IDA Pro addresses of arguments

Question

I am a newbie in reverse engineering and I was trying to understand this blog post:

http://0x0atang.github.io/reversing/2015/09/17/flareon2-concolic.html

At one point, the author says the following when looking at the arguments of a function he wants to run using symbolic execution:

Let's zoom into and find out more about the function sub_401084. It takes three arguments, namely (1) address to a buffer of bytes at 0x4010E4, which is presumbly the reference key for verification, (2) address to a user input buffer at 0x402159, and (3) the length of the user password supplied to the program.

My question is, how does he figure out the addresses of the 3 arguments? In IDA pro you just have the stack view with the offsets with respect to EBP. I have tried to do this calculation but I don't get his values. Can anyone tell me how I should reason? Thank you!

Answer 1

He probably didn't : the executable is packed, ASLR is disabled and relocations are stripped. Which means the two address arguments 0x4010E4 and 0x402159 are fixed.

There are major consequences since :

• the first argument 0x4010E4 is sub_401000 ( sub_401084 caller) return address ! Since ASLR is disabled, this is a constant. You can see here :

• the second argument 0x402159 is a static buffer in the binary .data segment. Since relocations are stripped, this is also a constant.

In the general case (ASLR + reloc), it's much more complicated. There is a great SO/RE question about extractin functions args in Idapython which then must be glued with angr Memory states in order to work properly.