defragger
  • Member for 8 years, 4 months
  • Last seen this week
I'm confused about parameter in Printf function
1 votes

0x405044 is the address of your format string. You can print the string with x/s 0x405044 It stores this address at esp cause its your first argument.

View answer
What does "???" mean in x32dbg?
Accepted answer
3 votes

This means that there is no valid opcode for this spot. The other 'valid' opcodes in your picture look also not useful at all. I assume the whole block there is nothing that can be executed.

View answer
What does anal.hasnext actually do?
Accepted answer
0 votes

hasnext tries to get the function behind the current one. It also skips padding stuff like int3 (0xcc), nop (0x90) and such (on x86). anal.depth defines the limit of this behaviour. every 'next' ...

View answer
Can't find SetCooperativeLevel call in disassembled program
1 votes

There's also the possibility to set a screen to full screen with the function SetRect I found this spot on the mentioned executable: 0x004619bf mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics] ...

View answer
Analyze all functions with radare2
Accepted answer
1 votes

To see the help of analysis you can use aa?. For a more detailed information i would always suggest visiting the sourcecode as a lot of aa commands are combinations of different steps. A good starting ...

View answer
How to get the memory-mapping (e.g. library) that contains a given address in Radare?
Accepted answer
2 votes

With the command dm. you can show the map name of the current address. To change the current address to your desired one add @ address For example: [0x7f8622478090]> dm. @ 0x00007f8622477000 ...

View answer
Basic Blocks and Data Flow Analysis
2 votes

You could look at the radare project: https://github.com/radare/radare2 Their ESIL representation of mnemonics can help you track down the access to variables, registers and even flags. https://...

View answer
Is there a way to get an instruction count with Radare2?
Accepted answer
1 votes

You can always add ~? to any radare command to count lines of the resulting output. But, like in Bash the pipe to wc -l also works, |wc -l. So in your case [0x08049060]> pif~? 18 [0x08049060]> ...

View answer
Debugging a process running in a Virtual Machine with Radare2?
1 votes

Radare is able to connect to gdb remote sessions. So if you use something like qemu for your virtualization you would be able to connect to this. The problem will be to find the desired process inside ...

View answer
Can I search Radare's help system?
Accepted answer
5 votes

You can try to find a command with searching over all help texts like this: ?* And to filter the result simply add this: ?*~keyword

View answer
Hopper on Linux -- how to use GDBserver
1 votes

I have always used gdbserver --remote-debug localhost:1234 ./yourapplication to start the gdbserver. If i remember correct the gdb connection could be configured under Window->Open Debugger Selector. ...

View answer
Stack pointer values in IDA Pro
Accepted answer
3 votes

The call pushes the address of the next mnemonic on the stack. But the ret in the function explode_bomb will also pop this address from the stack. So the stack value at 0x8048b6e will stay the same. ...

View answer
Finding code in MFC32 binary
1 votes

You just have to attach to the desired process with ollydbg or something similar and breakpoint ReadFile,WriteFile and CreateFile. (If you also need the information about the connection itself like ...

View answer