IDA recognizes standard library functions based on IDA's FLIRT libraries. If IDA isn't detecting statically linked standard library functions in your disassembly, it's likely because
You don't have the correct FLIRT library loaded, or
IDA doesn't have a FLIRT library for the compiler that created your binary (IDA natively supports these compilers)
You can ...
To answer your question, let us first set a solid ground in terms of entities and definitions.
ELF stands for "Executable and Linkable format".
That is, it defines the structure and shape of two types of files:
Executables (Shared Objects *.so and stand-alone executables)
Linkables (Object files *.o)
Let us focus on executables.
Dependencies resolution ...
Okay, so far your question is a bit meager on the informational side, but it's intriguing. Let me start an attempt to answer it. I'll not be able to answer it, lacking the device in question.
Here's what I would do.
Pose as a WiFi access point (AP). Most WiFi cards will allow you to do this, if the software side allows for it as well. If the ...
I'm looking for the same thing and for now I found the class PcodeSyntaxTree having a method called getBasicBlocks(), which returns an array of PcodeBlockBasic elements. This second class has methods like getIn and getOut which retrieve incoming and outgoing nodes (basic blocks), respectively. So I think using this methods should be the interface for ...
The best programming interface to radare2 called r2pipe.
To quote from the project's Github page:
The r2pipe APIs are based on a single r2 primitive found behind
r_core_cmd_str() which is a function that accepts a string parameter
describing the r2 command to run and returns a string with the result.
r2pipe supports many programming ...
These constants are usually defined in the header file corresponds to the API function in use.
You can discover the name of the header file by going into MSDN's SendMessageA page, and looking at the Header row of the Requirements table at the bottom.
In this case, the relevant header is Winuser.h, which you could find in the SDK corresponds to the ...
Fire up API Monitor (with the correct architecture fitting your sample)
Set the API hooks you need. This highly depends on what you are looking for. To see which APIs your exe is usually using you can use ApiLogger (https://www.aldeid.com/wiki/SysAnalyzer/ApiLogger)
Don't forget to set the Breakpoints Before Call
In my example I set a filter on ...
TLDR; you can't.
ProcMon does not record the data which has been read, it only records the API call arguments and return value (such as success or error code). If you want to see the data as well, a debugger or another tool like API Monitor may be more suitable.
To answer the main question, some C functions call WinAPI functions. Some don't.
There are things that you have to call WinAPI function for. (e.g. exit()) There are things that you have convenient WinAPI for, but can implement as pure C, so it depends on the library.
As I understand it, they didn't reverse engineer anything. They wrote an independent implementation based on reading the documentation of the APIs. Oracle's contention was that simply having the same method names in the APIs was a copyright violation, which is obviously silly.
I tried to decode the "AlphaNumeric" string for each movie in the Top 250 Chart.
Looks like they replaced the padding symbol (they use '@' instead of '=') but, once I restored the padding, every decoded string had the same format you reported before (I will use commas, instead of '^A', as field separators):
1, [numeric value], 2, jpg, me + [numeric value]...
Shortly after posting the question I took a closer look at my code for parsing the exports and came to the realization, that I made an incorrect assumption.
In the export directory entries, if a function entry point to the export section, you can find a string there, which depicts the forwarder export name. An example of that is visible in the last screensot ...
This depends on the implementation of the game in the browser.
The API is likely a RESTful API and the format for data exchange is likely JSON.
A modern full stack web development course will often cover both of these subjects.
In terms of reverse engineering the API itself, there's not a huge challenge. Restful APIs and JSON are chosen because they're easy ...
There is a ghidra_script that current does this, see https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Features/Base/ghidra_scripts/MarkCallOtherPcode.java
op = getInstructionAt(toAddr(0x1b034)).getPcode()
Ok, I figured it out. The websocket-client library I use for python writes its own Origin header by default and I was ending up with two Origin headers, which may have been tipping off the server.
I found out you can disable it by adding supress_origin=True when calling connect on the WebSocket.
I (a random bloke on the internet) would do these:
read the EULA and terms&conditions. Do they explicitly prohibit/allow all/some parts of the API?
is the API you're using internal or merely undocumented?
depending on the country/jurisdiction you might not be able to use the results of RE. It can be questionable how much of an RE it is to guess the API ...
That should be rather easy to solve in IDA with IDAPython or IDC.
I remember plugins that name functions based on API calls happening inside for a quick overview, one example here:
Finding all API calls in a function
Essentially it does what you need but note there is no semantic check whatsoever. It just means these API calls appeared in the same ...
Detouring is more or less a patching of the .text section inside of a program. It's practically more or less hacking, you're rerouting a program to do what you want it to do with your own function. Usually by placing the opcode 0xE9 (known as JMP, also added with some 0x90 which is NOP, for alignment) inside of the memory address you're detouring, that JMPs ...
Windows applications do not work in isolation. They have to share the processor with all the other processes, services, drivers and so on. There may be a myriad reasons why a specific API call is slow, and it's quite unlikely the API itself is a problem. Especially with I/O, there are all the caches, drivers, and hardware itself (i.e. HDD/SSD) to consider. ...
this should be a comment but the content is long for a comment so an answer
your statement /subsequent edit / that header files does not contain names
is not correct
E:\ewdk\Program Files\Windows Kits\10\Include\10.0.10586.0\um
:\>grep -irn -B 3 -A 3 GetLocalTime *
There is msdn-crawler, created by Zynamics and then amended by FireEye. I was not able to get it working but maybe you'll have more luck.
Alternatively, you can find an old MSDN CD with CHM files, decompile them to HTML and parse that.
A lot of APIs are called in this case. wmic is an executable. If you're asking because you want to replace such a command the updates installed on the machine are listed under Software\Microsoft\Windows\CurrentVersion\Component Based servicing\Packages. WMI has its own datastores which are probably less useful to you.
Where I would start...
Start by reading about QR codes. I would guess that QR codes aren't that far off from Snapcodes, but Snapcodes probably carry very little information. As in, they only contain a pointer to a Snapchat ID. A Micro QR code can hold 35 characters, which is probably about the capacity of a Snapcode and rather than an anchor point you have ...