/g/ - Programm decompilation analysis - Technology

rain

Programm decompilation analysi(...) 05/11/26(Mon)19:25:28 No.108803249

File: Photos_G8tOnXZJEA.png (703 KB, 1157x606)

Programm decompilation analysis rain 05/11/26(Mon)19:25:28 No.108803249 Archived

How the heck do I find a specific call (like a value comparison) in a reversed engineered app's assembly with x64dbg?

It's getting too similar to look at assembly ¬_¬

Anonymous
05/11/26(Mon)19:32:18 No.108803288

Anonymous 05/11/26(Mon)19:32:18 No.108803288

File: 1740712817740973.png (237 KB, 980x750)

237 KB PNG

>>108803249
>It's getting too similar to look at assembly ¬_¬
that's because it IS assembly dumb cunt
>also
if you don't like staring at ASM. Then download ghidra and get to it

Anonymous
05/11/26(Mon)19:35:45 No.108803306

Anonymous 05/11/26(Mon)19:35:45 No.108803306

>>108803249
>call?
Depends, comparisons are done with cmp, or test, but you are probably looking for a memory comparison. IDK. Also a comparison can be any registers against any other register or memory operand, or immediate value.

Anonymous
05/11/26(Mon)22:18:27 No.108804069

Anonymous 05/11/26(Mon)22:18:27 No.108804069

>>10880324
just use ghidra

Anonymous
05/11/26(Mon)23:27:52 No.108804315

Anonymous 05/11/26(Mon)23:27:52 No.108804315

>>108803249
I feed all this crap into claude and it finds what I'm looking for then I change it

Anonymous
05/12/26(Tue)01:21:54 No.108804761

Anonymous 05/12/26(Tue)01:21:54 No.108804761

>>108803249
use ghidra/ida.
you can scan for instruction patterns and it shows xrefs by default

unless you pay for ida's cloud there's not much reason to use it over ghidra.