Questions tagged [functions]
A sequence of instructions performing a basic task packaged as a unit in a program.
101
questions
5
votes
2
answers
7k
views
Tracing function calls in x64dbg
I'm new with x64dbg and want to know if there is any way to get the trace of a functions inside a module?
I've used trace over option, but basically it just traces all the insturctions but doesn't "...
- 21
3
votes
2
answers
338
views
How to force run a method triggered with a series of keys in a game?
This is my first time asking something on SE and I'll do the best I can to provide all of the required information, but I apologize in advance if I'm not clear enough.
I'm trying to reverse engineer ...
CommunityBot
- 1
0
votes
2
answers
152
views
Find functions that constantly calls another
Here is a brief list of all the places where this particular function gets called in IDA Pro.
What this function does is return 1/60=0.01666 (the game tick's timestep) from a pointer, which value is ...
0
votes
1
answer
200
views
which command in windbg to use to display the struct in function argument
The struct looks like this.
typedef struct _RTL_DYNAMIC_HASH_TABLE_ENUMERATOR {
struct _RTL_DYNAMIC_HASH_TABLE_ENTRY HashEntry;
struct _LIST_ENTRY* CurEntry;
struct _LIST_ENTRY* ChainHead;
ULONG ...
- 15.8k
1
vote
0
answers
61
views
How to reverse an import function?
I'm reversing windows .sys file and an import function RtlLookupEntryHashTable appears in my target functions. I want to know the pseudocode of it. How to achieve this?
.text:00000001C00218C2 ...
- 10.8k
0
votes
1
answer
174
views
How to speed up finding a function from pseudocode in IDA?
I have a function with the pseudocode of
__int64 __fastcall sub_7FF7067A01F0(__int64 a1, __int64 a2, unsigned int a3)
{
if ( qword_7FF709F91498 )
return (*(__int64 (__fastcall **)(ID2D1Geometry *...
- 8,758
3
votes
2
answers
2k
views
How do I adjust the length of the parameters in IDA?
In IDA I can easily change the size of the local variables using Alt+P and then changing the "Local Variables area" field to the desired value.
However, how can I do this with the parameters size? ...
- 453
1
vote
1
answer
49
views
Calling a function with a variable number of args from a proxy DLL
The program I'm messing with has builtin logging. Using a proxy DLL, I managed to activate it by calling the right functions from the real DLL. However, I got stuck at using the actual logging ...
- 1
0
votes
1
answer
344
views
How do I find a function and find out what it does using reverse engineering?
I am attempting to find a function in a specific game. Is there any way that, using the assembly code I get from decompiling the game in either IDA or x64dbg, I can locate a function I am specifically ...
- 10.8k
7
votes
3
answers
5k
views
How to strip more than symbols?
I've noticed that, even after stripping symbols from my executable, class names and their methods are still included at the end of the executable file.
For instance:
#include <iostream>
using ...
- 230
2
votes
2
answers
597
views
Call function by ebp
When I looking at exe file with Ida I see
call dword ptr [ebp -70p]
What is that? Why this function calling by ebp and not call sub_0xabcd
How can I know which function is that to enter to this ...
CommunityBot
- 1
1
vote
1
answer
2k
views
How to define "code" variable type in Ghidra
Of all the confusing parts of Ghidra, I'd like to ask about the "code" keyword. A similar question was asked here. However, I am not asking what the keyword is, but how to interpret/define ...
- 441
1
vote
1
answer
106
views
I don't find the body of a function that I called in the main function
I have created a very simple x86 console program that uses Visual Studio 2019 compiler to sum 2 numbers just to see how is the program be after disassembly but I found something unclear to me.
// C++
#...
- 15.8k
1
vote
2
answers
10k
views
Can I know which function from which dll was called at runtime?
I'm new to reverse engineering, I want to find out which command in the Source2 Engine's console invokes which function (and in which DLL). For that, I was wondering how can I know:
which functions ...
0
votes
0
answers
126
views
The way to determine how the decompiled constructor is structured
I have the following constructor decompiled by Ghidra, i.e. Game. I know some of the functions, which are part of that constructor. And thus I have created my interpretation of that structure. But I ...
- 326
0
votes
1
answer
75
views
Branching in arm assembly
This is an example assembly code:
function0()
0x0.mov r0, #1
0x8.mov r1, #20
0x10.mov r2, #6
0x18.cmp r1, #16
0x20.b function1
function1()
0x28.cmp r0, #1
0x30.b functionX
functionX(...
- 1,798
0
votes
1
answer
912
views
Having hard time analyzing stripped code
This is my first time doing RE on a statically linked and stripped binary with ghidra. And I'm having a really hard time analyzing what function does what just by looking the decompiled code present ...
CommunityBot
- 1
1
vote
1
answer
280
views
'local call from' in x64dbg
In OllyDbg there was a thing called "local call from xxx,xxx,xxx,xxx ... " which helps me know from where a function is being called in the entire module. Does such a feature exist in x64dbg as well?
CommunityBot
- 1
1
vote
0
answers
83
views
Function Arguments/Name on Radare and IDA
I am starting with reverse engineering and Radare and I'm facing the following problem, on IDA Free I see the following code:
mov ecx, 11h
lea edi, [esp+1208h+StartupInfo]
rep stosd
lea ...
- 11
2
votes
0
answers
9k
views
Reversing Pyarmor Discussion
Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what ...
- 1
1
vote
1
answer
246
views
does mov DWORD PTR 32[rsp], 5 means mov DWORD PTR [rsp+32], 5?
I am learning about windows x64 calling convention, where the first four arguments are passed to registers and left arguments are passed through the stack. To see it, I checked the assembly of the ...
- 921
1
vote
2
answers
216
views
Cannot disassemble exported functions
I want to disassemble a function from Kernel32.dll to see what it does, but every single function I try looks like this in the decompiler:
Function:
jmp ds:Function_0
Where is the function? ...
- 285
0
votes
0
answers
88
views
finding a not-so-straightforward game's function
I am working on Mad Max game [ APEX engine ]
I do my best to explain the situation.
so my target executes function like this:
there are commands like " call [eax+XX] " or " call RX &...
- 41
0
votes
1
answer
790
views
main function not found in GCC compiled code
I'm trying to learn reverse engineering using Radare2.
For this I compiled a hello world program with GCC on Ubuntu (version: gcc (Ubuntu 9.3.0-17ubuntu1~20.04) 9.3.0).
#include <stdio.h>
int ...
- 2,464
0
votes
1
answer
141
views
Is it possible to make a dynamic memory allocated .data segment to static in a file?
Sorry if this is a dumb question I'm new to assembly.
Basically I want to modify a function in a .exe file to return with a different data, but my issue is that the memory location of the data segment ...
- 1,124
0
votes
1
answer
58
views
Reverse engineering mode X VGA function(s)
I'm trying to reverse engineer an old DOS game. At the moment I'm stuck at a function that implements some functionality of VGA running in mode X. My issue is that any of the available sample codes on ...
- 35.9k
0
votes
1
answer
304
views
Converting rep movsd to to C without memcpy
So I am currently in the stages of creating binexact version of functions in decompiled code. I noticed that in this function the rep movsd is called and logically this is translated as Qmemcpy/memcpy ...
- 15.8k
0
votes
1
answer
201
views
Why some functions in IDA can't be searched
I don't know why but I noticed, on some program I am reversing, that in a section named .bss, there functions and I can't find them through the regular search, why is that.
For example, I wanted to ...
- 573
0
votes
1
answer
1k
views
How to view the functions of a loaded library in x64dbg
I am working on a packed file with UPX.
In one of the lines it calls to the value of the address 0xF5222C which is: 0x778057c0.
The debugger auto-completes it to kernel32.LoadLibraryA.
Where can I ...
- 686
0
votes
1
answer
345
views
How to track output parameters in disassembly?
I have the following disassembly of winload!CmpFindNlsData function and I need to check the output parameters of this function.
P.S.: CmpFindNLSData(int a1<eax>, int a2, PUNICODE_STRING ...
- 15.8k
1
vote
1
answer
456
views
How to extract static API sequences of a PE file?
How does one extract the static API sequences of a PE file? I don't mean the imports listed in the imports segment.
I am currently using different RE tools like Ghidra, IDA Pro, and Binary Ninja. ...
CommunityBot
- 1
1
vote
0
answers
373
views
Removing/bypassing a BIOS whitelist
I am trying to bypass or erase the BIOS whitelist on my Thinkpad T440p. So far I've
used flashrom and a soic8 clip to dump the bios to a bios.img file
made another dump and compared with diff bios....
- 111
1
vote
1
answer
56
views
text_mn in Radare2 --> Meaning?
I compiled some source code and extracted functions with Radare2 (afj).
Often I get a function with "sym..text_mn" function name/ symbol.
The other functions are named correctly. What does this ...
CommunityBot
- 1
2
votes
1
answer
2k
views
Ghidra error when edit main signature function
I'm new to ghidra.
I download the easy_reverse from crackme.one and open the executable file in ghidra.
When I'm trying to edit the main function signature I get an error: Can't parse name: argv[].
I ...
- 141
0
votes
0
answers
28
views
Understanding obscure function names [duplicate]
I have seen functions like this before in disassembly but don't have a clue what they are. Their names are extremely confusing. Would someone be able to explain what these are?
- 105
1
vote
1
answer
2k
views
Extracting functions of .obj file (compiled by myself with Visual Studio 19) --> extracts wrong data
How can I find only real functions not data garbage like section..debug_S_105 ? *
I need to collect function data (assembler code) of Open Source C++ Files which I compile with Visual Studio 19 (sln ...
- 15.8k
3
votes
3
answers
4k
views
How to see all functions that called with debugger
I debugging with IDA, and I want to see/print all the functions that get called.
In the functions window I see over than 1000 functions.
So I want to see which functions are called when I press ...
- 3,349
2
votes
1
answer
1k
views
Function's signature with unmatching parameters
I have following code disassembled by ghidra:
PUSH EBX
PUSH dword ptr [EBP + param_1] wchar_t * _Format for swprintf
PUSH u_%s\%s_0040eb88 size_t ...
- 35.9k
1
vote
1
answer
3k
views
Dump value of register using frida
I'm new with frida and came to this problem.
I have dll that I want to reverse engeneer(there are no debug symbols). Specifically I want to dump some data from a function. So I have this big function ...
- 15.8k
0
votes
1
answer
2k
views
Is it possible to call external functions?
I was wondering, assuming I wrote a dll in C++ and could access another application's memory, is it possible to call outside functions if I had the address?
- 258
3
votes
4
answers
2k
views
Is it possible to build an equivalent function just looking at the input and output of the original function?
Imagine you are reverse engineering a software. This software uses a library, which is obfuscated and encrypted. The library contains a function, lets call it secret_function. This function is a pure ...
- 121
1
vote
0
answers
53
views
Is there a way to modify number of reads/writes to/from a memory address?
I haven't had any luck researching this, so I thought I would inquire here!
Let's assume I have found a memory address housing a value of interest. Using a program like Cheat Engine, I look for ...
- 2,204
4
votes
3
answers
3k
views
Get interface definition of undocumented COM objects
I have started exploring COM objects, initially I got to it from UAC bypass methods but I guess my question is general. The general question is: How can I get from (elevated) CLSID in the registry to ...
- 15.8k
5
votes
1
answer
2k
views
Radare2 doesn't display the whole function
I am using radare2, I have disassembled the function: sym.loop, it contains a switch witch has 4 cases that calls different functions. After any of the function call, the program exits the loop ...
CommunityBot
- 1
-1
votes
2
answers
164
views
Is it possible to get the formula out of a blackbox using neural network
I have a so. library which I know the "C" interface but I don't have access to the source code only the disassembled code which is hard to understand at least for me.
I know the input parameters (...
- 11.7k
2
votes
1
answer
2k
views
Batch rename functions knowing their prototypes in IDA Pro
I have a long list of mappings from IDA function names (sub_??????) to known function prototypes. The prototype is complete, I mean it contains the return type, the name as in the code and the ...
- 11.7k
1
vote
1
answer
1k
views
Finding RegisterNatives function calls in JNI_OnLoad's assembly code
My goal is to see what a native method m does. It doesn't have a direct counterpart in the so file, but I've found the JNI_OnLoad function's ARM assembly code. It starts with
AAAAAAAA <JNI_OnLoad@@...
- 35.9k
4
votes
2
answers
708
views
IDA function never called and only cross-referenced as data
When I press the X key (list x-refs) on a function (sub_xyz) to see which functions call it, I only saw dd offset sub_xyz twice, with no call sub_xyz instructions.
There is no another place that ...
CommunityBot
- 1
0
votes
1
answer
81
views
What is the difference between xrefs and stack trace?
In IDA, I can see what calls a specific function by looking at the xrefs to it, or by looking 1 step back on stack trace.
What are the differences between them?
How does IDA know what the stack ...
- 4,692
5
votes
1
answer
749
views
Why do many imported functions jump to addresses that do not contain instructions?
I am learning to analyze binaries using radare2 and have been confused about what occurs within imported functions. In the binary below, titled Lab2B, I statically disassembled the binary and then ...
- 8,849