Questions tagged [assembly]

Assembly language is a low-level programming language whose instructions map almost 1-to-1 to a computer's machine code.

Assembly language is a low-level programming language whose instructions map almost 1-to-1 to a computer's machine code.

When analyzing an executable whose source code is unknown (e.g. the payload of an attack), the analyst can use a tool called a disassembler. A disassembler translates the machine code instructions (the numbers that form the unknown code) to assembly language, helping the analyst to better understand what the code is doing.

Below is a simple example of what assembly code looks like. Although assembly code looks quite cryptic, all the words are names or abbreviations. The example is for the x86 family of processors.

CLC
MOV  AX, 5   
ADD  AX, [SI]
MOV  [SI], AX
82 questions
31
votes
3 answers

Why can't reverse engineering be automated?

I am still in college for a Computer Security degree and took my first assembly language based class last semester. We touched upon the subject of reverse engineering and why it is an important part of fighting malware and ill-wished…
PositriesElectron
  • 1,595
  • 1
  • 13
  • 17
31
votes
4 answers

I feel like it's impossible to learn reverse engineering

I know how to use most of the tools in Kali like msfvenom and msfconsole and I can safely call myself a script kiddie. I learned the basics of C# and that helps me understand some of the things in C, but I still get easily lost. I know the basics…
Nikolay Atanasov
  • 451
  • 1
  • 5
  • 10
27
votes
2 answers

What does EIP stand for?

There are a ton of questions on here that make reference to the eip: How can I partially overwrite the EIP in order to bypass ASLR? Unable to overwrite EIP register Do I always have to overwrite EIP to get to write on the stack in a buffer…
Athena
  • 373
  • 1
  • 3
  • 7
21
votes
3 answers

Is it possible to write shellcode in C++?

Usually I write assembly programs and then dump their contents to get the shellcode. What I was wondering is whether I could write a C++ program instead of assembly, then dump and use that instead of the assembly?
John Doe
  • 319
  • 2
  • 3
21
votes
4 answers

Processor microcode manipulation to change opcodes?

I had recently thought of an extreme way of implementing security by obscurity and wanted to ask you guys if it's possible. Would a person with no access to special processor documentation be able to change the CPU's microcode in order to obfuscate…
d33tah
  • 6,524
  • 8
  • 38
  • 60
17
votes
2 answers

How are code-branch side channel attacks mitigated on Java?

When you are working with secret keys, if your code branches unequally it could reveal bits of the secret keys via side channels. So for some algorithms it should branch uniformly independently of the secret key. On C/C++/Rust, you can use assembly…
Guerlando OCs
  • 405
  • 4
  • 14
12
votes
1 answer

How to detect suspicious content in a TrueType Font (.ttf) font file

I got curious about how to scan or assess the risk of a particular font file before deploying it to hosts. First line of defense, of course, is to make sure that our hosts are patched against any TrueType font vulnerabilities. I read the excellent…
mcgyver5
  • 6,807
  • 2
  • 24
  • 45
10
votes
1 answer

Intel SGX and MSRs - what do developers need to know?

Intel SGX is an intriguing new technology that will ship as part of upcoming Intel processors. It is designed to enable running software in a secure enclave. Code running in the enclave will be isolated by the hardware from untrusted code running…
D.W.
  • 98,420
  • 30
  • 267
  • 572
9
votes
1 answer

Better way to import Win32 APIs from injected shellcode

I'm injecting native x86 code into a .NET application, via a TLS callback in the binary image. Unfortunately, .NET executables only import mscorlib.dll within the PE, and have kernel32.dll mapped automatically into the memory space at runtime. I…
Polynomial
  • 132,208
  • 43
  • 298
  • 379
7
votes
1 answer

Why would legitimate programs have a `jmp esp` instruction?

It appears that a common exploit trick is to use stack overflow to overwrite the instruction pointer such that it points to a jmp esp instruction somewhere in the code segment which then executes the arbitrary code of the attacker's choice. However,…
1110101001
  • 231
  • 1
  • 5
7
votes
1 answer

ROP Programming/Exploitation on ARM - Gadget chain

Unfortunately, I cannot find this gadget in my libc.so. How can we reprogram this using different instructions: pop {r0, r1, r2, r3, pc} Which instructions will achieve the same? What gadgets I have to look for? It relates to this exploit # pivot…
dev
  • 937
  • 1
  • 8
  • 23
6
votes
1 answer

How to find stack pointer for overflow bug?

I've read that stack usually starts in same address so the attacker may guess the starting point of the buffer to overflow. This is necessary to know this address to make the malicious code run. I made a program with a few lines of code to get the…
user2808671
  • 127
  • 1
  • 9
6
votes
1 answer

Difference Between Binary Exploitation and Reverse Engineering?

I am a beginner in Reverse Engineering and am trying to improve my skill by participating in any CTF's I can and solving CrackMe's. I am trying to find out why Binary Exploitation and Reverse Engineering are always separated as two different…
bi0s.kidd0
  • 203
  • 2
  • 7
6
votes
1 answer

Curious about Microsoft "Buffer Security Check" implementation

A very quick background to help you answering my questions : Learning IDA Interactive Disassembler, the old free edition (too expensive for a hobbyist) 15 year Linux Sysadmin & DBA experience Hobbyist coder (C/ASM/Fortran/...) Not very…
ker2x
  • 163
  • 4
5
votes
1 answer

Fuzzer causes crash. Now what?

Can anyone point me in the direction of some good tutorials regarding how to identify the type of vulnerability as reported by !exploitable and where to go from there? Essentially I've got myself a small fuzzing lab setup and I'm trying to broaden…
Stev0
  • 163
  • 4
1
2 3 4 5 6