9
votes
IDA - How to transform VA to FO?
At the bottom left of the IDA View, you'll see the location of the cursor, as file offset (red) as well as virtual location (blue).
(Underlines by me, not by Ida).
- 12.6k
8
votes
Finding address from function name
Ollydbg
if you want to search references for intermodular functions (calls to dll libraries) , go to : searche for -> All intermodular calls.
if you want to search for all readable labels (including ...
- 304
7
votes
Accepted
Any tool for finding IP that a process use/access?
Linux
As @Nirlzr correctly mentioned, netstat -ape | grep <proc_name/pid> will show you the active connections of a process. It might be just enough for you but there are some cases where it ...
- 8,579
6
votes
Accepted
Failure at finding the value of the dereferenced pointer
Right-click on the disassembly line above in OllyDbg and choose Follow in Dump. That will tell OllyDbg to navigate to address 7FEEC617750 in the dump pane and allow you to see the memory at that ...
- 20.4k
5
votes
Accepted
Difference between 'readelf' and 'radare2' addresses
.symtab
The symbol table of readelf (.symtab) shows you the offset of each symbol from the base of the section the symbol is in.
As you showed us, when you listing the table you get something like ...
- 8,579
5
votes
Accepted
Change sending IP of only certain executable
Following OP's other questions, assuming Windows OS
This can be achieved with many 3rd-party solutions for Windows, choose the one which fits best to your needs:
Proxifier
Proxifier allows ...
- 8,579
4
votes
Accepted
getting the static address/offset of a variable
Note: This does not answers the question using x32dbg/ollydbg, but another tool. (I can't seem to be able to post a comment). My apologies if it is off topic.
You can try with Cheat engine (CE).
If ...
- 188
4
votes
Accepted
Get the PE section address
Calling this function Get_PE_section_address is rather misleading since it doesn't generically get "the address of a PE section", but rather is used to get the virtual address of the Section Table ...
- 20.4k
4
votes
Accepted
Return address on ESP?
Lets take this small example code:
#include <stdio.h>
#include <stdlib.h>
int foo (int a)
{
return a ? a << 2: 1000;
}
int main()
{
printf("The result of foo(10) is %d\n", foo(...
- 18k
4
votes
Changing start address of thread using combination of Get- and SetThreadContext?
Your intuition is correct. Changing the starting address of the Thread via SetThreadContext will change the entry point. Here is a C++ snippet to verify our claims
#include <Windows.h>
#include ...
- 5,850
3
votes
Accepted
Operand address in Capstone disassembly is not the same as in IDA/HIEW
This is RIP-relative addressing. Basically, it is adding 0x144ed to the address of the very next instruction - i.e. rcx = rip + 7 (since this instruction is 7 bytes) + 0x144ed. In IDA, that ...
- 1,321
3
votes
IDA - How to transform VA to FO?
To find it using IDAPython:
ida_loader.get_fileregion_offset(ea)
where "ea" is your virtual offset like 0x400000.
- 66
3
votes
Return address on ESP?
The comment of Guntram Blohm explains your situation. Since you put the breakpoint at call, the instruction is not executed yet, and you do not see the returned address is pushed in the stack yet. But ...
- 1,370
2
votes
Accepted
Whats going on in this Class Constructor?
Your question is a bit unclear as you first say "Class C has a method "addListerner" which points to an attribute (this + 0x34).", then D::addListener(this + 0x34);. Typo?
Also, you should read about ...
- 12.6k
2
votes
Cannot run game TERA crashes on mov dword ptr ds:[3],0Dh
Based on TERA's message forums, it sounds like it's a poorly developed game. Running an AV product causes it to crash, running TeamSpeak causes it to crash, and using a firewall causes it to crash.
...
- 20.4k
2
votes
Heap address Calculation
this is from win7 but that shouldn't matter much
ProcessHeap From Peb of current Process
0:000> dt ntdll!_PEB ProcessHeap @$proc
+0x018 ProcessHeap : 0x00430000 Void
heap Stat For the ...
- 14.8k
2
votes
Unknown variable from asm code
Finally I've found an answer.
After parsing result lies into $rbp-0xdo
(gdb) x/8w ((int*)($rbp-0xd0))
0x7fffffffdf90: 0x00000000 0x00001111 0x00002222 0x00003333
0x7fffffffdfa0: ...
- 238
2
votes
Function Address Changes When Gets Referenced elsewhere
not sure what your question is
do you mean you get different address for the function every time you load it?
if yes then disable ASLR (address space layout randomization)
you can use the linker ...
- 14.8k
2
votes
Ida break point on address changed
This type of breakpoint is done through the use of hardware breakpoints. Hardware breakpoints set the debug registers for the thread context (dr0-dr3). The first four debug registers specify the ...
- 29
2
votes
How is the I/O address space on the PC arranged?
Port I/O works similar to memory I/O, so the low byte (08) will be written to the port 3CE and the high byte (0xFF) to the port 3CF.
Example from Use of bitplanes in mode 12h:
The index port of ...
- 34.6k
2
votes
Accepted
In IDA, why are the addresses of instructions different from the corresponding locations in the original file? How do I find the file locations?
The file offset of the current location is displayed in the disassembly (IDA View) status bar together with the address.
- 34.6k
2
votes
Problems with relocation when unpacking
i found a tool for unpacking UPX x64.exe it work for me.
it is called XVolkolak v0.22 i found it here: http://ntinfo.biz/index.html
its a universal tool so it can unpack other packers to.
Good luck.
...
- 21
2
votes
Accepted
What is copy_block struct in Tricore Arch?
So, the term copy_block seems to be an invention of the forum poster. It is not specific to Tricore but a general approach used in many embedded firmwares to solve the following problem:
The ...
- 34.6k
1
vote
multiple base addresses?
In the case you've outlined where the same offset from multiple static addresses modifies the same value, that lets you know that those addresses all lead to the same structure.
You're trying to ...
- 2,144
1
vote
In IDA, why are the addresses of instructions different from the corresponding locations in the original file? How do I find the file locations?
IDA is displaying the Relative Virtual Address based on the base address of the binary (or on that you supply before loading the binary). The reason this is different from the actual address is ...
- 109
1
vote
calculate branch target address powerpc
NIA = CIA + EXTS(LI || 0B00)
The || notation denotes concatenation. So if you take LI
0x6A -> 0b1101010
And add two zeroes:
0b1101010 || 0b00 -> 0b110101000 -> 0x1A8
You get: NIA = ...
- 34.6k
1
vote
calculate branch target address powerpc
base16 0x480001a9 == base2 1001000000000000000000110101001
chop of 5 upper bits and two lower bits for LI = 000000000000000001101010 = 0x6a
shift left 0x6a by two 0x6a << 2 = 0x1a8
add ...
- 14.8k
1
vote
How to find out address in binary file (like IDA) with python code only?
you mean you want to search for a hex pattern in an arbitrary file using your own code either in python or c ?
have you considered using regex or grep to satisfy your needs ?
there are certain ...
- 14.8k
1
vote
How to refer to the same call on separate IDAs
Actually, you said what is the solution: use offsets. You can get the offset for that function, global or whatever using the following IDA Python:
Python> hex(here() - idaapi.get_imagebase())
...
- 4,305
1
vote
How to refer to the same call on separate IDAs
One (or both) of you can just rebase the program and that should display all the addresses as being the same. If you want him to rebase his program to be the same as yours, figure out your base ...
- 350
Only top scored, non community-wiki answers of a minimum length are eligible