1

How do I find this function from RetDec in x64dbg?

// Address range: 0x1017dba0 - 0x1017dbda
int32_t function_1017dba0(int32_t * a1) {
    int32_t fileHandle = (int32_t)CreateFileA("\\\\.\\SntnlUsb", -0x40000000, 3, NULL, 3, 128, NULL); // 0x1017dbb7
    g2 = fileHandle;
    *(int32_t *)-0x40000000 = fileHandle;
    int32_t v1 = g2; // 0x1017dbc3
    int32_t v2 = v1 == -1 ? 0x1c0b : 0x1c00; // 0x1017dbce
    g5 = v2;
    int32_t result = v2 | v1 & -0x10000; // 0x1017dbd4
    g2 = result;
    return result;
}

My address is x64 debug are only going up to 01002FFE. I have no idea how to find this function when the dll is loaded into x64dbg.

  • Where did you get that function? You can just search for the string SntnlUsb. – Biswapriyo Sep 22 '19 at 14:41
  • @Biswapriyo I got it from decompiling it with RetDec, but I don't know how to find it in x64dbg – Kuzon Sep 22 '19 at 15:02
  • @Biswapriyo I also want to be able to find functions that don't have strings in them, could I use the memory address somehow? – Kuzon Sep 22 '19 at 15:12
1

i assume retdec loaded the binary at preferred ImageBase while x64dbg relocated the binary to Some Other BaseAddress or maybe it viceversa

if that is the case find the Loaded Base Address in Retdec and subtract it from the given address

that is if Retdec Loaded it at 0x10000000
then subtract that from 0x1017dba0
you get a difference of 17dba0

add this difference to Base Address in X64dbg

that is assuming x64dbg loaded it at 0x400000 then add 17dba0 to it and make it 57dba0

this is where the same function will be available

| improve this answer | |
  • 1
    Small correction: Windows is relocating, x64dbg just shows the result. – mrexodia Sep 23 '19 at 21:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.