Questions tagged [functions]

A sequence of instructions performing a basic task packaged as a unit in a program.

Filter by
Sorted by
Tagged with
0
votes
1answer
55 views

Converting rep movsd to to C without memcpy

So I am currently in the stages of creating binexact version of functions in decompiled code. I noticed that in this function the rep movsd is called and logically this is translated as Qmemcpy/memcpy ...
0
votes
1answer
66 views

Why some functions in IDA can't be searched

I don't know why but I noticed, on some program I am reversing, that in a section named .bss, there functions and I can't find them through the regular search, why is that. For example, I wanted to ...
0
votes
1answer
35 views

How to view the functions of a loaded library in x64dbg

I am working on a packed file with UPX. In one of the lines it calls to the value of the address 0xF5222C which is: 0x778057c0. The debugger auto-completes it to kernel32.LoadLibraryA. Where can I ...
0
votes
1answer
80 views

How to track output parameters in disassembly?

I have the following disassembly of winload!CmpFindNlsData function and I need to check the output parameters of this function. P.S.: CmpFindNLSData(int a1<eax>, int a2, PUNICODE_STRING ...
0
votes
1answer
183 views

Having hard time analyzing stripped code

This is my first time doing RE on a statically linked and stripped binary with ghidra. And I'm having a really hard time analyzing what function does what just by looking the decompiled code present ...
1
vote
0answers
76 views

Removing/bypassing a BIOS whitelist

I am trying to bypass or erase the BIOS whitelist on my Thinkpad T440p. So far I've used flashrom and a soic8 clip to dump the bios to a bios.img file made another dump and compared with diff bios....
0
votes
0answers
1k views

Reversing Pyarmor Discussion

Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what ...
0
votes
0answers
57 views

How to debug with gdb (rbreak) in order to obtain a callback to be used on C# interop

Well, I have several questions about this topic. I don't know if I'm using the right method to achieve what I need. I need to debug which exact method does something inside a process in order to ...
1
vote
1answer
343 views

Ghidra error when edit main signature function

I'm new to ghidra. I download the easy_reverse from crackme.one and open the executable file in ghidra. When I'm trying to edit the main function signature I get an error: Can't parse name: argv[]. I ...
1
vote
1answer
45 views

text_mn in Radare2 --> Meaning?

I compiled some source code and extracted functions with Radare2 (afj). Often I get a function with "sym..text_mn" function name/ symbol. The other functions are named correctly. What does this ...
0
votes
0answers
37 views

Find common functions in arm static binary

According to Detecting libc function with IDA I have static binary for arm and I want to find common function like fread sleep printf ioctl etc. When I looking for string in this binary I found glibc ...
0
votes
0answers
19 views

Understanding obscure function names [duplicate]

I have seen functions like this before in disassembly but don't have a clue what they are. Their names are extremely confusing. Would someone be able to explain what these are?
0
votes
1answer
237 views

Extracting functions of .obj file (compiled by myself with Visual Studio 19) --> extracts wrong data

How can I find only real functions not data garbage like section..debug_S_105 ? * I need to collect function data (assembler code) of Open Source C++ Files which I compile with Visual Studio 19 (sln ...
1
vote
1answer
121 views

How to extract static API sequences of a PE file?

How does one extract the static API sequences of a PE file? I don't mean the imports listed in the imports segment. I am currently using different RE tools like Ghidra, IDA Pro, and Binary Ninja. ...
0
votes
0answers
63 views

Add function to Export Address Table

I did reverse engineering through IDA Pro, but I needed to expand my function. Since there was no free space, I renamed the old function (using Hex-view) to avoid a match, created a new section (using ...
2
votes
1answer
266 views

Function's signature with unmatching parameters

I have following code disassembled by ghidra: PUSH EBX PUSH dword ptr [EBP + param_1] wchar_t * _Format for swprintf PUSH u_%s\%s_0040eb88 size_t ...
1
vote
2answers
144 views

Call function by ebp

When I looking at exe file with Ida I see call dword ptr [ebp -70p] What is that? Why this function calling by ebp and not call sub_0xabcd How can I know which function is that to enter to this ...
1
vote
1answer
1k views

Dump value of register using frida

I'm new with frida and came to this problem. I have dll that I want to reverse engeneer(there are no debug symbols). Specifically I want to dump some data from a function. So I have this big function ...
0
votes
1answer
98 views

'local call from' in x64dbg

In OllyDbg there was a thing called "local call from xxx,xxx,xxx,xxx ... " which helps me know from where a function is being called in the entire module. Does such a feature exist in x64dbg as well?
0
votes
1answer
387 views

Is it possible to call external functions?

I was wondering, assuming I wrote a dll in C++ and could access another application's memory, is it possible to call outside functions if I had the address?
3
votes
4answers
2k views

Is it possible to build an equivalent function just looking at the input and output of the original function?

Imagine you are reverse engineering a software. This software uses a library, which is obfuscated and encrypted. The library contains a function, lets call it secret_function. This function is a pure ...
1
vote
0answers
48 views

Is there a way to modify number of reads/writes to/from a memory address?

I haven't had any luck researching this, so I thought I would inquire here! Let's assume I have found a memory address housing a value of interest. Using a program like Cheat Engine, I look for ...
3
votes
3answers
1k views

How to see all functions that called with debugger

I debugging with IDA, and I want to see/print all the functions that get called. In the functions window I see over than 1000 functions. So I want to see which functions are called when I press ...
4
votes
3answers
2k views

Get interface definition of undocumented COM objects

I have started exploring COM objects, initially I got to it from UAC bypass methods but I guess my question is general. The general question is: How can I get from (elevated) CLSID in the registry to ...
2
votes
1answer
929 views

Batch rename functions knowing their prototypes in IDA Pro

I have a long list of mappings from IDA function names (sub_??????) to known function prototypes. The prototype is complete, I mean it contains the return type, the name as in the code and the ...
-1
votes
2answers
150 views

Is it possible to get the formula out of a blackbox using neural network

I have a so. library which I know the "C" interface but I don't have access to the source code only the disassembled code which is hard to understand at least for me. I know the input parameters (...
1
vote
1answer
994 views

Finding RegisterNatives function calls in JNI_OnLoad's assembly code

My goal is to see what a native method m does. It doesn't have a direct counterpart in the so file, but I've found the JNI_OnLoad function's ARM assembly code. It starts with AAAAAAAA <JNI_OnLoad@@...
0
votes
1answer
49 views

What is the difference between xrefs and stack trace?

In IDA, I can see what calls a specific function by looking at the xrefs to it, or by looking 1 step back on stack trace. What are the differences between them? How does IDA know what the stack ...
3
votes
2answers
277 views

IDA function never called and only cross-referenced as data

When I press the X key (list x-refs) on a function (sub_xyz) to see which functions call it, I only saw dd offset sub_xyz twice, with no call sub_xyz instructions. There is no another place that ...
5
votes
1answer
487 views

Why do many imported functions jump to addresses that do not contain instructions?

I am learning to analyze binaries using radare2 and have been confused about what occurs within imported functions. In the binary below, titled Lab2B, I statically disassembled the binary and then ...
1
vote
1answer
2k views

Tracing function calls in x64dbg

I'm new with x64dbg and want to know if there is any way to get the trace of a functions inside a module? I've used trace over option, but basically it just traces all the insturctions but doesn't "...
2
votes
2answers
840 views

IDA: call a function with different arguments

I'm reversing some software and found the function which decrypts some stuff: As you can see it has the password parameter for it which gets decrypted in this function. Function disassembly: ...
0
votes
2answers
134 views

Find functions that constantly calls another

Here is a list of all the places where this specific function gets called. What that function does is return 0.01666 from a pointer. That value is being used in the physics calculations of the game. ...
3
votes
2answers
1k views

Functions without a prologue and epilogue?

I was just wondering what exactly causes a function without a prologue/epilogue to be generated? If a program is compiled with just stdcall/cdecl convention, why is it that there are some calls which ...
0
votes
1answer
71 views

Help with animation function

I'm trying to find the function which is animating a bot ingame (singleplayer). I already figured out the animation state value with Cheat Engine. Freezing that value lets the bot repeat the animation ...
3
votes
1answer
418 views

Why most debuggers don't auto recognize functions?

may anyone explain to me why most of the debuggers don't auto recognize functions? This is a feature I only found in IDA and ollydbg, any other debugger I tried just don't analyze the functions as ...
1
vote
0answers
148 views

Why does IDA mark this as end of function?

I'm analyzing a .so file that is a part of an android application. I've stumbled upon this block of code: LOAD:0001B63C sub_1B63C ; CODE XREF: sub_1B628+Cp LOAD:...
2
votes
1answer
270 views

Why function names are visible in a decompiled iOS app?

While decompiling an iOS app, all function names and object names are visible. Why ? My guess is that during the build, function names are kept by the compilator to allow the linker to do its job. ...
5
votes
1answer
1k views

Radare2 doesn't display the whole function

I am using radare2, I have disassembled the function: sym.loop, it contains a switch witch has 4 cases that calls different functions. After any of the function call, the program exits the loop ...
0
votes
2answers
114 views

Function Address Changes When Gets Referenced elsewhere

i have been trying to get the address of a function and use that hex number for other calculations. I have read that you cannot get the address of a function like you get the address of a variable in ...
0
votes
2answers
521 views

Why do I get different addresses for the printf function when I disassemble with otool?

I'm using otool on macOS to disassemble some simple C programs I built in order to gain a better understanding of assembly language. I disassembled three programs, all of which consist of a single ...
2
votes
1answer
272 views

IDA ignoring register changes in pseudocode

The Watcom compiler uses a fairly unusual calling convention, and IDA seems to be discarding some of the changes as irrelevant to its built-in pseudo-code. In my experience, that usually means I'm ...
1
vote
1answer
3k views

Call DLL export in OllyDBG

I am using OllyDbg 2.01 and I walked through this tutorial to figure out how Call DLL export works. Even though it was written for another version of OllyDBG it work just fine. We should notice, that ...
1
vote
2answers
6k views

Can I know which function from which dll was called at runtime?

I'm new to reverse engineering, I want to find out which command in the Source2 Engine's console invokes which function (and in which DLL). For that, I was wondering how can I know: which functions ...
0
votes
1answer
248 views

How is the first jmp skipped in plt entry

Whenever there is a call to a function of a dynamically linked library (0x400586 in the example at the end), the call first leads to a few lines in the .plt section, which in turn starts with a jmp to ...
2
votes
0answers
123 views

Restore function key

I have a simple function which looks like that: keyAlphabet = [-1, 16, 32, 127, 61, -32, -31, 43, 0, 88, 2, 5, 7, 112, 64, 69, 96] key = ??? # only keyAlphabet values p = 0x1337 for i in key: ...p*=i ...
0
votes
1answer
1k views

How to list parameter of function from IDA Pro? [duplicate]

I want to list parameter of function for analysis. Can I list the parameter of function using IDA Pro or IDAPython ?
0
votes
1answer
446 views

Mach-O functions pointer

I'm trying to understand how Mach-O files work, i already succeed with parsing of load commands, sections, symbols table etc.. anyway i'm trying to figure out a way to find class methods pointer to ...
4
votes
1answer
245 views

Wierd names in import table

I'm trying to do a static analysis of a PE file to see what it does. While doing so, I stumbled upon some really wierd function names in my objdump DLL Name: msvcrt.dll vma: Hint/Ord Member-Name ...
5
votes
2answers
800 views

reverse engineering methodology

I'm new to reverse engineering and I'm following the on line course provided by the opensecurity.info site. The author provides a methodology for reverse engineering. He recommends to find a function ...