Questions tagged [functions]
A sequence of instructions performing a basic task packaged as a unit in a program.
102
questions
0
votes
1
answer
133
views
which command in windbg to use to display the struct in function argument
The struct looks like this.
typedef struct _RTL_DYNAMIC_HASH_TABLE_ENUMERATOR {
struct _RTL_DYNAMIC_HASH_TABLE_ENTRY HashEntry;
struct _LIST_ENTRY* CurEntry;
struct _LIST_ENTRY* ChainHead;
ULONG ...
- 121
0
votes
0
answers
50
views
How to reverse an import function?
I'm reversing windows .sys file and an import function RtlLookupEntryHashTable appears in my target functions. I want to know the pseudocode of it. How to achieve this?
.text:00000001C00218C2 ...
- 121
0
votes
1
answer
153
views
How to speed up finding a function from pseudocode in IDA?
I have a function with the pseudocode of
__int64 __fastcall sub_7FF7067A01F0(__int64 a1, __int64 a2, unsigned int a3)
{
if ( qword_7FF709F91498 )
return (*(__int64 (__fastcall **)(ID2D1Geometry *...
- 39
1
vote
1
answer
41
views
Calling a function with a variable number of args from a proxy DLL
The program I'm messing with has builtin logging. Using a proxy DLL, I managed to activate it by calling the right functions from the real DLL. However, I got stuck at using the actual logging ...
- 149
0
votes
0
answers
64
views
Finding function called when button is clicked
I am trying to find what function was called from the main application upon the button click in the specific game. In particular, there is a starting UI, where I can select Load option and then click ...
- 196
1
vote
1
answer
1k
views
How to define "code" variable type in Ghidra
Of all the confusing parts of Ghidra, I'd like to ask about the "code" keyword. A similar question was asked here. However, I am not asking what the keyword is, but how to interpret/define ...
- 21
1
vote
1
answer
94
views
I don't find the body of a function that I called in the main function
I have created a very simple x86 console program that uses Visual Studio 2019 compiler to sum 2 numbers just to see how is the program be after disassembly but I found something unclear to me.
// C++
#...
- 227
0
votes
1
answer
302
views
How do I find a function and find out what it does using reverse engineering?
I am attempting to find a function in a specific game. Is there any way that, using the assembly code I get from decompiling the game in either IDA or x64dbg, I can locate a function I am specifically ...
- 39
0
votes
0
answers
109
views
The way to determine how the decompiled constructor is structured
I have the following constructor decompiled by Ghidra, i.e. Game. I know some of the functions, which are part of that constructor. And thus I have created my interpretation of that structure. But I ...
- 196
0
votes
1
answer
69
views
Branching in arm assembly
This is an example assembly code:
function0()
0x0.mov r0, #1
0x8.mov r1, #20
0x10.mov r2, #6
0x18.cmp r1, #16
0x20.b function1
function1()
0x28.cmp r0, #1
0x30.b functionX
functionX(...
- 154
1
vote
0
answers
78
views
Function Arguments/Name on Radare and IDA
I am starting with reverse engineering and Radare and I'm facing the following problem, on IDA Free I see the following code:
mov ecx, 11h
lea edi, [esp+1208h+StartupInfo]
rep stosd
lea ...
- 11
1
vote
1
answer
223
views
does mov DWORD PTR 32[rsp], 5 means mov DWORD PTR [rsp+32], 5?
I am learning about windows x64 calling convention, where the first four arguments are passed to registers and left arguments are passed through the stack. To see it, I checked the assembly of the ...
- 45
0
votes
0
answers
88
views
finding a not-so-straightforward game's function
I am working on Mad Max game [ APEX engine ]
I do my best to explain the situation.
so my target executes function like this:
there are commands like " call [eax+XX] " or " call RX &...
- 11
0
votes
1
answer
724
views
main function not found in GCC compiled code
I'm trying to learn reverse engineering using Radare2.
For this I compiled a hello world program with GCC on Ubuntu (version: gcc (Ubuntu 9.3.0-17ubuntu1~20.04) 9.3.0).
#include <stdio.h>
int ...
- 3
0
votes
1
answer
128
views
Is it possible to make a dynamic memory allocated .data segment to static in a file?
Sorry if this is a dumb question I'm new to assembly.
Basically I want to modify a function in a .exe file to return with a different data, but my issue is that the memory location of the data segment ...
- 3
1
vote
2
answers
194
views
Cannot disassemble exported functions
I want to disassemble a function from Kernel32.dll to see what it does, but every single function I try looks like this in the decompiler:
Function:
jmp ds:Function_0
Where is the function? ...
- 111
0
votes
1
answer
56
views
Reverse engineering mode X VGA function(s)
I'm trying to reverse engineer an old DOS game. At the moment I'm stuck at a function that implements some functionality of VGA running in mode X. My issue is that any of the available sample codes on ...
- 57
0
votes
1
answer
283
views
Converting rep movsd to to C without memcpy
So I am currently in the stages of creating binexact version of functions in decompiled code. I noticed that in this function the rep movsd is called and logically this is translated as Qmemcpy/memcpy ...
- 763
0
votes
1
answer
193
views
Why some functions in IDA can't be searched
I don't know why but I noticed, on some program I am reversing, that in a section named .bss, there functions and I can't find them through the regular search, why is that.
For example, I wanted to ...
- 573
0
votes
1
answer
849
views
How to view the functions of a loaded library in x64dbg
I am working on a packed file with UPX.
In one of the lines it calls to the value of the address 0xF5222C which is: 0x778057c0.
The debugger auto-completes it to kernel32.LoadLibraryA.
Where can I ...
- 573
0
votes
1
answer
331
views
How to track output parameters in disassembly?
I have the following disassembly of winload!CmpFindNlsData function and I need to check the output parameters of this function.
P.S.: CmpFindNLSData(int a1<eax>, int a2, PUNICODE_STRING ...
- 17
0
votes
1
answer
856
views
Having hard time analyzing stripped code
This is my first time doing RE on a statically linked and stripped binary with ghidra. And I'm having a really hard time analyzing what function does what just by looking the decompiled code present ...
- 3
1
vote
0
answers
339
views
Removing/bypassing a BIOS whitelist
I am trying to bypass or erase the BIOS whitelist on my Thinkpad T440p. So far I've
used flashrom and a soic8 clip to dump the bios to a bios.img file
made another dump and compared with diff bios....
- 111
2
votes
0
answers
9k
views
Reversing Pyarmor Discussion
Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what ...
- 31
2
votes
1
answer
2k
views
Ghidra error when edit main signature function
I'm new to ghidra.
I download the easy_reverse from crackme.one and open the executable file in ghidra.
When I'm trying to edit the main function signature I get an error: Can't parse name: argv[].
I ...
- 141
1
vote
1
answer
55
views
text_mn in Radare2 --> Meaning?
I compiled some source code and extracted functions with Radare2 (afj).
Often I get a function with "sym..text_mn" function name/ symbol.
The other functions are named correctly. What does this ...
- 23
0
votes
0
answers
28
views
Understanding obscure function names [duplicate]
I have seen functions like this before in disassembly but don't have a clue what they are. Their names are extremely confusing. Would someone be able to explain what these are?
- 105
1
vote
1
answer
1k
views
Extracting functions of .obj file (compiled by myself with Visual Studio 19) --> extracts wrong data
How can I find only real functions not data garbage like section..debug_S_105 ? *
I need to collect function data (assembler code) of Open Source C++ Files which I compile with Visual Studio 19 (sln ...
- 23
1
vote
1
answer
423
views
How to extract static API sequences of a PE file?
How does one extract the static API sequences of a PE file? I don't mean the imports listed in the imports segment.
I am currently using different RE tools like Ghidra, IDA Pro, and Binary Ninja. ...
- 27
2
votes
1
answer
1k
views
Function's signature with unmatching parameters
I have following code disassembled by ghidra:
PUSH EBX
PUSH dword ptr [EBP + param_1] wchar_t * _Format for swprintf
PUSH u_%s\%s_0040eb88 size_t ...
- 45
2
votes
2
answers
541
views
Call function by ebp
When I looking at exe file with Ida I see
call dword ptr [ebp -70p]
What is that? Why this function calling by ebp and not call sub_0xabcd
How can I know which function is that to enter to this ...
1
vote
1
answer
3k
views
Dump value of register using frida
I'm new with frida and came to this problem.
I have dll that I want to reverse engeneer(there are no debug symbols). Specifically I want to dump some data from a function. So I have this big function ...
- 183
1
vote
1
answer
261
views
'local call from' in x64dbg
In OllyDbg there was a thing called "local call from xxx,xxx,xxx,xxx ... " which helps me know from where a function is being called in the entire module. Does such a feature exist in x64dbg as well?
- 163
0
votes
1
answer
1k
views
Is it possible to call external functions?
I was wondering, assuming I wrote a dll in C++ and could access another application's memory, is it possible to call outside functions if I had the address?
3
votes
4
answers
2k
views
Is it possible to build an equivalent function just looking at the input and output of the original function?
Imagine you are reverse engineering a software. This software uses a library, which is obfuscated and encrypted. The library contains a function, lets call it secret_function. This function is a pure ...
- 178
1
vote
0
answers
53
views
Is there a way to modify number of reads/writes to/from a memory address?
I haven't had any luck researching this, so I thought I would inquire here!
Let's assume I have found a memory address housing a value of interest. Using a program like Cheat Engine, I look for ...
- 2,194
3
votes
3
answers
3k
views
How to see all functions that called with debugger
I debugging with IDA, and I want to see/print all the functions that get called.
In the functions window I see over than 1000 functions.
So I want to see which functions are called when I press ...
- 513
4
votes
3
answers
3k
views
Get interface definition of undocumented COM objects
I have started exploring COM objects, initially I got to it from UAC bypass methods but I guess my question is general. The general question is: How can I get from (elevated) CLSID in the registry to ...
- 143
2
votes
1
answer
2k
views
Batch rename functions knowing their prototypes in IDA Pro
I have a long list of mappings from IDA function names (sub_??????) to known function prototypes. The prototype is complete, I mean it contains the return type, the name as in the code and the ...
- 123
-1
votes
2
answers
164
views
Is it possible to get the formula out of a blackbox using neural network
I have a so. library which I know the "C" interface but I don't have access to the source code only the disassembled code which is hard to understand at least for me.
I know the input parameters (...
- 21
1
vote
1
answer
1k
views
Finding RegisterNatives function calls in JNI_OnLoad's assembly code
My goal is to see what a native method m does. It doesn't have a direct counterpart in the so file, but I've found the JNI_OnLoad function's ARM assembly code. It starts with
AAAAAAAA <JNI_OnLoad@@...
- 121
0
votes
1
answer
76
views
What is the difference between xrefs and stack trace?
In IDA, I can see what calls a specific function by looking at the xrefs to it, or by looking 1 step back on stack trace.
What are the differences between them?
How does IDA know what the stack ...
- 49
4
votes
2
answers
663
views
IDA function never called and only cross-referenced as data
When I press the X key (list x-refs) on a function (sub_xyz) to see which functions call it, I only saw dd offset sub_xyz twice, with no call sub_xyz instructions.
There is no another place that ...
- 513
5
votes
1
answer
739
views
Why do many imported functions jump to addresses that do not contain instructions?
I am learning to analyze binaries using radare2 and have been confused about what occurs within imported functions. In the binary below, titled Lab2B, I statically disassembled the binary and then ...
- 225
3
votes
1
answer
7k
views
Tracing function calls in x64dbg
I'm new with x64dbg and want to know if there is any way to get the trace of a functions inside a module?
I've used trace over option, but basically it just traces all the insturctions but doesn't "...
- 183
2
votes
2
answers
1k
views
IDA: call a function with different arguments
I'm reversing some software and found the function which decrypts some stuff:
As you can see it has the password parameter for it which gets decrypted in this function.
Function disassembly:
...
- 183
0
votes
2
answers
152
views
Find functions that constantly calls another
Here is a brief list of all the places where this particular function gets called in IDA Pro.
What this function does is return 1/60=0.01666 (the game tick's timestep) from a pointer, which value is ...
3
votes
2
answers
2k
views
Functions without a prologue and epilogue?
I was just wondering what exactly causes a function without a prologue/epilogue to be generated? If a program is compiled with just stdcall/cdecl convention, why is it that there are some calls which ...
- 101
0
votes
1
answer
84
views
Help with animation function
I'm trying to find the function which is animating a bot ingame (singleplayer). I already figured out the animation state value with Cheat Engine. Freezing that value lets the bot repeat the animation ...
- 3
3
votes
1
answer
453
views
Why most debuggers don't auto recognize functions?
may anyone explain to me why most of the debuggers don't auto recognize functions?
This is a feature I only found in IDA and ollydbg, any other debugger I tried just don't analyze the functions as ...
- 295
Hot Network Questions
- When did Star Trek first start using low lights as a norm for red alert conditions?
- Accused of plagiarism in my master thesis, which I submitted two years ago. What now?
- What does "unsearchable" mean in "the unsearchable riches of Christ". Ephesians 3:8?
- Importance of PhD grade for future career in physics research?
- Could a supernova powered starship work/survive?
- When to use "the" in front of plural demonyms? "Americans" vs "the Americans" vs "the American people"?
- "Practical" use of time-continuous stochastic processes like Wiener process or Poisson (point) process?
- "Tidally locked" Oort Cloud object
- Are there any laws against either excessively loud motorcycles or riding such motorcycles inconsiderately in residential areas at night?
- Will installing European outlet in US change frequency to 50Hz?
- ESTABLISHED TCP connections after opening browser in linux
- Is it possible to write a character that remains mysterious until the very end without sacrificing character development?
- Unique number from digits 0123456789 with simple property
- Is Arcana the only profiency in 5e that locks something behind the *skill* profiency system?
- rsync the file `a`b
- How to run the execute method of Queueable Apex?
- Sci-Fi novel featuring space travel, time dilation, and civilization regression
- Should the y-axis on a survival plot go from 0 to 100 even if the lines are all above 0.9?
- Has the ICC ever tried to arrest any Western or pro-Western politician?
- Can bombs gain weapon runes?
- Who are the top 10 youngest players to reach a FIDE standard rating of 2200?
- The set of all possible values of subseries of a convergent positive term series
- How can I ensure anonymity with queries to small datasets?
- Is it a Frog List?