Skip to main content
9 votes
Accepted

radare2 ascii graph to image?

The ag command and subcommands can help you to output the visual graph into Graphviz format. [0x00000000]> ag? Usage: ag<graphtype><format> [addr] Graph commands: | aga[format] ...
Megabeets's user avatar
  • 8,989
8 votes
Accepted

How to apply IDA structure to a pointer of a structure

To set register as an offset to a structure in a sequence of assembly code, you'll need to select that sequence and then hit T. A pop up dialog called "Structure offsets" will appear, where you can ...
NirIzr's user avatar
  • 11.8k
7 votes
Accepted

Parsing/Rescuing corrupted IDA database

I published some tools on github which can do just that: https://github.com/nlitsme/pyidbutil and https://github.com/nlitsme/idbutil. The first is written in python, the second in C++, both have ...
Willem Hengeveld's user avatar
5 votes

Struct reconstruction in decompilers

There are several things in your example that makes it hard to decompile. s is the first, and only, local (so on the stack) variable in main(). main() is troublesome, as it's more or less a vararg-...
Tobias's user avatar
  • 201
5 votes
Accepted

Identifying possible structs in C/C++ disassembly

There is nothing strange in structures or objects with large arrays or other structures inside.In addition I see that most of the large offsets are counted from ecx register, which fits to the ...
w s's user avatar
  • 8,488
5 votes
Accepted

Identify two structs in IDA

You can do that through the "local types" window (View -> Open subviews -> Local types). Right-click on the structure and select Map to another type.
Rolf Rolles's user avatar
  • 9,198
4 votes
Accepted

What is __sighandler_t struct and purpose of SIGTRAP signal handler

First, am I right to think that the purpose of this is to create a handler for the SIGTRAP signal, probably in order to prevent any debuger use When a SIGTRAP is raised, normally the handler ...
wisk's user avatar
  • 1,154
3 votes

How to find arrays of objects (entities, enemies) in a game I'm reversing with Cheat Engine?

First Find the address you are looking for. Then cycle this: Find the base (the beginning of the record). Dissect the memory around this to recognize array or linked list. Search the memory for ...
Random guy's user avatar
3 votes
Accepted

Struct reconstruction in decompilers

The default compilation options do not embed full debugging information, and a small structure passed by value is indistinguishable from a bunch of individual arguments passed in registers (see the ...
Igor Skochinsky's user avatar
  • 36.7k
3 votes

How to reverse engineer structs in radare2?

According to the official radare2 book, you have to reverse the struct manually by understanding the features of the program. Then you can overwrite the variable by struct names such as for instance: ...
ultimate-anti-reversing's user avatar
3 votes
Accepted

What is the difference between uintX_n (used in IDA Pro) and unitX_t types?

It seems these types are custom to the program you’re analyzing and probably come from the debug information (e.g. DWARF). The standard types from stdint.hare usually typedefs and not structs.
Igor Skochinsky's user avatar
  • 36.7k
3 votes

C++ structure containing a RTTI getter function?

IIRC the typeid operator returns a pointer to a type info instance. Overall the code looks like a lambda expression implementation; the “constructor” captures the context so that the “handler” (lambda ...
Igor Skochinsky's user avatar
  • 36.7k
3 votes
Accepted

How are members of a Structure Type positioned on the stack?

The second member, called buf (at location 4) is not a char. The type of that member is defined at 0x3451, and this is an array type. Its elements are each of the type defined at 0x2d04, which is a ...
Michael Karcher's user avatar
3 votes

How to restore struct fields

IDA knew that there was a struct named ComputeService::RPC due to a mangled name containing a reference to it -- for example, a mangled name for the function shown in your question. However, IDA did ...
Rolf Rolles's user avatar
  • 9,198
3 votes

How can I define a struct in x64/x32Dbg?

Right now it is not possible to label instructions in the disassembly as structure members. It is however possible to define structs and visit them in memory (similar to 010 editor). The main sources ...
mrexodia's user avatar
  • 1,652
3 votes

How to get Packet Structures

There is no automated way (as far as I know) for that. The most common approach is examining sender and receiver processes and their communications. Another thing is packet (or frame) doesn't matter ...
Kerim Can Kalıpcıoğlu's user avatar
3 votes
Accepted

Problem with converting hex values to decimal

This is not the pascal/delphi string format, as those are either constant 1 byte or 4 bytes long length fields. It does have some resemblance to the ASN1 format, except ASN1 comes with an additional ...
NirIzr's user avatar
  • 11.8k
2 votes

Parsing/Rescuing corrupted IDA database

In my instance the error was "Read error: read past end of file (file position 0x0, wanted 0x20X bytes, read 0x0". After trying different things for a while, I realised the .id2, .nam and the .til ...
Jeromy Adofo's user avatar
2 votes

IDA Pro: how to pass a function a pointer to a structure field

In order to get Hexrays to detect that your subtype passed as an argument is actually a member of a bigger parent type, you have to declare the parent type as a structure, and declare the ...
user2823000's user avatar
2 votes

Problem with converting hex values to decimal

This looks like the LEB128 encoding.    Essentially, this is a variable length encoding where the lowest 7 bits of each byte store part of the value and highest bit of each byte is set if it's not ...
Ian Cook's user avatar
  • 2,548
2 votes

How can I export a struct in IDA Pro to a c-style struct?

I've found the answer here. It is possible to export a structure by going in Local Types (Shift+F1). Then select the structure you want to export and in the contextual menu choose either Edit or ...
user16715's user avatar
2 votes

How to properly label ALL structure members of C-style struct in IDA Pro

IDA picks up a potential struct member offset from the operand on which your cursor is. If it's [eax], the offset is 0, so it shows the member at 0 ( .name). But if you try for example [eax+34h], it ...
Igor Skochinsky's user avatar
  • 36.7k
2 votes

How to restore struct fields

Is there a way to check what are the fields inside this struct? The old fashion way. Follow that pointer around through the assembly and see what offsets are used and how. If you can find where it's ...
Thomas Mouton's user avatar
2 votes

How do I reverse engineer structs that are put as parameters in a function

The function's name isn't struct dynamic_array. The function's name is Mesh::CalculateBoneBindPoseBounds. The function accepts an argument of type struct dynamic_array<...>. There's no function ...
NirIzr's user avatar
  • 11.8k
1 vote

Parse offset to PE struct

Declare a new type in the local types window: union MZ_or_PE { IMAGE_DOS_HEADER *MZ; IMAGE_NT_HEADERS *PE; }; Then change the type of what you're currently calling module_base to MZ_or_PE. This ...
Rolf Rolles's user avatar
  • 9,198
1 vote
Accepted

Define partial struct with IDA

Something like: struct partially_known { char gap0[12]; int student_id; char gap10[32]; };
Rolf Rolles's user avatar
  • 9,198
1 vote

troublesome stack frame setup

After reading up on "shadow stack space" as suggested by @blabb it looks like this is an unoptimized build, so the 2 parameters RDX and RCX are being saved in the caller's scratch space, ...
Chris H's user avatar
  • 111
1 vote
Accepted

How is padding size calculated for members of structure types?

The offsets you are quoting are not the offsets of the structure members, but they are offsets of the debug information statements inside the dwarf section. The members itself are all 8 bytes in size. ...
Michael Karcher's user avatar
1 vote
Accepted

Generate dummy struct in IDA hexrays

You should right-click and select "reset pointer type". And then you get "make new struct" in the menu.
eyal karni's user avatar
1 vote
Accepted

IDA: apply function parameter as struct pointer

Since you code seems to be un-optimized, you have to manually follow the memory access manually. In your case, you have to apply this structure offset (T) at 0x000000000040111C (rax), ...
wisk's user avatar
  • 1,154

Only top scored, non community-wiki answers of a minimum length are eligible