecimal number, with a register in parenthesis mean in Assembly?

有些话、适合烂在心里 提交于 2019-11-28 11:46:55
问题 lea 0x1c(%ebp),%eax So, I understand vaguely what the lea instruction does, and I know those are registers, but what is this structure: 0x1c(%ebp) ? I got this code out of objdump. 回答1: It is one of the many x86 addressing modes. Specifically, this is referred to as "displacement" addressing. Since you said you used objdump and didn't specify that you used the -M flag, I'm going to assume this in the GAS syntax (as opposed to Intel syntax). This means that the first operand is the source, and

How do I determine the start and end of instructions in an object file?

只愿长相守 提交于 2019-11-28 11:13:29
问题 So, I've been trying to write an emulator, or at least understand how stuff works. I have a decent grasp of assembly, particularly z80 and x86, but I've never really understood how an object file (or in my case, a .gb ROM file) indicates the start and end of an instruction. I'm trying to parse out the opcode for each instruction, but it occurred to me that it's not like there's a line break after every instruction. So how does this happen? To me, it just looks like a bunch of bytes, with no

Could not load file or assembly 'AssemblyName PublicKeyToken=null' or one of its dependencies

瘦欲@ 提交于 2019-11-28 10:55:13
{"Could not load file or assembly 'AssemblyName, PublicKeyToken=null' or one of its dependencies. The located assembly's manifest definition does not match the assembly reference. (Exception from HRESULT: 0x80131040)":"AssemblyName, PublicKeyToken=null"} I'm getting the message in question as an InnerException.Message while trying to debug my application after signing the unsigned third-party assemblies it is using. The weird thing is that I have already signed the assembly shown in the message, the one that can't be loaded. What could the problem be here? How can I resolve this? EDIT Editing

Ida pro gragh output batch mode

情到浓时终转凉″ 提交于 2019-11-28 10:53:53
问题 Can anyone let me know how we are going to output all the subroutine's graphs in batch mode suing IDC . i.e. I have 447 subroutine's and wanna be output them all and I would like to make sure I first retrieve all the routines address automatically, cuz by knowing the address I can simply use GenFuncCall . P.S: Is this the only cfg that I can get from Ida Pro given a binary dis-assembled file? 回答1: If you just want the address of all known functions in the IDB, you could use something like

Methods to nail down 16 bit CRC/Checksum algorithm used by Windows CE executable?

泄露秘密 提交于 2019-11-28 10:23:22
I need to reverse engineer CRC/Checksum algorithm implemented by windows CE executable. Being propritory protocol, it does not say anything about CRC/checksum algorithm. However, There is console interface that reports correct/calculated checksum and I can construct my own messages with random bits if message protocol is correct: I have observed that, Changing single bit in message changes checksum bytes completely. Algorithm seems to be position dependent as I fed some single 1 bit messages in various message data positions with rest of the bits zero and all the time console reported