7
votes
Tracing function calls in x64dbg
It is possible using Trace->Trace into... option. After opening the executable, select this option and specify the message you want to log (in Log text field); for example {a:cip} {i:cip}, which ...
- 3,369
6
votes
Accepted
Functions without a prologue and epilogue?
The prologue and epilogue are not required by the CPU to execute functions, so most compilers only generate them when necessary, or optimization is not enabled. In particular, leaf functions (those ...
- 36.4k
6
votes
Is it possible to build an equivalent function just looking at the input and output of the original function?
Your problem seems to be related to what Sibyl aim at doing (https://github.com/cea-sec/Sibyl).
It tries based on the side effects of the function (return value, memory writes, ...) to identify a ...
- 206
5
votes
Accepted
How to find all functions in DLL
You can get a list of all exported functions just by reading the PE headers. But, that won't give you any function names, or expected arguments lists (*), and it won't give you any functions that are ...
- 12.9k
5
votes
Accepted
Wierd names in import table
As @guntram-blohm says, these are mangled C++ functions. If you demangle the names (using, for example, an online demangler) you will get the fully decorated function names:
public: __thiscall ...
- 4,470
5
votes
Accepted
Why do many imported functions jump to addresses that do not contain instructions?
I assume you are statically inspecting the program, hence, the addresses of the imported symbols wasn't calculated yet by the linker. To understand that better you need to get familiar with two terms, ...
- 8,919
5
votes
Accepted
Get interface definition of undocumented COM objects
Now, this can't be a full-fledged answer from A to Z, unfortunately. But for COM there are only a few steps that are really specific to COM.
The project you linked clearly has reverse-engineered the ...
- 10.9k
5
votes
Is it possible to build an equivalent function just looking at the input and output of the original function?
If you have all the possible input and all the expected outputs, and they're not indistinguishable from encrypted/compressed data, you can find more efficient storage mechanisms than just having a ...
- 151
4
votes
IDA function never called and only cross-referenced as data
Although Nirlzr's answer explains it pretty well, here's an example that considers C++ code and vtables are present. The code is taken from here
#include <iostream>
using namespace std;
class ...
- 2,629
4
votes
Accepted
Why most debuggers don't auto recognize functions?
As assembly instruction sets are reasonably complex, properly figuring out a function boundaries inside a big executable binaries is a somewhat difficult task. Even IDA, which specializes in that, has ...
- 11.7k
4
votes
reverse engineering methodology
Should I really reverse this unknown function from its start
Disclaimer: This is just my opinion. That said, my answer: no, don't do that unless you really need to do that. One of the first things I ...
- 4,470
4
votes
Is it possible to build an equivalent function just looking at the input and output of the original function?
Unless you try all the input possibilities, as you suggested, you can only get an approximation of the function. This is basically one of the basic problems in the machine learning field, so I would ...
- 141
3
votes
Accepted
Figure out whether a function has return value of not?
I see several problems with that approach:
Functions that return double values don't use eax
Functions that return structs don't neccesarily use eax, see here
return values from many functions, like ...
- 12.9k
3
votes
Accepted
Call DLL export in OllyDBG
i compiled the src in commandline (no vs using ewdk)
and it appears ollydbg is able to identify the args and the call export seems to succeed here with some random crap thrown in for s
i assume ...
- 16.3k
3
votes
Accepted
Can I know which function from which dll was called at runtime?
Looks like you're looking for process monitoring tools. Those are tools that use techniques like Hooking (and similar) to generate a runtime list of APIs or events caused by the monitored process.
...
- 11.7k
3
votes
Accepted
Batch rename functions knowing their prototypes in IDA Pro
IDA has the idc.SetType method that would accept a function start offset and a function prototype string and will set that function's prototype, although it will not set the function's name.
The idc....
- 11.7k
3
votes
Get interface definition of undocumented COM objects
well the answers out there are good this is just an addition to show how you could arrive using windbg in command line
dbh is an utility in windbg installation that can load any binary and provide a ...
- 16.3k
3
votes
How to see all functions that called with debugger
Although you can use several tools, I would suggest you to use GDB if possible, since it has a built-in feature of breaking at each function call.
Now, what you can do, is to run your program two ...
- 3,369
3
votes
Accepted
Ghidra error when edit main signature function
I continued to mess with it some more and found a way.
I correct the signature to have a pointer of argv:
int main(int argc, char **argv)
But I don't really know why the pointer works and the ...
- 161
2
votes
Accepted
How is the first jmp skipped in plt entry
In the file on disk, the GOT slot referenced in 0x400450 is initially set up with the address of the PLT stub at 0x400456.
So, the jump is taken the first time and goes to 0x400456 which pushes the ...
- 36.4k
2
votes
Accepted
How to list parameter of function from IDA Pro?
with some hack like this ?
cmt = GetType(ScreenEA());
print cmt
fc = cmt.split("(")
sc = fc[1].split(")")
tc = sc[0].split(",")
for s in tc:
print s
result when cursor is in functionstart
int ...
- 16.3k
2
votes
Accepted
IDA ignoring register changes in pseudocode
As you rightfully figured out, IDA only takes into account changes it understands are related to the rest of the code. It will consider those values only in the case they're indeed return values the ...
- 11.7k
2
votes
Function Address Changes When Gets Referenced elsewhere
not sure what your question is
do you mean you get different address for the function every time you load it?
if yes then disable ASLR (address space layout randomization)
you can use the linker ...
- 16.3k
2
votes
What is the difference between xrefs and stack trace?
x-refs is just a static cross-reference in the binary that can be identified during static-analysis.
So if you main call funcA you could tell that by looking at x-refs on funcA. But you can't be ...
- 4,912
2
votes
Find functions that constantly calls another
I'd solve this by running the target in a debugger and putting a logging bp on the function (OllyDbg has them, should be Ctrl+F2 if I remember correctly) that just writes out the return address from ...
- 1,391
2
votes
Accepted
Help with animation function
How about you breakpoint the function start and take a look at the call stack.
This way you can easily find out the calling convention and used arguments.
All in all, this function looks like it's ...
- 36
2
votes
IDA function never called and only cross-referenced as data
If there are no other references, this indicates there are no call sub_xyz (that IDA identified, at least). Instead, IDA only identified one cross-reference to sub_xyz, and that reference was a ...
- 11.7k
2
votes
Is it possible to get the formula out of a blackbox using neural network
No, you cannot use neural network (NN) to solve problems like this (you probably could, but it would be way to complex). If you already used NN you know that they can get output only if they see it in ...
- 216
2
votes
Get interface definition of undocumented COM objects
This is just an extension of @0xC0000022L's answer. For this question, I will explain ICMLuaUtil COM interface below because IFileOperation COM interface is in shell32.dll, too big ;)
You mentioned ...
- 1,559
2
votes
Is it possible to build an equivalent function just looking at the input and output of the original function?
This problem essentially describes the field of sequential analysis coupled with curve fitting.
If you are able to make some assumptions about the inputs to the secret function that your model needs ...
- 121
Only top scored, non community-wiki answers of a minimum length are eligible