4
Since the number of bytes in the instructions can be different and they had to put some limit on the column width, this is how it is indicated that there are more bytes in the instruction that those that you see on the screen. A '.' indicates that there's more and it doesn't mean it's always zero(s)- it can be anything.
If this bothers you there are flags ...
2
To write the string "foo" into the memory address 0xdeadbeef:
w foo @ 0xdeadbeef
To write the hex 0x41414141 to the memory address 0xdeadbeef:
w \x41\x41\x41\x41 @ 0xdeadbeef
I recommend also taking a look at the various options for writing using the command w?.
2
The 2 main approaches to disassembly are
Linear sweep - decode all bytes appearing in sections of the executable that are typically reserved for machine code (e.g. the .text section of an ELF binary) as machine code
Recursive traversal - take into account the control flow behavior of the program being disassembled in order to determine what to disassemble
...
2
when you are here 4017ff: 55 push rbp
your 5th argument will be available at [rsp+28]
(8 bytes for return address and 20 bytes for HOMEPARAMS (space for saving the 4 args passed via register)
two pushes and one subtract will make your argument no 5 available at
0x28 + 0x8 +0x8 +0x48 = 0x80
so rbp+0 will hold the address of 5th ...
2
While ARMv7-A does include the Thumb-2 subset used in ARMv7-M, the actually used instructions in ARMv7-A binaries will likely be pretty different from those used in ARMv7-M microcontrollers.
For one example, microcontrollers rarely use NEON floating-point or vector instructions from ARMv7-A (Cortex-M4F has FPU but IIRC it’s single precision only). Conversely,...
1
First of all, I want to clarify some of the concepts about "API calls." I will explain these concepts, mainly thinking of WinAPI and PE files. I'm not claiming these definitions are correct for all systems.
Operating system programming interfaces
I assume you are referring to OS API libraries as API. OS API is consists of different interfaces that ...
1
the instruction lea loads the Effective Address of its operand
so after executing lea rcx, qword ptr ds:[xxxxxxx]
rcx will hold the address xxxxxxx
so if you are sure you need rcx to be 0 in that instruction simply wipe the address from that specific operand
that is make 48:8d05 xyzabcd as 48:8d0425 00000000
or assemble lea rax,qword ptr ds:[0]
keep in mind ...
1
In a nutshell, stripping a binary means removing sections containing symbol and debug information from the file. These sections lie at the end of the binary, separate from the code. Removing this information has no bearing on the code itself, so the locations of functions in the file (their file offsets) will be the same after stripping the binary. Function ...
1
I've spent many hours (too many for me to admit) trying to figure this out and I just realized what it is, right after hitting submit. push instructions implicitly decrease the stack pointer. The call to the function DotProduct calls push three times; once in the call instruction itself, where the return address is implicitly pushed, and twice in the ...
1
You can use r2 to get the data and r2pipe to script it.
iS entropy produce the entropy values for each section. Adding j will produce it in JSON format and scripting it with r2pipe is easy.
import r2pipe
p = r2pipe.open('<path_to_exe>')
res = p.cmdj('iSj entropy')
print([(x['name'],x['entropy']) for x in res['sections']])
[('.text', '6.00602992'), ('....
1
It is indeed possible, and not that hard to do - providing the game doesn't have any anti-cheat nor integrity checks.
The thing you are looking for is called function hooking. If you don't want to mess with assembly there are few good libs that can do the most important and tedious part of work for you.
Detours - developed by Microsoft
Frida
PolyHook
Take ...
Only top voted, non community-wiki answers of a minimum length are eligible
