Questions tagged [functions]
A sequence of instructions performing a basic task packaged as a unit in a program.
14
questions
10
votes
1
answer
2k
views
Mapping an external module's source code to assembly - extracting information from source code
The situation is the following:
I'm reversing an application, In which I found a lot of functions that belongs to the OpenSSL library. Since I have the source code for this module, I was wondering if ...
- 2,038
12
votes
2
answers
3k
views
Detecting recursive functions in IDA
How can I detect/mark recursive functions in IDA?
Trivial method would be to check every function's call list and if it calls itself then it's recursive. I'ld like to put a comment or some kind of ...
- 2,038
6
votes
1
answer
7k
views
Finding address from function name
By checking the human-readable strings in my target application, I found several interesting function names:
...
DataIntegrityError
GetObjectIdsOfDuplicateLinksErrors
GetInvalidClusterIdsExists
Main
...
- 275
5
votes
2
answers
464
views
Grouping functions based on their placement/order in the binary
Can I group functions based on their place in the binary? Can I assume functions next to each othe belong to the same logical group, or at least they have similar functionality? I suspect that the ...
- 2,038
4
votes
3
answers
4k
views
Get interface definition of undocumented COM objects
I have started exploring COM objects, initially I got to it from UAC bypass methods but I guess my question is general. The general question is: How can I get from (elevated) CLSID in the registry to ...
- 143
4
votes
1
answer
303
views
Wierd names in import table
I'm trying to do a static analysis of a PE file to see what it does.
While doing so, I stumbled upon some really wierd function names in my objdump
DLL Name: msvcrt.dll
vma: Hint/Ord Member-Name ...
- 153
4
votes
2
answers
833
views
IDA function never called and only cross-referenced as data
When I press the X key (list x-refs) on a function (sub_xyz) to see which functions call it, I only saw dd offset sub_xyz twice, with no call sub_xyz instructions.
There is no another place that ...
- 523
3
votes
2
answers
2k
views
How do I adjust the length of the parameters in IDA?
In IDA I can easily change the size of the local variables using Alt+P and then changing the "Local Variables area" field to the desired value.
However, how can I do this with the parameters size? ...
- 627
3
votes
2
answers
346
views
How to force run a method triggered with a series of keys in a game?
This is my first time asking something on SE and I'll do the best I can to provide all of the required information, but I apologize in advance if I'm not clear enough.
I'm trying to reverse engineer ...
- 31
1
vote
2
answers
11k
views
How to find functions in games
There's one function I want to find in a game. When you fall through the game map you are "teleported" to specific xyz coordinates. I used to have the memory address of this function, but since then ...
- 35
1
vote
1
answer
2k
views
Finding RegisterNatives function calls in JNI_OnLoad's assembly code
My goal is to see what a native method m does. It doesn't have a direct counterpart in the so file, but I've found the JNI_OnLoad function's ARM assembly code. It starts with
AAAAAAAA <JNI_OnLoad@@...
- 121
1
vote
1
answer
4k
views
Dump value of register using frida
I'm new with frida and came to this problem.
I have dll that I want to reverse engeneer(there are no debug symbols). Specifically I want to dump some data from a function. So I have this big function ...
- 203
0
votes
1
answer
386
views
How is the first jmp skipped in plt entry
Whenever there is a call to a function of a dynamically linked library (0x400586 in the example at the end), the call first leads to a few lines in the .plt section, which in turn starts with a jmp to ...
- 103
0
votes
1
answer
364
views
How to track output parameters in disassembly?
I have the following disassembly of winload!CmpFindNlsData function and I need to check the output parameters of this function.
P.S.: CmpFindNLSData(int a1<eax>, int a2, PUNICODE_STRING ...
- 17