Questions tagged [functions]

A sequence of instructions performing a basic task packaged as a unit in a program.

Filter by
Sorted by
Tagged with
1 vote
1 answer
54 views

Tracing all functions in executable conditionally, to find function of interest

I would like to alter the behavior of some executable (in my case, a videogame). One way of doing this is to hook function calls (e.g., a function like Player::ReceiveDamage) and adjust parameters/...
0 votes
2 answers
155 views

Cutter shows addresses relative to stack but not rbp. How to change it?

Look at the first image: Here what I get is var void *buf @ stack - 0x28. But I'm watching a tutorial there his Cutter shows like this: var void *buf @ rbp - 0x20. How can I change cutter to appear ...
0 votes
1 answer
74 views

How to call unexported function in a third party DLL while having its PDB?

I'm new to reverse engineering and recently met with a problem: I have the dll and pdb of a debug version third party module, but I don't have its source codes. Now I want to write a piece of C++ code ...
2 votes
2 answers
2k views

Batch rename functions knowing their prototypes in IDA Pro

I have a long list of mappings from IDA function names (sub_??????) to known function prototypes. The prototype is complete, I mean it contains the return type, the name as in the code and the ...
0 votes
0 answers
42 views

WebAssembly Unity base64 decipher

When in game (taming.io) going to leaderboard and searching a player id lets say: 1. It renders player data retrieved from here just fine: https://account.taming.io/player?id=1 If I type this url (get ...
0 votes
1 answer
57 views

Function return in machine code (by platform/compiler)

I am asking this question to gather a knowledge base. I know in x86-64, a machine code function can have only one function return, i.e., ret instruction. I know it can be compiler (GCC, clang, etc) ...
4 votes
0 answers
10k views

Reversing Pyarmor Discussion

Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what ...
1 vote
2 answers
443 views

How can I jump to the start/end of a function in x64dbg?

I'm currently debugging a program using x64dbg, and I'm wondering how to quickly jump to the start or end (prologue/epilogue) of a function while I'm in the middle of it. I couldn't find this ...
1 vote
0 answers
120 views

Log functions called in IDA Pro?

When I run an exe in IDA how could I log which functions were called into a text file? log.txt: call func1 call func2 call func1 call func1 Not worried about indirect calls. This is for differential ...
0 votes
1 answer
100 views

split function argument from IDA's hints

Suppose I have a function, I know that the first 4 arguments come with fixed registers. _BYTE *__fastcall foo(__int64 a1, _QWORD *a2, unsigned int a3, char a4, _QWORD *a5) For the fifth one, if I ...
5 votes
2 answers
10k views

Tracing function calls in x64dbg

I'm new with x64dbg and want to know if there is any way to get the trace of a functions inside a module? I've used trace over option, but basically it just traces all the insturctions but doesn't "...
3 votes
2 answers
350 views

How to force run a method triggered with a series of keys in a game?

This is my first time asking something on SE and I'll do the best I can to provide all of the required information, but I apologize in advance if I'm not clear enough. I'm trying to reverse engineer ...
0 votes
2 answers
160 views

Find functions that constantly calls another

Here is a brief list of all the places where this particular function gets called in IDA Pro. What this function does is return 1/60=0.01666 (the game tick's timestep) from a pointer, which value is ...
0 votes
1 answer
481 views

which command in windbg to use to display the struct in function argument

The struct looks like this. typedef struct _RTL_DYNAMIC_HASH_TABLE_ENUMERATOR { struct _RTL_DYNAMIC_HASH_TABLE_ENTRY HashEntry; struct _LIST_ENTRY* CurEntry; struct _LIST_ENTRY* ChainHead; ULONG ...
1 vote
0 answers
88 views

How to reverse an import function?

I'm reversing windows .sys file and an import function RtlLookupEntryHashTable appears in my target functions. I want to know the pseudocode of it. How to achieve this? .text:00000001C00218C2 ...
0 votes
1 answer
288 views

How to speed up finding a function from pseudocode in IDA?

I have a function with the pseudocode of __int64 __fastcall sub_7FF7067A01F0(__int64 a1, __int64 a2, unsigned int a3) { if ( qword_7FF709F91498 ) return (*(__int64 (__fastcall **)(ID2D1Geometry *...
3 votes
2 answers
2k views

How do I adjust the length of the parameters in IDA?

In IDA I can easily change the size of the local variables using Alt+P and then changing the "Local Variables area" field to the desired value. However, how can I do this with the parameters size? ...
1 vote
1 answer
100 views

Calling a function with a variable number of args from a proxy DLL

The program I'm messing with has builtin logging. Using a proxy DLL, I managed to activate it by calling the right functions from the real DLL. However, I got stuck at using the actual logging ...
0 votes
1 answer
692 views

How do I find a function and find out what it does using reverse engineering?

I am attempting to find a function in a specific game. Is there any way that, using the assembly code I get from decompiling the game in either IDA or x64dbg, I can locate a function I am specifically ...
7 votes
3 answers
5k views

How to strip more than symbols?

I've noticed that, even after stripping symbols from my executable, class names and their methods are still included at the end of the executable file. For instance: #include <iostream> using ...
2 votes
2 answers
715 views

Call function by ebp

When I looking at exe file with Ida I see call dword ptr [ebp -70p] What is that? Why this function calling by ebp and not call sub_0xabcd How can I know which function is that to enter to this ...
1 vote
1 answer
3k views

How to define "code" variable type in Ghidra

Of all the confusing parts of Ghidra, I'd like to ask about the "code" keyword. A similar question was asked here. However, I am not asking what the keyword is, but how to interpret/define ...
1 vote
1 answer
133 views

I don't find the body of a function that I called in the main function

I have created a very simple x86 console program that uses Visual Studio 2019 compiler to sum 2 numbers just to see how is the program be after disassembly but I found something unclear to me. // C++ #...
1 vote
2 answers
10k views

Can I know which function from which dll was called at runtime?

I'm new to reverse engineering, I want to find out which command in the Source2 Engine's console invokes which function (and in which DLL). For that, I was wondering how can I know: which functions ...
0 votes
0 answers
220 views

The way to determine how the decompiled constructor is structured

I have the following constructor decompiled by Ghidra, i.e. Game. I know some of the functions, which are part of that constructor. And thus I have created my interpretation of that structure. But I ...
0 votes
1 answer
113 views

Branching in arm assembly

This is an example assembly code: function0() 0x0.mov r0, #1 0x8.mov r1, #20 0x10.mov r2, #6 0x18.cmp r1, #16 0x20.b function1 function1() 0x28.cmp r0, #1 0x30.b functionX functionX(...
0 votes
1 answer
1k views

Having hard time analyzing stripped code

This is my first time doing RE on a statically linked and stripped binary with ghidra. And I'm having a really hard time analyzing what function does what just by looking the decompiled code present ...
1 vote
1 answer
316 views

'local call from' in x64dbg

In OllyDbg there was a thing called "local call from xxx,xxx,xxx,xxx ... " which helps me know from where a function is being called in the entire module. Does such a feature exist in x64dbg as well?
1 vote
0 answers
106 views

Function Arguments/Name on Radare and IDA

I am starting with reverse engineering and Radare and I'm facing the following problem, on IDA Free I see the following code: mov ecx, 11h lea edi, [esp+1208h+StartupInfo] rep stosd lea ...
1 vote
1 answer
298 views

does mov DWORD PTR 32[rsp], 5 means mov DWORD PTR [rsp+32], 5?

I am learning about windows x64 calling convention, where the first four arguments are passed to registers and left arguments are passed through the stack. To see it, I checked the assembly of the ...
1 vote
2 answers
302 views

Cannot disassemble exported functions

I want to disassemble a function from Kernel32.dll to see what it does, but every single function I try looks like this in the decompiler: Function: jmp ds:Function_0 Where is the function? ...
0 votes
0 answers
97 views

finding a not-so-straightforward game's function

I am working on Mad Max game [ APEX engine ] I do my best to explain the situation. so my target executes function like this: there are commands like " call [eax+XX] " or " call RX &...
0 votes
1 answer
1k views

main function not found in GCC compiled code

I'm trying to learn reverse engineering using Radare2. For this I compiled a hello world program with GCC on Ubuntu (version: gcc (Ubuntu 9.3.0-17ubuntu1~20.04) 9.3.0). #include <stdio.h> int ...
0 votes
1 answer
179 views

Is it possible to make a dynamic memory allocated .data segment to static in a file?

Sorry if this is a dumb question I'm new to assembly. Basically I want to modify a function in a .exe file to return with a different data, but my issue is that the memory location of the data segment ...
0 votes
1 answer
74 views

Reverse engineering mode X VGA function(s)

I'm trying to reverse engineer an old DOS game. At the moment I'm stuck at a function that implements some functionality of VGA running in mode X. My issue is that any of the available sample codes on ...
0 votes
1 answer
463 views

Converting rep movsd to to C without memcpy

So I am currently in the stages of creating binexact version of functions in decompiled code. I noticed that in this function the rep movsd is called and logically this is translated as Qmemcpy/memcpy ...
0 votes
1 answer
280 views

Why some functions in IDA can't be searched

I don't know why but I noticed, on some program I am reversing, that in a section named .bss, there functions and I can't find them through the regular search, why is that. For example, I wanted to ...
0 votes
1 answer
2k views

How to view the functions of a loaded library in x64dbg

I am working on a packed file with UPX. In one of the lines it calls to the value of the address 0xF5222C which is: 0x778057c0. The debugger auto-completes it to kernel32.LoadLibraryA. Where can I ...
0 votes
1 answer
374 views

How to track output parameters in disassembly?

I have the following disassembly of winload!CmpFindNlsData function and I need to check the output parameters of this function. P.S.: CmpFindNLSData(int a1<eax>, int a2, PUNICODE_STRING ...
1 vote
1 answer
580 views

How to extract static API sequences of a PE file?

How does one extract the static API sequences of a PE file? I don't mean the imports listed in the imports segment. I am currently using different RE tools like Ghidra, IDA Pro, and Binary Ninja. ...
1 vote
0 answers
479 views

Removing/bypassing a BIOS whitelist

I am trying to bypass or erase the BIOS whitelist on my Thinkpad T440p. So far I've used flashrom and a soic8 clip to dump the bios to a bios.img file made another dump and compared with diff bios....
1 vote
1 answer
58 views

text_mn in Radare2 --> Meaning?

I compiled some source code and extracted functions with Radare2 (afj). Often I get a function with "sym..text_mn" function name/ symbol. The other functions are named correctly. What does this ...
3 votes
1 answer
2k views

Ghidra error when edit main signature function

I'm new to ghidra. I download the easy_reverse from crackme.one and open the executable file in ghidra. When I'm trying to edit the main function signature I get an error: Can't parse name: argv[]. I ...
0 votes
0 answers
29 views

Understanding obscure function names [duplicate]

I have seen functions like this before in disassembly but don't have a clue what they are. Their names are extremely confusing. Would someone be able to explain what these are?
1 vote
1 answer
2k views

Extracting functions of .obj file (compiled by myself with Visual Studio 19) --> extracts wrong data

How can I find only real functions not data garbage like section..debug_S_105 ? * I need to collect function data (assembler code) of Open Source C++ Files which I compile with Visual Studio 19 (sln ...
3 votes
3 answers
4k views

How to see all functions that called with debugger

I debugging with IDA, and I want to see/print all the functions that get called. In the functions window I see over than 1000 functions. So I want to see which functions are called when I press ...
2 votes
1 answer
2k views

Function's signature with unmatching parameters

I have following code disassembled by ghidra: PUSH EBX PUSH dword ptr [EBP + param_1] wchar_t * _Format for swprintf PUSH u_%s\%s_0040eb88 size_t ...
1 vote
1 answer
4k views

Dump value of register using frida

I'm new with frida and came to this problem. I have dll that I want to reverse engeneer(there are no debug symbols). Specifically I want to dump some data from a function. So I have this big function ...
0 votes
1 answer
2k views

Is it possible to call external functions?

I was wondering, assuming I wrote a dll in C++ and could access another application's memory, is it possible to call outside functions if I had the address?
3 votes
4 answers
2k views

Is it possible to build an equivalent function just looking at the input and output of the original function?

Imagine you are reverse engineering a software. This software uses a library, which is obfuscated and encrypted. The library contains a function, lets call it secret_function. This function is a pure ...