9
votes
Accepted
IDA Pro's Super-Complicated Function Pointer Definition
The variable being assigned to:
v14 =
The type cast needed to convert the result of the subroutine to the type of v14:
(int (__cdecl *)(signed int))
The subroutine call, with one argument: 1:
...
- 1,829
8
votes
What is the difference between MOV and LEA in example?
lea = address
mov = contents
if address 0x401000 contains 0xDeadBeef like ef be ad de
lea MySecretPlace, [401000] MySecretPlace will be 0x401000
Mov MySecretPlace, [401000] MySecretPlace will be ...
- 16.7k
6
votes
Accepted
replacing static value with variable
Let's split this up a bit. I'll skip over some stuff that you might already understand, but we may need to expand this if some stuff is not clear.
MOV DWORD PTR SS:[EBP-30],400400
MOV DWORD PTR SS:[...
- 694
5
votes
Accepted
Game cheating: Pointers vs Static memory editing
There are many reasons for this. I'll jot down a bunch that I can think of off the top of my head.
Many hackers use things like Cheat Engine's built-in automatic pointer scanning functionality ...
- 2,254
5
votes
Accepted
Is pointer decryption possible?
pointer encryption
There is no such thing. There is only pointer obfuscation. This is essentially how Microsoft markets a couple of functions, and they're pretty open about it from the docs on ...
- 1,789
3
votes
Accepted
Comparing the static address of the vtable of a class, to the pointer to it held by the object
The Itanium C++ ABI is sometimes not very clear about what exactly is “vtable”.
In practice, the symbol such as _ZTV12DerivedClass points to the complete vtable structure, which includes the two ...
- 36.9k
3
votes
What is the difference between MOV and LEA in example?
Warning: Illegal instruction used for explanation.
If you are wondering if mov can do the work of lea,
mov eax, esp+4 and lea eax, [esp+4] copies the same value to eax.
However, mov eax, esp+4 is not ...
- 153
3
votes
Accepted
How to find V-Table in IDA? (Using class informer)
What you're looking it is actually a VTable. As you know, a VTable is a table of function pointers and as you can see, at address 0x19B64 you actually see a single function address (this looks like dd ...
- 11.8k
3
votes
What is the difference between MOV and LEA in example?
This is basic. Assume that rpb has a value of 55h (Assembler syntax). then
lea rax, [rbp-50h]
would result in 5.
On the other hand, mov rax, [rbp-50h] would most probable crash your application, as ...
- 1,974
3
votes
Accepted
Point-to analysis of IDA Pro
The topic of pointer analysis is an important part of theoretical static analysis. Many articles and academic publications have been written about pointer analysis, this is a heavily researched field.
...
- 11.8k
3
votes
Accepted
Function Pointer Assembly Calculations
mov ds:dword_804C0D4, offset unk_804C0B8
so if this instruction was executed first before the sub was called then
0x804c0d4 would contain 0x804c0b8
v2 = *(_DWORD *)dword_804C0D4;
so v2 would be ...
- 16.7k
2
votes
How to get pointer from byte code
lets have a look how Cheat Engine calculates its offsets:
4C 8B 05 471EE300 translates to mov r8,QWORD PTR [rip+0xe31e47]
As you can see, the value depends on rip (the instruction pointer). You can ...
- 2,906
2
votes
IDA Pro: how to pass a function a pointer to a structure field
In order to get Hexrays to detect that your subtype passed as an argument is actually a member of a bigger parent type, you have to declare the parent type as a structure, and declare the ...
- 565
2
votes
Game cheating: Pointers vs Static memory editing
Some programs don't like it when you change their code, some protectors check for memory modifications.
Once I used a hack that patches directly the code and got instantly banned from the server.
- 51
2
votes
What is the difference between MOV and LEA in example?
The difference is that lea only calculates the address while mov actually moves the data. If you know C or C++, it’s somewhat similar to:
Lea:rax = rbp + 0x50;
Mov: rax = rbp[0x50];
(Not equivalent ...
- 36.9k
2
votes
Which ARM command is influencing the SP position?
There is no specific stack pointer register in ARM. By convention R13 is used as the stack pointer. There is no specific push and pop style stack pointer operands either.
Pushing and popping from ...
- 21
2
votes
Accepted
Does psVar[-6] refer to 6*sizeof(psVar) bytes before psVar? Can you avoid the negative index?
I think you are running into a case of "shifted pointers". For various reasons the compiler might generate code where a pointer to the middle of a struct is returned. There is a Ghidra PR ...
- 1,459
1
vote
IDA PRO decompiler expression last question (pseudocode)
memory=VirtualAlloc(lpAddress, 3*v48, flAllocationType, 16*v19);
memory will hold the allocated address
(int (__stdcall *)(_DWORD, _DWORD))
prototype of a function that takes two arguments of type ...
- 16.7k
1
vote
Is there a way to find all constant pointers in IDA Pro?
Using Sark's lines for brevity, this should return all the cross-referenced data addresses (with duplicates):
import idautils, sark
for line in sark.lines():
for ref in idautils.DataRefsFrom(line....
- 577
1
vote
How to set a variable as "pointer to struct" in IDA in order to automatically replace offsets by field names?
If you select all instructions referring to the structure and press T, you'll get a different dialog where you can select the base register and the struct to apply to offsets from it.
- 36.9k
1
vote
Accepted
How to set a variable as "pointer to struct" in IDA in order to automatically replace offsets by field names?
The Hex-Rays decompiler will automatically respond to changes in local or global variable types, and automatically display the memory dereferences as proper structure references. The same is not true ...
- 9,218
1
vote
How to define "code" variable type in Ghidra
code is a generic term for an undefined function pointer. Ghidra's usage of assigning variables as code * is only produced through auto-analysis and not an exposed type for users. A generic void * or ...
- 16.7k
1
vote
what does an integer modulus 32 cast to (byte *) points to?
based on what is provided
local_1120 % 0x20 can range between 0x0 to 0x1f only
:\>python printmod.py 0x0 0x20
00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c ...
- 16.7k
1
vote
Accepted
What does this custom piece of frame manipulation code from a router binary do?
ntohs basically converts a netshort to hostshort
>>> import socket
>>> print (hex(socket.ntohs(0x1337)))
0x3713
>>> print (hex(socket.ntohs(0x3713)))
0x1337
>>>
it ...
- 16.7k
1
vote
Function pointer reference
I have solved myself.
PVOID HookFunction;
HookFunction = (PVOID)HookFunction1;
and
DetourAttach(&(LPVOID&)AddressOfHook, HookFunction);
- 289
1
vote
replacing static value with variable
Memory-to-memory MOV does not exist. You could try the following:
MOV eax, DWORD PTR DS : [400400]
MOV DWORD PTR SS : [EBP - 30], eax
Please check also if the absolute numbers are ...
- 1,974
1
vote
Is pointer decryption possible?
I don't think there is any encryption going on. Probably the program uses multiple structs to store the data which is completely normal.
- 36.9k
1
vote
Is there a static address to a pointer on Mac OS?
By declaring d inside main() it is a local scope variable, which exists on the stack and is therefore dynamic.
If you declare this pointer outside of main, it will be a global variable and it will ...
- 156
1
vote
How to get pointer from byte code
It's way simpler than you'd think.
461EE300 is the relative offset to your variable. The relative offset needs to be added to the rip-register. And you already have the value of the rip-register. It's ...
- 23
Only top scored, non community-wiki answers of a minimum length are eligible