8
votes
Accepted
Why is it "safe" to write to ModuleBase.exe+0x100, and possibly other header offsets after PE is mapped to memory?
In PE files, sections are generally mapped at addresses that are multiples of 4kb (this is the default value, though it can be overridden). That means that even a section that is a single physical ...
- 4,709
4
votes
Accepted
getting the static address/offset of a variable
Note: This does not answers the question using x32dbg/ollydbg, but another tool. (I can't seem to be able to post a comment). My apologies if it is off topic.
You can try with Cheat engine (CE).
If ...
- 188
4
votes
IDA - How to transform VA to FO?
To find it using IDAPython:
ida_loader.get_fileregion_offset(ea)
where "ea" is your virtual offset like 0x400000.
- 76
3
votes
How to locate dynamic instructions?
Being an avid Cheat Engine user and game-hacker, I can walk you through a specific example that should give you solid clarity.
First, we'll use this arbitrary bit of code to work with:
7A1A7A162 - ...
- 2,254
2
votes
Which ARM command is influencing the SP position?
There is no specific stack pointer register in ARM. By convention R13 is used as the stack pointer. There is no specific push and pop style stack pointer operands either.
Pushing and popping from ...
- 21
2
votes
IDA Pro: how to pass a function a pointer to a structure field
In order to get Hexrays to detect that your subtype passed as an argument is actually a member of a bigger parent type, you have to declare the parent type as a structure, and declare the ...
- 565
2
votes
How to run part of exe file that is being reversed
You can use Ida's Appcall functionality:
Appcall is a mechanism to call functions inside the debugged program
from the debugger or your script as if it were a built-in function.
Such a ...
- 3,283
2
votes
Accepted
Do all class instances have a relative address/offset and can i make a copy of any class pointer?
I'll start with a few minor corrections and clarifications, just to make sure we're using the right terms and exact definitions.
I used Cheat engine to find the address of the variable i in A::...
- 11.8k
2
votes
Why is it "safe" to write to ModuleBase.exe+0x100, and possibly other header offsets after PE is mapped to memory?
Short answer: Because your average program will never access those values.
Long answer: Peter ferrie's answer states there's usually nothing present at that offset. That is not true. The shortest ...
- 161
2
votes
Accepted
Calculating offset from push instruction in exe to string in data section
push 402010 is broken down like
402010 - base_address - virtual_address_of_section + file_ptr_to_rawdata
your data has some inconsistencies it must be a counted string or pascal string etc there is ...
- 16.7k
1
vote
Accepted
How to reference an address set by 2 instructions in Ghidra
The default hotkey for this is 'R', which is mapped to "Add/Edit References". You can also reach this menu by right-clicking in the Listing view on one of these instructions and selecting ...
- 178
1
vote
Accepted
How does Cheat Engine offset calculation work?
As I Commented if you are adding 0x5c to 0x0F58F478 and getting 0xf58f4d4
it is not what the memory sharp or cheat engine does
0x0xf58f4d4 is a pointer an address in the memory space
they dereference ...
- 16.7k
1
vote
Accepted
How to find offset to a function address from the base address in decompiled image (IDA or Ghidra)
Found of how it works.
The offset is indeed just the difference of the addresses, which can be taken from the static analysis, i.e. from IDA or Ghidra regardless in which address space it loads by ...
- 328
1
vote
Accepted
1
vote
IDA Pro Reverse offset in struct
Since there seems to be no other way I ended up converting the Self variable into a pointer to the struct and IDA generated the following code:
Self[-1].vmtClassName
At least it is readable now.
- 197
1
vote
Accepted
Set lldb breakpoint relative to ASLR slide
This is possible with a command like:
breakpoint set -a 0x100168ff4 -s testapp
as from lldb's help breakpoint add, when you specify a module with -s then the address or expression passed with -a:
...
- 187
1
vote
troublesome stack frame setup
After reading up on "shadow stack space" as suggested by @blabb it looks like this is an unoptimized build, so the 2 parameters RDX and RCX are being saved in the caller's scratch space, ...
- 111
1
vote
Accepted
Radare2 - "/c pointer; offset" command not giving expected response to search instances of the same pair of similar instructions
The gist contains some old (create 3 yrs ago) r2 instructions and according to, also outdated, r2 book, it looks like /c command was responsible for "search for asm code matching the given string&...
- 4,952
1
vote
Accepted
Displaying Operands as Position Independent in IDA
Options-General-Analysis-Processor specific options, [x] Explicit RIP-addressing.
- 36.9k
1
vote
Accepted
How is padding size calculated for members of structure types?
The offsets you are quoting are not the offsets of the structure members, but they are offsets of the debug information statements inside the dwarf section. The members itself are all 8 bytes in size. ...
- 943
1
vote
How to find out address in binary file (like IDA) with python code only?
you mean you want to search for a hex pattern in an arbitrary file using your own code either in python or c ?
have you considered using regex or grep to satisfy your needs ?
there are certain ...
- 16.7k
1
vote
How to refer to the same call on separate IDAs
Actually, you said what is the solution: use offsets. You can get the offset for that function, global or whatever using the following IDA Python:
Python> hex(here() - idaapi.get_imagebase())
...
- 4,643
1
vote
How to refer to the same call on separate IDAs
One (or both) of you can just rebase the program and that should display all the addresses as being the same. If you want him to rebase his program to be the same as yours, figure out your base ...
- 380
Only top scored, non community-wiki answers of a minimum length are eligible