Hot answers tagged

3

For IDA/Hex-Rays: In the Loaded Type Libraries window (View->Open subviews->Type libraries), load ntddk_win10 (or whatever Windows version you want, back to Windows XP and Windows Server 2003). In the Structures window (View->Open subviews->Structures), import KUSER_SHARED_DATA. You can simply write the name of the type in the dialog box and ...


3

Please see Batch Operation In the decompiler’s manual.


2

You can take the instructions, assemble them into hex values, for example by using: Online disassembler. Then you get the byte representation: \x55\x48\x89\xE5\x89\x7D\xFC\x89\x75\xF8\x8B\x55\xFC\x8B\x45\xF8\x01\xD0\x5D\xC3 With this, you can patch bytes in the binary, and then use the normal decompile functionality in Ghidra/Ida on the patched area.


2

as i commented i used windbg to dump those structures sample code used for walk through #include <iostream> //01 #include <list> //02 #include <vector> //03 #include <map> ...


2

ghidra addr = toAddr(0x7ffe0000) currentProgram.memory.createUninitializedBlock("KUSER_SHARED_PAGE",addr,0x1000,0) createData(addr,getDataTypes("KUSER_SHARED_DATA")[0]) result undefined8 main(void) { wprintf((__crt_locale_pointers *)L"Version: %lu.%lu.%lu\n", (ulonglong)KUSER_SHARED_DATA_7ffe0000.NtMajorVersion, ...


1

ntohs basically converts a netshort to hostshort >>> import socket >>> print (hex(socket.ntohs(0x1337))) 0x3713 >>> print (hex(socket.ntohs(0x3713))) 0x1337 >>> it will write back 0x3713-0x2 = 0x3711 or 0x1337 - 0x2 = 0x1335 in the address pointed by remaining if it is > 1u and return back an address a pointer to ...


1

you created those structures or you pulled it from somewhere ? basically these are template classes and not structures where did you get the size of 0x1c for std::string it is 0x18 0x10 for buffer or Pointer (static small string or malloced() bigstring ) 0x4 for Actualsize or_Mysize 0x4 for Reservedsize or _Myres like typedef struct _FOO { union _Bx { char ...


1

here is the sample code that will show both the constructs if there is an atomic exchange requirement you use the api or intrinsc provided else simply assign source #include <stdio.h> #include <windows.h> #include <intrin.h> long tmp[10] = {NULL}; long *m_someMemoryPool[10] ={NULL}; int main (void) { tmp[0] = 0xbee5deed; long foo ...


1

You can actually compile this with NASM depends on your preferred architecture, example command is below (I used linux): nasm -f elf64 -o ./sample.asm ./sample.o ld -o ./sample ./sample.o global _start section .text _start: push rbp mov rbp, rsp mov DWORD [rbp-4], edi mov DWORD [rbp-8], esi mov edx, DWORD [rbp-4]...


1

While in the pseudocode view pressing F5 will re-decompile the current function.


Only top voted, non community-wiki answers of a minimum length are eligible