New answers tagged

0

I now have a working schematic and implementation for the NI file container, blocks, and decompressor. I still cannot interpret data blocks (basically variables in the packer), I'd love some help or discussion there. I understand basic things about DSIN blocks but not sure how the values relate to the data itself. I've put my findings up at https://github....


2

Unlike Linux, syscall numbers can and do change between Windows versions, so any program using raw syscalls would not run properly on a different OS release. The only officially supported API is provided by the system DLLs such as kernel32.dll, user32.dll and so on. So while fully static Windows binaries are possible, they are not practical and so are very ...


0

In PE file, AddressOfEntryPoint is a relative address to the image base, so you will have 0x11046 - 0x10000 = 0x1046 value in Optional Header. For more information, see PE format and search for "AddressOfEntryPoint". The reason you see 0x00011046 being displayed as the entry point (in CFF Explorer I suppose) is that when the file is loaded into ...


0

I think Radare2's 'agj' command only extract function call graph, which is different from CFG(control flow graph where a node represent a basic block).


1

I actually made some headway here on various files of this type, I've written a decompressor also for the LZ blocks. I think hsin stands for 'header section in' and DSIN stands for 'data section in'. There's also 4kin, not sure what that is. There are a few cases in certain files where an incorrect dictionary jump will be used - for example, offset 1, length ...


1

The entry function you mentioned is the function where the entry point of the program is located. This entry function contains the first instructions of the program executed when you run the program. The main function recognized by disassemblers is the the function where the main function of the program which code is compiled directly from the the developer'...


16

Main is usually a programmer-defined entry point, while entry is defined by the compiler, it's doing many other operations such as libc initializations, heap allocation, and so on, and eventually, call the user-defined main entry point. You can see main as a callback function that defined by the user and eventually called by entry.


Top 50 recent answers are included