We’re rewarding the question askers & reputations are being recalculated! Read more.

New answers tagged

0

There could be a huge number of reasons for this ranging from something as innocuous as a method pointer being a local variable to obfuscation (highly unlikely with the assembly you showed). As for how to follow it, you can either BP the call and follow it or track the frame pointer to see what it's set to.


0

These are functions exported by ordinal rather than by name. This being a C++ library the actual (mangled) function names are long (up to 200 characters with an average of over 50.) Dynamic linking using names in this case would involve lots of long string comparisons that would slow down the loading of applications using this library. 6153 ?...


0

You understanding is correct: PE's IAT is resolved by the system loader and can be made read-only afterwards. ELF's GOT entries initially point to PLT stubs and are overwritten with the final address on the first call.. meaning GOT needs to remain writable. Writable GOT is indeed a known source of vulnerabilities which is why mitigations like RELRO have ...


0

Yea, it's not completely automatic like IDA Pro. Although the NSA dev team is very active on the project. And any US citizen should be able to add such a feature (via Java) and make a pull request to add it. I found what you do is simply add the module to your Ghidra project. When you click on the module/executable it will ask "...Would you like to analyze ...


0

Relocations are processed by the loader, just like imports and everything else in the PE header is. All of this is processed before executing the entry point. Typically speaking relocations will be initially set to the VA (virtual address) of the target using preferred image base address. Of course in many cases the binary will not be loaded at the base ...


0

So basically you just want a hook? There are a huge number of ways to achieve this but the simplest is probably a JMP hook. I'm happy to explain the details of how it works if you want, but I suggest just using an existing library like MinHook either way. Note that if this game is online then it's very likely you'll be kicked or banned, CRC hashes on code ...


1

Sections are always mapped to the same location relative to each other (the section table in the file describes the layout, via the VirtualAddress field). Only the starting address for the entire module can change. The relocation table is generally(*) used to update absolute values according to the difference between the starting address that was specified ...


Top 50 recent answers are included