7
votes
Accepted
What does XREF mean?
Cross References (or simply XREFs) is a feature of disassemblers to show you where certain functions and objects were called from or which functions and objects are used by a specific function. We can ...
- 8,919
4
votes
Accepted
What exactly is this piece of assembly code doing?
How come the jz instruction jump to a non-instruction (0x400AC9)?
It does not. There is no such thing as "an instruction". Jumps do not jump to instructions, they jump to addresses.
How come the ...
- 2,354
3
votes
Accepted
How to call a func in an executable binary?
LIEF
If the binary is a PIE, exporting functions via the LIEF binary instrumentation framework should allow you to call the function you are interested in as if it was a function in a shared object.
...
- 7,078
3
votes
Accepted
Call instruction - preceding ?@_ in references?
The leading ? identifies a C++ name mangled symbol. Two ?? signify operators, constructors, destructors, constant strings, and various compiler generator functions. For example ??0 is a constructor. ...
- 851
3
votes
Accepted
Intel syntax - Meaning of jmp/call instruction with $+5 operand
opcode for call $+5 is e8 00000000 so it calls the next instruction
opcode for jmp $+5 is e9 00000000 so it jumps to the next insturction
76E95FE0 E8 00000000 CALL 76E95FE5 ...
- 16.3k
2
votes
What does XREF mean?
It means a cross-reference. It shows you that this part of code is called or referenced (like data) from another.
- 4,912
2
votes
Accepted
Idenifying far call target in protected mode (x86 assembly)
it seems the "code" you're trying to disassemble is not actually code but just the table of offsets for the indirect jump (likely a switch implementation). Try interpreting it as a list of 4-byte flat ...
- 36.4k
2
votes
IDA - call dword ptr [mana+0Ch] - Where is it pointing to?
From the provided disassembly, mana is a structure and you need to understand this structure and it's members.
The instruction below:
.text:0807EC41 call dword ptr [mana+0Ch]
It ...
- 176
2
votes
Intel syntax - Meaning of jmp/call instruction with $+5 operand
$ = Current position (beginning of the instruction)
+5 = +5 bytes from the beginning of the instruction
jmp $+5 = jmp 3 bytes past the jmp instruction (short jmp takes 2 bytes + 3 bytes past that)
- 586
2
votes
Call instruction - preceding ?@_ in references?
These are so-called "mangled" or "decorated" names. You can use undname utility from Visual Stduio to demangle them:
void * __cdecl operator new(unsigned int)
public: __thiscall CBLObject::...
- 36.4k
2
votes
What is the difference between xrefs and stack trace?
x-refs is just a static cross-reference in the binary that can be identified during static-analysis.
So if you main call funcA you could tell that by looking at x-refs on funcA. But you can't be ...
- 4,912
2
votes
Accepted
How do I call a statically imported function from a Dll? call dword ptr ds <> not working
It appears you've already guessed what the actual issue is - your call instruction is using direct addressing and not relative addressing. This means that when a DLL changes it's location between ...
- 11.7k
1
vote
Adding ltrace information to gdb
If you really want to use GDB to do this, the best option may be scripting it via its Python API.
Examples:
Automate Debugging with GDB Python API
finding a bug in one of 129 threads
Python Scripts ...
- 7,078
1
vote
Accepted
Accessing Call String of CALLOTHER Pcode Instruction via Java API?
There is a ghidra_script that current does this, see https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Features/Base/ghidra_scripts/MarkCallOtherPcode.java
basically:
op = ...
- 441
1
vote
Calling imported DLL functions from an injected DLL?
I guess you need the base address of the loaded DLL to install your hooks.
You can simply call GetModuleHandleA/W if the DLL is already loaded or LoadLibraryA/W if the DLL is loaded later.
Once you ...
- 1,124
1
vote
What exactly is this piece of assembly code doing?
IDA disassembled the instructions incorrectly. You need to manually change the instruction after jz to data and then change the jz destination to code.
- 186
Only top scored, non community-wiki answers of a minimum length are eligible