New answers tagged ghidra
0
You can always set it manually to the specific address from the reference dialog (available under R). There you can providing the correct address calculated by adding base address and an offset. If you have more than one, you can automate it via python script.
I've recorded a video detailing such situation in action https://www.youtube.com/watch?v=...
2
that is a negative number
C:\>python -c "print(hex(0xffff98b4-2**32))"
-0x674c
or in other words
C:\>python -c "print(hex(2**32 - 0x674c))"
0xffff98b4
3
you have a string you cant load a string as is into a disassembler
you may need to un-escape them into binary
for example
"\x48" is "H"
if you have a compiler compile and call it via a function pointer
use a scripting language like python make a binary blob and load it as raw into disassembler
use a disassembling framework like capstone ...
3
Compile and load:
#include <stdio.h>
char shellcode[] =
"\x48\x83\xEC\x28\x48\x83\xE4\xF0\x48\x8D\x15\x66\x00\x00\x00"
"\x48\x8D\x0D\x52\x00\x00\x00\xE8\x9E\x00\x00\x00\x4C\x8B\xF8"
"\x48\x8D\x0D\x5D\x00\x00\x00\xFF\xD0\x48\x8D\x15\x5F\x00\x00"
"\x00\x48\x8D\x0D\x4D\x00\x00\x00\xE8\x7F\...
2
The generated machine code is going to vary by compiler, and even within the same compiler depending on compiler optimization settings. Sometimes optimizations will "inline" functions, removing what was a function call in the code. Sometimes external libraries will be compiled "statically" i.e. their functions get incorporated directly ...
0
You have a external reference (presumably created via right click > References > Add/Edit...) with LoadLibraryB, while the default imported LoadLibraryA is an external function. You can convert the location to a function. From the Ghidra Help Contents:
From either the Symbol Table or Symbol Tree, an existing External Location may be converted to a ...
3
That really depends. There are two primary explanations to this phenomenon, which point to opposite answers.
First, a compiler optimization known as "inlining" inserts the body of the called function into the calling function, thereby eliminating the call instruction, but making the calling function bigger.
Secondly, games are usually written in C++...
Top 50 recent answers are included