Skip to main content
9 votes
Accepted

What does XREF mean?

Cross References (or simply XREFs) is a feature of disassemblers to show you where certain functions and objects were called from or which functions and objects are used by a specific function. We can ...
Megabeets's user avatar
  • 8,999
4 votes
Accepted

How to call a func in an executable binary?

LIEF If the binary is a PIE, exporting functions via the LIEF binary instrumentation framework should allow you to call the function you are interested in as if it was a function in a shared object. ...
julian's user avatar
  • 7,158
4 votes
Accepted

What exactly is this piece of assembly code doing?

How come the jz instruction jump to a non-instruction (0x400AC9)? It does not. There is no such thing as "an instruction". Jumps do not jump to instructions, they jump to addresses. How come the ...
Jongware's user avatar
  • 2,364
3 votes
Accepted

Call instruction - preceding ?@_ in references?

The leading ? identifies a C++ name mangled symbol. Two ?? signify operators, constructors, destructors, constant strings, and various compiler generator functions. For example ??0 is a constructor. ...
josh poley's user avatar
3 votes
Accepted

Intel syntax - Meaning of jmp/call instruction with $+5 operand

opcode for call $+5 is e8 00000000 so it calls the next instruction opcode for jmp $+5 is e9 00000000 so it jumps to the next insturction 76E95FE0 E8 00000000 CALL 76E95FE5 ...
blabb's user avatar
  • 16.4k
2 votes

What does XREF mean?

It means a cross-reference. It shows you that this part of code is called or referenced (like data) from another.
Paweł Łukasik's user avatar
2 votes
Accepted

Idenifying far call target in protected mode (x86 assembly)

it seems the "code" you're trying to disassemble is not actually code but just the table of offsets for the indirect jump (likely a switch implementation). Try interpreting it as a list of 4-byte flat ...
Igor Skochinsky's user avatar
  • 36.7k
2 votes

IDA - call dword ptr [mana+0Ch] - Where is it pointing to?

From the provided disassembly, mana is a structure and you need to understand this structure and it's members. The instruction below: .text:0807EC41 call dword ptr [mana+0Ch] It ...
c0d3inj3cT's user avatar
2 votes

Intel syntax - Meaning of jmp/call instruction with $+5 operand

$ = Current position (beginning of the instruction) +5 = +5 bytes from the beginning of the instruction jmp $+5 = jmp 3 bytes past the jmp instruction (short jmp takes 2 bytes + 3 bytes past that)
Sigtran's user avatar
  • 586
2 votes

Call instruction - preceding ?@_ in references?

These are so-called "mangled" or "decorated" names. You can use undname utility from Visual Stduio to demangle them: void * __cdecl operator new(unsigned int) public: __thiscall CBLObject::...
Igor Skochinsky's user avatar
  • 36.7k
2 votes

What is the difference between xrefs and stack trace?

x-refs is just a static cross-reference in the binary that can be identified during static-analysis. So if you main call funcA you could tell that by looking at x-refs on funcA. But you can't be ...
Paweł Łukasik's user avatar
2 votes
Accepted

How do I call a statically imported function from a Dll? call dword ptr ds <> not working

It appears you've already guessed what the actual issue is - your call instruction is using direct addressing and not relative addressing. This means that when a DLL changes it's location between ...
NirIzr's user avatar
  • 11.8k
1 vote

Adding ltrace information to gdb

If you really want to use GDB to do this, the best option may be scripting it via its Python API. Examples: Automate Debugging with GDB Python API finding a bug in one of 129 threads Python Scripts ...
julian's user avatar
  • 7,158
1 vote
Accepted

Accessing Call String of CALLOTHER Pcode Instruction via Java API?

There is a ghidra_script that current does this, see https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Features/Base/ghidra_scripts/MarkCallOtherPcode.java basically: op = ...
mumbel's user avatar
  • 441
1 vote

Calling imported DLL functions from an injected DLL?

I guess you need the base address of the loaded DLL to install your hooks. You can simply call GetModuleHandleA/W if the DLL is already loaded or LoadLibraryA/W if the DLL is loaded later. Once you ...
wisk's user avatar
  • 1,154
1 vote

What exactly is this piece of assembly code doing?

IDA disassembled the instructions incorrectly. You need to manually change the instruction after jz to data and then change the jz destination to code.
yellowbyte's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible