Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [address]

The tag has no usage guidance.

0
votes
0answers
37 views

How to read a global variable declared in ntoskrnl.exe?

I found the following global variable in IDA declared in ntoskrnl.exe whose value I'd like to obtain (with image base set to 0): In a normal executable, I'd take a base address of it, add the offset ...
0
votes
1answer
49 views

multiple base addresses?

I'm quite new to reverse engineering and I'm currently trying things out on a game called Assault Cube. What I've done so far is finding offsets to my players health, ammo, name, etc.. When doing so I'...
4
votes
1answer
110 views

getting the static address/offset of a variable

I'm fairly new to reverse engineering at all and I'm currently struggling to get the static offset/address of a variable of a program I've written myself. So I've written the following program in C++,...
1
vote
2answers
91 views

How to refer to the same call on separate IDAs

When I open an .exe file in IDA, each time I get a different function address because each time I get a different base address offset. So if I open an .exe file with IDA and want to tell a friend "...
2
votes
1answer
60 views

Ida break point on address changed

How can I set break point when the value on specific address is changed while I debug it with ida
5
votes
1answer
185 views

Difference between 'readelf' and 'radare2' addresses

I have an MIPS binary file that I want to analyze. I am having a little trouble understanding the way elfread and r2 interpret the adressing scheme from a binary. For example, r2 finds a function ...
0
votes
1answer
73 views

Operand address in Capstone disassembly is not the same as in IDA/HIEW

I'm trying to disassembly x64 executable (dll) using Capstone. But operand address returned by it doesn't match disassembly from IDA/HIEW. Here is the machine code: 0x48, 0x8D, 0x0D, 0xED, 0x44, ...
0
votes
1answer
329 views

How do I find address of a global variable in Ollydbg?

I have the line CMP BYTE PTR DS:[EAX+1620], 0 How do I find the memory address of EAX+1620 so I can monitor it in ollydbg? I click it and nothing helpful comes up in the context box at the bottom of ...
1
vote
0answers
219 views

Base address and offsets [closed]

I've watched a video about finding out static addresses with pointers Here is an example: OFFSET 0 01DE15B4 OFFSET 14 01DE15D0 OFFSET 378 BASE ADDRESS> 01DE8058 and the person said, that ...
0
votes
0answers
437 views

Odd difference between IDA Pro and OllyDbg

I try to get some practice with RE but I am stuck on a problem. When I load my program with IDA the base address is: 0x400000 and the entry point is 0x401128. When I now load the program with ...
1
vote
1answer
67 views

Change sending IP of only certain executable

An executable that access the Internet uses my IP to do so. Is it be possible, with the help of a software or something like that, to change what IP an executable uses to access the Internet? Without ...
2
votes
2answers
110 views

Any tool for finding IP that a process use/access?

I need to extract the IP that a certain application is using to receive and/or send data, is there any tool or software that would do this for me ? or any simple way without needing to dig into the ...
0
votes
2answers
93 views

Function Address Changes When Gets Referenced elsewhere

i have been trying to get the address of a function and use that hex number for other calculations. I have read that you cannot get the address of a function like you get the address of a variable in ...
3
votes
4answers
635 views

Locate address of function in DLL

I need to locate the address of a function in a DLL at runtime which isn't exported. The DLL in question is vbe7.dll related to Visual Basic (and macros). The function is ___vbaInStr, can be found in ...
0
votes
2answers
236 views

Heap address Calculation

I can see in the windbg disassembly the handle to the process heap on, allocated by the Windows (WINDOWS 10) for my process: 0:000> dt nt!_PEB 0106c000 ntdll!_PEB +0x000 InheritedAddressSpace : ...
2
votes
1answer
135 views

Unknown variable from asm code

During translating some asm code into pseudocode I've found two variables: $rbp-0xb4 and $rbp-0xb8 function check_password(arg0) { var_18 = *0x28; //stack checksum? if (parse_cereal(var_D0, ...
7
votes
1answer
296 views

How make old IDA understand wrap-around mapped 68k RAM?

UPDATE 3: I learned that one way to do it is to simply make a new processor definition, it should be fairly straight forward to port already existing 68k disassemblers to the IDA SDK. Still too ...
0
votes
1answer
150 views

Whats going on in this Class Constructor?

meanwhile, I am learning more and more how to reverse engineer. Ive figured out tons of stuff already, but I came to the point, where I just need some little explanation whats going on in the ...
1
vote
1answer
98 views

Failure at finding the value of the dereferenced pointer

000007FEEC55CF58| 48 8D 0D F1 A7 0B 00 | lea rcx,qword ptr ds:[7FEEC617750] | ;7FEEC617750:"500117367" I see the above line in the ollyDBG which has the value of "500117367" according to the comment ...
1
vote
2answers
4k views

Return address on ESP?

I've read that the return address of a function call is always pushed on the ESP stack. But the thing when i tried to see that using gdb, I didn't find it. Here's the program written in C I've used : ...
5
votes
1answer
3k views

Finding address from function name

By checking the human-readable strings in my target application, I found several interesting function names: ... DataIntegrityError GetObjectIdsOfDuplicateLinksErrors GetInvalidClusterIdsExists Main ...
0
votes
0answers
361 views

Rva to raw file offset in PE [duplicate]

What is really correct translation algorithm to get an offset in portable executable file from relative virtual address of some byte in the image? I see next cases: RVA points into the header part ...
1
vote
1answer
2k views

IDA - How to transform VA to FO?

I'm using IDA Pro to disassemble/modify a PE file. How can I get the file offset in the '.exe' where a specific data/instruction resides. Or how can I get the file offset which is the source of a ...
2
votes
1answer
1k views

Changing start address of thread using combination of Get- and SetThreadContext?

I have the following assembly lines: PUSH 0 PUSH 4 ; CreationFlags = CREATE_SUSPENDED PUSH 0 PUSH program.0040163B ; start address of thread ...
1
vote
1answer
320 views

Cannot run game TERA crashes on mov dword ptr ds:[3],0Dh

My computer meets all the requirements to play this game, I even ran the tool that comes with this game and it passes all checks, even found my graphics card on the list. The game's URL is http://tera....
1
vote
2answers
594 views

Get the PE section address

I study an analysis paper about a trojan and there are the following assembly lines: .text:004010D0 Get_PE_section_address proc near .text:004010D0 .text:004010D0 arg_0 = dword ptr ...