New answers tagged assembly
2
The connect syscall takes a sockaddr structure as an argument, which looks something like this:
struct sockaddr_in {
short sin_family;
u_short sin_port;
struct in_addr sin_addr;
char sin_zero[8];
};
They aren't extracting 4444, it's simply passed on the stack as a two-byte short. You are passing to connect, in little-...
0
Not sure if I understand you correctly. If you want to find a function that edits your player health (and possibly find a static address of for example player class) you can just simply right click the address of health you found, then click Find out what writes to this address. All addresses (in the middle of some function) that written to your health will ...
0
Correct me if I'm wrong about my understanding of what you want to achieve:
Find a specific memory address in a running application(I assume a game? becuase you're talking about health, so I guess health-points?)
If so, have you found the address already in cheat engine?
If yes, you can search for strings/values in both Cheat Engine and in Ghidra.
described ...
0
I found here how to convert it with python.
import socket
port = 4444
hex(socket.htons(port))
Result : 0x5c11
The opposite is like that:
socket.htons(0x5c11)
3
je is normally used with cmp instruction like
cmp Reg16/32/64,const
je someplace
while jz is normally used to check specifically for 0 or null
like
dec reg16/32/64
jz someplace
i just modified your code to an infinite loop and emulated it in x86 emulator
see below for code and gif.
code
mov ax, 0x2
dec ax
and ax, 0x1
jz equal
je equal
test ax,...
1
The Intel processors still support 16-bit real mode so the latest manuals do describe it as well, although not as prominently as protected or long mode. Look for mentions of “Real-Address or Virtual-8086 Mode”.
1
Borland's Turbo Debugger also has a text-window-based UI, with the stack in its own window and showing which values in which locations. It doesn't tell you what those values represent, but at least it's always visible.
2
I assume you are using *nix based systems since you mentioned gdb. If you just want to print the stack/registers when you hit a break point, you can use command to set up some print statements. See here.
Installing pwndbg makes it a lot less exhausting as it prints out the stack and registers every time you step, with labels on the stack identifying rbp and ...
2
Registers ss, cs, ds, es, gs, fs are special. They are called segment registers and contain not addresses but selectors.
A selector is used by the CPU as a reference to a segment - area of memory with a specific base (start address), limit (end address) and permissions.
Selectors and segments are set up by the OS and in theory there may be many different ...
0
ok it is _fastCall
so this function takes 5 arguments
2 in registers ecx,edx 3 in stack 8,12,16
and As I Commented edx is used as an argument to the First Indirect call [esi+4]
copy pasted the disassembly to notepad++
used the column editor to rip out the bytes from the paste
pasted the bytes in hxd to make a bin
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A ...
0
To determine if a function is using some registers as parameters: You could find the call references of the function, then see prior to the function call if those registers' values are copied from other operands and then later in the function, those values are used.
1
Typically, a register's value being used in a function prior to being initializing it is a hint that it may be a parameter.
Here we see ecx being used for the first time in this function:
00893c1e 8bf1 mov esi,ecx
There are a few different standard calling conventions that pass parameters in the ecx register such as fastcall. C++ compilers ...
1
compiling this code in godbolt.org the c code assembles to mov 16(%ebp),%edx
which is variable c not b as in your screenshot
0
Rolf Gave a nice Answer comparing his gist with a few minutes of ghidra on the file you edited in ghidra does give a nearly identical Pseudo Code
looking at JniEnv it is defined like
struct {
const struct func* Funcs;
jwhatever GetSomeJava(jsomething foo, jotherthing blah) {
return funcs->GetSomeJava(…...);
}
229 function ptrs like this
}
so creating a ...
2
With a 256-byte table dscrc_table declared, the decryption loop is a one-liner:
for( int i = 0; i < vNewByteArrayLen; ++i )
vNewByteArrayElts[i] ^= a4KeyByte ^ dscrc_table[vNewByteArrayLen];
See my gist on GitHub.
Edit: is this thing really being used to protect your door from being opened by unauthorized people? Throw it away!
Top 50 recent answers are included
