Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I'd like to get all the addresses in the binary that some function is called from using PyDbg. The address of the function will be supplied as a parameter.
Do I have actually to scan all the code, looking for the call that is calling that function or is there a more elegant way?
Update:
The function is not exported or imported.
Update 2:
For example ImmDbg how can it find all the references and show them?
Since you want all the call instructions (and possibly fake calls using push and jmp and similar using opaque predicates) you won't get around static analysis (static-analysis) of the binary. And if the binary is in any way packed or encrypted that means you need to get through that layer first.
Igor's solution will be your best bet short of loading the file into a good disassembler and finding all the cross-references to the function you are interested in. But it has the limitation that Igor already pointed out.
Static analysis has to deal with a lot of ambiguities and issues when distinguishing data and code. But good disassemblers are fairly good at making the right guess and will offer to interactively mark items one way or the other in case of doubt.
What this means is that PyDbg is probably not the right tool for the problem at hand unless you manage to coerce it into making use of a proper full-fledged disassembler to get all cross-references. But the better choice is probably something like radare2 and then, if you are more familiar with PyDbg, applying the gained knowledge to the debugged target in PyDbg.
ESP - that would be the return address.This, obviously, will catch only the actual calls, not all potential ones.
