2

I have a question about reversing a tutorial which shows how to reverse engineering shellcode. My question is simple:

In figure 4, we see at (7) TEX.ProcessEnvironmentBlock: is this a comment, or was IDA able to figure this out? When I reverse engineer the same payload, I see

edx, fs:[eax, 30h]

And at (8) I see:

edx, [edx, 0Ch]

is my IDA set up not correct? I heard about hard coded vtable values(?) which have an integer identifier. Not sure if I am mixing up things at the moment, but is that what we are looking at?

1
  • 1
    that is not a comment the analyzer has added the structure peb and applied it to relevent offset go to structures tab insert peb structure abd right click on 0x30 ida should suggest the member
    – blabb
    Sep 14, 2022 at 15:32

1 Answer 1

1

The user has applied a structure field reference to that operand. To do the same yourself, place your cursor over the memory operand (i.e., [eax+30h]) and press T to bring up the list of possible structures to apply.

Two more notes. IDA knows about many structures, but you might have to do a few things before you're able to select them from the T window as described above. If you don't see the structure you want in that window:

  1. The first thing to try is to go to the structures window (Shift-F9 on Windows, or View -> Open subviews -> Structures) and press Insert to create a structure. Then select Add standard structure, and choose the one you want.

  2. If the structure you want doesn't appear in the window popped up by Add standard structure, you might have to load a type library first. Go to View -> Open subviews -> Type libraries, then right-click and select Load type library... to see the list that IDA has available.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.