Skip to main content
deleted 9 characters in body; edited title
Source Link
0xC0000022L
  • 10.9k
  • 9
  • 41
  • 79

Find Retdec Address Range in x64dbfx64dbg

How do I find this function from retdec (https://github.com/avast/retdecRetDec) in x64dbg?

// Address range: 0x1017dba0 - 0x1017dbda
int32_t function_1017dba0(int32_t * a1) {
    int32_t fileHandle = (int32_t)CreateFileA("\\\\.\\SntnlUsb", -0x40000000, 3, NULL, 3, 128, NULL); // 0x1017dbb7
    g2 = fileHandle;
    *(int32_t *)-0x40000000 = fileHandle;
    int32_t v1 = g2; // 0x1017dbc3
    int32_t v2 = v1 == -1 ? 0x1c0b : 0x1c00; // 0x1017dbce
    g5 = v2;
    int32_t result = v2 | v1 & -0x10000; // 0x1017dbd4
    g2 = result;
    return result;
}

My address is x64 debug are only going up to 01002FFE. I have no idea how to find this function when the dll is loaded into x64dbg.

Cheers

Find Retdec Address Range in x64dbf

How do I find this function from retdec (https://github.com/avast/retdec) in x64dbg?

// Address range: 0x1017dba0 - 0x1017dbda
int32_t function_1017dba0(int32_t * a1) {
    int32_t fileHandle = (int32_t)CreateFileA("\\\\.\\SntnlUsb", -0x40000000, 3, NULL, 3, 128, NULL); // 0x1017dbb7
    g2 = fileHandle;
    *(int32_t *)-0x40000000 = fileHandle;
    int32_t v1 = g2; // 0x1017dbc3
    int32_t v2 = v1 == -1 ? 0x1c0b : 0x1c00; // 0x1017dbce
    g5 = v2;
    int32_t result = v2 | v1 & -0x10000; // 0x1017dbd4
    g2 = result;
    return result;
}

My address is x64 debug are only going up to 01002FFE. I have no idea how to find this function when the dll is loaded into x64dbg.

Cheers

Find Retdec Address Range in x64dbg

How do I find this function from RetDec in x64dbg?

// Address range: 0x1017dba0 - 0x1017dbda
int32_t function_1017dba0(int32_t * a1) {
    int32_t fileHandle = (int32_t)CreateFileA("\\\\.\\SntnlUsb", -0x40000000, 3, NULL, 3, 128, NULL); // 0x1017dbb7
    g2 = fileHandle;
    *(int32_t *)-0x40000000 = fileHandle;
    int32_t v1 = g2; // 0x1017dbc3
    int32_t v2 = v1 == -1 ? 0x1c0b : 0x1c00; // 0x1017dbce
    g5 = v2;
    int32_t result = v2 | v1 & -0x10000; // 0x1017dbd4
    g2 = result;
    return result;
}

My address is x64 debug are only going up to 01002FFE. I have no idea how to find this function when the dll is loaded into x64dbg.

Bumped by Community user
Bumped by Community user
Bumped by Community user
Source Link
Kuzon
  • 111
  • 2

Find Retdec Address Range in x64dbf

How do I find this function from retdec (https://github.com/avast/retdec) in x64dbg?

// Address range: 0x1017dba0 - 0x1017dbda
int32_t function_1017dba0(int32_t * a1) {
    int32_t fileHandle = (int32_t)CreateFileA("\\\\.\\SntnlUsb", -0x40000000, 3, NULL, 3, 128, NULL); // 0x1017dbb7
    g2 = fileHandle;
    *(int32_t *)-0x40000000 = fileHandle;
    int32_t v1 = g2; // 0x1017dbc3
    int32_t v2 = v1 == -1 ? 0x1c0b : 0x1c00; // 0x1017dbce
    g5 = v2;
    int32_t result = v2 | v1 & -0x10000; // 0x1017dbd4
    g2 = result;
    return result;
}

My address is x64 debug are only going up to 01002FFE. I have no idea how to find this function when the dll is loaded into x64dbg.

Cheers