7
votes
Accepted
Functions without a prologue and epilogue?
The prologue and epilogue are not required by the CPU to execute functions, so most compilers only generate them when necessary, or optimization is not enabled. In particular, leaf functions (those ...
- 36.9k
7
votes
Tracing function calls in x64dbg
It is possible using Trace->Trace into... option. After opening the executable, select this option and specify the message you want to log (in Log text field); for example {a:cip} {i:cip}, which ...
- 3,419
6
votes
Is it possible to build an equivalent function just looking at the input and output of the original function?
Your problem seems to be related to what Sibyl aim at doing (https://github.com/cea-sec/Sibyl).
It tries based on the side effects of the function (return value, memory writes, ...) to identify a ...
- 206
5
votes
Accepted
Get interface definition of undocumented COM objects
Now, this can't be a full-fledged answer from A to Z, unfortunately. But for COM there are only a few steps that are really specific to COM.
The project you linked clearly has reverse-engineered the ...
- 10.9k
5
votes
Accepted
Why do many imported functions jump to addresses that do not contain instructions?
I assume you are statically inspecting the program, hence, the addresses of the imported symbols wasn't calculated yet by the linker. To understand that better you need to get familiar with two terms, ...
- 9,019
5
votes
Is it possible to build an equivalent function just looking at the input and output of the original function?
If you have all the possible input and all the expected outputs, and they're not indistinguishable from encrypted/compressed data, you can find more efficient storage mechanisms than just having a ...
- 151
4
votes
IDA function never called and only cross-referenced as data
Although Nirlzr's answer explains it pretty well, here's an example that considers C++ code and vtables are present. The code is taken from here
#include <iostream>
using namespace std;
class ...
- 2,739
4
votes
Accepted
Why most debuggers don't auto recognize functions?
As assembly instruction sets are reasonably complex, properly figuring out a function boundaries inside a big executable binaries is a somewhat difficult task. Even IDA, which specializes in that, has ...
- 11.8k
4
votes
Is it possible to build an equivalent function just looking at the input and output of the original function?
Unless you try all the input possibilities, as you suggested, you can only get an approximation of the function. This is basically one of the basic problems in the machine learning field, so I would ...
- 141
4
votes
Accepted
Ghidra error when edit main signature function
I continued to mess with it some more and found a way.
I correct the signature to have a pointer of argv:
int main(int argc, char **argv)
But I don't really know why the pointer works and the ...
- 181
4
votes
Accepted
Cutter shows addresses relative to stack but not rbp. How to change it?
The two pictures probably show the same binary being analyzed. But the two Cutter versions might not be the same, and that's likely the cause for the discrepancy you see.
Cutter is a front end for ...
- 116
3
votes
How to see all functions that called with debugger
Although you can use several tools, I would suggest you to use GDB if possible, since it has a built-in feature of breaking at each function call.
Now, what you can do, is to run your program two ...
- 3,419
3
votes
Accepted
Batch rename functions knowing their prototypes in IDA Pro
IDA has the idc.SetType method that would accept a function start offset and a function prototype string and will set that function's prototype, although it will not set the function's name.
The idc....
- 11.8k
3
votes
Get interface definition of undocumented COM objects
well the answers out there are good this is just an addition to show how you could arrive using windbg in command line
dbh is an utility in windbg installation that can load any binary and provide a ...
- 16.7k
3
votes
Accepted
Call DLL export in OllyDBG
i compiled the src in commandline (no vs using ewdk)
and it appears ollydbg is able to identify the args and the call export seems to succeed here with some random crap thrown in for s
i assume ...
- 16.7k
3
votes
Accepted
Can I know which function from which dll was called at runtime?
Looks like you're looking for process monitoring tools. Those are tools that use techniques like Hooking (and similar) to generate a runtime list of APIs or events caused by the monitored process.
...
- 11.8k
2
votes
Accepted
How is the first jmp skipped in plt entry
In the file on disk, the GOT slot referenced in 0x400450 is initially set up with the address of the PLT stub at 0x400456.
So, the jump is taken the first time and goes to 0x400456 which pushes the ...
- 36.9k
2
votes
Function Address Changes When Gets Referenced elsewhere
not sure what your question is
do you mean you get different address for the function every time you load it?
if yes then disable ASLR (address space layout randomization)
you can use the linker ...
- 16.7k
2
votes
Accepted
Help with animation function
How about you breakpoint the function start and take a look at the call stack.
This way you can easily find out the calling convention and used arguments.
All in all, this function looks like it's ...
- 36
2
votes
Accepted
IDA ignoring register changes in pseudocode
As you rightfully figured out, IDA only takes into account changes it understands are related to the rest of the code. It will consider those values only in the case they're indeed return values the ...
- 11.8k
2
votes
IDA function never called and only cross-referenced as data
If there are no other references, this indicates there are no call sub_xyz (that IDA identified, at least). Instead, IDA only identified one cross-reference to sub_xyz, and that reference was a ...
- 11.8k
2
votes
Find functions that constantly calls another
I'd solve this by running the target in a debugger and putting a logging bp on the function (OllyDbg has them, should be Ctrl+F2 if I remember correctly) that just writes out the return address from ...
- 1,391
2
votes
What is the difference between xrefs and stack trace?
x-refs is just a static cross-reference in the binary that can be identified during static-analysis.
So if you main call funcA you could tell that by looking at x-refs on funcA. But you can't be ...
- 4,952
2
votes
Get interface definition of undocumented COM objects
This is just an extension of @0xC0000022L's answer. For this question, I will explain ICMLuaUtil COM interface below because IFileOperation COM interface is in shell32.dll, too big ;)
You mentioned ...
- 1,589
2
votes
Is it possible to get the formula out of a blackbox using neural network
No, you cannot use neural network (NN) to solve problems like this (you probably could, but it would be way to complex). If you already used NN you know that they can get output only if they see it in ...
- 216
2
votes
Is it possible to build an equivalent function just looking at the input and output of the original function?
This problem essentially describes the field of sequential analysis coupled with curve fitting.
If you are able to make some assumptions about the inputs to the secret function that your model needs ...
- 121
2
votes
Accepted
Extracting functions of .obj file (compiled by myself with Visual Studio 19) --> extracts wrong data
from your paste above I presume
You Want to get this data from the object files ( *.obj ) and not from the compiled and linked executable
if yes then COFF (component object file format ) is pretty ...
- 16.7k
2
votes
Accepted
Why some functions in IDA can't be searched
You are not looking at functions that you can't reach, but at unassigned variables.
As you said, you are looking at the .bss section. From Wikipedia, the .bss section is
the portion of an object file,...
- 709
2
votes
Accepted
does mov DWORD PTR 32[rsp], 5 means mov DWORD PTR [rsp+32], 5?
Yes, mov DWORD PTR 40[rsp], 6 is the same as mov DWORD PTR [rsp + 40], 6. The first syntax makes a lot more sense in cases where the constant is the base address of an array, and the register contains ...
- 943
1
vote
How to see all functions that called with debugger
In addition to Nirlzr's answer, you can go to the function Imports window in the debugger (IDA, OllyDbg and x64Dbg for example), and set a breakpoint on the functions you are curious about. Then, ...
- 1,880
Only top scored, non community-wiki answers of a minimum length are eligible