Hot answers tagged

9

At the bottom left of the IDA View, you'll see the location of the cursor, as file offset (red) as well as virtual location (blue). (Underlines by me, not by Ida).


8

Ollydbg if you want to search references for intermodular functions (calls to dll libraries) , go to : searche for -> All intermodular calls. if you want to search for all readable labels (including that every human readable function) go to : searche for -> Name in all modules , or current module.


7

Linux As @Nirlzr correctly mentioned, netstat -ape | grep <proc_name/pid> will show you the active connections of a process. It might be just enough for you but there are some cases where it would not. netstat has some blind spots -- it only shows connections at a certain point in time. Therefore, connections which closed quickly and every ...


6

Right-click on the disassembly line above in OllyDbg and choose Follow in Dump. That will tell OllyDbg to navigate to address 7FEEC617750 in the dump pane and allow you to see the memory at that address: To see what accesses and writes to the memory at that address, right-click in the dump pane on the first byte of memory at that address and set a hardware ...


5

Following OP's other questions, assuming Windows OS This can be achieved with many 3rd-party solutions for Windows, choose the one which fits best to your needs: Proxifier Proxifier allows network applications that do not support working through proxy servers to operate through a SOCKS or HTTPS proxy and chains. https://www.proxifier.com/ ...


4

Note: This does not answers the question using x32dbg/ollydbg, but another tool. (I can't seem to be able to post a comment). My apologies if it is off topic. You can try with Cheat engine (CE). If yes, download the installer-less release, because the installer includes crap: I assume you downloaded it and extracted it at this point. This software has a ...


4

Your intuition is correct. Changing the starting address of the Thread via SetThreadContext will change the entry point. Here is a C++ snippet to verify our claims #include <Windows.h> #include <WinNT.h> DWORD WINAPI orig_entry( LPVOID param) { MessageBoxA(0, "Original Thread Entrypoint called", "", MB_OK); return 0; } DWORD WINAPI ...


4

Calling this function Get_PE_section_address is rather misleading since it doesn't generically get "the address of a PE section", but rather is used to get the virtual address of the Section Table entry for the first section with a 0x00 as the 5th byte of its section name, iterating through sections backwards starting from the second-to-last section. So for ...


4

Lets take this small example code: #include <stdio.h> #include <stdlib.h> int foo (int a) { return a ? a << 2: 1000; } int main() { printf("The result of foo(10) is %d\n", foo(10)); return EXIT_SUCCESS; } Once in assembly we get: 0000000000400506 <foo>: 400506: 55 push %rbp 400507: 48 ...


4

.symtab The symbol table of readelf (.symtab) shows you the offset of each symbol from the base of the section the symbol is in. As you showed us, when you listing the table you get something like that: $ readelf --symbols <filename> Symbol table '.symtab' contains 471 entries: Num: Value Size Type Bind Vis Ndx Name 0: 00000000 ...


3

This is RIP-relative addressing. Basically, it is adding 0x144ed to the address of the very next instruction - i.e. rcx = rip + 7 (since this instruction is 7 bytes) + 0x144ed. In IDA, that instruction is located at 0x404 so it is adding 0x144ed to (0x404+7) = 0x148f8


3

The comment of Guntram Blohm explains your situation. Since you put the breakpoint at call, the instruction is not executed yet, and you do not see the returned address is pushed in the stack yet. But if you let it execute (for example by typing si), then you will see the returned address is pushed into the stack.


2

Your question is a bit unclear as you first say "Class C has a method "addListerner" which points to an attribute (this + 0x34).", then D::addListener(this + 0x34);. Typo? Also, you should read about (typical) implementations of multiple inheritance. Assume your classes B, C, D have methods b, c, d respectively. A will inherit all of them. Now, if A does ...


2

Based on TERA's message forums, it sounds like it's a poorly developed game. Running an AV product causes it to crash, running TeamSpeak causes it to crash, and using a firewall causes it to crash. Regarding the mov large dword ptr ds:3, 0Dh, my guess would be that this is code intended to force a crash, and sub_8130E0 logs error messages. The decompilation ...


2

this is from win7 but that shouldn't matter much ProcessHeap From Peb of current Process 0:000> dt ntdll!_PEB ProcessHeap @$proc +0x018 ProcessHeap : 0x00430000 Void heap Stat For the same 0:000> !heap -s @$proc->ProcessHeap **************************************************************************** ...


2

Finally I've found an answer. After parsing result lies into $rbp-0xdo (gdb) x/8w ((int*)($rbp-0xd0)) 0x7fffffffdf90: 0x00000000 0x00001111 0x00002222 0x00003333 0x7fffffffdfa0: 0x00004444 0x00005555 0x00006666 0x00007777 when input is 0000:1111:2222:3333:4444:5555:6666:7777 So $rbp-0xb8 (var_b8) is similar to $rbp-0xd0+0x18, ...


2

not sure what your question is do you mean you get different address for the function every time you load it? if yes then disable ASLR (address space layout randomization) you can use the linker switch /DYNAMICBASE:no to make the exe load at a fixed address every time (this is not production friendly disabling ASLR is a security risk) source as it is ...


2

Port I/O works similar to memory I/O, so the low byte (08) will be written to the port 3CE and the high byte (0xFF) to the port 3CF. Example from Use of bitplanes in mode 12h: The index port of the Graphics Controller (part of the VGA interface) is at $3CE. The data port is at (index+1), so $3CF. If we want to write a 4 to index 2, we do: Port[$3CE]:...


2

This type of breakpoint is done through the use of hardware breakpoints. Hardware breakpoints set the debug registers for the thread context (dr0-dr3). The first four debug registers specify the address for the breakpoint, dr7 enables you to specify the condition for each hardware breakpoint set (write, general access, execute). IDA implements this in its ...


2

The file offset of the current location is displayed in the disassembly (IDA View) status bar together with the address.


1

IDA is displaying the Relative Virtual Address based on the base address of the binary (or on that you supply before loading the binary). The reason this is different from the actual address is because it is mapped into memory. The Relative Virtual Address (RVA) is BaseAddress + Offset, if you find the offset address and add it to your at rest binary base ...


1

NIA = CIA + EXTS(LI || 0B00) The || notation denotes concatenation. So if you take LI 0x6A -> 0b1101010 And add two zeroes: 0b1101010 || 0b00 -> 0b110101000 -> 0x1A8 You get: NIA = 0x100004C8 + 0x1A8 = 10000670


1

base16 0x480001a9 == base2 1001000000000000000000110101001 chop of 5 upper bits and two lower bits for LI = 000000000000000001101010 = 0x6a shift left 0x6a by two 0x6a << 2 = 0x1a8 add current instruction Address 0x100004c8 to the result 0x10000670 is the Target Address since LK = 1 put 0x100004cc in link register a simple python demo (...


1

you mean you want to search for a hex pattern in an arbitrary file using your own code either in python or c ? have you considered using regex or grep to satisfy your needs ? there are certain things you should be aware of 1) file offsets will not be equal to virtual offsets 2) even if you manage to map the file you may have to deal with aslr 2) you ...


1

Actually, you said what is the solution: use offsets. You can get the offset for that function, global or whatever using the following IDA Python: Python> hex(here() - idaapi.get_imagebase()) 0x38a0aL It subtracts from the address under the cursor the base address of the database. Then, you can tell your friend the offset and she/he will have to go to ...


1

One (or both) of you can just rebase the program and that should display all the addresses as being the same. If you want him to rebase his program to be the same as yours, figure out your base address (scroll to the top of your .exe in Text View) and then have your friend go to Edit -> Segments -> Rebase Program... and when prompted have him put in your ...


1

Since OP's answer was a bit low on details, i'll assume Linux and Dynamic IP. On most OSes there are tools to list network resources taken by processes. This often includes IP addresses and ports used for existing connections. If you want to list existing connections and their owning processes on linux, running the netstat command. By providing it some ...


1

if you have pdb then this code can fetch you either Symbol or Type from it #include <windows.h> #include <stdio.h> #include <dbghelp.h> #pragma comment(lib , "dbghelp.lib") HANDLE hProcess; BOOL CALLBACK EnumSymProc(PSYMBOL_INFO pSymInfo,ULONG ,PVOID UserContext){ size_t maxcmplen = strlen((PCHAR)UserContext); if( maxcmplen == ...


1

The problem was due to the Page Heap verification, enabled by Gflags. I forgot about that, and the heap verifier was messing with the heap handles. When i disabled it, the handle at the PEB became valid.


1

support for 24-bit address space for 68k has been added in IDA 6.9: https://www.hex-rays.com/products/ida/6.9/ BUGFIX: mc68k: address bus width for mc68000, mc68010, cpu32 reduced to 24 bits


Only top voted, non community-wiki answers of a minimum length are eligible