New answers tagged

1

use im to get the type and state they are not deciphered like windbg can but you can get the flags radare2 [0x7ff6c5153380]> im~0xcf39d2c000 0xcf39d2c000 +0x4000 rw- paddr=0x0000959e state=0x00001000 type=0x00020000 allocation_protect=0x00000004 Memory_Section [0x7ff6c5153380]> iS~0xcf39d2c000 2 0x0000959e 0x4000 0xcf39d2c000 0x4000 -rw- ...


2

Since I don't know any tool to solve your problem easily, I will tell you how it can be done "by hand". First of all, you have to be familiar with PE format. If you are not, you may check aldeid and MSDN to understand the steps I will describe. Adding an export to dll is just extending Export Directory and possibly changing some other fields. So, ...


0

Assuming You Wrote this code This opens a file in the current Directory Reads its contents and counts the content length and Prints to console contents and count This is a crt function it transistions from crt to kernel32.dll , kernelbase.dll and ntdll.dll in user mode. and from ntdll it transitions into kernel mode via a syscall to NtCreateFile in ntoskrnl/...


3

when you are here 4017ff: 55 push rbp your 5th argument will be available at [rsp+28] (8 bytes for return address and 20 bytes for HOMEPARAMS (space for saving the 4 args passed via register) two pushes and one subtract will make your argument no 5 available at 0x28 + 0x8 +0x8 +0x48 = 0x80 so rbp+0 will hold the address of 5th ...


1

I've spent many hours (too many for me to admit) trying to figure this out and I just realized what it is, right after hitting submit. push instructions implicitly decrease the stack pointer. The call to the function DotProduct calls push three times; once in the call instruction itself, where the return address is implicitly pushed, and twice in the ...


Top 50 recent answers are included