New answers tagged

2

ghidra addr = toAddr(0x7ffe0000) currentProgram.memory.createUninitializedBlock("KUSER_SHARED_PAGE",addr,0x1000,0) createData(addr,getDataTypes("KUSER_SHARED_DATA")[0]) result undefined8 main(void) { wprintf((__crt_locale_pointers *)L"Version: %lu.%lu.%lu\n", (ulonglong)KUSER_SHARED_DATA_7ffe0000.NtMajorVersion, ...


3

For IDA/Hex-Rays: In the Loaded Type Libraries window (View->Open subviews->Type libraries), load ntddk_win10 (or whatever Windows version you want, back to Windows XP and Windows Server 2003). In the Structures window (View->Open subviews->Structures), import KUSER_SHARED_DATA. You can simply write the name of the type in the dialog box and ...


2

The answer to the specific question that you asked is: not directly through the UI, but it's possible with a plugin. Sample plugin #18 in the Hex-Rays SDK. The comment at the top of the plugin says: * It shows how to specify a register value at a desired location. * Such a functionality may be useful when the code to decompile is * obfuscated and uses opaque ...


0

For anyone else this happens to... Ensure you use the same Python version as the original author. That is, I originally created the ELF with Python 3.7. But I tried the reversing process on a different machine - with Python 3.8. Learn from my mistake!


0

This person has a microscope with apparently an identical WiFi camera module and detailed his reverse engineering efforts. It turns out the first 1450 byte packet has a short header followed by the bytes to begin a jpeg image, and the end of variable-length packet ends the jpeg image. Concatenating all the packets and stripping the header gives the data for ...


0

In hexrays.hpp, citem_t is the base class for both cinsn_t ("instructions", such as for loops, if statements, etc.) and cexpr_t ("expressions", such as addition, memory dereference, function calls, etc.) citem_t has a field ea_t ea;. That field stores the address of the corresponding line in the assembly language (unless it's BADADDR, in ...


0

the file command says the binary is unstripped you shouldn't have much problem identifying the arguments the &0xffffffff is a mask to get a 32 bit value from a 64 bit value for example if a function is proto typed as ulong64 foo(ulong64 a, ulong b); as x64 calling convention uses 6 registers in linux system ABI RDI, RSI, RDX, RCX, R8, and R9 you cannot ...


2

as i commented i used windbg to dump those structures sample code used for walk through #include <iostream> //01 #include <list> //02 #include <vector> //03 #include <map> ...


Top 50 recent answers are included