disassembly | 易学教程

Is there a way to prevent Reflector from being able to reflect my source code?

阅读更多关于 Is there a way to prevent Reflector from being able to reflect my source code?

问题 Is there a way (reliable and preferably not commercial) to prevent from Reflector to reflect my source code??? Thanks, Adi 回答1: No. Reflector looks at your assembly just like the .NET runtime would in order to generate native code to execute. The best you could hope for would be to obfuscate your code and make it (somewhat) harder for the reader to understand. Some pros and cons of performing the obfuscation can be found at Should you obfuscate a commercial .Net application? 回答2: There is no

Reverse Engineering old paint programs

阅读更多关于 Reverse Engineering old paint programs

问题 I've got a couple of really old MSDos based paint programs. They work on palette indexed image buffers. They have a number of spectacular shape drawing tools, brushes and effects that simply do not exist in any modern paint program- Particularly not whilst staying within the "bounds" of a low color palette indexed image. I would like to reproduce many of these wonderful tools in a modern program, to perhaps make them more accessible to myself and the general public again, without having to

How to disassemble a memory range with GDB?

阅读更多关于 How to disassemble a memory range with GDB?

I'm trying to disassemble a program to see a syscall assembly instruction (the INT instruction, I believe) and the handler with GDB and have written a little program (see below) for it that opens and closes a file. I was able to follow the call to fopen with GDB until it executed a call. When I tried to tell GDB "disassemble 0x...." (address of call) it responded with 'No function contains specified address.' Is it possible to force GDB to disassemble (or display it in assembler as good as possible) that memory address? If so, how? #include <stdio.h> #include <stdlib.h> int main() { FILE* f; f

Get size of assembly instructions

阅读更多关于 Get size of assembly instructions

I need to read instructions one-by-one from a small code segment in memory and I have to find out the size of the instructions which I have in memory. The following is just a example of raw disassembled code to explain my problem: (gdb) disas /r 0x400281,+8 Dump of assembler code from 0x400281 to 0x400289: 0x0000000000400281: 48 89 c7 movq %rax, %rdi 0x0000000000400284: b0 00 movb $0, %al 0x0000000000400286: e8 f2 48 00 00 callq 0x10001f30a End of assembler dump. I know the memory address of the first instruction (p = 0x0000000000400281 in this case) and I can read every memory address from p.

What is the meaning of “static synthetic”?

阅读更多关于 What is the meaning of “static synthetic”?

I am looking at some disassembled code obtained from Java bytecode. I see some declaration as follows: .method static synthetic access$0()Lcom/package/Sample; I am not able to figure out what the synthetic or access$0 mean. Can someone please help me understand this part? Johan Sjöberg Synthetic field , (2) A compiler-created field that links a local inner class to a block's local variable or reference type parameter. See also The JavaTM Virtual Machine Specification (§4.7.6) or Synthetic Class in Java . In the java language, inner classes can access private members of their enclosing class.

How to disassemble one single function using objdump?

阅读更多关于 How to disassemble one single function using objdump?

I've got a binary installed on my system, and would like to look at the disassembly of a given function. Preferrably using objdump , but other solutions would be acceptable as well. From this questions I've learned that I might be able to disassemble part of the code if I only know the boundary addresses. From this answer I've learned how to turn my split debug symbols back into a single file. But even operating on that single file, and even disassembling all the code (i.e. without start or stop address, but plain -d parameter to objdump ), I still don't see that symbol anywhere. Which makes

Generating CMOV instructions using Microsoft compilers

阅读更多关于 Generating CMOV instructions using Microsoft compilers

问题 In an effort to eke out some cmov instructions on an intel core 2 running windows 7 pro I wrote the code below. All it does is take a string from the console as input, apply some shift operations to generate a random seed, and then pass that seed on to srand, for the generation of a small array of pseudorandom numbers. The pseudorandom numbers are then evaluated for whether they satisfy the predicate function ( more arbitrary bitshuffling ), and output a '*' or a '_'. The purpose of the

Weird MIPS assembler behavior with jump (and link) instruction

阅读更多关于 Weird MIPS assembler behavior with jump (and link) instruction

问题 So, we're studying MIPS architecture at school and we're implementing a MIPS32 architecture. I thought I'd use GNU cross-binutils as assembler but I'm getting weird output when dealing with instructions jal, j and jr. The assembler seems to insert the instructions at the wrong places. I have no idea why this happens, and I doubt the MIPS assembler would be that broken, so I assume this is supposed to happen. Here is my dummy assembly file: .section .text .globl __start __start: addi $a0, $0,

Translation of machinecode into LLVM IR (disassembly / reassembly of X86_64. X86. ARM into LLVM bitcode)

阅读更多关于 Translation of machinecode into LLVM IR (disassembly / reassembly of X86_64. X86. ARM into LLVM bitcode)

I would like to translate X86_64, x86, ARM executables into LLVM IR (disassembly). What solution do you suggest ? mcsema is a production-quality binary lifter. It takes x86 and x86-64 and statically "lifts" it to LLVM IR. It's actively maintained, BSD licensed, and has extensive tests and documentation. https://github.com/trailofbits/mcsema Consider using RevGen tool developed within the S2E project . It allows converting x86 binaries to LLVM IR. The source code could be checked out from Revgen branch of GIT repository available by url https://dslabgit.epfl.ch/git/s2e/s2e.git . As regards to

How does GCC optimize out an unused variable incremented inside a loop?

阅读更多关于 How does GCC optimize out an unused variable incremented inside a loop?

问题 I wrote this simple C program: int main() { int i; int count = 0; for(i = 0; i < 2000000000; i++){ count = count + 1; } } I wanted to see how the gcc compiler optimizes this loop (clearly add 1 2000000000 times should be "add 2000000000 one time"). So: gcc test.c and then time on a.out gives: real 0m7.717s user 0m7.710s sys 0m0.000s $ gcc -O2 test.c and then time on a.out` gives: real 0m0.003s user 0m0.000s sys 0m0.000s Then I disassembled both with gcc -S . First one seems quite clear: .file