Skip to main content
9 votes
Accepted

IDA Pro's Super-Complicated Function Pointer Definition

The variable being assigned to: v14 = The type cast needed to convert the result of the subroutine to the type of v14: (int (__cdecl *)(signed int)) The subroutine call, with one argument: 1: ...
Willem Hengeveld's user avatar
8 votes

What is the difference between MOV and LEA in example?

lea = address mov = contents if address 0x401000 contains 0xDeadBeef like ef be ad de lea MySecretPlace, [401000] MySecretPlace will be 0x401000 Mov MySecretPlace, [401000] MySecretPlace will be ...
blabb's user avatar
  • 16.4k
6 votes
Accepted

replacing static value with variable

Let's split this up a bit. I'll skip over some stuff that you might already understand, but we may need to expand this if some stuff is not clear. MOV DWORD PTR SS:[EBP-30],400400 MOV DWORD PTR SS:[...
Abigail's user avatar
  • 684
5 votes
Accepted

Game cheating: Pointers vs Static memory editing

There are many reasons for this. I'll jot down a bunch that I can think of off the top of my head. Many hackers use things like Cheat Engine's built-in automatic pointer scanning functionality ...
dsasmblr's user avatar
  • 2,234
5 votes
Accepted

Is pointer decryption possible?

pointer encryption There is no such thing. There is only pointer obfuscation. This is essentially how Microsoft markets a couple of functions, and they're pretty open about it from the docs on ...
Evan Carroll's user avatar
  • 1,789
3 votes

What is the difference between MOV and LEA in example?

Warning: Illegal instruction used for explanation. If you are wondering if mov can do the work of lea, mov eax, esp+4 and lea eax, [esp+4] copies the same value to eax. However, mov eax, esp+4 is not ...
Jithin Pavithran's user avatar
3 votes
Accepted

Comparing the static address of the vtable of a class, to the pointer to it held by the object

The Itanium C++ ABI is sometimes not very clear about what exactly is “vtable”. In practice, the symbol such as _ZTV12DerivedClass points to the complete vtable structure, which includes the two ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes

What is the difference between MOV and LEA in example?

This is basic. Assume that rpb has a value of 55h (Assembler syntax). then lea rax, [rbp-50h] would result in 5. On the other hand, mov rax, [rbp-50h] would most probable crash your application, as ...
josh's user avatar
  • 1,974
3 votes
Accepted

Point-to analysis of IDA Pro

The topic of pointer analysis is an important part of theoretical static analysis. Many articles and academic publications have been written about pointer analysis, this is a heavily researched field. ...
NirIzr's user avatar
  • 11.8k
3 votes
Accepted

How to find V-Table in IDA? (Using class informer)

What you're looking it is actually a VTable. As you know, a VTable is a table of function pointers and as you can see, at address 0x19B64 you actually see a single function address (this looks like dd ...
NirIzr's user avatar
  • 11.8k
3 votes
Accepted

Function Pointer Assembly Calculations

mov ds:dword_804C0D4, offset unk_804C0B8 so if this instruction was executed first before the sub was called then 0x804c0d4 would contain 0x804c0b8 v2 = *(_DWORD *)dword_804C0D4; so v2 would be ...
blabb's user avatar
  • 16.4k
2 votes

How to get pointer from byte code

lets have a look how Cheat Engine calculates its offsets: 4C 8B 05 471EE300 translates to mov r8,QWORD PTR [rip+0xe31e47] As you can see, the value depends on rip (the instruction pointer). You can ...
Nordwald's user avatar
  • 2,906
2 votes
Accepted

Whats going on in this Class Constructor?

Your question is a bit unclear as you first say "Class C has a method "addListerner" which points to an attribute (this + 0x34).", then D::addListener(this + 0x34);. Typo? Also, you should read about ...
Guntram Blohm's user avatar
2 votes

IDA Pro: how to pass a function a pointer to a structure field

In order to get Hexrays to detect that your subtype passed as an argument is actually a member of a bigger parent type, you have to declare the parent type as a structure, and declare the ...
user2823000's user avatar
2 votes

Game cheating: Pointers vs Static memory editing

Some programs don't like it when you change their code, some protectors check for memory modifications. Once I used a hack that patches directly the code and got instantly banned from the server.
COB RCE's user avatar
  • 51
2 votes

Which ARM command is influencing the SP position?

There is no specific stack pointer register in ARM. By convention R13 is used as the stack pointer. There is no specific push and pop style stack pointer operands either. Pushing and popping from ...
Cyberspice's user avatar
2 votes

What is the difference between MOV and LEA in example?

The difference is that lea only calculates the address while mov actually moves the data. If you know C or C++, it’s somewhat similar to: Lea:rax = rbp + 0x50; Mov: rax = rbp[0x50]; (Not equivalent ...
Igor Skochinsky's user avatar
  • 36.8k
2 votes
Accepted

Does psVar[-6] refer to 6*sizeof(psVar) bytes before psVar? Can you avoid the negative index?

I think you are running into a case of "shifted pointers". For various reasons the compiler might generate code where a pointer to the middle of a struct is returned. There is a Ghidra PR ...
Florian Magin's user avatar
1 vote

How to set a variable as "pointer to struct" in IDA in order to automatically replace offsets by field names?

If you select all instructions referring to the structure and press T, you'll get a different dialog where you can select the base register and the struct to apply to offsets from it.
Igor Skochinsky's user avatar
  • 36.8k
1 vote
Accepted

How to set a variable as "pointer to struct" in IDA in order to automatically replace offsets by field names?

The Hex-Rays decompiler will automatically respond to changes in local or global variable types, and automatically display the memory dereferences as proper structure references. The same is not true ...
Rolf Rolles's user avatar
  • 9,198
1 vote

How to define "code" variable type in Ghidra

code is a generic term for an undefined function pointer. Ghidra's usage of assigning variables as code * is only produced through auto-analysis and not an exposed type for users. A generic void * or ...
blabb's user avatar
  • 16.4k
1 vote

IDA PRO decompiler expression last question (pseudocode)

memory=VirtualAlloc(lpAddress, 3*v48, flAllocationType, 16*v19); memory will hold the allocated address (int (__stdcall *)(_DWORD, _DWORD)) prototype of a function that takes two arguments of type ...
blabb's user avatar
  • 16.4k
1 vote

what does an integer modulus 32 cast to (byte *) points to?

based on what is provided local_1120 % 0x20 can range between 0x0 to 0x1f only :\>python printmod.py 0x0 0x20 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c ...
blabb's user avatar
  • 16.4k
1 vote
Accepted

What does this custom piece of frame manipulation code from a router binary do?

ntohs basically converts a netshort to hostshort >>> import socket >>> print (hex(socket.ntohs(0x1337))) 0x3713 >>> print (hex(socket.ntohs(0x3713))) 0x1337 >>> it ...
blabb's user avatar
  • 16.4k
1 vote

replacing static value with variable

Memory-to-memory MOV does not exist. You could try the following: MOV eax, DWORD PTR DS : [400400] MOV DWORD PTR SS : [EBP - 30], eax Please check also if the absolute numbers are ...
josh's user avatar
  • 1,974
1 vote

Is pointer decryption possible?

I don't think there is any encryption going on. Probably the program uses multiple structs to store the data which is completely normal.
Igor Skochinsky's user avatar
  • 36.8k
1 vote

Is there a static address to a pointer on Mac OS?

By declaring d inside main() it is a local scope variable, which exists on the stack and is therefore dynamic. If you declare this pointer outside of main, it will be a global variable and it will ...
GuidedHacking's user avatar
1 vote

How to get pointer from byte code

It's way simpler than you'd think. 461EE300 is the relative offset to your variable. The relative offset needs to be added to the rip-register. And you already have the value of the rip-register. It's ...
moccajoghurt's user avatar
1 vote

Why does MSVC x64 Compiler load addresses like this?

If you disassemble the instructions for mov edx, offset ds:mystring vs lea rdx, offset ds:mystring You'll notice the LEA instruction length (in bytes) was smaller. Its a compiler optimization! ...
grepNstepN's user avatar
1 vote
Accepted

Set register to specific value for use in autoanalysis in IDA Pro 6.9

Just set it in processor options.
Igor Skochinsky's user avatar
  • 36.8k

Only top scored, non community-wiki answers of a minimum length are eligible