Hot answers tagged

3

You might have a look here It says: off_ data, contains offset value


2

Starting from address 0x56 all your instructions seems to be off. And if you look closely it there is a pattern how much off they are from the original. For example, at offset 0x58, there's supposed to be push edx so the byte should be 0x52, but you have push esp which is 0x54. Since the article mentions that this part is encrypted with a xor (with a single ...


2

as i commented i used windbg to dump those structures sample code used for walk through #include <iostream> //01 #include <list> //02 #include <vector> //03 #include <map> ...


2

The answer to the specific question that you asked is: not directly through the UI, but it's possible with a plugin. Sample plugin #18 in the Hex-Rays SDK. The comment at the top of the plugin says: * It shows how to specify a register value at a desired location. * Such a functionality may be useful when the code to decompile is * obfuscated and uses opaque ...


1

Generally speaking, this is not possible with any reverse engineering tool. If the programmer created custom #define statements to associate numbers with symbolic names, this information will be destroyed by the compiler very early into the compilation process, long before the binary is ultimately created. Local variable names are also not preserved in the ...


1

these should be comments but it grew up what is the windbg version ? what is the os version ? what is the output of lm m "your specific Module" are the symbols loaded for your Module ? have you tried disassembling with u <address> in command window as it appears you are looking at Disassembly Window did you try ln <address> to list the ...


1

Run the debug server as admin, this should be enough.


1

you created those structures or you pulled it from somewhere ? basically these are template classes and not structures where did you get the size of 0x1c for std::string it is 0x18 0x10 for buffer or Pointer (static small string or malloced() bigstring ) 0x4 for Actualsize or_Mysize 0x4 for Reservedsize or _Myres like typedef struct _FOO { union _Bx { char ...


1

since this has nothing to do with original query and is an experiment of sorts with the labeller windbg extension that i edited in in my first answer i am adding this as a new answer and not editing my original answer since the question of performance of AddSyntheticSymbol for bulk Addition Came up i cooked up a small 6 figure long windbg script file that i ...


1

Have you noted the term battlezone2.exe + before the address? That denotes the (usually random) base address of the executable. In IDA this base address is a fixed value e.g. 0x400000. Scroll to the beginning of the IDA View and check the Imagebase value (hexadecimal). This value you have to add to every address shown in the Cheat engine. If debugging a ...


1

Since in your case the final value of ZF will be zero, there is no need to check the initial value but simply always zero it: ZF=0,0 The ,0 at the end will ensure that the result of expression is 0 so IDA will continue execution of the program.


1

shift + f2 Message("zf flag when bp hit = %x\n" , GetRegValue("zf")); SetRegValue(0,"zf"); Message("zf flag after setting it %x\n" , GetRegValue("zf")); result zf flag when bp hit = 1 zf flag after setting it 0


Only top voted, non community-wiki answers of a minimum length are eligible