8 votes

Finding address from function name

Ollydbg if you want to search references for intermodular functions (calls to dll libraries) , go to : searche for -> All intermodular calls. if you want to search for all readable labels (including ...
user avatar
  • 304
6 votes
Accepted

Functions without a prologue and epilogue?

The prologue and epilogue are not required by the CPU to execute functions, so most compilers only generate them when necessary, or optimization is not enabled. In particular, leaf functions (those ...
user avatar
  • 34.9k
6 votes

Is it possible to build an equivalent function just looking at the input and output of the original function?

Your problem seems to be related to what Sibyl aim at doing (https://github.com/cea-sec/Sibyl). It tries based on the side effects of the function (return value, memory writes, ...) to identify a ...
user avatar
  • 206
5 votes
Accepted

How to find all functions in DLL

You can get a list of all exported functions just by reading the PE headers. But, that won't give you any function names, or expected arguments lists (*), and it won't give you any functions that are ...
user avatar
5 votes
Accepted

Wierd names in import table

As @guntram-blohm says, these are mangled C++ functions. If you demangle the names (using, for example, an online demangler) you will get the fully decorated function names: public: __thiscall ...
user avatar
  • 4,325
5 votes
Accepted

IDApro subroutine analysis

It's not very reliable. IDA can't determine types beyond analyzing the size and type of loads and stores. For instance IDA doesn't tell the difference between a pointer to a type and an integer, given ...
user avatar
5 votes
Accepted

List late binding functions

Dependency Walker is your friend. Note that it's almost impossible to find out which libraries/entry points a program uses by static analysis alone, since the strings passed to LoadLibrary and ...
user avatar
5 votes
Accepted

Why do many imported functions jump to addresses that do not contain instructions?

I assume you are statically inspecting the program, hence, the addresses of the imported symbols wasn't calculated yet by the linker. To understand that better you need to get familiar with two terms, ...
user avatar
  • 8,659
5 votes

Is it possible to build an equivalent function just looking at the input and output of the original function?

If you have all the possible input and all the expected outputs, and they're not indistinguishable from encrypted/compressed data, you can find more efficient storage mechanisms than just having a ...
user avatar
  • 151
4 votes
Accepted

How to strip more than symbols?

It is possible that you are using RTTI. Try compiling your code with option -fno-rtti. Update: It is really RTTI. I don't know how exactly it works, but I succeeded to remove those strings as ...
user avatar
  • 7,875
4 votes

IDA API - query number of parameters for cdecl functions

For cdecl the caller needs to clean up the stack. So somewhere after the function call there HAS to be a stack operation that removes the parameters from the stack (remove as in adjust the stack ...
user avatar
  • 260
4 votes

Which functions of a dll is called in OllyDBG

There are quite a few ways to achieve this. In OllyDbg search for all Intermodular calls. This would bring up a list of functions called from the main module. You can the set a logging breakpoint on ...
user avatar
  • 5,860
4 votes

reverse engineering methodology

Should I really reverse this unknown function from its start Disclaimer: This is just my opinion. That said, my answer: no, don't do that unless you really need to do that. One of the first things I ...
user avatar
  • 4,325
4 votes
Accepted

Why most debuggers don't auto recognize functions?

As assembly instruction sets are reasonably complex, properly figuring out a function boundaries inside a big executable binaries is a somewhat difficult task. Even IDA, which specializes in that, has ...
user avatar
  • 11.4k
4 votes

Tracing function calls in x64dbg

It is possible using Trace->Trace into... option. After opening the executable, select this option and specify the message you want to log (in Log text field); for example {a:cip} {i:cip}, which ...
user avatar
  • 3,189
4 votes

IDA function never called and only cross-referenced as data

Although Nirlzr's answer explains it pretty well, here's an example that considers C++ code and vtables are present. The code is taken from here #include <iostream> using namespace std; class ...
user avatar
  • 2,389
4 votes
Accepted

Get interface definition of undocumented COM objects

Now, this can't be a full-fledged answer from A to Z, unfortunately. But for COM there are only a few steps that are really specific to COM. The project you linked clearly has reverse-engineered the ...
user avatar
  • 10.5k
4 votes

Is it possible to build an equivalent function just looking at the input and output of the original function?

Unless you try all the input possibilities, as you suggested, you can only get an approximation of the function. This is basically one of the basic problems in the machine learning field, so I would ...
user avatar
  • 141
3 votes
Accepted

Figure out whether a function has return value of not?

I see several problems with that approach: Functions that return double values don't use eax Functions that return structs don't neccesarily use eax, see here return values from many functions, like ...
user avatar
3 votes
Accepted

Can I know which function from which dll was called at runtime?

Looks like you're looking for process monitoring tools. Those are tools that use techniques like Hooking (and similar) to generate a runtime list of APIs or events caused by the monitored process. ...
user avatar
  • 11.4k
3 votes
Accepted

Declaration of a complex C expression

(*(int (**)(void))(v22 + 464))() is a function call (v22 is an object (perhaps a vtable) that contains a function pointer).
user avatar
3 votes
Accepted

Strange function in IDA Pro: Only one basic block ending with a jmp sub_xxxxxx (instead of a ret)

This is just a bit of optimization. A call xxxx followed by a ret can be optimized to a jmp xxxx.
user avatar
3 votes
Accepted

How to extract a function call graph from IDA's Pro disassembled file (.asm file)?

Note: You'll probably get a better answer on stackoverflow, as your question is more about creating software than about reversing it. First, you'll want to split your text file into blocks. You can ...
user avatar
3 votes
Accepted

How does IDA pro generate function names?

I've seen 4 naming conventions being used: vNNN() when decompiling ARM binaries (i.e.: Android JNI code) - not sure how it numbers them as it doesn't seem it's related to their position or address ...
user avatar
3 votes
Accepted

Viewing an exported DLL function in OllyDbg - garbage code

Your library might get loaded to a location that's completely different from the one it wants to be loaded at, i.e. the address in the header, due to ASLR. Also, when loading a DLL, Ollydbg doesn't ...
user avatar
3 votes

How to find functions in games

So you are looking for the teleport function if I understood you correctly. The address you had will not work obviously, because the binary has changed. What I would do in your position is to get ...
user avatar
3 votes

How to find functions in games

If you can start the program under Ollydbg (many game clients have code that detects if the software runs under a debugger and terminate in one way or another if it does), you could set a hardware ...
user avatar
3 votes
Accepted

Call DLL export in OllyDBG

i compiled the src in commandline (no vs using ewdk) and it appears ollydbg is able to identify the args and the call export seems to succeed here with some random crap thrown in for s i assume ...
user avatar
  • 15k
3 votes
Accepted

Batch rename functions knowing their prototypes in IDA Pro

IDA has the idc.SetType method that would accept a function start offset and a function prototype string and will set that function's prototype, although it will not set the function's name. The idc....
user avatar
  • 11.4k
3 votes

Get interface definition of undocumented COM objects

well the answers out there are good this is just an addition to show how you could arrive using windbg in command line dbh is an utility in windbg installation that can load any binary and provide a ...
user avatar
  • 15k

Only top scored, non community-wiki answers of a minimum length are eligible