Questions tagged [address]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
6 votes
1 answer
6k views

Finding address from function name

By checking the human-readable strings in my target application, I found several interesting function names: ... DataIntegrityError GetObjectIdsOfDuplicateLinksErrors GetInvalidClusterIdsExists Main ...
  • 275
6 votes
1 answer
715 views

How make old IDA understand wrap-around mapped 68k RAM?

UPDATE 3: I learned that one way to do it is to simply make a new processor definition, it should be fairly straight forward to port already existing 68k disassemblers to the IDA SDK. Still too ...
5 votes
1 answer
819 views

Difference between 'readelf' and 'radare2' addresses

I have an MIPS binary file that I want to analyze. I am having a little trouble understanding the way elfread and r2 interpret the adressing scheme from a binary. For example, r2 finds a function ...
  • 53
4 votes
2 answers
6k views

IDA - How to transform VA to FO?

I'm using IDA Pro to disassemble/modify a PE file. How can I get the file offset in the '.exe' where a specific data/instruction resides. Or how can I get the file offset which is the source of a ...
  • 411
4 votes
1 answer
2k views

getting the static address/offset of a variable

I'm fairly new to reverse engineering at all and I'm currently struggling to get the static offset/address of a variable of a program I've written myself. So I've written the following program in C++,...
3 votes
2 answers
2k views

Any tool for finding IP that a process use/access?

I need to extract the IP that a certain application is using to receive and/or send data, is there any tool or software that would do this for me ? or any simple way without needing to dig into the ...
2 votes
2 answers
12k views

Return address on ESP?

I've read that the return address of a function call is always pushed on the ESP stack. But the thing when i tried to see that using gdb, I didn't find it. Here's the program written in C I've used : ...
2 votes
1 answer
2k views

Changing start address of thread using combination of Get- and SetThreadContext?

I have the following assembly lines: PUSH 0 PUSH 4 ; CreationFlags = CREATE_SUSPENDED PUSH 0 PUSH program.0040163B ; start address of thread ...
  • 1,501
2 votes
1 answer
530 views

Ida break point on address changed

How can I set break point when the value on specific address is changed while I debug it with ida
  • 513
2 votes
1 answer
175 views

Unknown variable from asm code

During translating some asm code into pseudocode I've found two variables: $rbp-0xb4 and $rbp-0xb8 function check_password(arg0) { var_18 = *0x28; //stack checksum? if (parse_cereal(var_D0, ...
  • 238
2 votes
1 answer
1k views

How to find offset to a function address from the base address in decompiled image (IDA or Ghidra)

Let's say there is a default base address for the application image on both IDA and Ghidra and it is equal to 140 000 000. If the function address is: 140 039 ea0 Does it mean that the offset from the ...
  • 166
2 votes
1 answer
464 views

How to make a reference to a different segment?

I am reverse engineering a very old LE MS-DOS binary and have convinced Ghidra that there are two segments in the file, one is the code segment and another one is the data segment. Now when I look ad ...
2 votes
1 answer
109 views

IDA - Rename Address/Function: Says name exists already but it does not show up anywhere

I am trying to rename a function address in IDA (free) and it says that the name I picked already exists in the database (Error Code: 8727B0) ... but the provided name does not show in the functions ...
  • 121
2 votes
4 answers
3k views

Locate address of function in DLL

I need to locate the address of a function in a DLL at runtime which isn't exported. The DLL in question is vbe7.dll related to Visual Basic (and macros). The function is ___vbaInStr, can be found in ...
2 votes
0 answers
291 views

calculate memory address from IDA to use with Frida

I saw an interesting value in IDA at address 0xf8766; I want to view the value at that address. I debug an Android application with Frida, how can I put this address in Frida to watch this value? I ...
  • 21
1 vote
1 answer
225 views

Failure at finding the value of the dereferenced pointer

000007FEEC55CF58| 48 8D 0D F1 A7 0B 00 | lea rcx,qword ptr ds:[7FEEC617750] | ;7FEEC617750:"500117367" I see the above line in the ollyDBG which has the value of "500117367" according to the comment ...
  • 609
1 vote
1 answer
355 views

Change sending IP of only certain executable

An executable that access the Internet uses my IP to do so. Is it be possible, with the help of a software or something like that, to change what IP an executable uses to access the Internet? Without ...
1 vote
2 answers
1k views

Get the PE section address

I study an analysis paper about a trojan and there are the following assembly lines: .text:004010D0 Get_PE_section_address proc near .text:004010D0 .text:004010D0 arg_0 = dword ptr ...
  • 1,501
1 vote
3 answers
723 views

Problems with relocation when unpacking

I'm trying to learn how to do basic unpacking EXEs. I've read into how the PE header works, sections, the IAT and I already know a fair bit about assembly. I started with compressing my simple x64....
1 vote
3 answers
1k views

In IDA, why are the addresses of instructions different from the corresponding locations in the original file? How do I find the file locations?

I noticed that if I found an instruction in IDA, the address shown to its left would be wildly different from where it appears in the actual file. I wanted to know why this was the case and how I can ...
1 vote
2 answers
858 views

Heap address Calculation

I can see in the windbg disassembly the handle to the process heap on, allocated by the Windows (WINDOWS 10) for my process: 0:000> dt nt!_PEB 0106c000 ntdll!_PEB +0x000 InheritedAddressSpace : ...
  • 153
1 vote
1 answer
321 views

How is the I/O address space on the PC arranged?

I'm disassembling a 16-bit DOS executable, and looking at the following three instructions: mov dx,0x3ce mov ax,0xff08 out dx,ax I know it writes the value 0xff08 to I/O port 0x3ce. I also know that ...
  • 258
1 vote
2 answers
97 views

How to refer to the same call on separate IDAs

When I open an .exe file in IDA, each time I get a different function address because each time I get a different base address offset. So if I open an .exe file with IDA and want to tell a friend "...
  • 513
1 vote
1 answer
395 views

Cannot run game TERA crashes on mov dword ptr ds:[3],0Dh

My computer meets all the requirements to play this game, I even ran the tool that comes with this game and it passes all checks, even found my graphics card on the list. The game's URL is http://tera....
1 vote
1 answer
64 views

How do I get the start address of the 'code section' and its size to know the end address?

I am trying to read the binary code in the text section of an executable game file (PE) programmatically but I don't know the start address and the end address of the text section. I am using C++/...
  • 197
1 vote
1 answer
430 views

How does Cheat Engine offset calculation work?

I have this memory address 0F58F478 and this offset 5C. I'm using memory sharp and it works perfectly when I'm adding this number. IntPtr address = _mSharp.Read<IntPtr>(0F58F478, false) + 0x5C; /...
  • 153
1 vote
1 answer
102 views

How to find the new address of a function on a new version of the same assembly with IDA?

Well, I have the old version of an assembly with a mapped address to a function I need to detour. The developer has stopped the reverse engineering to that assembly, so now, I want to do his job. But ...
  • 111
1 vote
1 answer
2k views

How to find out address in binary file (like IDA) with python code only?

I have binary for example https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/nmap that I open with IDA , and search some data that I want to find without open IDA ,only ...
1 vote
1 answer
584 views

multiple base addresses?

I'm quite new to reverse engineering and I'm currently trying things out on a game called Assault Cube. What I've done so far is finding offsets to my players health, ammo, name, etc.. When doing so I'...
1 vote
0 answers
59 views

Local KD -- can't access physical address 0xFFFFFFF0 but you can with RwEverything

I've never been able to access 0xf0000000 range using !db on local debug, and I've tried !db -m 00000000`fffffff0 and !db [uc] 00000000`fffffff0. I only get Physical memory read at fffffff0 failed. It ...
1 vote
1 answer
37 views

Confused about address being referenced

lea ebp, dword_403638 lea ebx, [ebp-4] mov edi, ss:[ebx] I understand the first instruction setting ebp to the address of the byte sequence. What I don't understand is what ebx will then ...
  • 13
1 vote
0 answers
210 views

IDA map one memory address to another

I am trying to reverse engineer firmware for an embedded device. The memory region 0xA0000000-0xA1FFFFFF is mapped to 0x80000000-0x81FFFFF. How do I setup ida to recognise this?
1 vote
0 answers
1k views

Base address and offsets [closed]

I've watched a video about finding out static addresses with pointers Here is an example: OFFSET 0 01DE15B4 OFFSET 14 01DE15D0 OFFSET 378 BASE ADDRESS> 01DE8058 and the person said, that ...
  • 121
1 vote
1 answer
978 views

Why address space is different for Ghidra, IDA and xDebug runtime and which one to use?

I have opened an executable with Ghidra, IDA and x64dbg (runtime). It seems that the address space in IDA and x64dbg is the same, but it is different from the one I see in Ghidra. When hooking through ...
  • 166
0 votes
1 answer
263 views

Operand address in Capstone disassembly is not the same as in IDA/HIEW

I'm trying to disassembly x64 executable (dll) using Capstone. But operand address returned by it doesn't match disassembly from IDA/HIEW. Here is the machine code: 0x48, 0x8D, 0x0D, 0xED, 0x44, ...
0 votes
1 answer
148 views

What is copy_block struct in Tricore Arch?

Recently I work on Tricore Arch to reverse an algorithm. But I had a problem to find a constant value(4 byte). the line of code shown below: ld32.w d4, [a0]-0x68D4 I know a0 = 0xD00032E0 but ...
  • 117
0 votes
2 answers
146 views

calculate branch target address powerpc

I want to know how next instruction address (NIA) is calculated for BL instruction. Lets assume that there is such instruction: .text:100004C8 BL sub_10000670. This command in hex is: 48 00 01 ...
  • 111
0 votes
2 answers
145 views

Function Address Changes When Gets Referenced elsewhere

i have been trying to get the address of a function and use that hex number for other calculations. I have read that you cannot get the address of a function like you get the address of a variable in ...
0 votes
1 answer
260 views

Whats going on in this Class Constructor?

meanwhile, I am learning more and more how to reverse engineer. Ive figured out tons of stuff already, but I came to the point, where I just need some little explanation whats going on in the ...
0 votes
1 answer
172 views

How can I use cutter like ida, trying to search by address

I'm new to reverse engineering and I'm trying to get into using a disassembler - I've been using reclass for a while now. I was looking at IDA Pro and that was 7k euros so that was not an option. I've ...
0 votes
1 answer
166 views

How to reference an address set by 2 instructions in Ghidra

I encountered the following 2 instructions while reversing Tricore assembly: These 2 instructions load the final address: 0x804A9474. Where a global symbol resides. Is there a way to hint Ghidra the ...
0 votes
1 answer
503 views

How do I find the address of /bin/bash within a binary?

With the following command be correct in the following sequence? gdb-peda -q binary break main info registers
  • 121
0 votes
1 answer
247 views

2 byte format string attacks

Protostar I was doing the protostar format string (3rd challenge). where we have to change the value of a variable target with format string buffer overflow. so, I came up to this medium article: ...
0 votes
2 answers
1k views

How to get address or symbol of the usage of a constant located in rodata?

I have an elf executable. I found a string (awesome string) in my .rodata section: $ mb-readelf -p 10 a.out String dump of section '.rodata': [ 0] Hello world ... [ ab12] awesome string ......
0 votes
0 answers
18 views

How do I find the address that was held by the variable?

gdb-peda$ info address not_used Symbol "not_used" is at 0x804a024 in a file compiled without debugging For example, I managed to do this. How will I know what is stored in the variable and ...
  • 121
0 votes
1 answer
925 views

How do I get all sections in a PE file using C++?

So I am wondering how can I get all sections and their info from a dumped PE file on the disk, using C++. I have the entire PE loaded on a buffer, the NT headers, and hopefully the DOS headers. I need ...
0 votes
1 answer
385 views

Can't find sequence of bytes in IDA while debugging

While debugging a program, I have an address 0011E028 in eax that points to another address: 680df44: I wanted to see what appear inside the address 680df44 so I go to Search > sequence of bytes......
  • 533
0 votes
1 answer
323 views

How i can grab a pointer or hook the process procedure without creating a global hook [closed]

i am trying to hook wndproc in an game, to do that i am injecting a dll into their memory, my problem is i don't wanna do a Global Hook to the wndproc, i want to get a pointer to his procedure to do ...
0 votes
1 answer
1k views

How do I find address of a global variable in Ollydbg?

I have the line CMP BYTE PTR DS:[EAX+1620], 0 How do I find the memory address of EAX+1620 so I can monitor it in ollydbg? I click it and nothing helpful comes up in the context box at the bottom of ...
0 votes
0 answers
1k views

Rva to raw file offset in PE [duplicate]

What is really correct translation algorithm to get an offset in portable executable file from relative virtual address of some byte in the image? I see next cases: RVA points into the header part ...
  • 131