Questions tagged [call]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
168 views

Calling imported DLL functions from an injected DLL?

If I have injected my own DLL into an executable (a game specifically) which imports a DLL to draw its graphics, camera, etc. How can I go about calling the DLLs functions? I'm able to find the ...
0
votes
1answer
34 views

What is the difference between xrefs and stack trace?

In IDA, I can see what calls a specific function by looking at the xrefs to it, or by looking 1 step back on stack trace. What are the differences between them? How does IDA know what the stack ...
3
votes
2answers
1k views

What does XREF mean?

I have been learning about the x86 assembly language by analyzing a binary using radare2 that is stored on a Intel 80386 machine. When I have been analyzing functions on the binary, I noticed that "...
0
votes
1answer
439 views

Calling internal functions via dll injection - runtime error

I am trying to modify closed source game client that works with my game server. The purpose of that is being able to add new graphical elements into the client. I have read a lot of tutorials about ...
0
votes
1answer
296 views

Idenifying far call target in protected mode (x86 assembly)

I am currently analysing a regular Windows x86 executable (-> protected mode) and I came across several far call instructions in the disassembly. I know that far calls, for example, are used in WOW64 ...
0
votes
1answer
852 views

IDA - call dword ptr [mana+0Ch] - Where is it pointing to?

Pseudo Code: (*((void (__cdecl **)(_DWORD, _DWORD))cr->baseclass_0.Skills[1]->_vptr.TSkill + 3))(cr->baseclass_0.Skills[1], Mana); IDA Assembly Code: .text:0807EC41 call ...
3
votes
0answers
599 views

GNU Assembler - Tricore - how to set origin?

I have a compiled Tricore binary that I am patching. By creating a .asm file from IDA Pro of a function and reformatting it, I can get it to reassemble faithfully apart from call (relative) and jump (...
0
votes
3answers
321 views

What exactly is this piece of assembly code doing?

This assembly is for Intel x86-64 bit, seems to be too baffling to me. How come the jz instruction jump to a non-instruction (0x400AC9)? How come the call invokes a non-existing address? For curious ...
2
votes
1answer
343 views

How do I call a statically imported function from a Dll? call dword ptr ds <> not working

Disclaimer: I am relatively new to this whole RE thing. So I successfully crammed some instructions into the end of an existing DLL and redirected a call. Now I actually want to do things with a ...
0
votes
2answers
1k views

Intel syntax - Meaning of jmp/call instruction with $+5 operand

I'm currently parsing a lot of assembly files and don't understand a specific jmp or call with $+5 as operand: call $+5 jmp $+5 To provide more context I grepped some of the occurrences: mov esp, [...
0
votes
2answers
267 views

Call instruction - preceding ?@_ in references?

Seems to be a question of no importance, but I'm just curious: Is there a deeper meaning of the preceeding (single/double) ?-marks, @-signs or __ underscores in these different call instructions? ...
1
vote
0answers
495 views

DirectX calls not appearing

I'm trying to do some reverse-engineering to a DirectX 9 game. I've used PIX to see all the DirectX calls of the game, and that part worked correctly. After that, I wanted to know where in the code ...
4
votes
1answer
537 views

mov ecx, arg - How to replicate in C++?

I frequently see code formatted like this: push arg push arg (...) mov ecx, arg call function If I need to call that function in Assembly, it's fine. But since I know how to consistently get the ...
0
votes
1answer
617 views

Is it possible to trace data without adding a break point?

I'm using IDA Pro and trying to analyze a parameter passed to a function call. Problem is, when i add a breakpoint on function address to see what values are being passed , the application crashes. Is ...
1
vote
1answer
1k views

How to extract a function call graph from IDA's Pro disassembled file (.asm file)?

I am totally new to reverse engineering science and does not know much about the assembly language. By the way, I am working on a data set of disassembled malicious files available at kaggle. These ...
2
votes
1answer
530 views

Using GetProcAddress with offset syntax

I have the following line (I use IDA PRO) : ... push (offset aPstorec_dllwne+0Ch) ; lpProcName push esi ; hModule call GetProcAddress_0 ... When I ...