9
votes
Accepted
radare2 ascii graph to image?
The ag command and subcommands can help you to output the visual graph into Graphviz format.
[0x00000000]> ag?
Usage: ag<graphtype><format> [addr]
Graph commands:
| aga[format] ...
- 8,899
8
votes
Accepted
How to apply IDA structure to a pointer of a structure
To set register as an offset to a structure in a sequence of assembly code, you'll need to select that sequence and then hit T. A pop up dialog called "Structure offsets" will appear, where you can ...
- 11.7k
7
votes
Accepted
Parsing/Rescuing corrupted IDA database
I published some tools on github which can do just that: https://github.com/nlitsme/pyidbutil and https://github.com/nlitsme/idbutil.
The first is written in python, the second in C++, both have ...
- 1,829
5
votes
Struct reconstruction in decompilers
There are several things in your example that makes it hard to decompile.
s is the first, and only, local (so on the stack) variable in main(). main() is troublesome, as it's more or less a vararg-...
- 191
5
votes
Accepted
Identifying possible structs in C/C++ disassembly
There is nothing strange in structures or objects with large arrays or other structures inside.In addition I see that most of the large offsets are counted from ecx register, which fits to the ...
- 8,343
5
votes
Accepted
Identify two structs in IDA
You can do that through the "local types" window (View -> Open subviews -> Local types). Right-click on the structure and select Map to another type.
- 9,088
4
votes
Accepted
What is __sighandler_t struct and purpose of SIGTRAP signal handler
First, am I right to think that the purpose of this is to create a
handler for the SIGTRAP signal, probably in order to prevent any
debuger use
When a SIGTRAP is raised, normally the handler ...
- 1,124
3
votes
How to find arrays of objects (entities, enemies) in a game I'm reversing with Cheat Engine?
First Find the address you are looking for. Then cycle this:
Find the base (the beginning of the record).
Dissect the memory around this to recognize array or linked list.
Search the memory for ...
- 31
3
votes
Accepted
Struct reconstruction in decompilers
The default compilation options do not embed full debugging information, and a small structure passed by value is indistinguishable from a bunch of individual arguments passed in registers (see the ...
- 36.2k
3
votes
How to reverse engineer structs in radare2?
According to the official radare2 book, you have to reverse the struct manually by understanding the features of the program. Then you can overwrite the variable by struct names such as for instance:
...
3
votes
Accepted
What is the difference between uintX_n (used in IDA Pro) and unitX_t types?
It seems these types are custom to the program you’re analyzing and probably come from the debug information (e.g. DWARF).
The standard types from stdint.hare usually typedefs and not structs.
- 36.2k
3
votes
C++ structure containing a RTTI getter function?
IIRC the typeid operator returns a pointer to a type info instance.
Overall the code looks like a lambda expression implementation; the “constructor” captures the context so that the “handler” (lambda ...
- 36.2k
3
votes
Accepted
How are members of a Structure Type positioned on the stack?
The second member, called buf (at location 4) is not a char. The type of that member is defined at 0x3451, and this is an array type. Its elements are each of the type defined at 0x2d04, which is a ...
- 921
3
votes
How to restore struct fields
IDA knew that there was a struct named ComputeService::RPC due to a mangled name containing a reference to it -- for example, a mangled name for the function shown in your question. However, IDA did ...
- 9,088
3
votes
How can I define a struct in x64/x32Dbg?
Right now it is not possible to label instructions in the disassembly as structure members. It is however possible to define structs and visit them in memory (similar to 010 editor). The main sources ...
- 1,652
3
votes
How to get Packet Structures
There is no automated way (as far as I know) for that. The most common approach is examining sender and receiver processes and their communications. Another thing is packet (or frame) doesn't matter ...
3
votes
Accepted
Problem with converting hex values to decimal
This is not the pascal/delphi string format, as those are either constant 1 byte or 4 bytes long length fields.
It does have some resemblance to the ASN1 format, except ASN1 comes with an additional ...
- 11.7k
2
votes
Parsing/Rescuing corrupted IDA database
In my instance the error was "Read error: read past end of file (file position 0x0, wanted 0x20X bytes, read 0x0".
After trying different things for a while, I realised the .id2, .nam and the .til ...
- 121
2
votes
IDA Pro: how to pass a function a pointer to a structure field
In order to get Hexrays to detect that your subtype passed as an argument is actually a member of a bigger parent type, you have to declare the parent type as a structure, and declare the ...
- 565
2
votes
Problem with converting hex values to decimal
This looks like the LEB128 encoding.
Essentially, this is a variable length encoding where the lowest 7 bits of each byte store part of the value and highest bit of each byte is set if it's not ...
- 2,503
2
votes
How to properly label ALL structure members of C-style struct in IDA Pro
IDA picks up a potential struct member offset from the operand on which your cursor is. If it's [eax], the offset is 0, so it shows the member at 0 ( .name). But if you try for example [eax+34h], it ...
- 36.2k
2
votes
How to restore struct fields
Is there a way to check what are the fields inside this struct?
The old fashion way. Follow that pointer around through the assembly and see what offsets are used and how. If you can find where it's ...
- 176
2
votes
How do I reverse engineer structs that are put as parameters in a function
The function's name isn't struct dynamic_array. The function's name is Mesh::CalculateBoneBindPoseBounds.
The function accepts an argument of type struct dynamic_array<...>.
There's no function ...
- 11.7k
1
vote
Parse offset to PE struct
Declare a new type in the local types window:
union MZ_or_PE {
IMAGE_DOS_HEADER *MZ;
IMAGE_NT_HEADERS *PE;
};
Then change the type of what you're currently calling module_base to MZ_or_PE. This ...
- 9,088
1
vote
Accepted
Define partial struct with IDA
Something like:
struct partially_known {
char gap0[12];
int student_id;
char gap10[32];
};
- 9,088
1
vote
troublesome stack frame setup
After reading up on "shadow stack space" as suggested by @blabb it looks like this is an unoptimized build, so the 2 parameters RDX and RCX are being saved in the caller's scratch space, ...
- 111
1
vote
Accepted
How is padding size calculated for members of structure types?
The offsets you are quoting are not the offsets of the structure members, but they are offsets of the debug information statements inside the dwarf section. The members itself are all 8 bytes in size. ...
- 921
1
vote
Accepted
Generate dummy struct in IDA hexrays
You should right-click and select "reset pointer type". And then you get "make new struct" in the menu.
- 228
1
vote
Accepted
IDA: apply function parameter as struct pointer
Since you code seems to be un-optimized, you have to manually follow the memory access manually. In your case, you have to apply this structure offset (T) at 0x000000000040111C (rax), ...
- 1,124
1
vote
How can I unpack this archive file?
Please read this article of mine: https://www.codeproject.com/Articles/5035/How-to-Write-a-Simple-Packer-Unpacker-with-a-Self
It answers you in C. But rewriting in Python is easy.
- 216
Only top scored, non community-wiki answers of a minimum length are eligible