Questions tagged [functions]
A sequence of instructions performing a basic task packaged as a unit in a program.
106
questions
13
votes
4
answers
636
views
Inverting functions HOWTO
I just read some code that applies a series of transformations to a 4 byte integer. I'm curious to know if the following function is invertible.
f(y) = y^(y>>11)
A general doubt I have, is the ...
user1743
12
votes
2
answers
3k
views
Detecting recursive functions in IDA
How can I detect/mark recursive functions in IDA?
Trivial method would be to check every function's call list and if it calls itself then it's recursive. I'ld like to put a comment or some kind of ...
- 2,038
10
votes
1
answer
2k
views
Mapping an external module's source code to assembly - extracting information from source code
The situation is the following:
I'm reversing an application, In which I found a lot of functions that belongs to the OpenSSL library. Since I have the source code for this module, I was wondering if ...
- 2,038
7
votes
3
answers
5k
views
How to strip more than symbols?
I've noticed that, even after stripping symbols from my executable, class names and their methods are still included at the end of the executable file.
For instance:
#include <iostream>
using ...
user2005
6
votes
1
answer
7k
views
Finding address from function name
By checking the human-readable strings in my target application, I found several interesting function names:
...
DataIntegrityError
GetObjectIdsOfDuplicateLinksErrors
GetInvalidClusterIdsExists
Main
...
- 275
5
votes
2
answers
1k
views
Automatic function naming
I'ld like to know how to bulk rename functions in IDA, based on some condition.
Example:
Rename all functions to Foo_XYZ where the function accesses a certain static variable, for example : ...
- 2,038
5
votes
2
answers
9k
views
Tracing function calls in x64dbg
I'm new with x64dbg and want to know if there is any way to get the trace of a functions inside a module?
I've used trace over option, but basically it just traces all the insturctions but doesn't "...
- 203
5
votes
1
answer
773
views
Why do many imported functions jump to addresses that do not contain instructions?
I am learning to analyze binaries using radare2 and have been confused about what occurs within imported functions. In the binary below, titled Lab2B, I statically disassembled the binary and then ...
- 225
5
votes
2
answers
1k
views
reverse engineering methodology
I'm new to reverse engineering and I'm following the on line course provided by the opensecurity.info site.
The author provides a methodology for reverse engineering. He recommends to find a function ...
- 151
5
votes
2
answers
465
views
Grouping functions based on their placement/order in the binary
Can I group functions based on their place in the binary? Can I assume functions next to each othe belong to the same logical group, or at least they have similar functionality? I suspect that the ...
- 2,038
5
votes
1
answer
2k
views
Radare2 doesn't display the whole function
I am using radare2, I have disassembled the function: sym.loop, it contains a switch witch has 4 cases that calls different functions. After any of the function call, the program exits the loop ...
- 143
5
votes
0
answers
2k
views
Tracing function call args with IDA Pro
Right now I'm trying to place a trace point and hook it with the Python code that pulls all relevant stuff from the stack. Unfortunately it just gives me the garbage all the time, because the value in ...
- 171
4
votes
3
answers
4k
views
Get interface definition of undocumented COM objects
I have started exploring COM objects, initially I got to it from UAC bypass methods but I guess my question is general. The general question is: How can I get from (elevated) CLSID in the registry to ...
- 143
4
votes
2
answers
836
views
IDA function never called and only cross-referenced as data
When I press the X key (list x-refs) on a function (sub_xyz) to see which functions call it, I only saw dd offset sub_xyz twice, with no call sub_xyz instructions.
There is no another place that ...
- 523
4
votes
1
answer
304
views
Wierd names in import table
I'm trying to do a static analysis of a PE file to see what it does.
While doing so, I stumbled upon some really wierd function names in my objdump
DLL Name: msvcrt.dll
vma: Hint/Ord Member-Name ...
- 153
4
votes
1
answer
3k
views
Which functions of a dll is called in OllyDBG
I`m beginner in OllyDBG. In the debugging of an exe file, I found which dll is used (kernel32, ntdl, user32, etc). I want to get a list of all functions of each dll that are called.
How?
Thanks a lot....
4
votes
1
answer
1k
views
Runtime memory reading with injection
I'm reversing an application written in C. I have a certain function that I want to log runtime, without pausing/stopping the application.
My desired values of that function are:
[ESP + 4] which ...
- 2,038
4
votes
0
answers
10k
views
Reversing Pyarmor Discussion
Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what ...
- 51
3
votes
4
answers
2k
views
Is it possible to build an equivalent function just looking at the input and output of the original function?
Imagine you are reverse engineering a software. This software uses a library, which is obfuscated and encrypted. The library contains a function, lets call it secret_function. This function is a pure ...
- 178
3
votes
2
answers
2k
views
Functions without a prologue and epilogue?
I was just wondering what exactly causes a function without a prologue/epilogue to be generated? If a program is compiled with just stdcall/cdecl convention, why is it that there are some calls which ...
- 101
3
votes
1
answer
2k
views
IDApro subroutine analysis
I am using IDA to find out parameters of a routine in a DLL. I browsed to the routine in question and saw that IDA has automatically done that job for me and put a comment like this:
; ==============...
- 33
3
votes
2
answers
2k
views
How do I adjust the length of the parameters in IDA?
In IDA I can easily change the size of the local variables using Alt+P and then changing the "Local Variables area" field to the desired value.
However, how can I do this with the parameters size? ...
- 627
3
votes
3
answers
4k
views
How to see all functions that called with debugger
I debugging with IDA, and I want to see/print all the functions that get called.
In the functions window I see over than 1000 functions.
So I want to see which functions are called when I press ...
- 523
3
votes
1
answer
455
views
Why most debuggers don't auto recognize functions?
may anyone explain to me why most of the debuggers don't auto recognize functions?
This is a feature I only found in IDA and ollydbg, any other debugger I tried just don't analyze the functions as ...
- 305
3
votes
1
answer
758
views
Strange function in IDA Pro: Only one basic block ending with a jmp sub_xxxxxx (instead of a ret)
Analyzing the ELF file /usr/bin/curl (Ubuntu 14.04, 64bit), I stumbled upon a strange function (see image). It is called regularly via call sub_403D90 but does not end with a ret. Instead, it jumps to ...
- 1,550
3
votes
1
answer
1k
views
IDA API - query number of parameters for cdecl functions
I'm writing a script that, among other things, reads and does some processing with parameters to a function. Right now my solution to find the number of arguments for a given function at addr is:
(...
- 1,022
3
votes
1
answer
2k
views
Ghidra error when edit main signature function
I'm new to ghidra.
I download the easy_reverse from crackme.one and open the executable file in ghidra.
When I'm trying to edit the main function signature I get an error: Can't parse name: argv[].
I ...
- 161
3
votes
2
answers
347
views
How to force run a method triggered with a series of keys in a game?
This is my first time asking something on SE and I'll do the best I can to provide all of the required information, but I apologize in advance if I'm not clear enough.
I'm trying to reverse engineer ...
- 31
3
votes
1
answer
440
views
Experiences from reverse engineers in detecting recursive calls
I have absolutely no experience in reversing real-world binary codes, so I wonder how the obfuscated codes prevent reversers. I doubt that the reverses always find some ways to understand what are ...
- 1,410
3
votes
0
answers
245
views
Implementing call into compiled, undocumented, C DLL; divining exported function prototype
I've been attempting to build my own implementation of Nvidia's Surround functionality by using their DLLs within a more reliable and automatic system. I'm pretty new to this; I've been a programmer ...
- 131
2
votes
2
answers
2k
views
Detecting epilogue/prologue of functions [closed]
I'm trying to catch epilogue/prologue of functions in IDApython. Anyone got clue/snippet/algorithm of how should I do this?
- 41
2
votes
1
answer
2k
views
Batch rename functions knowing their prototypes in IDA Pro
I have a long list of mappings from IDA function names (sub_??????) to known function prototypes. The prototype is complete, I mean it contains the return type, the name as in the code and the ...
- 123
2
votes
1
answer
2k
views
How to extract a function call graph from IDA's Pro disassembled file (.asm file)?
I am totally new to reverse engineering science and does not know much about the assembly language. By the way, I am working on a data set of disassembled malicious files available at kaggle. These ...
- 123
2
votes
1
answer
6k
views
Viewing an exported DLL function in OllyDbg - garbage code
Being rather new to the concept of RE, I wanted to try and take a look at the assembly code in one DLL that I know exports some functions.
First, I used this tool - http://www.nirsoft.net/utils/...
- 585
2
votes
2
answers
673
views
Call function by ebp
When I looking at exe file with Ida I see
call dword ptr [ebp -70p]
What is that? Why this function calling by ebp and not call sub_0xabcd
How can I know which function is that to enter to this ...
2
votes
2
answers
2k
views
IDA: call a function with different arguments
I'm reversing some software and found the function which decrypts some stuff:
As you can see it has the password parameter for it which gets decrypted in this function.
Function disassembly:
...
- 203
2
votes
1
answer
464
views
IDA ignoring register changes in pseudocode
The Watcom compiler uses a fairly unusual calling convention, and IDA seems to be discarding some of the changes as irrelevant to its built-in pseudo-code. In my experience, that usually means I'm ...
- 145
2
votes
1
answer
498
views
IDA PRO Struct Pointer Counter big number not starting from address offset 0, Lowers a bit slightly but not all the way to 0
I put the whole question in 2 images. From research, it seems I need to use Ctrl+R, but I don't think that's what I need since I couldn't lower the number a bit further in order to reach 0.
I think ...
- 759
2
votes
1
answer
2k
views
Function's signature with unmatching parameters
I have following code disassembled by ghidra:
PUSH EBX
PUSH dword ptr [EBP + param_1] wchar_t * _Format for swprintf
PUSH u_%s\%s_0040eb88 size_t ...
- 55
2
votes
1
answer
417
views
Why function names are visible in a decompiled iOS app?
While decompiling an iOS app, all function names and object names are visible. Why ?
My guess is that during the build, function names are kept by the compilator to allow the linker to do its job. ...
- 121
2
votes
0
answers
156
views
Restore function key
I have a simple function which looks like that:
keyAlphabet = [-1, 16, 32, 127, 61, -32, -31, 43, 0, 88, 2, 5, 7, 112, 64, 69, 96]
key = ??? # only keyAlphabet values
p = 0x1337
for i in key:
...p*=i
...
- 238
2
votes
0
answers
229
views
Decoding A/C IR Codes
I captured infrared codes from an air conditioner remote to realize each code contains the entire state (i.e. temperature, mode, fan speed, etc.) every time a button is pressed. I believe this is so ...
- 21
1
vote
2
answers
11k
views
How to find functions in games
There's one function I want to find in a game. When you fall through the game map you are "teleported" to specific xyz coordinates. I used to have the memory address of this function, but since then ...
- 35
1
vote
1
answer
5k
views
How to find all functions in DLL
I'm looking for a way to get the addresses of all the functions in a DLL in the .text section. Is there a way to do it without using a disassembler and moving through the commands? How does IDA know ...
- 133
1
vote
1
answer
116
views
List late binding functions
I'd like to identify all late-binding calls made by a windows 32 or 64 executable program. I can take a look at the imported functions through the IAT but I'm unable to list the functions called ...
- 113
1
vote
1
answer
4k
views
Call DLL export in OllyDBG
I am using OllyDbg 2.01 and I walked through this tutorial to figure out how Call DLL export works. Even though it was written for another version of OllyDBG it work just fine. We should notice, that ...
- 124
1
vote
2
answers
10k
views
Can I know which function from which dll was called at runtime?
I'm new to reverse engineering, I want to find out which command in the Source2 Engine's console invokes which function (and in which DLL). For that, I was wondering how can I know:
which functions ...
- 113
1
vote
2
answers
465
views
Figure out whether a function has return value of not?
I am doing binary analysis on x86-64bit ELF binaries. All the binaries are compiled from C language. Basically, for a given function, I would like to figure out whether this function has a return ...
- 2,475
1
vote
1
answer
183
views
Declaration of a complex C expression
I used IDA Pro and got the following expression from a produced C file:
v25 = (*(int (**)(void))(v22 + 464))();
I am trying to figure out the meaning of the above expression with the following links:...
- 319
1
vote
1
answer
2k
views
How does IDA pro generate function names?
I am using IDA pro to decompile a series of applications. These applications share a common feature and what I have found is that in each decompilation each application shares the same set of ...
- 179