16

Main is usually a programmer-defined entry point, while entry is defined by the compiler, it's doing many other operations such as libc initializations, heap allocation, and so on, and eventually, call the user-defined main entry point. You can see main as a callback function that defined by the user and eventually called by entry.


6

Your physical RAM size doesn't say too much about what your memory addresses will look like. What matters is your system architecture and how many bits there are (usually 64 or 32). Virtual memory also makes RAM insignificant; each process has virtual memory space covering possibly the entire address space but mapped to a limited section of physical memory. ...


6

This is most likely code that was compiled without optimizations (-O0 ). In such code redundant operations are very common as the compiler faithfully translates individual statements to machine code but does not try to perform optimizations to remove or simplify redundant ones.


6

It takes the file name, but IDA doesn't recognise it. In this example, IDA interpreted 4-byte string NUL\x00 (4E 55 4C 00) as an offset (address 0x004C554E) in the code. You may force it to interpret it as an ascii string simple by pressing a when the cursor is on the line 006A5D8C. The reason that the byte order is reversed is that x86 architecture uses ...


5

Without the proguard mapping, this is not possible. That information is simply no longer contained in the dex file. The best you could do would be to manually rename the methods, etc. with your own names.


5

When you have just raw bytes without proper headers tools might not know how to process as the code might not start from offset 0. They could try to analyze the bytes to detect if there's code, data or something else but you might also get some false-positives. In your case, you instruct r2 to display those bytes as code (pd - print disassembly) and it does ...


5

You're showing x86 (32bit) shellcode, but are not compiling your program for that architecture, so gcc most likely creates an amd64 (64bit) executable instead. This can be fixed by adding the -m32 switch: gcc -g -Wall -fno-stack-protector -z execstack -m32 code.c -o code You can verify this by running file on the resulting file: code: ELF 32-bit LSB ...


4

You're correctly interpreting C++'s way of implementing class inheritance, however your assumption that the "subobject" is a member object of the class may be incorrect. Through compiled code alone, It is impossible to completely distinguish member objects from additional inheritance in multiple inheritance classes as both appear the same. As a matter of ...


4

After a bit more research, and help from a friend, I figured it out. the movss and mov are opcodes and its usually in the form of a float (for movss atleast) So, hence, you CAN change its value. Simply write movss [..address..],(float)### replace ### with your number. As for my question, it works, I have disabled the entire game's health decrement. ...


4

In binaries compiled with Visual C++, functions which use SEH (Structured exceptions handling), usually use var_4 ([ebp-4]) for the try level value (value specifying the current SEH scope block). The value 0FFFFFFFFh (or -1) is used for the outermost, global function scope (i.e. before and after any __try blocks). For more info check my OpenRCE article.


4

This is function dflt (or __aeabi_i2d) from the ARM compiler libraries. It performs a conversion of a 32-bit signed integer in R0 into a a soft-float double (64-bit floating point value) in R0:R1. An IEEE 754 double consists of a sign bit, 11-bit exponent and 52-bit fraction: 63 62 52 51 0 +------------...


4

Since the number of bytes in the instructions can be different and they had to put some limit on the column width, this is how it is indicated that there are more bytes in the instruction that those that you see on the screen. A '.' indicates that there's more and it doesn't mean it's always zero(s)- it can be anything. If this bothers you there are flags ...


4

This general pattern of exclusive-access instructions is usually seen when atomic variables are modified. C++ Example (C++11 or later) #include <atomic> void release( std::atomic<int>& refcount ) { refcount--; } You can see here on godbolt that GCC's ARM64 compilation of the above produces your assembly code. C Example (C11) #...


4

From Ghidra.re: Sometimes you will see warnings in the decompiler view stating that there are too many branches to recover a jumptable. One reason for this is that there actually is a jump table, but the decompiler can’t determine bounds on the switch variable For your example, this is saying there may a jump table (which is really just an array of ...


3

Could it be multiple inheritance? That could explain why the vptr of the supposed subobject is overwritten by ctor_2 without having to assume the compiler to inline anything. The derived class might actually have two base classes, the "base" and the "subobject". If this is the case, it kinda makes sense why the compiler would make ctor_3 to change the vptr ...


3

The point of dynamic linking a library is not including the library in the object, so the sections you want to disassemble just aren't there. You could even replace the dynamic library (the .so object) with something else, which could result in different code being run by your same main program. So you first need to identify which dynamic objects are ...


3

Try to do ctrl + A - select all and then press D to disassemble. good chance it will solve your problem.


3

Paweł Łukasik is correct. Disassembling the code fragment using Ghidra can be done in 3 steps: Selecting the architecture (which you have already done) Highlighting the bytes to disassemble Press "D" as Paweł stated or right click and select "disassemble"


3

From the decompiler view it cleary states there's no function. Decompiler works when you have one - it shows code of a function. So, if that's the beginning of a function (it might be) just create it by pressing F (or right click, Create Function) while your cursor is on the line that is the beginning of this function. After that the decompiler view should ...


3

Kevin, ls comes in coreutils. The best way to experiment with these programs is to download and manually build the binaries (in this way you can give your favorite options like -g, -O3 during compilation). Anyways, coming back to your question, assuming you want to decompile /usr/bin/ls (that's what I get from your comments on Pawel's answer), then open ...


3

So, the answer was provided in the OP's ticket #1994, just transferring it here for the future seekers: from ghidra.program.model.listing import CodeUnitFormat, CodeUnitFormatOptions codeUnitFormat = CodeUnitFormat(CodeUnitFormatOptions(CodeUnitFormatOptions.ShowBlockName.ALWAYS,CodeUnitFormatOptions.ShowNamespace.ALWAYS,"",True,True,True,True,True,...


3

when you are here 4017ff: 55 push rbp your 5th argument will be available at [rsp+28] (8 bytes for return address and 20 bytes for HOMEPARAMS (space for saving the 4 args passed via register) two pushes and one subtract will make your argument no 5 available at 0x28 + 0x8 +0x8 +0x48 = 0x80 so rbp+0 will hold the address of 5th ...


3

Okay, so let's start by converting the first four instructions to rough pseudocode. I'll include the instructions as comments so you can see what each one does. r5 = r4; // mov r5, r4 - Set R5 to equal the value in R4 r5 >>= 14; // shr r5, #14 - Shift R5 14 bits to the right r5 <<= 1; // shl r5, #1 - Shift ...


2

This isn't a complete answer but is a bit more than fits in a comment. There's definitely a pattern in the powers of 2. They all have exactly 4 bits set. The high bit is always 1 and the lower 15 bits seem to be the same bit pattern (11001) but rotated to different positions. Try filling in the gaps (32, 64, 128, 1024) and show in binary without spaces to ...


2

you don't have to attach to a running process you can open any binary as a dumpfile and ask windbg to disassemble a given function There is a dbgeng api Execute and ExecuteCmdFile that can execute commands you can write a standalone dbgeng executable that can open a binary run the command uf and quit with ".opendump \..\foo.dll ; uf foo!blah;q" sample ...


2

One of the possible ways to do this - use radare2 or Cutter with the r2ghidra plugin. It will load the PDB and use Ghidra decompiler to do the actual decompilation.


2

Yea, it's not completely automatic like IDA Pro. Although the NSA dev team is very active on the project. And any US citizen should be able to add such a feature (via Java) and make a pull request to add it. I found what you do is simply add the module to your Ghidra project. When you click on the module/executable it will ask "...Would you like to analyze ...


2

To write the string "foo" into the memory address 0xdeadbeef: w foo @ 0xdeadbeef To write the hex 0x41414141 to the memory address 0xdeadbeef: w \x41\x41\x41\x41 @ 0xdeadbeef I recommend also taking a look at the various options for writing using the command w?.


2

This question is a bit confusing. Both __fastcall and __thiscall share that they use ecx as the first storage point. So either you implicitly say the class pointer will be in ecx (__thiscall) or you say the function is not a member function but has one argument - which also gets passed in ecx when using __fastcall so the class pointer still ends up in the ...


2

not sure what methodology you are looking for if the said gui is under some debugger you can simply detour a patch or if you are under the wndproc Thread of the gui You can use apis (for example for checking the menu wordwrap in notepad use CheckMenuItem(); ) or use the oldest trick SendMessage From an external App a demo and src of the third method ...


Only top voted, non community-wiki answers of a minimum length are eligible