1

Cutter displays functions like this: enter image description here

I'm having trouble understanding the layout of the functions

For example: enter image description here

What does 184 mean? What does the green | mean at the beginning of each line? Why are there two jump instructions?

2

this query has got noting to do with Reverse Engineering

184 is the size of Function you can use afi to check what the function sizes are

[0x01012d6c]> afil
address    size  nbbs edges    cc cost  min bound range max bound  calls locals args xref frame name
========== ==== ===== ===== ===== ==== ========== ===== ========== ===== ====== ==== ==== ===== ====
0x01012d6c  626    43    62    23  290 0x0101217f 110918 0x0102deb2    19    6      3    0   112 entry0
[0x01012d6c]>

the green lines represent basic block boundaries / jumps to / jumps from etc

you can disable them with

e asm.lines = false

why two jumps who knows it is your binary may be it is handcrafted code you have to determine that

you can have n number of unconditional jumps one below other

supposing you have code like this

#include <stdio.h>
__declspec (naked) void foo(void) {
    goto jumphere;
    jumpthere:
    goto dowork;    
    jumphere:
    goto jumpthere;
    dowork:
    printf ("i came here after jumping through hoops\n");
}
void main(void){
foo();
}

if you disassemble foo() you can see jumps like you show on screenshot

[0x00401358]> af @0x401000
[0x00401358]> pdf @0x401000
            ;-- section..text:
/ (fcn) fcn.00401000 20
|   fcn.00401000 ();
|       ,=< 0x00401000      eb06           jmp 0x401008                ; [00] -r-x section size 249856 named .text
..
|      ||   ; CODE XREF from fcn.00401000 (0x401008)
|    ,.---> 0x00401004      eb04           jmp 0x40100a
..
|   |||||   ; CODE XREF from fcn.00401000 (0x401000)
|   ||```-> 0x00401008      ebfa           jmp 0x401004
|   ||      ; CODE XREF from fcn.00401000 (0x401004)
|   ``----> 0x0040100a      68a0e14300     push str.i_came_here_after_jumping_through_hoops ; 0x43e1a0 ; "i came here after jumping through hoops\n"
|           0x0040100f      e85c000000     call fcn.00401070
|           0x00401014      83c404         add esp, 4
\           0x00401017      cc             int3

[0x00401358]> e asm.lines= false

[0x00401358]> pdf @0x401000
;-- section..text:
(fcn) fcn.00401000 20
  fcn.00401000 ();
0x00401000      eb06           jmp 0x401008                            ; [00] -r-x section size 249856 named .text
..
; CODE XREF from fcn.00401000 (0x401008)
0x00401004      eb04           jmp 0x40100a
..
; CODE XREF from fcn.00401000 (0x401000)
0x00401008      ebfa           jmp 0x401004
; CODE XREF from fcn.00401000 (0x401004)
0x0040100a      68a0e14300     push str.i_came_here_after_jumping_through_hoops ; 0x43e1a0 ; "i came here after jumping through hoops\n"
0x0040100f      e85c000000     call fcn.00401070
0x00401014      83c404         add esp, 4
0x00401017      cc             int3
[0x00401358]>
  • In the functions section to the left there is a column called sized. The size of this function is listed as 5 in that column. How could 184 be the size? – Riker Mar 4 at 18:11
0

I don't know what the 184 means; perhaps you should scroll right the left pane to see if it appears there and what is the name of the column.

Regarding the pipes on the left, these are the arrows stretching from the functions that appear on top: these are just "lines" stretching down so you will be able to track the branches sources / destinations.

  • It does not appear in the column to the left. – Riker Mar 4 at 17:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.