Tag Info

Hot answers tagged functions

15

I lack 9 reputation points, so sadly I can't comment the great answer by w_s. ;) Just for completeness, the concept described is known in graph theory as "Tarjan's Algorithm" for finding strongly connected components. Wikipedia has a nice animation that helps following the steps. For study, here is another (more formal) Python implementation, it's the ...

14

A good way to quickly find if a function f() has an inverse or not, is trying to find two elements of the initial domain x and y such that x!=y and f(x)==f(y). If such couple of elements exist, you cannot distinguish them in the target domain of f and, thus, a reverse function cannot be built. Looking at your example: f(x) = x^(x>>11), we can split ...

12

It is not trivial task. You can do it relatively easy if you not taking in account indirect calls (for example such as virtual functions in C++) and calls from another function like this: int f() { g(); } int g() { f(); } It can be much more complicated if one of your functions is in another binary (dll for example). So, there are two ways to do it,...

9

The IDAScope plugin has similar functionality to rename functions based on the Windows API functions they are calling. You can find a standalone script here that does that http://hooked-on-mnemonics.blogspot.fr/2012/06/automated-generic-function-naming-in.html it should give you an idea how to implement what you are looking for.

8

Perror already covered this particular case, but here are some general principles for inverting similar functions. Note: all of this assumes the integer is either unsigned, or it is signed using two's complement and using unsigned shifts. In Java, two's complement is guaranteed. In C/C++, it is not guaranteed, but it's almost always the case in practice, ...

8

Build the module with debug symbols Load the module you built into IDA Pro and import the debug symbols Use BinDiff to port function names, etc. from the IDB of the module you built to the IDB of your target module

8

Ollydbg if you want to search references for intermodular functions (calls to dll libraries) , go to : searche for -> All intermodular calls. if you want to search for all readable labels (including that every human readable function) go to : searche for -> Name in all modules , or current module.

6

The prologue and epilogue are not required by the CPU to execute functions, so most compilers only generate them when necessary, or optimization is not enabled. In particular, leaf functions (those that don't call other functions) do not usually need a prolog (unless required by the ABI) and the compiler may safely omit it.

6

Your problem seems to be related to what Sibyl aim at doing (https://github.com/cea-sec/Sibyl). It tries based on the side effects of the function (return value, memory writes, ...) to identify a known function. Of course, you will need a kind of database to "learn" the function !

5

Dependency Walker is your friend. Note that it's almost impossible to find out which libraries/entry points a program uses by static analysis alone, since the strings passed to LoadLibrary and GetProcAddress might be obfuscated, i.e. not visible in the binary. Dependency Walker catches those calls at runtime, which means a) you need to run the program - ...

5

It's not very reliable. IDA can't determine types beyond analyzing the size and type of loads and stores. For instance IDA doesn't tell the difference between a pointer to a type and an integer, given that they're the same size, as far as I know. Other than that all it can do is propagate type information entered by the user. I believe the Hex-Rays ...

5

I try to give a very superficial answer for your question because I am quite sure that there are other treatments for this problem. Mathematically, the function f(y) = y^(y >> 11) is invertible in the sense that the left-inversion, namely a function g so that y = g(f(y)) exists, because f is an injective function. However that does not mean we can ...

5

You can get a list of all exported functions just by reading the PE headers. But, that won't give you any function names, or expected arguments lists (*), and it won't give you any functions that are internal to the DLL. In the general case, the only thing you can do is start with exported functions, disassemble from there, follow jmps, and mark everything ...

5

As @guntram-blohm says, these are mangled C++ functions. If you demangle the names (using, for example, an online demangler) you will get the fully decorated function names: public: __thiscall bad_cast::bad_cast(class bad_cast const &) public: virtual __thiscall bad_cast::~bad_cast(void) So these functions are the constructor and the destructor for ...

5

I assume you are statically inspecting the program, hence, the addresses of the imported symbols wasn't calculated yet by the linker. To understand that better you need to get familiar with two terms, PLT and GOT. Anyway, even if you are debugging the file, these are not functiona but a table with pointers. So pdf isn't what you should try. Give a shot to pd....

5

If you have all the possible input and all the expected outputs, and they're not indistinguishable from encrypted/compressed data, you can find more efficient storage mechanisms than just having a large lookup table. Even a simple genetic algorithm can very quickly get you to "use a * b, unless a == 234" (I've actually made a solver specifically for this ...

4

You can write an IDC script to do this: IDA Online Help - IDC Language

4

You can write your hooking library (DLL) which will patch the API you are targeting. This patch will just print to file/console the parameters and continue back to the original function. There will be no stops on the way. To actually hook the APIs you will need to inject the DLL into the target application. You can use Detours from Microsoft as and example ...

4

Open the stack frame window (Ctrl-K or double-click on a variable), then delete bogus arguments with U.

4

It is possible that you are using RTTI. Try compiling your code with option -fno-rtti. Update: It is really RTTI. I don't know how exactly it works, but I succeeded to remove those strings as follows: \$ g++ -Xlinker -unexported_symbol -Xlinker "*" -o executable file.cpp \$ strip executable (This was found at https://stackoverflow.com/questions/1931626/...

4

For cdecl the caller needs to clean up the stack. So somewhere after the function call there HAS to be a stack operation that removes the parameters from the stack (remove as in adjust the stack pointer) PUSH 0xABCDEF01 CALL function ADD ESP, 4 ; sizeof(DWORD) (the parameter) It does NOT need to be directly after the call. (I think VS08 sometimes puts the ...

4

There are quite a few ways to achieve this. In OllyDbg search for all Intermodular calls. This would bring up a list of functions called from the main module. You can the set a logging breakpoint on all the functions. The disadvantage of this approach is that dynamically resolved function calls cannot not be intercepted. Search for Name in all modules. ...

4

Should I really reverse this unknown function from its start Disclaimer: This is just my opinion. That said, my answer: no, don't do that unless you really need to do that. One of the first things I always say to my students when I teach reverse engineering is actually that: never try to reverse engineer a function line-by-line unless you really need to do ...

4

As assembly instruction sets are reasonably complex, properly figuring out a function boundaries inside a big executable binaries is a somewhat difficult task. Even IDA, which specializes in that, has quite a few mistakes and misses in certain scenarios. This goes back to disassembly strategies, which are basically the algorithm used to provide disassembly ...

4

Although Nirlzr's answer explains it pretty well, here's an example that considers C++ code and vtables are present. The code is taken from here #include <iostream> using namespace std; class Vehicle { public: virtual void ApplyBreaks() { cout << "Vehicle Break" << endl; } virtual void ApplyHorns() { cout << "...

4

Now, this can't be a full-fledged answer from A to Z, unfortunately. But for COM there are only a few steps that are really specific to COM. The project you linked clearly has reverse-engineered the interfaces (elvint.h). What this means first and foremost is that the names of the interfaces needn't necessarily match what Microsoft called them (in your case ...

4

Unless you try all the input possibilities, as you suggested, you can only get an approximation of the function. This is basically one of the basic problems in the machine learning field, so I would look that way instead of trying to generate a lookup table for 2^32 * 2^32 values. You should obviously be careful that you won't have 100% guarantee that the ...

3

This is just a bit of optimization. A call xxxx followed by a ret can be optimized to a jmp xxxx.

3

Note: You'll probably get a better answer on stackoverflow, as your question is more about creating software than about reversing it. First, you'll want to split your text file into blocks. You can do that looking for the ============= S U B R O U T I N E ============ comments that IDA emits, or checking the sub_XXXX proc [near|far] and sub_XXXX endp ...

3