Skip to main content
7 votes
Accepted

Any tool for finding IP that a process use/access?

Linux As @Nirlzr correctly mentioned, netstat -ape | grep <proc_name/pid> will show you the active connections of a process. It might be just enough for you but there are some cases where it ...
Megabeets's user avatar
  • 8,999
5 votes
Accepted

Change sending IP of only certain executable

Following OP's other questions, assuming Windows OS This can be achieved with many 3rd-party solutions for Windows, choose the one which fits best to your needs: Proxifier Proxifier allows ...
Megabeets's user avatar
  • 8,999
5 votes
Accepted

Difference between 'readelf' and 'radare2' addresses

.symtab The symbol table of readelf (.symtab) shows you the offset of each symbol from the base of the section the symbol is in. As you showed us, when you listing the table you get something like ...
Megabeets's user avatar
  • 8,999
4 votes
Accepted

getting the static address/offset of a variable

Note: This does not answers the question using x32dbg/ollydbg, but another tool. (I can't seem to be able to post a comment). My apologies if it is off topic. You can try with Cheat engine (CE). If ...
Riptide's user avatar
  • 188
4 votes
Accepted

PE ImageBase presence in PDB

I believe this information is not stored within the PDB files in any recent versions. Microsoft's DIA SDK used for dumping information contained in PDB files does provide a method named ...
ynwarcs's user avatar
  • 441
3 votes
Accepted

In IDA, why are the addresses of instructions different from the corresponding locations in the original file? How do I find the file locations?

The file offset of the current location is displayed in the disassembly (IDA View) status bar together with the address.
Igor Skochinsky's user avatar
  • 36.7k
3 votes
Accepted

Operand address in Capstone disassembly is not the same as in IDA/HIEW

This is RIP-relative addressing. Basically, it is adding 0x144ed to the address of the very next instruction - i.e. rcx = rip + 7 (since this instruction is 7 bytes) + 0x144ed. In IDA, that ...
cimarron's user avatar
  • 1,341
3 votes

IDA - How to transform VA to FO?

To find it using IDAPython: ida_loader.get_fileregion_offset(ea) where "ea" is your virtual offset like 0x400000.
Cih2001's user avatar
  • 66
2 votes
Accepted

Whats going on in this Class Constructor?

Your question is a bit unclear as you first say "Class C has a method "addListerner" which points to an attribute (this + 0x34).", then D::addListener(this + 0x34);. Typo? Also, you should read about ...
Guntram Blohm's user avatar
2 votes

Heap address Calculation

this is from win7 but that shouldn't matter much ProcessHeap From Peb of current Process 0:000> dt ntdll!_PEB ProcessHeap @$proc +0x018 ProcessHeap : 0x00430000 Void heap Stat For the ...
blabb's user avatar
  • 16.4k
2 votes

Unknown variable from asm code

Finally I've found an answer. After parsing result lies into $rbp-0xdo (gdb) x/8w ((int*)($rbp-0xd0)) 0x7fffffffdf90: 0x00000000 0x00001111 0x00002222 0x00003333 0x7fffffffdfa0: ...
desu's user avatar
  • 238
2 votes

Function Address Changes When Gets Referenced elsewhere

not sure what your question is do you mean you get different address for the function every time you load it? if yes then disable ASLR (address space layout randomization) you can use the linker ...
blabb's user avatar
  • 16.4k
2 votes

Ida break point on address changed

This type of breakpoint is done through the use of hardware breakpoints. Hardware breakpoints set the debug registers for the thread context (dr0-dr3). The first four debug registers specify the ...
Jason's user avatar
  • 39
2 votes

How is the I/O address space on the PC arranged?

Port I/O works similar to memory I/O, so the low byte (08) will be written to the port 3CE and the high byte (0xFF) to the port 3CF. Example from Use of bitplanes in mode 12h: The index port of ...
Igor Skochinsky's user avatar
  • 36.7k
2 votes

Problems with relocation when unpacking

i found a tool for unpacking UPX x64.exe it work for me. it is called XVolkolak v0.22 i found it here: http://ntinfo.biz/index.html its a universal tool so it can unpack other packers to. Good luck. ...
Luffe's user avatar
  • 21
2 votes
Accepted

What is copy_block struct in Tricore Arch?

So, the term copy_block seems to be an invention of the forum poster. It is not specific to Tricore but a general approach used in many embedded firmwares to solve the following problem: The ...
Igor Skochinsky's user avatar
  • 36.7k
2 votes
Accepted

How can I use cutter like ida, trying to search by address

Seek or goto an address in cutter could be done by pressing G. It'll take the focus to the top where you see an address bar like such Just paste the address or function name and press Enter
sudhackar's user avatar
  • 2,709
1 vote

IDA - Rename Address/Function: Says name exists already but it does not show up anywhere

The namespace in IDA database includes not only names in disassembly but also structs and enums, so check there too Additionally, not all names are included in the name list (you can uncheck “include ...
Igor Skochinsky's user avatar
  • 36.7k
1 vote
Accepted

2 byte format string attacks

The second and third methods are simply variants of the first method, using different write sizes. The %n format specifier writes 4 bytes to the destination address. There are times where you may not ...
multithr3at3d's user avatar
1 vote

How to get address or symbol of the usage of a constant located in rodata?

It cannot be solved in all cases. Some string (start) is not referenced in the whole text at all, even if you turned on all optimizations. Let's see the following example. #define _FILE strrchr(...
betontalpfa's user avatar
1 vote

Problems with relocation when unpacking

AFAIK there is no existing tool but you should be able to create one using the approach used by DOS unpackers: Run the binary once, dump it at the entry point Run it second time, forcing the load ...
Igor Skochinsky's user avatar
  • 36.7k
1 vote

How to find the new address of a function on a new version of the same assembly with IDA?

BinnDiff and Diaphora do exactly what you ask.
macro_controller's user avatar
1 vote

In IDA, why are the addresses of instructions different from the corresponding locations in the original file? How do I find the file locations?

IDA is displaying the Relative Virtual Address based on the base address of the binary (or on that you supply before loading the binary). The reason this is different from the actual address is ...
TJ Nel's user avatar
  • 119
1 vote

calculate branch target address powerpc

NIA = CIA + EXTS(LI || 0B00) The || notation denotes concatenation. So if you take LI 0x6A -> 0b1101010 And add two zeroes: 0b1101010 || 0b00 -> 0b110101000 -> 0x1A8 You get: NIA = ...
Igor Skochinsky's user avatar
  • 36.7k
1 vote

calculate branch target address powerpc

base16 0x480001a9 == base2 1001000000000000000000110101001 chop of 5 upper bits and two lower bits for LI = 000000000000000001101010 = 0x6a shift left 0x6a by two 0x6a << 2 = 0x1a8 add ...
blabb's user avatar
  • 16.4k
1 vote

How to find out address in binary file (like IDA) with python code only?

you mean you want to search for a hex pattern in an arbitrary file using your own code either in python or c ? have you considered using regex or grep to satisfy your needs ? there are certain ...
blabb's user avatar
  • 16.4k
1 vote

multiple base addresses?

In the case you've outlined where the same offset from multiple static addresses modifies the same value, that lets you know that those addresses all lead to the same structure. You're trying to ...
dsasmblr's user avatar
  • 2,234
1 vote

How to refer to the same call on separate IDAs

Actually, you said what is the solution: use offsets. You can get the offset for that function, global or whatever using the following IDA Python: Python> hex(here() - idaapi.get_imagebase()) ...
joxeankoret's user avatar
  • 4,488
1 vote

How to refer to the same call on separate IDAs

One (or both) of you can just rebase the program and that should display all the addresses as being the same. If you want him to rebase his program to be the same as yours, figure out your base ...
theTheodidact's user avatar
1 vote

Any tool for finding IP that a process use/access?

Since OP's answer was a bit low on details, i'll assume Linux and Dynamic IP. On most OSes there are tools to list network resources taken by processes. This often includes IP addresses and ports ...
NirIzr's user avatar
  • 11.8k

Only top scored, non community-wiki answers of a minimum length are eligible