New answers tagged decompilation
0
Actually, you got the flag! do a ROT13 on synt{0p5r7996pnq3qn36377036onor7342s41pq30r3n3q0p46n283862718o7n6s78n} to get flag{0c5e7996cad3da36377036babe7342f41cd30e3a3d0c46a283862718b7a6f78a}
0
I have experienced this in the past too with different tools. What I have done is find something easy to locate in both tools such as the DLL Main of a library or Entry Point of the PE file, (or another string) etc. Then you can calculate the offset between the two tools. Depending on the program, it can change with each run of the debugger. What X64DBG is ...
0
OK after some bold attempts I finally found it quite simple, at least on this Unity version.
First, find the method name string and where it's referenced:
It is referenced at 11376594. But what's at this address? Here we go:
It's a string table. The next thing to do is to find out the table's start address, and then what references to this address. This ...
0
Found of how it works.
The offset is indeed just the difference of the addresses, which can be taken from the static analysis, i.e. from IDA or Ghidra regardless in which address space it loads by default.
So, if the basis address specified by those tools (in the beginning of the image) is say: 140 000 000 and the function starts at 140 039 ea0, then the ...
Top 50 recent answers are included