Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [functions]

A sequence of instructions performing a basic task packaged as a unit in a program.

0
votes
0answers
57 views

IDA - Find Function via Arguments

I am looking for a specific function. I have the header file of the Target, thus the function declaration. IDA seems to know the Arguments passed to a function, so how can I match the Arguments in the ...
2
votes
1answer
70 views

Batch rename functions knowing their prototypes in IDA Pro

I have a long list of mappings from IDA function names (sub_??????) to known function prototypes. The prototype is complete, I mean it contains the return type, the name as in the code and the ...
-1
votes
2answers
105 views

Is it possible to get the formula out of a blackbox using neural network

I have a so. library which I know the "C" interface but I don't have access to the source code only the disassembled code which is hard to understand at least for me. I know the input parameters (...
1
vote
1answer
73 views

Finding RegisterNatives function calls in JNI_OnLoad's assembly code

My goal is to see what a native method m does. It doesn't have a direct counterpart in the so file, but I've found the JNI_OnLoad function's ARM assembly code. It starts with AAAAAAAA <JNI_OnLoad@@...
0
votes
1answer
28 views

What is the difference between xrefs and stack trace?

In IDA, I can see what calls a specific function by looking at the xrefs to it, or by looking 1 step back on stack trace. What are the differences between them? How does IDA know what the stack ...
3
votes
2answers
74 views

IDA function never called and only cross-referenced as data

When I press the X key (list x-refs) on a function (sub_xyz) to see which functions call it, I only saw dd offset sub_xyz twice, with no call sub_xyz instructions. There is no another place that ...
5
votes
1answer
355 views

Why do many imported functions jump to addresses that do not contain instructions?

I am learning to analyze binaries using radare2 and have been confused about what occurs within imported functions. In the binary below, titled Lab2B, I statically disassembled the binary and then ...
1
vote
0answers
343 views

Tracing function calls in x64dbg

I'm new with x64dbg and want to know if there is any way to get the trace of a functions inside a module? I've used trace over option, but basically it just traces all the insturctions but doesn't "...
2
votes
2answers
170 views

IDA: call a function with different arguments

I'm reversing some software and found the function which decrypts some stuff: As you can see it has the password parameter for it which gets decrypted in this function. Function disassembly: ...
0
votes
2answers
96 views

Find functions that constantly calls another

Here is a list of all the places where this specific function gets called. What that function does is return 0.01666 from a pointer. That value is being used in the physics calculations of the game. ...
2
votes
2answers
301 views

Functions without a prologue and epilogue?

I was just wondering what exactly causes a function without a prologue/epilogue to be generated? If a program is compiled with just stdcall/cdecl convention, why is it that there are some calls which ...
0
votes
1answer
54 views

Help with animation function

I'm trying to find the function which is animating a bot ingame (singleplayer). I already figured out the animation state value with Cheat Engine. Freezing that value lets the bot repeat the animation ...
3
votes
1answer
363 views

Why most debuggers don't auto recognize functions?

may anyone explain to me why most of the debuggers don't auto recognize functions? This is a feature I only found in IDA and ollydbg, any other debugger I tried just don't analyze the functions as ...
1
vote
0answers
81 views

Why does IDA mark this as end of function?

I'm analyzing a .so file that is a part of an android application. I've stumbled upon this block of code: LOAD:0001B63C sub_1B63C ; CODE XREF: sub_1B628+Cp LOAD:...
2
votes
1answer
162 views

Why function names are visible in a decompiled iOS app?

While decompiling an iOS app, all function names and object names are visible. Why ? My guess is that during the build, function names are kept by the compilator to allow the linker to do its job. ...
5
votes
1answer
577 views

Radare2 doesn't display the whole function

I am using radare2, I have disassembled the function: sym.loop, it contains a switch witch has 4 cases that calls different functions. After any of the function call, the program exits the loop ...
0
votes
2answers
93 views

Function Address Changes When Gets Referenced elsewhere

i have been trying to get the address of a function and use that hex number for other calculations. I have read that you cannot get the address of a function like you get the address of a variable in ...
0
votes
0answers
198 views

How does IDA Pro work out where internal functions are?

My assumption is that it goes through the .text section (already knowing the ABI and expected calling convention) looking for any form of call opcode (call, bl, whatever) and then deduces that the ...
0
votes
0answers
343 views

Is there an option in IDA to track function arguments?

I would like to know if there is any option in IDA to track function arguments at least within that function? Assume in the beginning of the function arguments are stored in memory, afterwards they ...
1
vote
2answers
239 views

Why do I get different addresses for the printf function when I disassemble with otool?

I'm using otool on macOS to disassemble some simple C programs I built in order to gain a better understanding of assembly language. I disassembled three programs, all of which consist of a single ...
2
votes
1answer
180 views

IDA ignoring register changes in pseudocode

The Watcom compiler uses a fairly unusual calling convention, and IDA seems to be discarding some of the changes as irrelevant to its built-in pseudo-code. In my experience, that usually means I'm ...
1
vote
1answer
1k views

Call DLL export in OllyDBG

I am using OllyDbg 2.01 and I walked through this tutorial to figure out how Call DLL export works. Even though it was written for another version of OllyDBG it work just fine. We should notice, that ...
1
vote
2answers
1k views

Can I know which function from which dll was called at runtime?

I'm new to reverse engineering, I want to find out which command in the Source2 Engine's console invokes which function (and in which DLL). For that, I was wondering how can I know: which functions ...
0
votes
0answers
262 views

Reversing (well known) obfuscated ARM function

I am working quite some time on a binary which uses the below function. Furternatly the function should be well known, but I cannot seem to find the name of it. It takes a uchar* as input and somehow ...
0
votes
1answer
87 views

How is the first jmp skipped in plt entry

Whenever there is a call to a function of a dynamically linked library (0x400586 in the example at the end), the call first leads to a few lines in the .plt section, which in turn starts with a jmp to ...
2
votes
0answers
91 views

Restore function key

I have a simple function which looks like that: keyAlphabet = [-1, 16, 32, 127, 61, -32, -31, 43, 0, 88, 2, 5, 7, 112, 64, 69, 96] key = ??? # only keyAlphabet values p = 0x1337 for i in key: ...p*=i ...
0
votes
1answer
568 views

How to list parameter of function from IDA Pro? [duplicate]

I want to list parameter of function for analysis. Can I list the parameter of function using IDA Pro or IDAPython ?
0
votes
1answer
263 views

Mach-O functions pointer

I'm trying to understand how Mach-O files work, i already succeed with parsing of load commands, sections, symbols table etc.. anyway i'm trying to figure out a way to find class methods pointer to ...
5
votes
1answer
178 views

Wierd names in import table

I'm trying to do a static analysis of a PE file to see what it does. While doing so, I stumbled upon some really wierd function names in my objdump DLL Name: msvcrt.dll vma: Hint/Ord Member-Name ...
6
votes
2answers
402 views

reverse engineering methodology

I'm new to reverse engineering and I'm following the on line course provided by the opensecurity.info site. The author provides a methodology for reverse engineering. He recommends to find a function ...
0
votes
1answer
103 views

wsasend(disassemblied) function get parameters

Good Evening, currently, I am struggling around with a problem of getting the parameters of the wsasend function. The only parameter where found out something is this one: mov qword ptr ss:[rsp+60],...
0
votes
0answers
70 views

breaks on wsasend but not on wsaconnect

Good evening it's me again, I have found the address of the wsasend function where my program calls it. I have set a breakpoint on the function inside the ws2_32.dll and just checked the traceback ...
1
vote
2answers
144 views

Figure out whether a function has return value of not?

I am doing binary analysis on x86-64bit ELF binaries. All the binaries are compiled from C language. Basically, for a given function, I would like to figure out whether this function has a return ...
1
vote
1answer
2k views

How to find all functions in DLL

I'm looking for a way to get the addresses of all the functions in a DLL in the .text section. Is there a way to do it without using a disassembler and moving through the commands? How does IDA know ...
-1
votes
1answer
76 views

Computing function offset differences

When I'm trying to compute the difference between two functions loaded into memory: int _start(void) { // code } int _end(void) { // code } DWORD funcSize = (DWORD) _end - (DWORD) _start; ...
1
vote
1answer
275 views

Ida Pro compare constants in same function or not

How do I compare in IDA PRO if constants are located in the same functions or not.. like filter from all constants if I search for 2 constants or more I want to know which function(s) contain all the ...
2
votes
1answer
551 views

IDA Strings to Functions (ARM, Protected Functions)

I am working with an ARM (android apk: libgame.so) file that has protected functions (sub_xxxx, etc). The strings are supposed to have cross references with their function, but most of them reference ...
1
vote
0answers
359 views

DirectX calls not appearing

I'm trying to do some reverse-engineering to a DirectX 9 game. I've used PIX to see all the DirectX calls of the game, and that part worked correctly. After that, I wanted to know where in the code ...
0
votes
1answer
85 views

Understand what it looks like standard lib functions not properly identified by IDA Pro

I'm reverse engineering a piece of code that has hundreds of calls to a couple of functions I'm not exactly sure what they are doing but looks like standard library functions that do some byte reading?...
1
vote
0answers
43 views

IDA Pro monitor applications function calls [duplicate]

is there a function in IDA Pro to monitor all function calls of an application? So for example if I import an application into IDA it gives me functions like "sub_45E5C6", right? And now my question ...
4
votes
0answers
195 views

Implementing call into compiled, undocumented, C DLL; divining exported function prototype

I've been attempting to build my own implementation of Nvidia's Surround functionality by using their DLLs within a more reliable and automatic system. I'm pretty new to this; I've been a programmer ...
4
votes
2answers
231 views

How to force run a method triggered with a series of keys in a game?

This is my first time asking something on SE and I'll do the best I can to provide all of the required information, but I apologize in advance if I'm not clear enough. I'm trying to reverse engineer ...
2
votes
1answer
82 views

Where is the function cssyyparse code in webkit project? [closed]

Recently, I have viewed webkit source code and there is a function 'cssyyparse' which I cannot find c++ body code. Ther is only declaration of function cssyyparse. // CSSParser.cpp extern int ...
2
votes
0answers
158 views

Decoding A/C IR Codes

I captured infrared codes from an air conditioner remote to realize each code contains the entire state (i.e. temperature, mode, fan speed, etc.) every time a button is pressed. I believe this is so ...
3
votes
1answer
2k views

Which functions of a dll is called in OllyDBG

I`m beginner in OllyDBG. In the debugging of an exe file, I found which dll is used (kernel32, ntdl, user32, etc). I want to get a list of all functions of each dll that are called. How? Thanks a lot....
5
votes
1answer
3k views

Finding address from function name

By checking the human-readable strings in my target application, I found several interesting function names: ... DataIntegrityError GetObjectIdsOfDuplicateLinksErrors GetInvalidClusterIdsExists Main ...
1
vote
1answer
156 views

How to distinguish Functions boundaries, entry points and instructions in instruction trace

I have an instruction trace which is collected form a binary analysis platform and I already convert it to assembly instructions. I want to extract all functions and function calls in the file but ...
1
vote
1answer
141 views

Declaration of a complex C expression

I used IDA Pro and got the following expression from a produced C file: v25 = (*(int (**)(void))(v22 + 464))(); I am trying to figure out the meaning of the above expression with the following links:...
3
votes
0answers
1k views

Tracing function call args with IDA Pro

Right now I'm trying to place a trace point and hook it with the Python code that pulls all relevant stuff from the stack. Unfortunately it just gives me the garbage all the time, because the value in ...
2
votes
1answer
379 views

Strange function in IDA Pro: Only one basic block ending with a jmp sub_xxxxxx (instead of a ret)

Analyzing the ELF file /usr/bin/curl (Ubuntu 14.04, 64bit), I stumbled upon a strange function (see image). It is called regularly via call sub_403D90 but does not end with a ret. Instead, it jumps to ...