Questions tagged [functions]
A sequence of instructions performing a basic task packaged as a unit in a program.
101
questions
2
votes
1
answer
379
views
Why function names are visible in a decompiled iOS app?
While decompiling an iOS app, all function names and object names are visible. Why ?
My guess is that during the build, function names are kept by the compilator to allow the linker to do its job. ...
- 121
5
votes
1
answer
2k
views
Radare2 doesn't display the whole function
I am using radare2, I have disassembled the function: sym.loop, it contains a switch witch has 4 cases that calls different functions. After any of the function call, the program exits the loop ...
- 143
0
votes
2
answers
148
views
Function Address Changes When Gets Referenced elsewhere
i have been trying to get the address of a function and use that hex number for other calculations. I have read that you cannot get the address of a function like you get the address of a variable in ...
- 385
0
votes
2
answers
703
views
Why do I get different addresses for the printf function when I disassemble with otool?
I'm using otool on macOS to disassemble some simple C programs I built in order to gain a better understanding of assembly language. I disassembled three programs, all of which consist of a single ...
2
votes
1
answer
428
views
IDA ignoring register changes in pseudocode
The Watcom compiler uses a fairly unusual calling convention, and IDA seems to be discarding some of the changes as irrelevant to its built-in pseudo-code. In my experience, that usually means I'm ...
- 145
1
vote
1
answer
3k
views
Call DLL export in OllyDBG
I am using OllyDbg 2.01 and I walked through this tutorial to figure out how Call DLL export works. Even though it was written for another version of OllyDBG it work just fine. We should notice, that ...
- 124
1
vote
2
answers
10k
views
Can I know which function from which dll was called at runtime?
I'm new to reverse engineering, I want to find out which command in the Source2 Engine's console invokes which function (and in which DLL). For that, I was wondering how can I know:
which functions ...
- 113
0
votes
1
answer
364
views
How is the first jmp skipped in plt entry
Whenever there is a call to a function of a dynamically linked library (0x400586 in the example at the end), the call first leads to a few lines in the .plt section, which in turn starts with a jmp to ...
- 103
2
votes
0
answers
155
views
Restore function key
I have a simple function which looks like that:
keyAlphabet = [-1, 16, 32, 127, 61, -32, -31, 43, 0, 88, 2, 5, 7, 112, 64, 69, 96]
key = ??? # only keyAlphabet values
p = 0x1337
for i in key:
...p*=i
...
- 238
0
votes
1
answer
2k
views
How to list parameter of function from IDA Pro? [duplicate]
I want to list parameter of function for analysis. Can I list the parameter of function using IDA Pro or IDAPython ?
- 141
0
votes
1
answer
576
views
Mach-O functions pointer
I'm trying to understand how Mach-O files work, i already succeed with parsing of load commands, sections, symbols table etc.. anyway i'm trying to figure out a way to find class methods pointer to ...
4
votes
1
answer
287
views
Wierd names in import table
I'm trying to do a static analysis of a PE file to see what it does.
While doing so, I stumbled upon some really wierd function names in my objdump
DLL Name: msvcrt.dll
vma: Hint/Ord Member-Name ...
- 153
5
votes
2
answers
972
views
reverse engineering methodology
I'm new to reverse engineering and I'm following the on line course provided by the opensecurity.info site.
The author provides a methodology for reverse engineering. He recommends to find a function ...
- 151
0
votes
1
answer
230
views
wsasend(disassemblied) function get parameters
Good Evening,
currently, I am struggling around with a problem of getting the parameters of the wsasend function. The only parameter where found out something is this one:
mov qword ptr ss:[rsp+60],...
- 115
1
vote
2
answers
378
views
Figure out whether a function has return value of not?
I am doing binary analysis on x86-64bit ELF binaries. All the binaries are compiled from C language. Basically, for a given function, I would like to figure out whether this function has a return ...
- 2,465
1
vote
1
answer
4k
views
How to find all functions in DLL
I'm looking for a way to get the addresses of all the functions in a DLL in the .text section. Is there a way to do it without using a disassembler and moving through the commands? How does IDA know ...
- 133
-1
votes
1
answer
123
views
Computing function offset differences
When I'm trying to compute the difference between two functions loaded into memory:
int _start(void)
{
// code
}
int _end(void)
{
// code
}
DWORD funcSize = (DWORD) _end - (DWORD) _start;
...
- 153
1
vote
1
answer
757
views
Ida Pro compare constants in same function or not
How do I compare in IDA PRO if constants are located in the same functions or not.. like filter from all constants if I search for 2 constants or more I want to know which function(s) contain all the ...
- 759
1
vote
1
answer
838
views
IDA Strings to Functions (ARM, Protected Functions)
I am working with an ARM (android apk: libgame.so) file that has protected functions (sub_xxxx, etc). The strings are supposed to have cross references with their function, but most of them reference ...
- 41
1
vote
0
answers
709
views
DirectX calls not appearing
I'm trying to do some reverse-engineering to a DirectX 9 game. I've used PIX to see all the DirectX calls of the game, and that part worked correctly.
After that, I wanted to know where in the code ...
- 111
0
votes
1
answer
96
views
Understand what it looks like standard lib functions not properly identified by IDA Pro
I'm reverse engineering a piece of code that has hundreds of calls to a couple of functions I'm not exactly sure what they are doing but looks like standard library functions that do some byte reading?...
- 336
1
vote
0
answers
55
views
IDA Pro monitor applications function calls [duplicate]
is there a function in IDA Pro to monitor all function calls of an application?
So for example if I import an application into IDA it gives me functions like "sub_45E5C6", right?
And now my question ...
- 11
3
votes
0
answers
245
views
Implementing call into compiled, undocumented, C DLL; divining exported function prototype
I've been attempting to build my own implementation of Nvidia's Surround functionality by using their DLLs within a more reliable and automatic system. I'm pretty new to this; I've been a programmer ...
- 131
3
votes
2
answers
338
views
How to force run a method triggered with a series of keys in a game?
This is my first time asking something on SE and I'll do the best I can to provide all of the required information, but I apologize in advance if I'm not clear enough.
I'm trying to reverse engineer ...
- 31
1
vote
1
answer
121
views
Where is the function cssyyparse code in webkit project? [closed]
Recently, I have viewed webkit source code and there is a function 'cssyyparse' which I cannot find c++ body code.
Ther is only declaration of function cssyyparse.
// CSSParser.cpp
extern int ...
- 11
2
votes
0
answers
222
views
Decoding A/C IR Codes
I captured infrared codes from an air conditioner remote to realize each code contains the entire state (i.e. temperature, mode, fan speed, etc.) every time a button is pressed. I believe this is so ...
- 21
4
votes
1
answer
3k
views
Which functions of a dll is called in OllyDBG
I`m beginner in OllyDBG. In the debugging of an exe file, I found which dll is used (kernel32, ntdl, user32, etc). I want to get a list of all functions of each dll that are called.
How?
Thanks a lot....
6
votes
1
answer
7k
views
Finding address from function name
By checking the human-readable strings in my target application, I found several interesting function names:
...
DataIntegrityError
GetObjectIdsOfDuplicateLinksErrors
GetInvalidClusterIdsExists
Main
...
- 275
1
vote
1
answer
223
views
How to distinguish Functions boundaries, entry points and instructions in instruction trace
I have an instruction trace which is collected form a binary analysis platform and I already convert it to assembly instructions.
I want to extract all functions and function calls in the file but ...
- 171
1
vote
1
answer
181
views
Declaration of a complex C expression
I used IDA Pro and got the following expression from a produced C file:
v25 = (*(int (**)(void))(v22 + 464))();
I am trying to figure out the meaning of the above expression with the following links:...
- 319
5
votes
0
answers
2k
views
Tracing function call args with IDA Pro
Right now I'm trying to place a trace point and hook it with the Python code that pulls all relevant stuff from the stack. Unfortunately it just gives me the garbage all the time, because the value in ...
- 171
3
votes
1
answer
720
views
Strange function in IDA Pro: Only one basic block ending with a jmp sub_xxxxxx (instead of a ret)
Analyzing the ELF file /usr/bin/curl (Ubuntu 14.04, 64bit), I stumbled upon a strange function (see image). It is called regularly via call sub_403D90 but does not end with a ret. Instead, it jumps to ...
- 1,518
2
votes
1
answer
2k
views
How to extract a function call graph from IDA's Pro disassembled file (.asm file)?
I am totally new to reverse engineering science and does not know much about the assembly language. By the way, I am working on a data set of disassembled malicious files available at kaggle. These ...
- 123
0
votes
1
answer
121
views
Save Valuable Time Reverse Engineering
As we know, time is the bane of reverse engineering. I am wanting to know how are some ways that I can save time in reverse engineering? I have taken some thought and I have been going through many ...
- 773
1
vote
1
answer
2k
views
How does IDA pro generate function names?
I am using IDA pro to decompile a series of applications. These applications share a common feature and what I have found is that in each decompilation each application shares the same set of ...
- 179
1
vote
1
answer
112
views
List late binding functions
I'd like to identify all late-binding calls made by a windows 32 or 64 executable program. I can take a look at the imported functions through the IAT but I'm unable to list the functions called ...
- 113
3
votes
1
answer
1k
views
IDA API - query number of parameters for cdecl functions
I'm writing a script that, among other things, reads and does some processing with parameters to a function. Right now my solution to find the number of arguments for a given function at addr is:
(...
- 1,022
2
votes
1
answer
6k
views
Viewing an exported DLL function in OllyDbg - garbage code
Being rather new to the concept of RE, I wanted to try and take a look at the assembly code in one DLL that I know exports some functions.
First, I used this tool - http://www.nirsoft.net/utils/...
- 565
3
votes
1
answer
2k
views
IDApro subroutine analysis
I am using IDA to find out parameters of a routine in a DLL. I browsed to the routine in question and saw that IDA has automatically done that job for me and put a comment like this:
; ==============...
- 33
7
votes
3
answers
5k
views
How to strip more than symbols?
I've noticed that, even after stripping symbols from my executable, class names and their methods are still included at the end of the executable file.
For instance:
#include <iostream>
using ...
user2005
1
vote
2
answers
11k
views
How to find functions in games
There's one function I want to find in a game. When you fall through the game map you are "teleported" to specific xyz coordinates. I used to have the memory address of this function, but since then ...
- 35
3
votes
1
answer
438
views
Experiences from reverse engineers in detecting recursive calls
I have absolutely no experience in reversing real-world binary codes, so I wonder how the obfuscated codes prevent reversers. I doubt that the reverses always find some ways to understand what are ...
- 1,410
2
votes
1
answer
471
views
IDA PRO Struct Pointer Counter big number not starting from address offset 0, Lowers a bit slightly but not all the way to 0
I put the whole question in 2 images. From research, it seems I need to use Ctrl+R, but I don't think that's what I need since I couldn't lower the number a bit further in order to reach 0.
I think ...
- 759
3
votes
2
answers
2k
views
How do I adjust the length of the parameters in IDA?
In IDA I can easily change the size of the local variables using Alt+P and then changing the "Local Variables area" field to the desired value.
However, how can I do this with the parameters size? ...
- 627
2
votes
2
answers
2k
views
Detecting epilogue/prologue of functions [closed]
I'm trying to catch epilogue/prologue of functions in IDApython. Anyone got clue/snippet/algorithm of how should I do this?
- 41
4
votes
1
answer
1k
views
Runtime memory reading with injection
I'm reversing an application written in C. I have a certain function that I want to log runtime, without pausing/stopping the application.
My desired values of that function are:
[ESP + 4] which ...
- 2,028
12
votes
2
answers
3k
views
Detecting recursive functions in IDA
How can I detect/mark recursive functions in IDA?
Trivial method would be to check every function's call list and if it calls itself then it's recursive. I'ld like to put a comment or some kind of ...
- 2,028
13
votes
4
answers
619
views
Inverting functions HOWTO
I just read some code that applies a series of transformations to a 4 byte integer. I'm curious to know if the following function is invertible.
f(y) = y^(y>>11)
A general doubt I have, is the ...
user1743
5
votes
2
answers
454
views
Grouping functions based on their placement/order in the binary
Can I group functions based on their place in the binary? Can I assume functions next to each othe belong to the same logical group, or at least they have similar functionality? I suspect that the ...
- 2,028
10
votes
1
answer
2k
views
Mapping an external module's source code to assembly - extracting information from source code
The situation is the following:
I'm reversing an application, In which I found a lot of functions that belongs to the OpenSSL library. Since I have the source code for this module, I was wondering if ...
- 2,028