Hot answers tagged

13

Although these terms are being used interchangeably, there is an intrinsic difference between disassembler and decompiler definitions traditionally. Let's first consider common steps involved in converting low level code to high level human readable code. This is similar to compilation where you convert high level code to low level machine code or an ...


5

Welcome to the Reverse engineering stack exchange Q&A site! Although you only asked about nullsub_, you described ___cxa_pure_virtual slightly incorrectly so I'll describe it as well nullsub_X IDA makes a minimal effort of providing meaningful, yet general, names for functions according to their implementation by adding a prefix or name for certain types ...


4

ALT-D, then Float. (Or Double, or Packed Real.)


4

Disclaimer: I'm going to expose my workflow when I see similar things. I'm not telling you that this is the best one or the faster, and I'm sure you have a lot of other way to deal with this. But this should give you an insight on how you can do this. As your question is really wide and does not contain any details (malware name, hash, or what 'failed to ...


4

db means “define byte”, i.e. a reservation of 1 byte of memory, dw means “define word” (2 bytes of memory), dd means “define double-word” (4 bytes of memory). The offset prefix means to fill the reserved byte(s) not with the mentioned data itself (i.e., not with the content), but only with the offset to it (i.e., with the position of data in memory, ...


4

It because of the "Link Incrementally". For example, there is a test program: #include <iostream> void test(void) { std::cout << "Hello" << std::endl; return; } int main() { test(); return 0; } If I enable /INCREMENTAL option, the code is: ; __int64 __fastcall main() main proc near push rbp push ...


3

If you compare pseudocode returned by decompiler with your own C code you will notice one very important difference - in decompiler's output it is merely a comment, but it's very important. I'm talking about following lines: int v7; // [sp+10h] [bp-42Ch]@1 char v8; // [sp+14h] [bp-428h]@1 int v9; ...


3

I've just received from a friend a *.idb file concerning the pe file i'd like to disassemble in IDA. a IDB file is IDAs primary project/database format its the result of an IDA exe load + analyze run What the file is and how can i load/use it with the exe linked with it in IDA? just open it with IDA


3

From the looks of it that's an easy one. Yes, these are variables on the stack and the magic number in EAX is used to denote uninitialized values. Quote: CCCCCCCC Used by Microsoft's C++ debugging runtime library and many DOS environments to mark uninitialized stack memory. CC resembles the opcode of the INT 3 debug breakpoint interrupt on x86 processors. ...


3

The key thing is that you're likely dealing with a C++ object and these are roughly structured as follows: void* vtable; void* param1; ... etc Inside the vtable it'll look like this: void* func1; void* func2; So you'll want to see what gets passed into a2, you'll probably find something like this: v1 = operator new(0x60); *v1 = offset XXXXX; ... This is ...


3

Press t and it should be in the expanded view for the generic lib.


3

On the machine level, there is no difference between an int[2] array, a structure with two ints, or two int variables that happen to be placed next to each other. In addition, sometimes one variable may be stored separately in different locations. For example, when dealing with 64-bit numbers on 32-bit processors, the compiler has to work with 32 bits at a ...


3

Either put the PDB in the same folder as the executable, or use File->Load file->PDB file (after opening the .EXE in IDA) to load the PDB from whatever path you like on the disk.


3

I was able to work this one out. The decompiler was not detecting the correct call parameter counts for the >> and << operators of cin and cout. For example: int __thiscall std__basic_istream_char_std__char_traits_char____operator__(_DWORD, _DWORD, _DWORD) Is the detected signature of the >> operator. However, reviewing the C++ reference, ...


3

I expect that the compiler emitted two different symbol references in the two LEA instructions, and uses the compare instruction to detect at run time whether the two symbols were resolved to the same address at link time. Many modern compilers/linkers offer "link time code generation" aka "whole program optimization", where the compiler'...


3

It sounds like you know how to use Hex-Rays to a non-trivial extent. You have probably noticed that Hex-Rays might -- or might not -- pause noticeably when decompiling a large function that you have already decompiled some time ago. That's because Hex-Rays often decompiles the same function more than once -- numerous times, actually -- throughout the course ...


3

I am not sure if there is something inbuilt, but you can write a simple Python script and assign a key binding to that script as below: #TODO evaluates a string expression as Numeral and formats it in multiple radix #@author blabb #@category _NEW_ #@keybinding Shift-SLASH import ghidra exp = askString("Expression","Expression") print(&...


3

I found some tools for both the open source software products. Ghidra: Dragon Dance EMERALD Cutter: CutterDRcov


3

IDA knew that there was a struct named ComputeService::RPC due to a mangled name containing a reference to it -- for example, a mangled name for the function shown in your question. However, IDA did not have a struct declaration for it, so it created an empty struct -- you can tell this because the Description field for that entry simply says struct. If IDA ...


2

Segments are still used on 64 bit long mode and are still set up, except the CPU treats their bases to be 0 (except for gs and fs), and does not perform a limit check. The default segment for rax is indeed ds, but this can be changed with a segment override. lea rdx, ds:0[rax*4] is lea rdx, ds:[rax*4 + 0], which is lea rdx, ds:[rax*4], which is the same as ...


2

Position cursor where you want to insert (cannot be at the structure end) and press Ctrl+E (see expand command in IDA documentation).


2

Updating answer for IDA Pro version 7.5, using Python 3: ida_kernwin.jumpto(ea)


2

(Since I can't add comments due reputation) I ported IDAPython version of Referee to IDA 7.x (works on 7.5 good so far) Repository is here


2

I don't know off the top of my head if there's an option you can set for that, but that's the type of thing that's utterly trivial to write a Hex-Rays plugin for. I bet that would be less than 25 lines of code. If you can send a link to a binary, I'll write a script to demonstrate. Assuming you're writing IDAPython (the details would only be slightly ...


2

if visual studio 2017 community is generating the pattern fill then compiler option /RTCsu is being used this also switches on Incremental linking (*.ilk files will be generated) earlier versions of compiler used /GZ option which if used now will generate a deprecation warning your code is also not using scanf_s a secure version of vulnerable scanf(); that ...


2

No it does not all pe files do not start at the same address 0x401000 historically 0x400000 is the ImageBaseAddress Header is 0x1000 bytes so .code section starts at 0x401000 for a normal exe since the Exe's module is the first to be loaded it normally gets its Preferred ImageBase Address but a relocation table is a part of exe in case there is a conflict ...


2

Instruction encoding and decoding is one of the least user-friendly parts of the SDK. Since they have to support so many processor architectures with the same set of data types, they basically have to get creative with how they store information about the operands. It does not always make logical sense, but it really doesn't have to -- there are few ...


2

Short of debugging it and adding a hardware breakpoint on the vtable/vfunction, this may give you some additional information. Whether it is enough, or whether it will work in this case, I cannot say. Install and run the Class Informer plugin. Go to that xref you mentioned, and scroll up until you hit the start of the vtable. Note that it is possible that ...


2

I just found what appears to be the official version of the adjustment function for the transmigration of worthless min-spd based offsets into heaven sent frame based offsets. cfunc.get_stkoff_delta() Possible implementation: def GetMinSpdAdjustment(funcea): func = ida_funcs.get_func(funcea) return 0 - (func.frsize + func.frregs + idc.get_spd(idc....


2

There are two ways: Keyboard Shortcut: Alt-D, followed by F Action : OpFloat By the way you can also add keyboard shortcut of your own choice by: Menu: Options->Shortcuts and then add a shortcut for OpFloat


Only top voted, non community-wiki answers of a minimum length are eligible