Hot answers tagged

9

Googling for 0x50435245 gives several hits, for example here: /* Magic number to provide a small check against being handed junk. Also used to detect whether a pattern was compiled on a host of different endianness. */ #define MAGIC_NUMBER 0x50435245UL /* 'PCRE' */ <...snip...> /* The real format of the start of the pcre block; the index of ...


9

The ag command and subcommands can help you to output the visual graph into Graphviz format. [0x00000000]> ag? Usage: ag<graphtype><format> [addr] Graph commands: | aga[format] Data references graph .... | agf[format] Basic blocks function graph .... Output formats: | <blank> Ascii art | * ...


8

To set register as an offset to a structure in a sequence of assembly code, you'll need to select that sequence and then hit T. A pop up dialog called "Structure offsets" will appear, where you can supply the register and structure it points to, and you'll see all references IDA recognized using it. Lets take the following code snippet taken from calc.exe ...


8

Add your struct in the function's stack view: With your cursor in the function's disassembly view, press Ctrl+K to open the stack view. In the stack view, ensure that enough function arguments exist to get to at least +00000010 in the stack. Use D to add more function arguments as necessary. Position your cursor on the +00000010 line in the stack view and ...


7

I published some tools on github which can do just that: https://github.com/nlitsme/pyidbutil and https://github.com/nlitsme/idbutil. The first is written in python, the second in C++, both have similar functionality. pyidbutil provides the most low level recovery options: using --pagedump you can dump each page in the file without the need of an intact ...


7

Struct: Alt+Q Array: Numeric keypad *


6

There is a great IDA plugin called HexRaysCodeXplorer that does automatic type reconstruction for C++ objects . It should do what you need.


5

Yes. In StructB, select the field you want to convert to a sub-structure or create a new field by pressing D. With the given field selected, press Alt+Q and select StructA for the field.


5

You should rather ask your questions with some kind of example output so that answers are not based on guesswork. Does iam loading the struct mean I wrote a program where I am employing OpenProcess() ReadProcessMemory() or does it mean i am opening the raw file with FILE * fp ; fopen("c:\XXX","wb") fread(fp); or load it in say ollydbg or in a ...


5

Unfortunately, I cannot provide answer what to do when your database is already corrupted. That's the nature of proprietary binary databases: if you're hosed, you've got to keep all the pieces. But I may suggest that you should foresee and be prepared to IDA database corruption, which is imminent and happens sooner or later to almost everyone. So: Prefer ...


5

You need to select the range of instructions you're interested in, then use the same T shortcut as you would for a single occurrence. The dialog shown will allow you to select the register, the offset delta to add to the displacement, and the struct you want to apply. The dialog does some preparation work/struct analysis before showing up. If you have a ...


5

This feature is supported since Hex-Rays 1.6: http://www.hexblog.com/?p=544 (see section 3. CONTAINING_RECORD macro)


5

There are several things in your example that makes it hard to decompile. s is the first, and only, local (so on the stack) variable in main(). main() is troublesome, as it's more or less a vararg-function if you read the C++ standard, and as you can see atleast IDA guesses that you have three arguments on the stack. You use both int and long in your ...


4

From above... Decompiled: *(_DWORD *)(shipsStruct - 4) = playerPointer->ssXCoord; *(_DWORD *)shipsStruct = playerPointer->ssYCoord; ... Original: Ships[i].XCoordinate = *(DWORD *) (playerPtr + 0x4); Ships[i].YCoordinate = *(DWORD *) (playerPtr + 0x8); ... Based on these snippets, it looks like the structure in your stack variables is 8 bytes off. ...


4

In the next version, 6.5, it should be as easy as selecting the corresponding VTable area, right click and selecting the menu option "Create struct from data" (leak from IDA Beta testing). In the meantime, you can use this IDAPython script I use myself. I hope you'll find it helpful.


4

Unless the string is at the end of the structure, it doesn't make sense to try and make this struct in IDA, because it probably doesn't even exist in C (or whatever the original language was). Now if the string is at the end of the struct, this might correlate to an actual C struct definition. This is called a "zero-length" array, or "flexible array member"....


4

First, am I right to think that the purpose of this is to create a handler for the SIGTRAP signal, probably in order to prevent any debuger use When a SIGTRAP is raised, normally the handler given in parameter of signal is called. If you have a debugger attached, this function will not get called. If your handler is never called, you can assume a ...


3

It seems to me that the problem is a bit worse than you describe, and there's no easy way to get around it. First, @sealed seems to be right with the function being a class method, and your compiler passing the class pointer in ecx, because that's the only way for .text:008F28B5 lea ecx, [esi+eax*4+4] .text:008F28B9 call ...


3

As I Don't know the prototype of ReadCfgEntry and structure of the code my answer is not exact. First: If the buffer is dynamically allocated As your function use ECX as initialized register: .text:008F2886 mov esi, ecx It is a class function so the owner class has a constructor that initiated the target buffer. you must trace the ...


3

The Y key equivalent is indeed the SetType (or, rather, ApplyType) function, and it normally accepts addresses. However, you actually can pass the structure member ID as the "address" to set the member's type info.


3

What you referring to as ptr-4 and ptr-8 are in fact location of singled out variables on stack. IDA has to know the structure in order to recognize it automatically. If you setup custom structure in "Structures" subview. Subsequently, You can manually set whatever variable you choose to be the type of that particular variable. Thereafter, IDA will replace ...


3

First Find the address you are looking for. Then cycle this: Find the base (the beginning of the record). Dissect the memory around this to recognize array or linked list. Search the memory for pointer to that base. Example: Scan for parameter finding the address 30000032. Find out the base of this record is 30000000. Checking memory - nothing fancy ...


3

Unfortunately this IDA feature doesn't always work as needed especially if you define your objects in Hex-Rays. If your problem is around using Hex-Rays, you can use the XRefs plugin with the hexrays-python API in IDA 6.4. As far as I understand latest version of IDAPython with support of IDA 6.5 at google code already contains these bindings in IDA API ...


3

IDA has been able to show cross-references to structure members since version 6.2:


3

There is nothing strange in structures or objects with large arrays or other structures inside.In addition I see that most of the large offsets are counted from ecx register, which fits to the definition of Visual Studio variant of __thiscall calling convention. So I think that it is just large structure or object. In addition - structures in IDA not ...


3

This is not the pascal/delphi string format, as those are either constant 1 byte or 4 bytes long length fields. It does have some resemblance to the ASN1 format, except ASN1 comes with an additional field denoting the type of the object. Anyways, This looks like the Most significant bit of the first byte is not part of the length and has the special ...


3

The default compilation options do not embed full debugging information, and a small structure passed by value is indistinguishable from a bunch of individual arguments passed in registers (see the ABI spec). You will get a slightly better output if you enable DWARF debug info generation (-gdwarf). At least IDA can make use of DWARF info to import types, ...


3

The second member, called buf (at location 4) is not a char. The type of that member is defined at 0x3451, and this is an array type. Its elements are each of the type defined at 0x2d04, which is a typedef named Char, which redirects to 0x29b7, which is indeed char (represented as base type signed char). <1><3451>: Abbrev Number: 11 (...


3

IIRC the typeid operator returns a pointer to a type info instance. Overall the code looks like a lambda expression implementation; the “constructor” captures the context so that the “handler” (lambda body) can access the variables it needs from the outer scope.


3

It seems these types are custom to the program you’re analyzing and probably come from the debug information (e.g. DWARF). The standard types from stdint.hare usually typedefs and not structs.


Only top voted, non community-wiki answers of a minimum length are eligible