Hot answers tagged

9 votes

IDA - How to transform VA to FO?

At the bottom left of the IDA View, you'll see the location of the cursor, as file offset (red) as well as virtual location (blue). (Underlines by me, not by Ida).
user avatar
8 votes

Finding address from function name

Ollydbg if you want to search references for intermodular functions (calls to dll libraries) , go to : searche for -> All intermodular calls. if you want to search for all readable labels (including ...
user avatar
  • 304
7 votes
Accepted

Any tool for finding IP that a process use/access?

Linux As @Nirlzr correctly mentioned, netstat -ape | grep <proc_name/pid> will show you the active connections of a process. It might be just enough for you but there are some cases where it ...
user avatar
  • 8,579
6 votes
Accepted

Failure at finding the value of the dereferenced pointer

Right-click on the disassembly line above in OllyDbg and choose Follow in Dump. That will tell OllyDbg to navigate to address 7FEEC617750 in the dump pane and allow you to see the memory at that ...
user avatar
5 votes
Accepted

Difference between 'readelf' and 'radare2' addresses

.symtab The symbol table of readelf (.symtab) shows you the offset of each symbol from the base of the section the symbol is in. As you showed us, when you listing the table you get something like ...
user avatar
  • 8,579
5 votes
Accepted

Change sending IP of only certain executable

Following OP's other questions, assuming Windows OS This can be achieved with many 3rd-party solutions for Windows, choose the one which fits best to your needs: Proxifier Proxifier allows ...
user avatar
  • 8,579
4 votes
Accepted

getting the static address/offset of a variable

Note: This does not answers the question using x32dbg/ollydbg, but another tool. (I can't seem to be able to post a comment). My apologies if it is off topic. You can try with Cheat engine (CE). If ...
user avatar
  • 188
4 votes
Accepted

Get the PE section address

Calling this function Get_PE_section_address is rather misleading since it doesn't generically get "the address of a PE section", but rather is used to get the virtual address of the Section Table ...
user avatar
4 votes
Accepted

Return address on ESP?

Lets take this small example code: #include <stdio.h> #include <stdlib.h> int foo (int a) { return a ? a << 2: 1000; } int main() { printf("The result of foo(10) is %d\n", foo(...
user avatar
  • 18k
4 votes

Changing start address of thread using combination of Get- and SetThreadContext?

Your intuition is correct. Changing the starting address of the Thread via SetThreadContext will change the entry point. Here is a C++ snippet to verify our claims #include <Windows.h> #include ...
user avatar
  • 5,850
3 votes
Accepted

Operand address in Capstone disassembly is not the same as in IDA/HIEW

This is RIP-relative addressing. Basically, it is adding 0x144ed to the address of the very next instruction - i.e. rcx = rip + 7 (since this instruction is 7 bytes) + 0x144ed. In IDA, that ...
user avatar
  • 1,321
3 votes

IDA - How to transform VA to FO?

To find it using IDAPython: ida_loader.get_fileregion_offset(ea) where "ea" is your virtual offset like 0x400000.
user avatar
  • 66
3 votes

Return address on ESP?

The comment of Guntram Blohm explains your situation. Since you put the breakpoint at call, the instruction is not executed yet, and you do not see the returned address is pushed in the stack yet. But ...
user avatar
2 votes
Accepted

Whats going on in this Class Constructor?

Your question is a bit unclear as you first say "Class C has a method "addListerner" which points to an attribute (this + 0x34).", then D::addListener(this + 0x34);. Typo? Also, you should read about ...
user avatar
2 votes

Cannot run game TERA crashes on mov dword ptr ds:[3],0Dh

Based on TERA's message forums, it sounds like it's a poorly developed game. Running an AV product causes it to crash, running TeamSpeak causes it to crash, and using a firewall causes it to crash. ...
user avatar
2 votes

Heap address Calculation

this is from win7 but that shouldn't matter much ProcessHeap From Peb of current Process 0:000> dt ntdll!_PEB ProcessHeap @$proc +0x018 ProcessHeap : 0x00430000 Void heap Stat For the ...
user avatar
  • 14.8k
2 votes

Unknown variable from asm code

Finally I've found an answer. After parsing result lies into $rbp-0xdo (gdb) x/8w ((int*)($rbp-0xd0)) 0x7fffffffdf90: 0x00000000 0x00001111 0x00002222 0x00003333 0x7fffffffdfa0: ...
user avatar
  • 238
2 votes

Function Address Changes When Gets Referenced elsewhere

not sure what your question is do you mean you get different address for the function every time you load it? if yes then disable ASLR (address space layout randomization) you can use the linker ...
user avatar
  • 14.8k
2 votes

Ida break point on address changed

This type of breakpoint is done through the use of hardware breakpoints. Hardware breakpoints set the debug registers for the thread context (dr0-dr3). The first four debug registers specify the ...
user avatar
  • 29
2 votes

How is the I/O address space on the PC arranged?

Port I/O works similar to memory I/O, so the low byte (08) will be written to the port 3CE and the high byte (0xFF) to the port 3CF. Example from Use of bitplanes in mode 12h: The index port of ...
user avatar
  • 34.6k
2 votes
Accepted

In IDA, why are the addresses of instructions different from the corresponding locations in the original file? How do I find the file locations?

The file offset of the current location is displayed in the disassembly (IDA View) status bar together with the address.
user avatar
  • 34.6k
2 votes

Problems with relocation when unpacking

i found a tool for unpacking UPX x64.exe it work for me. it is called XVolkolak v0.22 i found it here: http://ntinfo.biz/index.html its a universal tool so it can unpack other packers to. Good luck. ...
user avatar
  • 21
2 votes
Accepted

What is copy_block struct in Tricore Arch?

So, the term copy_block seems to be an invention of the forum poster. It is not specific to Tricore but a general approach used in many embedded firmwares to solve the following problem: The ...
user avatar
  • 34.6k
1 vote

multiple base addresses?

In the case you've outlined where the same offset from multiple static addresses modifies the same value, that lets you know that those addresses all lead to the same structure. You're trying to ...
user avatar
  • 2,144
1 vote

In IDA, why are the addresses of instructions different from the corresponding locations in the original file? How do I find the file locations?

IDA is displaying the Relative Virtual Address based on the base address of the binary (or on that you supply before loading the binary). The reason this is different from the actual address is ...
user avatar
  • 109
1 vote

calculate branch target address powerpc

NIA = CIA + EXTS(LI || 0B00) The || notation denotes concatenation. So if you take LI 0x6A -> 0b1101010 And add two zeroes: 0b1101010 || 0b00 -> 0b110101000 -> 0x1A8 You get: NIA = ...
user avatar
  • 34.6k
1 vote

calculate branch target address powerpc

base16 0x480001a9 == base2 1001000000000000000000110101001 chop of 5 upper bits and two lower bits for LI = 000000000000000001101010 = 0x6a shift left 0x6a by two 0x6a << 2 = 0x1a8 add ...
user avatar
  • 14.8k
1 vote

How to find out address in binary file (like IDA) with python code only?

you mean you want to search for a hex pattern in an arbitrary file using your own code either in python or c ? have you considered using regex or grep to satisfy your needs ? there are certain ...
user avatar
  • 14.8k
1 vote

How to refer to the same call on separate IDAs

Actually, you said what is the solution: use offsets. You can get the offset for that function, global or whatever using the following IDA Python: Python> hex(here() - idaapi.get_imagebase()) ...
user avatar
  • 4,305
1 vote

How to refer to the same call on separate IDAs

One (or both) of you can just rebase the program and that should display all the addresses as being the same. If you want him to rebase his program to be the same as yours, figure out your base ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible