Hot answers tagged

10 votes
Accepted

Is it possible to find static pointer with disassembler?

Yes, it is possible I'm going to explain you a bit how most games do it (I have never reversed any GTA but I suppose it's something like this anyway). I'm going to cover static and dynamic ...
  • 1,273
9 votes
Accepted

IDA Pro's Super-Complicated Function Pointer Definition

The variable being assigned to: v14 = The type cast needed to convert the result of the subroutine to the type of v14: (int (__cdecl *)(signed int)) The subroutine call, with one argument: 1: ...
7 votes

What is the difference between MOV and LEA in example?

lea = address mov = contents if address 0x401000 contains 0xDeadBeef like ef be ad de lea MySecretPlace, [401000] MySecretPlace will be 0x401000 Mov MySecretPlace, [401000] MySecretPlace will be ...
  • 15.4k
6 votes
Accepted

Failure at finding the value of the dereferenced pointer

Right-click on the disassembly line above in OllyDbg and choose Follow in Dump. That will tell OllyDbg to navigate to address 7FEEC617750 in the dump pane and allow you to see the memory at that ...
5 votes
Accepted

Game cheating: Pointers vs Static memory editing

There are many reasons for this. I'll jot down a bunch that I can think of off the top of my head. Many hackers use things like Cheat Engine's built-in automatic pointer scanning functionality ...
  • 2,174
5 votes
Accepted

Is pointer decryption possible?

pointer encryption There is no such thing. There is only pointer obfuscation. This is essentially how Microsoft markets a couple of functions, and they're pretty open about it from the docs on ...
  • 1,684
5 votes
Accepted

replacing static value with variable

Let's split this up a bit. I'll skip over some stuff that you might already understand, but we may need to expand this if some stuff is not clear. MOV DWORD PTR SS:[EBP-30],400400 MOV DWORD PTR SS:[...
  • 664
3 votes

What is the difference between MOV and LEA in example?

Warning: Illegal instruction used for explanation. If you are wondering if mov can do the work of lea, mov eax, esp+4 and lea eax, [esp+4] copies the same value to eax. However, mov eax, esp+4 is not ...
3 votes
Accepted

Function Pointer Assembly Calculations

mov ds:dword_804C0D4, offset unk_804C0B8 so if this instruction was executed first before the sub was called then 0x804c0d4 would contain 0x804c0b8 v2 = *(_DWORD *)dword_804C0D4; so v2 would be ...
  • 15.4k
3 votes
Accepted

Comparing the static address of the vtable of a class, to the pointer to it held by the object

The Itanium C++ ABI is sometimes not very clear about what exactly is “vtable”. In practice, the symbol such as _ZTV12DerivedClass points to the complete vtable structure, which includes the two ...
  • 35.2k
3 votes
Accepted

How to find V-Table in IDA? (Using class informer)

What you're looking it is actually a VTable. As you know, a VTable is a table of function pointers and as you can see, at address 0x19B64 you actually see a single function address (this looks like dd ...
  • 11.5k
3 votes

What is the difference between MOV and LEA in example?

This is basic. Assume that rpb has a value of 55h (Assembler syntax). then lea rax, [rbp-50h] would result in 5. On the other hand, mov rax, [rbp-50h] would most probable crash your application, as ...
  • 1,824
3 votes
Accepted

Point-to analysis of IDA Pro

The topic of pointer analysis is an important part of theoretical static analysis. Many articles and academic publications have been written about pointer analysis, this is a heavily researched field. ...
  • 11.5k
2 votes
Accepted

Locate member of a structure

FAR is just an attribute, not a data type. Not even a standard attribute, but an attribute that was introduced with MS-DOS C compilers, to distinguish between 16-bit and 32-bit pointers, and carried ...
2 votes

How to get pointer from byte code

lets have a look how Cheat Engine calculates its offsets: 4C 8B 05 471EE300 translates to mov r8,QWORD PTR [rip+0xe31e47] As you can see, the value depends on rip (the instruction pointer). You can ...
  • 2,866
2 votes
Accepted

Whats going on in this Class Constructor?

Your question is a bit unclear as you first say "Class C has a method "addListerner" which points to an attribute (this + 0x34).", then D::addListener(this + 0x34);. Typo? Also, you should read about ...
2 votes

Variable's position on stack

I'd change the variable right when it's created and stored into its position. For example, if one function calls another, that other function returns the variable, and the first function stores it ...
2 votes

IDA Pro: how to pass a function a pointer to a structure field

In order to get Hexrays to detect that your subtype passed as an argument is actually a member of a bigger parent type, you have to declare the parent type as a structure, and declare the ...
  • 565
2 votes

Game cheating: Pointers vs Static memory editing

Some programs don't like it when you change their code, some protectors check for memory modifications. Once I used a hack that patches directly the code and got instantly banned from the server.
  • 51
2 votes

What is the difference between MOV and LEA in example?

The difference is that lea only calculates the address while mov actually moves the data. If you know C or C++, it’s somewhat similar to: Lea:rax = rbp + 0x50; Mov: rax = rbp[0x50]; (Not equivalent ...
  • 35.2k
2 votes

Which ARM command is influencing the SP position?

There is no specific stack pointer register in ARM. By convention R13 is used as the stack pointer. There is no specific push and pop style stack pointer operands either. Pushing and popping from ...
2 votes
Accepted

Does psVar[-6] refer to 6*sizeof(psVar) bytes before psVar? Can you avoid the negative index?

I think you are running into a case of "shifted pointers". For various reasons the compiler might generate code where a pointer to the middle of a struct is returned. There is a Ghidra PR ...
1 vote
Accepted

What does this custom piece of frame manipulation code from a router binary do?

ntohs basically converts a netshort to hostshort >>> import socket >>> print (hex(socket.ntohs(0x1337))) 0x3713 >>> print (hex(socket.ntohs(0x3713))) 0x1337 >>> it ...
  • 15.4k
1 vote

replacing static value with variable

Memory-to-memory MOV does not exist. You could try the following: MOV eax, DWORD PTR DS : [400400] MOV DWORD PTR SS : [EBP - 30], eax Please check also if the absolute numbers are ...
  • 1,824
1 vote

Is pointer decryption possible?

I don't think there is any encryption going on. Probably the program uses multiple structs to store the data which is completely normal.
  • 35.2k
1 vote

Is there a static address to a pointer on Mac OS?

By declaring d inside main() it is a local scope variable, which exists on the stack and is therefore dynamic. If you declare this pointer outside of main, it will be a global variable and it will ...
1 vote

How to get pointer from byte code

It's way simpler than you'd think. 461EE300 is the relative offset to your variable. The relative offset needs to be added to the rip-register. And you already have the value of the rip-register. It's ...
1 vote

Why does MSVC x64 Compiler load addresses like this?

If you disassemble the instructions for mov edx, offset ds:mystring vs lea rdx, offset ds:mystring You'll notice the LEA instruction length (in bytes) was smaller. Its a compiler optimization! ...
1 vote
Accepted

Set register to specific value for use in autoanalysis in IDA Pro 6.9

Just set it in processor options.
  • 35.2k
1 vote

Set register to specific value for use in autoanalysis in IDA Pro 6.9

Regarding the potential bug in IDA: First of all, you can add references yourself with idaapi.add_cref and idaapi.add_dref IDAPython APIs. This may be done with relatively simple script like this: ...
  • 7,995

Only top scored, non community-wiki answers of a minimum length are eligible