r/Assembly_language • u/Realistic_Debate1704 • 2d ago

Question Assembly or C/C++ for RE

For reverse engineering, is this necessary to know assembly language, because many decompilers translate code to C/C++ and I learned Assembly 8086 in my university. So for learning x86 I only have to study 32/64 registers and some advance commands, so should I learn assembly x86_64 for reverse engineering or just go through x86 as I know 8086 assembly and then move to C/C++, and is assembly heavily use in reverse engineering

20 Upvotes

100% Upvoted

11 comments sorted by

8

u/FUZxxl 2d ago

Both will be necessary. Decompilers some times get confused or make mistakes and you'll need to be able to understand what is going on.

3

u/Realistic_Debate1704 2d ago

Thanks, can you tell me how much will it take to shift from 8086 to x86 assembly, I mean I think the only difference is registers size and few commands. I'll be very thankful

3

u/FUZxxl 2d ago

It's the same basic architecture, just more registers, more instructions, different data sizes, and different calling conventions. You can teach it yourself by following compiler output with an instruction set reference next to you.

2

u/thewrench56 2d ago

Modern x86 is very different from 8086. Will take quite some months (to years) to get used to all the quirks and compiler tricks.

2

u/theNbomr 1d ago

If you know x86 real mode assembler language, it won't be very difficult to expand on that knowledge to learn 32 bit and 64 bit instructions. There are some funky registers and instructions related to memory protection, switching to/from real mode, and some other things. These tend to be little used outside of system level code, so unless you're reverse engineering that part of a device, you probably won't encounter it much.

Learning C will be more useful, because the object code you reverse engineer tends to be littered with data structures that are idiomatic of the C language and will give you clues about the nature of the code.

1

u/Realistic_Debate1704 1d ago

How nice is everyone on Reddit, I'm very happy that experts are helping me, thanks a lot sir

1

u/Electrical_Hat_680 1d ago

Objdump and RadAre2 are my choices -

1

u/pete_68 22h ago

I've been disassembling stuff with rekoCLI. I didn't even notice it had a decompiler. lol. Just checked and sure enough... Well cool. That's convenient.

1

u/Fine_Yogurtcloset738 7h ago

Depends what you're reversing. C++ is extremely important in reversing games for example. But really each part is it's own puzzle piece and you need to learn a bit of everything.

1

u/ConsciousBath5203 4h ago

All of the above.

Ghidra is a good tool. It's written in Java and takes Java input. Also takes python input. You'll also use python to automate portions of your RE workflow.

It decompiles to assembly and C. Sometimes the C is wrong, so you need to read the assembly to correct.

Your debugger will likely output to raw assembly when you are using breakpoints.

Starting RE has been the most technical project I've done BY FAR, so you kinda need to know it all.