Questions tagged [functions]

A sequence of instructions performing a basic task packaged as a unit in a program.

Filter by
Sorted by
Tagged with
0
votes
1answer
3 views

Ghidra error when edit main signature function

I'm new to ghidra. I download the easy_reverse from crackme.one and open the executable file in ghidra. When I'm trying to edit the main function signature I get an error: Can't parse name: argv[]. I ...
0
votes
0answers
2 views

sym..text_mn --> Symbol Meaning?

I compiled some source code and extracted functions with Radare2 (afj). Often I get a function with "sym..text_mn" function name/ symbol. The other functions are named correctly. What does this ...
0
votes
0answers
34 views

Find common functions in arm static binary

According to Detecting libc function with IDA I have static binary for arm and I want to find common function like fread sleep printf ioctl etc. When I looking for string in this binary I found glibc ...
0
votes
0answers
17 views

Understanding obscure function names [duplicate]

I have seen functions like this before in disassembly but don't have a clue what they are. Their names are extremely confusing. Would someone be able to explain what these are?
0
votes
1answer
66 views

Extracting functions of .obj file (compiled by myself with Visual Studio 19) --> extracts wrong data

How can I find only real functions not data garbage like section..debug_S_105 ? * I need to collect function data (assembler code) of Open Source C++ Files which I compile with Visual Studio 19 (sln ...
0
votes
1answer
72 views

How to extract static API sequences of a PE file?

How does one extract the static API sequences of a PE file? I don't mean the imports listed in the imports segment. I am currently using different RE tools like Ghidra, IDA Pro, and Binary Ninja. ...
0
votes
0answers
48 views

Add function to Export Address Table

I did reverse engineering through IDA Pro, but I needed to expand my function. Since there was no free space, I renamed the old function (using Hex-view) to avoid a match, created a new section (using ...
2
votes
1answer
77 views

Function's signature with unmatching parameters

I have following code disassembled by ghidra: PUSH EBX PUSH dword ptr [EBP + param_1] wchar_t * _Format for swprintf PUSH u_%s\%s_0040eb88 size_t ...
1
vote
2answers
112 views

Call function by ebp

When I looking at exe file with Ida I see call dword ptr [ebp -70p] What is that? Why this function calling by ebp and not call sub_0xabcd How can I know which function is that to enter to this ...
1
vote
1answer
548 views

Dump value of register using frida

I'm new with frida and came to this problem. I have dll that I want to reverse engeneer(there are no debug symbols). Specifically I want to dump some data from a function. So I have this big function ...
0
votes
1answer
70 views

'local call from' in x64dbg

In OllyDbg there was a thing called "local call from xxx,xxx,xxx,xxx ... " which helps me know from where a function is being called in the entire module. Does such a feature exist in x64dbg as well?
0
votes
1answer
145 views

Is it possible to call external functions?

I was wondering, assuming I wrote a dll in C++ and could access another application's memory, is it possible to call outside functions if I had the address?
3
votes
4answers
2k views

Is it possible to build an equivalent function just looking at the input and output of the original function?

Imagine you are reverse engineering a software. This software uses a library, which is obfuscated and encrypted. The library contains a function, lets call it secret_function. This function is a pure ...
1
vote
0answers
48 views

Is there a way to modify number of reads/writes to/from a memory address?

I haven't had any luck researching this, so I thought I would inquire here! Let's assume I have found a memory address housing a value of interest. Using a program like Cheat Engine, I look for ...
2
votes
3answers
627 views

How to see all functions that called with debugger

I debugging with IDA, and I want to see/print all the functions that get called. In the functions window I see over than 1000 functions. So I want to see which functions are called when I press ...
4
votes
3answers
1k views

Get interface definition of undocumented COM objects

I have started exploring COM objects, initially I got to it from UAC bypass methods but I guess my question is general. The general question is: How can I get from (elevated) CLSID in the registry to ...
2
votes
1answer
603 views

Batch rename functions knowing their prototypes in IDA Pro

I have a long list of mappings from IDA function names (sub_??????) to known function prototypes. The prototype is complete, I mean it contains the return type, the name as in the code and the ...
-1
votes
2answers
143 views

Is it possible to get the formula out of a blackbox using neural network

I have a so. library which I know the "C" interface but I don't have access to the source code only the disassembled code which is hard to understand at least for me. I know the input parameters (...
1
vote
1answer
797 views

Finding RegisterNatives function calls in JNI_OnLoad's assembly code

My goal is to see what a native method m does. It doesn't have a direct counterpart in the so file, but I've found the JNI_OnLoad function's ARM assembly code. It starts with AAAAAAAA <JNI_OnLoad@@...
0
votes
1answer
41 views

What is the difference between xrefs and stack trace?

In IDA, I can see what calls a specific function by looking at the xrefs to it, or by looking 1 step back on stack trace. What are the differences between them? How does IDA know what the stack ...
3
votes
2answers
189 views

IDA function never called and only cross-referenced as data

When I press the X key (list x-refs) on a function (sub_xyz) to see which functions call it, I only saw dd offset sub_xyz twice, with no call sub_xyz instructions. There is no another place that ...
5
votes
1answer
431 views

Why do many imported functions jump to addresses that do not contain instructions?

I am learning to analyze binaries using radare2 and have been confused about what occurs within imported functions. In the binary below, titled Lab2B, I statically disassembled the binary and then ...
1
vote
1answer
1k views

Tracing function calls in x64dbg

I'm new with x64dbg and want to know if there is any way to get the trace of a functions inside a module? I've used trace over option, but basically it just traces all the insturctions but doesn't "...
2
votes
2answers
626 views

IDA: call a function with different arguments

I'm reversing some software and found the function which decrypts some stuff: As you can see it has the password parameter for it which gets decrypted in this function. Function disassembly: ...
0
votes
2answers
127 views

Find functions that constantly calls another

Here is a list of all the places where this specific function gets called. What that function does is return 0.01666 from a pointer. That value is being used in the physics calculations of the game. ...
3
votes
2answers
818 views

Functions without a prologue and epilogue?

I was just wondering what exactly causes a function without a prologue/epilogue to be generated? If a program is compiled with just stdcall/cdecl convention, why is it that there are some calls which ...
0
votes
1answer
65 views

Help with animation function

I'm trying to find the function which is animating a bot ingame (singleplayer). I already figured out the animation state value with Cheat Engine. Freezing that value lets the bot repeat the animation ...
3
votes
1answer
408 views

Why most debuggers don't auto recognize functions?

may anyone explain to me why most of the debuggers don't auto recognize functions? This is a feature I only found in IDA and ollydbg, any other debugger I tried just don't analyze the functions as ...
1
vote
0answers
132 views

Why does IDA mark this as end of function?

I'm analyzing a .so file that is a part of an android application. I've stumbled upon this block of code: LOAD:0001B63C sub_1B63C ; CODE XREF: sub_1B628+Cp LOAD:...
2
votes
1answer
252 views

Why function names are visible in a decompiled iOS app?

While decompiling an iOS app, all function names and object names are visible. Why ? My guess is that during the build, function names are kept by the compilator to allow the linker to do its job. ...
5
votes
1answer
1k views

Radare2 doesn't display the whole function

I am using radare2, I have disassembled the function: sym.loop, it contains a switch witch has 4 cases that calls different functions. After any of the function call, the program exits the loop ...
0
votes
2answers
107 views

Function Address Changes When Gets Referenced elsewhere

i have been trying to get the address of a function and use that hex number for other calculations. I have read that you cannot get the address of a function like you get the address of a variable in ...
0
votes
2answers
451 views

Why do I get different addresses for the printf function when I disassemble with otool?

I'm using otool on macOS to disassemble some simple C programs I built in order to gain a better understanding of assembly language. I disassembled three programs, all of which consist of a single ...
2
votes
1answer
245 views

IDA ignoring register changes in pseudocode

The Watcom compiler uses a fairly unusual calling convention, and IDA seems to be discarding some of the changes as irrelevant to its built-in pseudo-code. In my experience, that usually means I'm ...
1
vote
1answer
2k views

Call DLL export in OllyDBG

I am using OllyDbg 2.01 and I walked through this tutorial to figure out how Call DLL export works. Even though it was written for another version of OllyDBG it work just fine. We should notice, that ...
1
vote
2answers
5k views

Can I know which function from which dll was called at runtime?

I'm new to reverse engineering, I want to find out which command in the Source2 Engine's console invokes which function (and in which DLL). For that, I was wondering how can I know: which functions ...
0
votes
1answer
214 views

How is the first jmp skipped in plt entry

Whenever there is a call to a function of a dynamically linked library (0x400586 in the example at the end), the call first leads to a few lines in the .plt section, which in turn starts with a jmp to ...
2
votes
0answers
120 views

Restore function key

I have a simple function which looks like that: keyAlphabet = [-1, 16, 32, 127, 61, -32, -31, 43, 0, 88, 2, 5, 7, 112, 64, 69, 96] key = ??? # only keyAlphabet values p = 0x1337 for i in key: ...p*=i ...
0
votes
1answer
918 views

How to list parameter of function from IDA Pro? [duplicate]

I want to list parameter of function for analysis. Can I list the parameter of function using IDA Pro or IDAPython ?
0
votes
1answer
403 views

Mach-O functions pointer

I'm trying to understand how Mach-O files work, i already succeed with parsing of load commands, sections, symbols table etc.. anyway i'm trying to figure out a way to find class methods pointer to ...
4
votes
1answer
235 views

Wierd names in import table

I'm trying to do a static analysis of a PE file to see what it does. While doing so, I stumbled upon some really wierd function names in my objdump DLL Name: msvcrt.dll vma: Hint/Ord Member-Name ...
5
votes
2answers
746 views

reverse engineering methodology

I'm new to reverse engineering and I'm following the on line course provided by the opensecurity.info site. The author provides a methodology for reverse engineering. He recommends to find a function ...
0
votes
1answer
139 views

wsasend(disassemblied) function get parameters

Good Evening, currently, I am struggling around with a problem of getting the parameters of the wsasend function. The only parameter where found out something is this one: mov qword ptr ss:[rsp+60],...
1
vote
2answers
161 views

Figure out whether a function has return value of not?

I am doing binary analysis on x86-64bit ELF binaries. All the binaries are compiled from C language. Basically, for a given function, I would like to figure out whether this function has a return ...
1
vote
1answer
3k views

How to find all functions in DLL

I'm looking for a way to get the addresses of all the functions in a DLL in the .text section. Is there a way to do it without using a disassembler and moving through the commands? How does IDA know ...
-1
votes
1answer
99 views

Computing function offset differences

When I'm trying to compute the difference between two functions loaded into memory: int _start(void) { // code } int _end(void) { // code } DWORD funcSize = (DWORD) _end - (DWORD) _start; ...
1
vote
1answer
482 views

Ida Pro compare constants in same function or not

How do I compare in IDA PRO if constants are located in the same functions or not.. like filter from all constants if I search for 2 constants or more I want to know which function(s) contain all the ...
1
vote
1answer
641 views

IDA Strings to Functions (ARM, Protected Functions)

I am working with an ARM (android apk: libgame.so) file that has protected functions (sub_xxxx, etc). The strings are supposed to have cross references with their function, but most of them reference ...
1
vote
0answers
558 views

DirectX calls not appearing

I'm trying to do some reverse-engineering to a DirectX 9 game. I've used PIX to see all the DirectX calls of the game, and that part worked correctly. After that, I wanted to know where in the code ...
0
votes
1answer
87 views

Understand what it looks like standard lib functions not properly identified by IDA Pro

I'm reverse engineering a piece of code that has hundreds of calls to a couple of functions I'm not exactly sure what they are doing but looks like standard library functions that do some byte reading?...