3
You might have a look here It says:
off_ data, contains offset value
2
Starting from address 0x56 all your instructions seems to be off. And if you look closely it there is a pattern how much off they are from the original.
For example, at offset 0x58, there's supposed to be push edx so the byte should be 0x52, but you have push esp which is 0x54. Since the article mentions that this part is encrypted with a xor (with a single ...
2
as i commented i used windbg to dump those structures
sample code used for walk through
#include <iostream> //01
#include <list> //02
#include <vector> //03
#include <map> ...
2
The answer to the specific question that you asked is: not directly through the UI, but it's possible with a plugin. Sample plugin #18 in the Hex-Rays SDK. The comment at the top of the plugin says:
* It shows how to specify a register value at a desired location.
* Such a functionality may be useful when the code to decompile is
* obfuscated and uses opaque ...
1
Generally speaking, this is not possible with any reverse engineering tool. If the programmer created custom #define statements to associate numbers with symbolic names, this information will be destroyed by the compiler very early into the compilation process, long before the binary is ultimately created. Local variable names are also not preserved in the ...
1
these should be comments but it grew up
what is the windbg version ?
what is the os version ?
what is the output of lm m "your specific Module"
are the symbols loaded for your Module ?
have you tried disassembling with u <address> in command window as it appears you are looking at Disassembly Window
did you try ln <address> to list the ...
1
Run the debug server as admin, this should be enough.
1
The following worked for me on IDA 7.2:
Get the frame id and confirm it's sane.
Python> frame_id = get_frame_id(get_name_ea(BADADDR, 'sub_5450'))
Python> print(list(StructMembers(frame_id)))
[(0L, 'var_18', 8L), (12L, 'var_C', 4L), (24L, ' r', 8L)]
Get the existing variable id.
Python> var_id = get_member_id(frame_id, 12)
If I needed a new ...
1
Have you noted the term battlezone2.exe + before the address? That denotes the (usually random) base address of the executable.
In IDA this base address is a fixed value e.g. 0x400000. Scroll to the beginning of the IDA View and check the Imagebase value (hexadecimal). This value you have to add to every address shown in the Cheat engine.
If debugging a ...
1
Since in your case the final value of ZF will be zero, there is no need to check the initial value but simply always zero it:
ZF=0,0
The ,0 at the end will ensure that the result of expression is 0 so IDA will continue execution of the program.
1
shift + f2
Message("zf flag when bp hit = %x\n" , GetRegValue("zf"));
SetRegValue(0,"zf");
Message("zf flag after setting it %x\n" , GetRegValue("zf"));
result
zf flag when bp hit = 1
zf flag after setting it 0
Only top voted, non community-wiki answers of a minimum length are eligible
