Hot answers tagged

2

CreateRemoteThread takes 7 arguments and the 4th of them is called lpStartAddress. Now, from MSDN docs: lpStartAddress A pointer to the application-defined function of type LPTHREAD_START_ROUTINE to be executed by the thread and represents the starting address of the thread in the remote process. The function must exist in the remote process. For more ...


2

Yes, mov DWORD PTR 40[rsp], 6 is the same as mov DWORD PTR [rsp + 40], 6. The first syntax makes a lot more sense in cases where the constant is the base address of an array, and the register contains a byte offset into that array. That's the use case the syntax was designed for.


1

Yes, this is possible with some cooperation from the debugger. The OllyMigrate plugin supports migration between following debuggers: OllyDbg Immunity Debugger IDA Pro/Freeware WinDbg x64dbg It seems Visual Studio is not supported but you can always do it the manual way: Patch an infinite loop (EB FE) at the current EIP/RIP; Detach the current debugger. ...


1

You can parse a header using File > Load file > C header file or create a type library beforehand.


1

If you are using CLIthen do something like: ida_typeinf.idc_parse_types("filename.h", idc.PT_FILE). See this file for more options. Also check this link for GUI, they also explained how to setup your header file. Hope this helps.


1

All statically linked MFC binaries I've seen always include strings for some internal classes. The naming convention can be found in afximpl.h: #define AFX_WNDCLASS(s) \ _T("Afx") _T(s) _T(_MFC_FILENAME_VER) _STATIC_SUFFIX _UNICODE_SUFFIX _DEBUG_SUFFIX #define AFX_WND AFX_WNDCLASS("Wnd") #define AFX_WNDCONTROLBAR ...


1

It is strange that segments ends in the middle of a function. You could optimize your method, writing script that calculates the desired start and end of combined segments , deleting the relevant segments and then recreating as a combined segment. It is probably better than merging. You have a lot of control over parameters of the segments and it needs to ...


1

The earliest break is sxe ibp break on kd communication if you want to break earlier than that you need to lookup boot debugging you can use ctrl+alt+d for a debug spew of kdcom kdnet packets sent to and fro


Only top voted, non community-wiki answers of a minimum length are eligible