0

I've made a simple c++ program. In the ollydbg i searching for the string which is my name, there are 2-3 call functions near the string location but i don't know what those function do.

My question is is there a way to know what those function do? is it print function or maybe other function?

the program

  • Could you upload your program and the resulting executable? – bart1e Jun 11 at 15:21
  • added:)......... – Frd Jun 11 at 15:35
0

i searching for the string

Presumably "fffaaarrriiiddd." So we find ourselves at 0x401538, where the string is referenced.

there are 2-3 call functions near the string location... is is there a way to know what those function do? is it print function or maybe other function?

The first call after 0x401538, which is at 0x40154b and calls to 0x46ec30 is the print function. We know this because it gets the string as an argument (see x64 calling convention) and because the call is followed by the struct accesses, as we would expect.

The second call after 0x401538 is correctly identified as a call to getch (or possibly a wrapper function that jmp's to the imported DLL function).

The call before 0x401538, which is at 0x401538 and calls to 0x40e760, is less obvious. Because it is part of main but precedes the print function, which is the first call we expect based on the known functionality of main, I suspect it is just some sort of convention with which I am unfamiliar. Look at the disassembly at 0x40e760. What does that function do? Try compiling a binary with a no/different functionality. Is there always a call in main after the stack setup? Or are there always two calls for cout?

  • So we can assume if there is a string at above the call then the it's the print function?, what if there's no string? – Frd Jun 11 at 16:04
  • That's probably an oversimplification for which people could contrive counterexamples, but it's generally a good expectation. The print function has to get a value to print somehow. Looking at the arguments to the function, you will eventually trace one of them back to a string, even if it is less local to the call or indirected somehow. – devtty1er Jun 11 at 16:12
  • Let say i got another call function and no string at above the call function, how do i know what func it would be? – Frd Jun 11 at 16:37
  • The way I see it, the possible approaches for the general case are to 1) reverse engineer the functionality by looking at the disassembly/decompilation of the function in question -- this is called static analysis 2) if you have source code, you should be able to simply compile with debug symbols 3) if you have similar (or the same) source code, you could also use a tool like BinDiff 4) you could use dynamic analysis to match a function's behavior to the behavior of a known function. – devtty1er Jun 11 at 16:52
  • For this example, we used static analysis (1). Debug symbols (2) is certainly a valid approach, which you might already have for free -- I don't know if OllyDbg displays them. As @bart1e suggests, another tool, such as IDA, might make this approach easier. – devtty1er Jun 11 at 16:55
0

First and easy way is to open the resulting executable in IDA which will just show you the function names for library functions. IDA_analysis

Other still easy way is to just breakpoint before these function calls, step over these functions and observe the console output. You should be able to find at least cout this way. To do this in x64dbg, set up the breakpoint in the main function and keep clicking Run until you see it highlighted this way (that is EIP blue arrow in the same line as your breakpoint): x64dbgBreakpoint

Then, keep clicking Step over until EIP is pointing on the first function call. Look at the console and click Step over once again. You should see that nothing happened there. Do the same thing with the subsequent function and after stepping over it, you will see the string being printed in the console.

  • I tried to breakpoint before the function calls then step over the function but why i got dragged to other function (DbgUiRemoteBreakin) – Frd Jun 11 at 16:29
  • Are you sure that you used step over (not step into)? – bart1e Jun 11 at 16:29
  • Im pretty sure i clicked step over – Frd Jun 11 at 16:34
  • I've updated my answer to better explain this process. – bart1e Jun 11 at 16:48
  • Thanks bart1e :), i would likely to ask ur opinion, Let say i got another call function and no string at above the call function, how do i know what func it would be other than you mention above? – Frd Jun 11 at 17:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.