Hot answers tagged

10 votes
Accepted

mov ecx, arg - How to replicate in C++?

You can either typedef it like this: // typedef <return-type>(__thiscall* <type-name>)(<ecx>, <stack-1>, <stack-2>); typedef int(__thiscall* tSomeFunc)(int thisPtr, int ...
  • 1,273
7 votes
Accepted

What does XREF mean?

Cross References (or simply XREFs) is a feature of disassemblers to show you where certain functions and objects were called from or which functions and objects are used by a specific function. We can ...
  • 8,689
4 votes
Accepted

What exactly is this piece of assembly code doing?

How come the jz instruction jump to a non-instruction (0x400AC9)? It does not. There is no such thing as "an instruction". Jumps do not jump to instructions, they jump to addresses. How come the ...
  • 2,294
3 votes
Accepted

How to extract a function call graph from IDA's Pro disassembled file (.asm file)?

Note: You'll probably get a better answer on stackoverflow, as your question is more about creating software than about reversing it. First, you'll want to split your text file into blocks. You can ...
3 votes
Accepted

Using GetProcAddress with offset syntax

If you run across an API call that you're unfamiliar with, check the MSDN page. Parameter 2 is "The function or variable name, or the function's ordinal value." Looking at your offset only one of ...
  • 972
3 votes
Accepted

Call instruction - preceding ?@_ in references?

The leading ? identifies a C++ name mangled symbol. Two ?? signify operators, constructors, destructors, constant strings, and various compiler generator functions. For example ??0 is a constructor. ...
3 votes
Accepted

Intel syntax - Meaning of jmp/call instruction with $+5 operand

opcode for call $+5 is e8 00000000 so it calls the next instruction opcode for jmp $+5 is e9 00000000 so it jumps to the next insturction 76E95FE0 E8 00000000 CALL 76E95FE5 ...
  • 15.2k
2 votes

Intel syntax - Meaning of jmp/call instruction with $+5 operand

$ = Current position (beginning of the instruction) +5 = +5 bytes from the beginning of the instruction jmp $+5 = jmp 3 bytes past the jmp instruction (short jmp takes 2 bytes + 3 bytes past that)
  • 586
2 votes

Call instruction - preceding ?@_ in references?

These are so-called "mangled" or "decorated" names. You can use undname utility from Visual Stduio to demangle them: void * __cdecl operator new(unsigned int) public: __thiscall CBLObject::...
  • 35.1k
2 votes

What does XREF mean?

It means a cross-reference. It shows you that this part of code is called or referenced (like data) from another.
2 votes
Accepted

Idenifying far call target in protected mode (x86 assembly)

it seems the "code" you're trying to disassemble is not actually code but just the table of offsets for the indirect jump (likely a switch implementation). Try interpreting it as a list of 4-byte flat ...
  • 35.1k
2 votes

IDA - call dword ptr [mana+0Ch] - Where is it pointing to?

From the provided disassembly, mana is a structure and you need to understand this structure and it's members. The instruction below: .text:0807EC41 call dword ptr [mana+0Ch] It ...
2 votes
Accepted

How to call a func in an executable binary?

LIEF If the binary is a PIE, exporting functions via the LIEF binary instrumentation framework should allow you to call the function you are interested in as if it was a function in a shared object. ...
  • 6,889
2 votes

What is the difference between xrefs and stack trace?

x-refs is just a static cross-reference in the binary that can be identified during static-analysis. So if you main call funcA you could tell that by looking at x-refs on funcA. But you can't be ...
1 vote

What exactly is this piece of assembly code doing?

IDA disassembled the instructions incorrectly. You need to manually change the instruction after jz to data and then change the jz destination to code.
1 vote
Accepted

How do I call a statically imported function from a Dll? call dword ptr ds <> not working

It appears you've already guessed what the actual issue is - your call instruction is using direct addressing and not relative addressing. This means that when a DLL changes it's location between ...
  • 11.4k
1 vote

Adding ltrace information to gdb

If you really want to use GDB to do this, the best option may be scripting it via its Python API. Examples: Automate Debugging with GDB Python API finding a bug in one of 129 threads Python Scripts ...
  • 6,889
1 vote
Accepted

Accessing Call String of CALLOTHER Pcode Instruction via Java API?

There is a ghidra_script that current does this, see https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Features/Base/ghidra_scripts/MarkCallOtherPcode.java basically: op = ...
  • 431
1 vote

Calling imported DLL functions from an injected DLL?

I guess you need the base address of the loaded DLL to install your hooks. You can simply call GetModuleHandleA/W if the DLL is already loaded or LoadLibraryA/W if the DLL is loaded later. Once you ...
  • 1,084
1 vote
Accepted

Is it possible to trace data without adding a break point?

Assuming you're using a software breakpoint (int 3), you have a few alternative options: Use a hardware breakpoint instead Use an OllyDbg-style memory breakpoint instead Hook the target function by ...

Only top scored, non community-wiki answers of a minimum length are eligible