Hot answers tagged

16

Main is usually a programmer-defined entry point, while entry is defined by the compiler, it's doing many other operations such as libc initializations, heap allocation, and so on, and eventually, call the user-defined main entry point. You can see main as a callback function that defined by the user and eventually called by entry.


5

Let's break it down line by line. Assuming x is the thing you want to multiply by 21 and it's stored in eax (as it is in this example after line 34). <39>: mov edx, eax ; so copy the x to edx <41>: mov eax, edx ; it's pointless to do this mov; after those two lines eax & edx has the value of x <43>: shl eax, 2 ; so eax = x * 4 <...


4

to search String you cant be using disassemble-all look at the bytes in both commands if you disassemble how can you find the string objdump -s sample.exe |grep -i sample sample.exe: file format pei-i386 404040 00000000 53616d70 6c652100 20634000 ....Sample!. c@. objdump -M intel --disassemble-all sample.exe --start-address=0x404044 --stop-address=...


4

In short, the difference is in the format into which Java and native code are compiled and executed. Compilation into native code formats eliminates from resulting executable a lot of information that Java code keeps by design, including, but not limited to the following list: Class names Method names Properties names and types Methods borders Exact ...


3

This is compiled to simple jump-table. Firstly it subtracts 1 from the a variable, so now your switch-case is for values in range <0;4> inclusive (instead of <1;5>). Next it checks if a is > 4, if so it jumps to the default label at 0A1109F. Note that the JA instruction is for the unsigned values, so it will jump to the default label in case ...


3

those are pointer arithmetics marks is an <<<;ADDRESS;>>>>> assume 0x10000000 it points to an integer whose size is 4 in 32 bit machine so the next integer will be at 0x10000004 , and the next will be at 0x10000008 and so on &marks[0] = 0x10000000 &marks[1] = 0x10000004 &marks[2] = 0x10000008,c,10,14,18,.....nn each of ...


3

It's not calling itself; you're overlooking the * dereferences at the beginning of the call expression. As in: result = (**(__int64 (__fastcall ***)(volatile signed __int32 *))lambda)(lambda); Notice the two ** inside of the first parenthesis? It's dereferencing the address held in the variable named lambda, which the assembly makes clear: .text:...


3

Non-Invertibility (1) It's definitely not invertible. To see this you only need to consider the contents of tmp1 after 2 iterations of the first loop. Let's unroll these 2 iterations (and, for simplicity of exposition only, assume tmp1 was zero on entry to the loop.) This gives - tmp1 = _array_1[ 0 ] * 64 + _array_1[ 1 ]; The values of the first two input ...


3

When executing ELF files, the OS loader does not care about sections but only segments (aka program headers). You need to ensure your code belongs to an executable segment. As can be seen, section .fini starts at 11e8 and has the size of d. The next section - .rodata starts at 2000. Does that mean that the space between 11e8 + d and 2000 does not belong to ...


3

You can't analyze native functions with a standard decompiler because native functions are not implemented in the Java Bytecode (The Java Native Keyword and Methods). You have to use common x86 disassemblers (Like IDA, JEB) to analyze the native functions. At first, search for System.loadLibrary calls, to see which native library gets loaded (should be in a ...


2

SOLVED: I must pass the address of the buffer not the value inside that buffer in WriteProcessMemmory [Call by reference] Modified: WriteProcessMemory(pinfo.hProcess, (LPVOID)(ctx->Ebx + 8), (LPVOID)(&ntHeader->OptionalHeader.ImageBase), 4, 0)


2

Not possible, either through a configuration option or through a plugin. For example, here is the part of the code that prints the [rbp-1Fh] from your example: qsnprintf(v16, v36 - v16, "[%s%c%ah]", gpPlatformStackPointerName, v20, v29); I.e. the format string that produces it is hard-coded in the binary and cannot be modified.


2

If all you're trying to do is replicate what the SysInternals project does, the strings2 project you linked does that and should suit your purposes. The x86/x64 thing is only for a special extraction mode they added, which is separate from the functionality of SysInternals Strings. On the other hand, if you do need to extract strings stored more sneakily (...


2

Basically, when main calls body, it essentially pushes the return address (which is the value of the EIP register, containing the offset of the instruction following the CALL instruction) to the stack, and then jumps to the address of body. When body will finish running (by executing the RET instruction), it will essentially pop the return address from the ...


1

By finding the constructor for the structure type that you're looking at, making note of the VTable address, and adding the indicated offsets to obtain the concrete function pointers for the calls in question.


1

You can parse a header using File > Load file > C header file or create a type library beforehand.


1

If you are using CLIthen do something like: ida_typeinf.idc_parse_types("filename.h", idc.PT_FILE). See this file for more options. Also check this link for GUI, they also explained how to setup your header file. Hope this helps.


1

This topic has been explored by Rolf Rolles in this OpenRCE article (reposted here). Briefly, when the cases are close together, the compiler can use the switch variable to index a jump table. However, when cases are further apart, it would have to generate a huge table with many empty cases which would blow up the binary size. Although the sequence of cmp ...


1

its very hard to understand what you want How to get machine code of a file(mainly executables) in C? so you want a C program that loads an executable file (for example dos,windows,linux exucutable) and showing you the whole or parts of the image (that normaly contains machine code and data)? so there are several documented file formats that can contain ...


1

from binascii import * from pefile import * from capstone import * if(sys.argv[1]): pe = PE(sys.argv[1]) entry = pe.OPTIONAL_HEADER.AddressOfEntryPoint base = pe.OPTIONAL_HEADER.ImageBase OEP = base+entry bytes = pe.get_data(entry,17) print(hexlify(bytes)) for i in (Cs(CS_ARCH_X86,CS_MODE_64).disasm(bytes,OEP)): ...


1

You can make a program that interprets machine code using an engine like Capstone-engine, this is the easiest way to do something that gives you good results in an optimized way easily, keep in mind that this is not an easy task, it is much better to use a ready-made tool, we have many free and very good options and constantly updated like Ghidra, but if you ...


1

It seems it’s simply performing initialization of the VGA registers and clearing the screen buffer. The array at 318EF contains the values of the CRT controller indexed registers (ports 3D4/3D5).


1

Quote From Link #define LOBYTE(x) (*((_BYTE*)&(x))) is that a hypothetical query x is treated as address so x-1 will be a 32 bit type on a x86 machine so theoretically you cannot assign a 32 bit type to an 8 bit type LOBYTE(x) will be a byte and not an address so again theoretically you cannot assign a byte to a byte LOBYTE(x) is an AND ...


1

Assuming, that executable is not packed, and if you got to the killswitch already, just select some asm commands and look for them in debugger. then you can change necessary bytes with NOP. No recompilation would be necessary at all. Recompilation, even if successful, will make executable not exactly the same as original code.


1

For any external functions used (e.g. libc functions), there will exist a stub in the binary's PLT for said function. When the program calls the function, it jumps to the PLT stub, which correctly handles finding the address of the function the first time it is called. For your purposes, you can read the PLT addresses or offsets from the binary, and use that ...


1

It seems you are talking about debugging information. You can use a compilation switch such as /Zi to generate a PDB file with debugging information which can then be used by IDA to label your functions and variables in the disassembly. Note that some information is lost anyway: comments, preprocess or definitions, or any code or data which has been ...


1

Providing you know the length of the flag (obtain for example from RE) you can modify your code in the following way: import claripy flag_chars = [claripy.BVS('flag_%d' % i, 8) for i in range(15)] flag = claripy.Concat(*flag_chars+[claripy.BVV(b'\n')]) That will create an array with 15 (in this example) bit vectors of the size of 8-bits. And on the ...


1

Buffers on the heap are usually easy to spot. Just look for calls to malloc and similar functions, and find the corresponding argument for the buffer size. Buffers on the stack are a little harder to spot, but can often be identified. Usually, you can see the stack pointer address will be decremented to make room for the new buffer. This amount will ...


1

josh's answer is a good one, but one thing to note is that there is an alternative scheme that (usually) does not require inline assembly, and which handles the virtual functions case also. This is how I prefer to interact with C++ programs when I'm doing DLL injection/code reuse like your question is asking. Begin by defining something for the class whose ...


1

This is an interesting problem where some issues have to be solved. For the first part of your question: How to run an exe from memory, you might want to consult the following link: https://stackoverflow.com/questions/305203/createprocess-from-memory-buffer In the following, I will try to show you how to tackle your second question, how to call a class ...


Only top voted, non community-wiki answers of a minimum length are eligible