7
votes
Accepted
Any tool for finding IP that a process use/access?
Linux
As @Nirlzr correctly mentioned, netstat -ape | grep <proc_name/pid> will show you the active connections of a process. It might be just enough for you but there are some cases where it ...
- 9,019
3
votes
Understanding the output of Windbg's `dds esp`
The stack can be used to hold all kinds of values, including ones that look like return addresses but aren't. If stack-frames are omitted, then it becomes very difficult to trace backwards without ...
- 4,709
3
votes
Accepted
Why do debuggers sometimes not show entire call stack?
Olly and WinDbg generate the 'call stack' by parsing the actual stack utilizing function signatures and calling convention. When the disassembler doesn't have the signature (e.g. when the developer ...
- 2,906
2
votes
What is the difference between xrefs and stack trace?
x-refs is just a static cross-reference in the binary that can be identified during static-analysis.
So if you main call funcA you could tell that by looking at x-refs on funcA. But you can't be ...
- 4,952
2
votes
Accepted
Android Reverse Engineering Network Traffic Stack Trace
Hello you can start with the following approach:
Decompile the apk file with apktool
convert classes.dex to .jar with dex2jar
open the file with some java decompiler. My favorite is Luyten
Find ...
- 268
2
votes
Accepted
Understanding the output of Windbg's `dds esp`
dds means dump dwords intrepreting the result as symbols
suppose 0x401234 contains 0x77123456 and
0x77123456 is resolved as kernel32!CreateFileA
dds 0x401234 will yield kernel32!CreateFileA
if ...
- 16.7k
2
votes
Trace system calls, including stack (and java stack if possible), on android?
you can get system call stack with strace too. you just need to compile strace with libunwind. After that you just need to use -k to get system call stack for each system call.
- 21
2
votes
Accepted
usercalls in old Win32 game
Yes, this sounds perfectly normal. If the program did not use C++, you won't see thiscall with usage of ecx but just standard stdcall or cdecl which use only stack for passing arguments.
- 36.9k
2
votes
Estimate depth of call stack without symbols
ret instructions are not going to the call stack. When a function executes call, the next instruction address is pushed to the stack and when ret instruction is executed, eip is updated with the next ...
- 1,858
1
vote
How works k command in windbg
It uses the ebp, esp and eip registers for each stack frame unless you explicitly pass them to the k command yourself. If those registers aren't set correctly then usually you'll get a inaccurate ...
- 11
1
vote
VC 6 C++ Exception handling, nTryBlocks=0, pTryBlockMap=0 , how?why?
Actually it was so obvious - I just haven't read the C++ standard and was writing throw() specification thinking it would allow all exceptions - instead it turned out it was the exact opposite.
And ...
- 475
1
vote
Any tool for finding IP that a process use/access?
Since OP's answer was a bit low on details, i'll assume Linux and Dynamic IP.
On most OSes there are tools to list network resources taken by processes. This often includes IP addresses and ports ...
- 11.8k
Only top scored, non community-wiki answers of a minimum length are eligible