New answers tagged disassembly
0
Yes, if the input is not 0-terminated. If that's the case, strlen will happily continue counting bytes until it finds one, moving out of the input's bounds. It then depends on how clean the memory is where the input is allocated.
0
I think your current hierarchy model is incomplete and func_3 is one more constructor.
I would suggest checking methods in each vtable to see changed or added methods so it's more clear what is being changed.
You should also look for the destructors and see how they restore vtables, it should add more info to the picture. (look at the first few methods in ...
1
Procedure:
Get base address in x64dbg: Load the binary in x64dbg. Go to "Memory Map" tab.
Find the binary name in info column. Then copy the address with the right
click on it. For example, in the following screenshot, the x86_64 PE binary
name is Project1.exe and the base address is 0x00007FF6A4850000.
Rebase in IDA: Open the binary in IDA. Click on Edit >...
1
This question is a bit confusing.
Both __fastcall and __thiscall share that they use ecx as the first storage point. So either you implicitly say the class pointer will be in ecx (__thiscall) or you say the function is not a member function but has one argument - which also gets passed in ecx when using __fastcall so the class pointer still ends up in the ...
0
The solution is to delete your project (or use new) and add -deleteproject next time when you run your analyzeHeadless script.
1
It's a matter where you want to break. The address 0x770B0D54 is in kernel code and it's probably before kernel starts executing user code. Useful if there's some magic happening before main is executed and you want to step through that.
On the other hand 0x00043b33 is int user code and it's probably the address of the main function so that is the real code ...
1
I would say this really depends on your definition of packing. Typically packing is limited to compression moreso than protection. In this case the binary is updated to maintain virtual memory while minimizing file size. The entry point will decompress everything so, despite the files differing, the virtual memory at the point of executing the original entry ...
1
Is there a difference between unpacked and dumped that I should know about while loading it in IDA to see the actual imports section?
You can dump anything not only packed binaries, but with packed ones it usually comes with stripped imports table just to make it hard(-er) to analyze.
After sample is unpacked it usually rebuild its import table so it can ...
0
Yea, it's not completely automatic like IDA Pro.
Although the NSA dev team is very active on the project. And any US citizen should be able to add such a feature (via Java) and make a pull request to add it.
I found what you do is simply add the module to your Ghidra project.
When you click on the module/executable it will ask "...Would you like to analyze ...
0
Normally the debugger should pause at the location where breakpoint is triggered, or you can use "jump to EIP" or similar command to navigate to the instruction being executed (which should be the one that triggered the exception).
Top 50 recent answers are included
