Questions tagged [functions]

A sequence of instructions performing a basic task packaged as a unit in a program.

Filter by
Sorted by
Tagged with
2
votes
1answer
298 views

IDA ignoring register changes in pseudocode

The Watcom compiler uses a fairly unusual calling convention, and IDA seems to be discarding some of the changes as irrelevant to its built-in pseudo-code. In my experience, that usually means I'm ...
0
votes
1answer
289 views

How is the first jmp skipped in plt entry

Whenever there is a call to a function of a dynamically linked library (0x400586 in the example at the end), the call first leads to a few lines in the .plt section, which in turn starts with a jmp to ...
2
votes
0answers
137 views

Restore function key

I have a simple function which looks like that: keyAlphabet = [-1, 16, 32, 127, 61, -32, -31, 43, 0, 88, 2, 5, 7, 112, 64, 69, 96] key = ??? # only keyAlphabet values p = 0x1337 for i in key: ...p*=i ...
0
votes
1answer
488 views

Mach-O functions pointer

I'm trying to understand how Mach-O files work, i already succeed with parsing of load commands, sections, symbols table etc.. anyway i'm trying to figure out a way to find class methods pointer to ...
0
votes
1answer
1k views

How to list parameter of function from IDA Pro? [duplicate]

I want to list parameter of function for analysis. Can I list the parameter of function using IDA Pro or IDAPython ?
1
vote
2answers
197 views

Figure out whether a function has return value of not?

I am doing binary analysis on x86-64bit ELF binaries. All the binaries are compiled from C language. Basically, for a given function, I would like to figure out whether this function has a return ...
4
votes
1answer
258 views

Wierd names in import table

I'm trying to do a static analysis of a PE file to see what it does. While doing so, I stumbled upon some really wierd function names in my objdump DLL Name: msvcrt.dll vma: Hint/Ord Member-Name ...
5
votes
2answers
846 views

reverse engineering methodology

I'm new to reverse engineering and I'm following the on line course provided by the opensecurity.info site. The author provides a methodology for reverse engineering. He recommends to find a function ...
0
votes
1answer
173 views

wsasend(disassemblied) function get parameters

Good Evening, currently, I am struggling around with a problem of getting the parameters of the wsasend function. The only parameter where found out something is this one: mov qword ptr ss:[rsp+60],...
-1
votes
1answer
118 views

Computing function offset differences

When I'm trying to compute the difference between two functions loaded into memory: int _start(void) { // code } int _end(void) { // code } DWORD funcSize = (DWORD) _end - (DWORD) _start; ...
1
vote
1answer
666 views

Ida Pro compare constants in same function or not

How do I compare in IDA PRO if constants are located in the same functions or not.. like filter from all constants if I search for 2 constants or more I want to know which function(s) contain all the ...
1
vote
1answer
721 views

IDA Strings to Functions (ARM, Protected Functions)

I am working with an ARM (android apk: libgame.so) file that has protected functions (sub_xxxx, etc). The strings are supposed to have cross references with their function, but most of them reference ...
1
vote
0answers
626 views

DirectX calls not appearing

I'm trying to do some reverse-engineering to a DirectX 9 game. I've used PIX to see all the DirectX calls of the game, and that part worked correctly. After that, I wanted to know where in the code ...
0
votes
1answer
91 views

Understand what it looks like standard lib functions not properly identified by IDA Pro

I'm reverse engineering a piece of code that has hundreds of calls to a couple of functions I'm not exactly sure what they are doing but looks like standard library functions that do some byte reading?...
1
vote
0answers
50 views

IDA Pro monitor applications function calls [duplicate]

is there a function in IDA Pro to monitor all function calls of an application? So for example if I import an application into IDA it gives me functions like "sub_45E5C6", right? And now my question ...
3
votes
0answers
236 views

Implementing call into compiled, undocumented, C DLL; divining exported function prototype

I've been attempting to build my own implementation of Nvidia's Surround functionality by using their DLLs within a more reliable and automatic system. I'm pretty new to this; I've been a programmer ...
1
vote
1answer
116 views

Where is the function cssyyparse code in webkit project? [closed]

Recently, I have viewed webkit source code and there is a function 'cssyyparse' which I cannot find c++ body code. Ther is only declaration of function cssyyparse. // CSSParser.cpp extern int ...
2
votes
0answers
210 views

Decoding A/C IR Codes

I captured infrared codes from an air conditioner remote to realize each code contains the entire state (i.e. temperature, mode, fan speed, etc.) every time a button is pressed. I believe this is so ...
3
votes
1answer
3k views

Which functions of a dll is called in OllyDBG

I`m beginner in OllyDBG. In the debugging of an exe file, I found which dll is used (kernel32, ntdl, user32, etc). I want to get a list of all functions of each dll that are called. How? Thanks a lot....
5
votes
1answer
5k views

Finding address from function name

By checking the human-readable strings in my target application, I found several interesting function names: ... DataIntegrityError GetObjectIdsOfDuplicateLinksErrors GetInvalidClusterIdsExists Main ...
1
vote
1answer
176 views

Declaration of a complex C expression

I used IDA Pro and got the following expression from a produced C file: v25 = (*(int (**)(void))(v22 + 464))(); I am trying to figure out the meaning of the above expression with the following links:...
12
votes
2answers
3k views

Detecting recursive functions in IDA

How can I detect/mark recursive functions in IDA? Trivial method would be to check every function's call list and if it calls itself then it's recursive. I'ld like to put a comment or some kind of ...
3
votes
0answers
2k views

Tracing function call args with IDA Pro

Right now I'm trying to place a trace point and hook it with the Python code that pulls all relevant stuff from the stack. Unfortunately it just gives me the garbage all the time, because the value in ...
3
votes
1answer
1k views

Runtime memory reading with injection

I'm reversing an application written in C. I have a certain function that I want to log runtime, without pausing/stopping the application. My desired values of that function are: [ESP + 4] which ...
2
votes
1answer
577 views

Strange function in IDA Pro: Only one basic block ending with a jmp sub_xxxxxx (instead of a ret)

Analyzing the ELF file /usr/bin/curl (Ubuntu 14.04, 64bit), I stumbled upon a strange function (see image). It is called regularly via call sub_403D90 but does not end with a ret. Instead, it jumps to ...
1
vote
1answer
1k views

How to extract a function call graph from IDA's Pro disassembled file (.asm file)?

I am totally new to reverse engineering science and does not know much about the assembly language. By the way, I am working on a data set of disassembled malicious files available at kaggle. These ...
0
votes
1answer
113 views

Save Valuable Time Reverse Engineering

As we know, time is the bane of reverse engineering. I am wanting to know how are some ways that I can save time in reverse engineering? I have taken some thought and I have been going through many ...
1
vote
1answer
2k views

How does IDA pro generate function names?

I am using IDA pro to decompile a series of applications. These applications share a common feature and what I have found is that in each decompilation each application shares the same set of ...
1
vote
2answers
10k views

How to find functions in games

There's one function I want to find in a game. When you fall through the game map you are "teleported" to specific xyz coordinates. I used to have the memory address of this function, but since then ...
1
vote
1answer
108 views

List late binding functions

I'd like to identify all late-binding calls made by a windows 32 or 64 executable program. I can take a look at the imported functions through the IAT but I'm unable to list the functions called ...
3
votes
1answer
895 views

IDA API - query number of parameters for cdecl functions

I'm writing a script that, among other things, reads and does some processing with parameters to a function. Right now my solution to find the number of arguments for a given function at addr is: (...
2
votes
1answer
6k views

Viewing an exported DLL function in OllyDbg - garbage code

Being rather new to the concept of RE, I wanted to try and take a look at the assembly code in one DLL that I know exports some functions. First, I used this tool - http://www.nirsoft.net/utils/...
8
votes
1answer
1k views

Mapping an external module's source code to assembly - extracting information from source code

The situation is the following: I'm reversing an application, In which I found a lot of functions that belongs to the OpenSSL library. Since I have the source code for this module, I was wondering if ...
12
votes
4answers
535 views

Inverting functions HOWTO

I just read some code that applies a series of transformations to a 4 byte integer. I'm curious to know if the following function is invertible. f(y) = y^(y>>11) A general doubt I have, is the ...
2
votes
1answer
2k views

IDApro subroutine analysis

I am using IDA to find out parameters of a routine in a DLL. I browsed to the routine in question and saw that IDA has automatically done that job for me and put a comment like this: ; ==============...
6
votes
3answers
4k views

How to strip more than symbols?

I've noticed that, even after stripping symbols from my executable, class names and their methods are still included at the end of the executable file. For instance: #include <iostream> using ...
3
votes
1answer
414 views

Experiences from reverse engineers in detecting recursive calls

I have absolutely no experience in reversing real-world binary codes, so I wonder how the obfuscated codes prevent reversers. I doubt that the reverses always find some ways to understand what are ...
2
votes
1answer
359 views

IDA PRO Struct Pointer Counter big number not starting from address offset 0, Lowers a bit slightly but not all the way to 0

I put the whole question in 2 images. From research, it seems I need to use Ctrl+R, but I don't think that's what I need since I couldn't lower the number a bit further in order to reach 0. I think ...
3
votes
2answers
1k views

How do I adjust the length of the parameters in IDA?

In IDA I can easily change the size of the local variables using Alt+P and then changing the "Local Variables area" field to the desired value. However, how can I do this with the parameters size? ...
2
votes
2answers
1k views

Detecting epilogue/prologue of functions [closed]

I'm trying to catch epilogue/prologue of functions in IDApython. Anyone got clue/snippet/algorithm of how should I do this?
3
votes
2answers
381 views

Grouping functions based on their placement/order in the binary

Can I group functions based on their place in the binary? Can I assume functions next to each othe belong to the same logical group, or at least they have similar functionality? I suspect that the ...
4
votes
2answers
1k views

Automatic function naming

I'ld like to know how to bulk rename functions in IDA, based on some condition. Example: Rename all functions to Foo_XYZ where the function accesses a certain static variable, for example : ...

1
2