Skip to main content
7 votes
Accepted

Functions without a prologue and epilogue?

The prologue and epilogue are not required by the CPU to execute functions, so most compilers only generate them when necessary, or optimization is not enabled. In particular, leaf functions (those ...
Igor Skochinsky's user avatar
  • 36.7k
7 votes

Tracing function calls in x64dbg

It is possible using Trace->Trace into... option. After opening the executable, select this option and specify the message you want to log (in Log text field); for example {a:cip} {i:cip}, which ...
bart1e's user avatar
  • 3,399
6 votes

Is it possible to build an equivalent function just looking at the input and output of the original function?

Your problem seems to be related to what Sibyl aim at doing (https://github.com/cea-sec/Sibyl). It tries based on the side effects of the function (return value, memory writes, ...) to identify a ...
Caroline's user avatar
  • 206
5 votes
Accepted

Why do many imported functions jump to addresses that do not contain instructions?

I assume you are statically inspecting the program, hence, the addresses of the imported symbols wasn't calculated yet by the linker. To understand that better you need to get familiar with two terms, ...
Megabeets's user avatar
  • 8,999
5 votes
Accepted

How to find all functions in DLL

You can get a list of all exported functions just by reading the PE headers. But, that won't give you any function names, or expected arguments lists (*), and it won't give you any functions that are ...
Guntram Blohm's user avatar
5 votes
Accepted

Wierd names in import table

As @guntram-blohm says, these are mangled C++ functions. If you demangle the names (using, for example, an online demangler) you will get the fully decorated function names: public: __thiscall ...
joxeankoret's user avatar
  • 4,488
5 votes
Accepted

Get interface definition of undocumented COM objects

Now, this can't be a full-fledged answer from A to Z, unfortunately. But for COM there are only a few steps that are really specific to COM. The project you linked clearly has reverse-engineered the ...
0xC0000022L's user avatar
  • 10.9k
5 votes

Is it possible to build an equivalent function just looking at the input and output of the original function?

If you have all the possible input and all the expected outputs, and they're not indistinguishable from encrypted/compressed data, you can find more efficient storage mechanisms than just having a ...
Luaan's user avatar
  • 151
4 votes

reverse engineering methodology

Should I really reverse this unknown function from its start Disclaimer: This is just my opinion. That said, my answer: no, don't do that unless you really need to do that. One of the first things I ...
joxeankoret's user avatar
  • 4,488
4 votes
Accepted

Why most debuggers don't auto recognize functions?

As assembly instruction sets are reasonably complex, properly figuring out a function boundaries inside a big executable binaries is a somewhat difficult task. Even IDA, which specializes in that, has ...
NirIzr's user avatar
  • 11.8k
4 votes

IDA function never called and only cross-referenced as data

Although Nirlzr's answer explains it pretty well, here's an example that considers C++ code and vtables are present. The code is taken from here #include <iostream> using namespace std; class ...
sudhackar's user avatar
  • 2,709
4 votes

Is it possible to build an equivalent function just looking at the input and output of the original function?

Unless you try all the input possibilities, as you suggested, you can only get an approximation of the function. This is basically one of the basic problems in the machine learning field, so I would ...
frollo's user avatar
  • 141
4 votes
Accepted

Cutter shows addresses relative to stack but not rbp. How to change it?

The two pictures probably show the same binary being analyzed. But the two Cutter versions might not be the same, and that's likely the cause for the discrepancy you see. Cutter is a front end for ...
feldspar's user avatar
3 votes
Accepted

Batch rename functions knowing their prototypes in IDA Pro

IDA has the idc.SetType method that would accept a function start offset and a function prototype string and will set that function's prototype, although it will not set the function's name. The idc....
NirIzr's user avatar
  • 11.8k
3 votes
Accepted

Figure out whether a function has return value of not?

I see several problems with that approach: Functions that return double values don't use eax Functions that return structs don't neccesarily use eax, see here return values from many functions, like ...
Guntram Blohm's user avatar
3 votes
Accepted

Call DLL export in OllyDBG

i compiled the src in commandline (no vs using ewdk) and it appears ollydbg is able to identify the args and the call export seems to succeed here with some random crap thrown in for s i assume ...
blabb's user avatar
  • 16.4k
3 votes
Accepted

Can I know which function from which dll was called at runtime?

Looks like you're looking for process monitoring tools. Those are tools that use techniques like Hooking (and similar) to generate a runtime list of APIs or events caused by the monitored process. ...
NirIzr's user avatar
  • 11.8k
3 votes

Get interface definition of undocumented COM objects

well the answers out there are good this is just an addition to show how you could arrive using windbg in command line dbh is an utility in windbg installation that can load any binary and provide a ...
blabb's user avatar
  • 16.4k
3 votes

How to see all functions that called with debugger

Although you can use several tools, I would suggest you to use GDB if possible, since it has a built-in feature of breaking at each function call. Now, what you can do, is to run your program two ...
bart1e's user avatar
  • 3,399
3 votes
Accepted

Ghidra error when edit main signature function

I continued to mess with it some more and found a way. I correct the signature to have a pointer of argv: int main(int argc, char **argv) But I don't really know why the pointer works and the ...
Nirgn's user avatar
  • 161
2 votes
Accepted

How is the first jmp skipped in plt entry

In the file on disk, the GOT slot referenced in 0x400450 is initially set up with the address of the PLT stub at 0x400456. So, the jump is taken the first time and goes to 0x400456 which pushes the ...
Igor Skochinsky's user avatar
  • 36.7k
2 votes
Accepted

How to list parameter of function from IDA Pro?

with some hack like this ? cmt = GetType(ScreenEA()); print cmt fc = cmt.split("(") sc = fc[1].split(")") tc = sc[0].split(",") for s in tc: print s result when cursor is in functionstart int ...
blabb's user avatar
  • 16.4k
2 votes
Accepted

IDA ignoring register changes in pseudocode

As you rightfully figured out, IDA only takes into account changes it understands are related to the rest of the code. It will consider those values only in the case they're indeed return values the ...
NirIzr's user avatar
  • 11.8k
2 votes

Function Address Changes When Gets Referenced elsewhere

not sure what your question is do you mean you get different address for the function every time you load it? if yes then disable ASLR (address space layout randomization) you can use the linker ...
blabb's user avatar
  • 16.4k
2 votes

What is the difference between xrefs and stack trace?

x-refs is just a static cross-reference in the binary that can be identified during static-analysis. So if you main call funcA you could tell that by looking at x-refs on funcA. But you can't be ...
Paweł Łukasik's user avatar
2 votes

IDA function never called and only cross-referenced as data

If there are no other references, this indicates there are no call sub_xyz (that IDA identified, at least). Instead, IDA only identified one cross-reference to sub_xyz, and that reference was a ...
NirIzr's user avatar
  • 11.8k
2 votes

Find functions that constantly calls another

I'd solve this by running the target in a debugger and putting a logging bp on the function (OllyDbg has them, should be Ctrl+F2 if I remember correctly) that just writes out the return address from ...
Johann Aydinbas's user avatar
2 votes
Accepted

Help with animation function

How about you breakpoint the function start and take a look at the call stack. This way you can easily find out the calling convention and used arguments. All in all, this function looks like it's ...
Andrew Mason's user avatar
2 votes

Is it possible to get the formula out of a blackbox using neural network

No, you cannot use neural network (NN) to solve problems like this (you probably could, but it would be way to complex). If you already used NN you know that they can get output only if they see it in ...
Rok Tavčar's user avatar
2 votes

Get interface definition of undocumented COM objects

This is just an extension of @0xC0000022L's answer. For this question, I will explain ICMLuaUtil COM interface below because IFileOperation COM interface is in shell32.dll, too big ;) You mentioned ...
Biswapriyo's user avatar
  • 1,569

Only top scored, non community-wiki answers of a minimum length are eligible