Hot answers tagged

14

To convert a raw offset in a PE file to its corresponding "disassembler offset" (known as the virtual address or VA), you need to perform the following steps: Step 1 Using a PE editor, look at the PE file's section table to find the section containing the file offset. For example, let's say your PE file's section table looks like this: +------------------...


9

At the bottom left of the IDA View, you'll see the location of the cursor, as file offset (red) as well as virtual location (blue). (Underlines by me, not by Ida).


8

In PE files, sections are generally mapped at addresses that are multiples of 4kb (this is the default value, though it can be overridden). That means that even a section that is a single physical byte long will have the entire 4kb of memory allocated for it. The first section is mapped into memory after the file header, so it will be 4kb away from the ...


5

The instruction format is in little-endian, so bytes 0A E0 gets parsed as machine code 0xE00A, or 1110000000001010b in binary. According to the documentation for the THUMB Instruction Set, the first 5 bits (11100b) decode to an unconditional branch opcode, and the last 11 bits (00000001010b) decode to Offset11: As per the documentation above, the ...


4

Note: This does not answers the question using x32dbg/ollydbg, but another tool. (I can't seem to be able to post a comment). My apologies if it is off topic. You can try with Cheat engine (CE). If yes, download the installer-less release, because the installer includes crap: I assume you downloaded it and extracted it at this point. This software has a ...


4

You're missing the fact that you're working in THUMB mode, where you have two bytes per instruction (for most instructions at least), and that link describes ARM mode, where every instruction has 4 bytes. (How do i know you're in THUMB mode? Apart from your last question, your 0x60ECE B loc_60EE6 isn't 4-byte aligned, so it must be THUMB). If you add 4 ...


3

Being an avid Cheat Engine user and game-hacker, I can walk you through a specific example that should give you solid clarity. First, we'll use this arbitrary bit of code to work with: 7A1A7A162 - 55 - push rbp 7A1A7A163 - 00 6E 00 - add [rsi+00],ch 7A1A7A166 - 69 00 74000000 - imul eax,[rax],00000074 { 116 } ...


3

If you run across an API call that you're unfamiliar with, check the MSDN page. Parameter 2 is "The function or variable name, or the function's ordinal value." Looking at your offset only one of those things is a function name, WNetEnumCachedPasswords. You can verify this as the comment in your post said, by counting 12 (0xc) bytes from aPstorec_dllwne. db ...


3

To find it using IDAPython: ida_loader.get_fileregion_offset(ea) where "ea" is your virtual offset like 0x400000.


2

ollydbg 1.10 if you have the binary loaded in ollydbg disasm window is in the correct module the binary is also open in hexeditor Right Click -> View -> Executable File In the New Window do ctrl+g and enter the offset you saw in hexeditor ebe75 right click in new window -> follow in disassembler in hexeditor 0x1529 has the 0xe8 opcode xxd -s ...


2

FAR is just an attribute, not a data type. Not even a standard attribute, but an attribute that was introduced with MS-DOS C compilers, to distinguish between 16-bit and 32-bit pointers, and carried over to windows 16 bit, windows 32 bit and, recently, windows 64 bit. What is stored in the structure is a pointer to a character (in fact, an array of ...


2

There is no specific stack pointer register in ARM. By convention R13 is used as the stack pointer. There is no specific push and pop style stack pointer operands either. Pushing and popping from the stack is carried out using the STM (store to memory) and LDM (load from memory) operands. These operands can be modified with the post fixes IA and DB. IA is ...


2

You can use Ida's Appcall functionality: Appcall is a mechanism to call functions inside the debugged program from the debugger or your script as if it were a built-in function. Such a mechanism can be used for debugging, fuzzing and testing applications. Appcall mechanism highly depends on the type information of the function to be called. For ...


2

I'll start with a few minor corrections and clarifications, just to make sure we're using the right terms and exact definitions. I used Cheat engine to find the address of the variable i in A::doThing First of all, i is not a variable of method A::doThing. It is a member of the A class. Then I used the option to find what writes to that address Doing ...


2

Short answer: Because your average program will never access those values. Long answer: Peter ferrie's answer states there's usually nothing present at that offset. That is not true. The shortest possible valid header for a Portable Executable is 0xc8 long. But that's for a program with a single section, no imports (or anything else that would require a ...


2

push 402010 is broken down like 402010 - base_address - virtual_address_of_section + file_ptr_to_rawdata your data has some inconsistencies it must be a counted string or pascal string etc there is a 4 byte mismatch between the addresses 0xc/0x8 disassembly of a string push 0:000> u . l4 msgbox!WinMain: 002c1000 55 push ebp 002c1001 ...


1

Shifted pointer should work, I think.


1

Since there seems to be no other way I ended up converting the Self variable into a pointer to the struct and IDA generated the following code: Self[-1].vmtClassName At least it is readable now.


1

After reading up on "shadow stack space" as suggested by @blabb it looks like this is an unoptimized build, so the 2 parameters RDX and RCX are being saved in the caller's scratch space, presumably to make debugging easier. I got most of this information from the following post: What is the 'shadow space' in x64 assembly?


1

The gist contains some old (create 3 yrs ago) r2 instructions and according to, also outdated, r2 book, it looks like /c command was responsible for "search for asm code matching the given string". Currently (radare2 5.2.0-git 26093 @ linux-x86-64 git.5.1.1) the similar instruction could be one from /a group Usage: /a[?] [arg] Search for assembly ...


1

Options-General-Analysis-Processor specific options, [x] Explicit RIP-addressing.


1

The offsets you are quoting are not the offsets of the structure members, but they are offsets of the debug information statements inside the dwarf section. The members itself are all 8 bytes in size. _IO_write_ptr is at offset 40, _IO_write_end is at offset 48 and and _IO_buf_base is at offset 56. The debug information for _IO_write_end is bigger than the ...


1

you mean you want to search for a hex pattern in an arbitrary file using your own code either in python or c ? have you considered using regex or grep to satisfy your needs ? there are certain things you should be aware of 1) file offsets will not be equal to virtual offsets 2) even if you manage to map the file you may have to deal with aslr 2) you ...


1

Actually, you said what is the solution: use offsets. You can get the offset for that function, global or whatever using the following IDA Python: Python> hex(here() - idaapi.get_imagebase()) 0x38a0aL It subtracts from the address under the cursor the base address of the database. Then, you can tell your friend the offset and she/he will have to go to ...


1

One (or both) of you can just rebase the program and that should display all the addresses as being the same. If you want him to rebase his program to be the same as yours, figure out your base address (scroll to the top of your .exe in Text View) and then have your friend go to Edit -> Segments -> Rebase Program... and when prompted have him put in your ...


1

In order to get Hexrays to detect that your subtype passed as an argument is actually a member of a bigger parent type, you have to declare the parent type as a structure, and declare the corresponding field in this parent struct as a pointer to the subtype. The function argument type is irrelevant for this purpose, and should have the type of the substruct....


1

Because end is greater than start and you see the actual representation of negative number. (DWORD) _end - (DWORD) _start should give you a more reasonable number. Just for completeness sake: the computations with numbers you provided (may be checked in windows calculator or with python) 0x002915a0 - 0x00291450 = 0x150 0x00291450 - 0x002915a0 = -0x150 (...


1

A sample walkthrough containing few lines of code compiled in msvc++exp and windbagged in 32 bit machine int _tmain(int argc, _TCHAR* argv[]) { WSADATA wsaData; in_addr addr; hostent *myhost; if ((WSAStartup(MAKEWORD(2, 2), &wsaData)) == 0) if ( ( myhost = gethostbyname("www.google.com") ) != NULL) { printf("...


Only top voted, non community-wiki answers of a minimum length are eligible