Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

A sequence of instructions performing a basic task packaged as a unit in a program.

1
vote
1answer
50 views

Finding RegisterNatives function calls in JNI_OnLoad's assembly code

My goal is to see what a native method m does. It doesn't have a direct counterpart in the so file, but I've found the JNI_OnLoad function's ARM assembly code. It starts with AAAAAAAA <JNI_OnLoad@@...
0
votes
1answer
26 views

What is the difference between xrefs and stack trace?

In IDA, I can see what calls a specific function by looking at the xrefs to it, or by looking 1 step back on stack trace. What are the differences between them? How does IDA know what the stack ...
3
votes
2answers
60 views

IDA function never called and only cross-referenced as data

When I press the X key (list x-refs) on a function (sub_xyz) to see which functions call it, I only saw dd offset sub_xyz twice, with no call sub_xyz instructions. There is no another place that ...
5
votes
1answer
345 views

Why do many imported functions jump to addresses that do not contain instructions?

I am learning to analyze binaries using radare2 and have been confused about what occurs within imported functions. In the binary below, titled Lab2B, I statically disassembled the binary and then ...
1
vote
0answers
216 views

Tracing function calls in x64dbg

I'm new with x64dbg and want to know if there is any way to get the trace of a functions inside a module? I've used trace over option, but basically it just traces all the insturctions but doesn't "...
2
votes
2answers
130 views

IDA: call a function with different arguments

I'm reversing some software and found the function which decrypts some stuff: As you can see it has the password parameter for it which gets decrypted in this function. Function disassembly: ...
0
votes
2answers
95 views

Find functions that constantly calls another

Here is a list of all the places where this specific function gets called. What that function does is return 0.01666 from a pointer. That value is being used in the physics calculations of the game. ...
2
votes
2answers
274 views

Functions without a prologue and epilogue?

I was just wondering what exactly causes a function without a prologue/epilogue to be generated? If a program is compiled with just stdcall/cdecl convention, why is it that there are some calls which ...
0
votes
1answer
54 views

Help with animation function

I'm trying to find the function which is animating a bot ingame (singleplayer). I already figured out the animation state value with Cheat Engine. Freezing that value lets the bot repeat the animation ...
3
votes
1answer
357 views

Why most debuggers don't auto recognize functions?

may anyone explain to me why most of the debuggers don't auto recognize functions? This is a feature I only found in IDA and ollydbg, any other debugger I tried just don't analyze the functions as ...
1
vote
0answers
77 views

Why does IDA mark this as end of function?

I'm analyzing a .so file that is a part of an android application. I've stumbled upon this block of code: LOAD:0001B63C sub_1B63C ; CODE XREF: sub_1B628+Cp LOAD:...
2
votes
1answer
144 views

Why function names are visible in a decompiled iOS app?

While decompiling an iOS app, all function names and object names are visible. Why ? My guess is that during the build, function names are kept by the compilator to allow the linker to do its job. ...
4
votes
1answer
484 views

Radare2 doesn't display the whole function

I am using radare2, I have disassembled the function: sym.loop, it contains a switch witch has 4 cases that calls different functions. After any of the function call, the program exits the loop ...
0
votes
2answers
92 views

Function Address Changes When Gets Referenced elsewhere

i have been trying to get the address of a function and use that hex number for other calculations. I have read that you cannot get the address of a function like you get the address of a variable in ...
0
votes
0answers
184 views

How does IDA Pro work out where internal functions are?

My assumption is that it goes through the .text section (already knowing the ABI and expected calling convention) looking for any form of call opcode (call, bl, whatever) and then deduces that the ...
0
votes
0answers
309 views

Is there an option in IDA to track function arguments?

I would like to know if there is any option in IDA to track function arguments at least within that function? Assume in the beginning of the function arguments are stored in memory, afterwards they ...
0
votes
2answers
205 views

Why do I get different addresses for the printf function when I disassemble with otool?

I'm using otool on macOS to disassemble some simple C programs I built in order to gain a better understanding of assembly language. I disassembled three programs, all of which consist of a single ...
2
votes
1answer
161 views

IDA ignoring register changes in pseudocode

The Watcom compiler uses a fairly unusual calling convention, and IDA seems to be discarding some of the changes as irrelevant to its built-in pseudo-code. In my experience, that usually means I'm ...
1
vote
1answer
1k views

Call DLL export in OllyDBG

I am using OllyDbg 2.01 and I walked through this tutorial to figure out how Call DLL export works. Even though it was written for another version of OllyDBG it work just fine. We should notice, that ...
0
votes
2answers
953 views

Can I know which function from which dll was called at runtime?

I'm new to reverse engineering, I want to find out which command in the Source2 Engine's console invokes which function (and in which DLL). For that, I was wondering how can I know: which functions ...
0
votes
0answers
240 views

Reversing (well known) obfuscated ARM function

I am working quite some time on a binary which uses the below function. Furternatly the function should be well known, but I cannot seem to find the name of it. It takes a uchar* as input and somehow ...
0
votes
1answer
71 views

How is the first jmp skipped in plt entry

Whenever there is a call to a function of a dynamically linked library (0x400586 in the example at the end), the call first leads to a few lines in the .plt section, which in turn starts with a jmp to ...
2
votes
0answers
90 views

Restore function key

I have a simple function which looks like that: keyAlphabet = [-1, 16, 32, 127, 61, -32, -31, 43, 0, 88, 2, 5, 7, 112, 64, 69, 96] key = ??? # only keyAlphabet values p = 0x1337 for i in key: ...p*=i ...
0
votes
1answer
533 views

How to list parameter of function from IDA Pro? [duplicate]

I want to list parameter of function for analysis. Can I list the parameter of function using IDA Pro or IDAPython ?
0
votes
1answer
253 views

Mach-O functions pointer

I'm trying to understand how Mach-O files work, i already succeed with parsing of load commands, sections, symbols table etc.. anyway i'm trying to figure out a way to find class methods pointer to ...
5
votes
1answer
170 views

Wierd names in import table

I'm trying to do a static analysis of a PE file to see what it does. While doing so, I stumbled upon some really wierd function names in my objdump DLL Name: msvcrt.dll vma: Hint/Ord Member-Name ...
6
votes
2answers
368 views

reverse engineering methodology

I'm new to reverse engineering and I'm following the on line course provided by the opensecurity.info site. The author provides a methodology for reverse engineering. He recommends to find a function ...
0
votes
1answer
96 views

wsasend(disassemblied) function get parameters

Good Evening, currently, I am struggling around with a problem of getting the parameters of the wsasend function. The only parameter where found out something is this one: mov qword ptr ss:[rsp+60],...
0
votes
0answers
69 views

breaks on wsasend but not on wsaconnect

Good evening it's me again, I have found the address of the wsasend function where my program calls it. I have set a breakpoint on the function inside the ws2_32.dll and just checked the traceback ...
1
vote
2answers
140 views

Figure out whether a function has return value of not?

I am doing binary analysis on x86-64bit ELF binaries. All the binaries are compiled from C language. Basically, for a given function, I would like to figure out whether this function has a return ...
1
vote
1answer
2k views

How to find all functions in DLL

I'm looking for a way to get the addresses of all the functions in a DLL in the .text section. Is there a way to do it without using a disassembler and moving through the commands? How does IDA know ...
-1
votes
1answer
75 views

Computing function offset differences

When I'm trying to compute the difference between two functions loaded into memory: int _start(void) { // code } int _end(void) { // code } DWORD funcSize = (DWORD) _end - (DWORD) _start; ...
1
vote
1answer
259 views

Ida Pro compare constants in same function or not

How do I compare in IDA PRO if constants are located in the same functions or not.. like filter from all constants if I search for 2 constants or more I want to know which function(s) contain all the ...
2
votes
1answer
535 views

IDA Strings to Functions (ARM, Protected Functions)

I am working with an ARM (android apk: libgame.so) file that has protected functions (sub_xxxx, etc). The strings are supposed to have cross references with their function, but most of them reference ...
1
vote
0answers
341 views

DirectX calls not appearing

I'm trying to do some reverse-engineering to a DirectX 9 game. I've used PIX to see all the DirectX calls of the game, and that part worked correctly. After that, I wanted to know where in the code ...
0
votes
1answer
84 views

Understand what it looks like standard lib functions not properly identified by IDA Pro

I'm reverse engineering a piece of code that has hundreds of calls to a couple of functions I'm not exactly sure what they are doing but looks like standard library functions that do some byte reading?...
1
vote
0answers
42 views

IDA Pro monitor applications function calls [duplicate]

is there a function in IDA Pro to monitor all function calls of an application? So for example if I import an application into IDA it gives me functions like "sub_45E5C6", right? And now my question ...
2
votes
0answers
185 views

Implementing call into compiled, undocumented, C DLL; divining exported function prototype

I've been attempting to build my own implementation of Nvidia's Surround functionality by using their DLLs within a more reliable and automatic system. I'm pretty new to this; I've been a programmer ...
4
votes
2answers
229 views

How to force run a method triggered with a series of keys in a game?

This is my first time asking something on SE and I'll do the best I can to provide all of the required information, but I apologize in advance if I'm not clear enough. I'm trying to reverse engineer ...
1
vote
1answer
78 views

Where is the function cssyyparse code in webkit project? [closed]

Recently, I have viewed webkit source code and there is a function 'cssyyparse' which I cannot find c++ body code. Ther is only declaration of function cssyyparse. // CSSParser.cpp extern int ...
2
votes
0answers
158 views

Decoding A/C IR Codes

I captured infrared codes from an air conditioner remote to realize each code contains the entire state (i.e. temperature, mode, fan speed, etc.) every time a button is pressed. I believe this is so ...
3
votes
1answer
2k views

Which functions of a dll is called in OllyDBG

I`m beginner in OllyDBG. In the debugging of an exe file, I found which dll is used (kernel32, ntdl, user32, etc). I want to get a list of all functions of each dll that are called. How? Thanks a lot....
4
votes
1answer
3k views

Finding address from function name

By checking the human-readable strings in my target application, I found several interesting function names: ... DataIntegrityError GetObjectIdsOfDuplicateLinksErrors GetInvalidClusterIdsExists Main ...
1
vote
1answer
152 views

How to distinguish Functions boundaries, entry points and instructions in instruction trace

I have an instruction trace which is collected form a binary analysis platform and I already convert it to assembly instructions. I want to extract all functions and function calls in the file but ...
1
vote
1answer
139 views

Declaration of a complex C expression

I used IDA Pro and got the following expression from a produced C file: v25 = (*(int (**)(void))(v22 + 464))(); I am trying to figure out the meaning of the above expression with the following links:...
3
votes
0answers
1k views

Tracing function call args with IDA Pro

Right now I'm trying to place a trace point and hook it with the Python code that pulls all relevant stuff from the stack. Unfortunately it just gives me the garbage all the time, because the value in ...
2
votes
1answer
368 views

Strange function in IDA Pro: Only one basic block ending with a jmp sub_xxxxxx (instead of a ret)

Analyzing the ELF file /usr/bin/curl (Ubuntu 14.04, 64bit), I stumbled upon a strange function (see image). It is called regularly via call sub_403D90 but does not end with a ret. Instead, it jumps to ...
1
vote
1answer
934 views

How to extract a function call graph from IDA's Pro disassembled file (.asm file)?

I am totally new to reverse engineering science and does not know much about the assembly language. By the way, I am working on a data set of disassembled malicious files available at kaggle. These ...
0
votes
1answer
101 views

Save Valuable Time Reverse Engineering

As we know, time is the bane of reverse engineering. I am wanting to know how are some ways that I can save time in reverse engineering? I have taken some thought and I have been going through many ...
1
vote
1answer
1k views

How does IDA pro generate function names?

I am using IDA pro to decompile a series of applications. These applications share a common feature and what I have found is that in each decompilation each application shares the same set of ...