3
For IDA/Hex-Rays:
In the Loaded Type Libraries window (View->Open subviews->Type libraries), load ntddk_win10 (or whatever Windows version you want, back to Windows XP and Windows Server 2003).
In the Structures window (View->Open subviews->Structures), import KUSER_SHARED_DATA. You can simply write the name of the type in the dialog box and ...
3
Please see Batch Operation
In the decompiler’s manual.
2
You can take the instructions, assemble them into hex values, for example by using: Online disassembler.
Then you get the byte representation:
\x55\x48\x89\xE5\x89\x7D\xFC\x89\x75\xF8\x8B\x55\xFC\x8B\x45\xF8\x01\xD0\x5D\xC3
With this, you can patch bytes in the binary, and then use the normal decompile functionality in Ghidra/Ida on the patched area.
2
as i commented i used windbg to dump those structures
sample code used for walk through
#include <iostream> //01
#include <list> //02
#include <vector> //03
#include <map> ...
2
ghidra
addr = toAddr(0x7ffe0000)
currentProgram.memory.createUninitializedBlock("KUSER_SHARED_PAGE",addr,0x1000,0)
createData(addr,getDataTypes("KUSER_SHARED_DATA")[0])
result
undefined8 main(void)
{
wprintf((__crt_locale_pointers *)L"Version: %lu.%lu.%lu\n",
(ulonglong)KUSER_SHARED_DATA_7ffe0000.NtMajorVersion,
...
1
ntohs basically converts a netshort to hostshort
>>> import socket
>>> print (hex(socket.ntohs(0x1337)))
0x3713
>>> print (hex(socket.ntohs(0x3713)))
0x1337
>>>
it will write back
0x3713-0x2 = 0x3711 or 0x1337 - 0x2 = 0x1335
in the address pointed by remaining if it is > 1u
and return back an address a pointer to ...
1
you created those structures or you pulled it from somewhere ?
basically these are template classes and not structures
where did you get the size of 0x1c for std::string
it is 0x18
0x10 for buffer or Pointer (static small string or malloced() bigstring )
0x4 for Actualsize or_Mysize
0x4 for Reservedsize or _Myres
like
typedef struct _FOO {
union _Bx {
char ...
1
here is the sample code that will show both the constructs if there is an atomic exchange requirement you use the api or intrinsc provided
else simply assign
source
#include <stdio.h>
#include <windows.h>
#include <intrin.h>
long tmp[10] = {NULL};
long *m_someMemoryPool[10] ={NULL};
int main (void) {
tmp[0] = 0xbee5deed;
long foo ...
1
You can actually compile this with NASM depends on your preferred architecture, example command is below (I used linux):
nasm -f elf64 -o ./sample.asm ./sample.o
ld -o ./sample ./sample.o
global _start
section .text
_start:
push rbp
mov rbp, rsp
mov DWORD [rbp-4], edi
mov DWORD [rbp-8], esi
mov edx, DWORD [rbp-4]...
1
While in the pseudocode view pressing F5 will re-decompile the current function.
Only top voted, non community-wiki answers of a minimum length are eligible
