Neitsa
  • Member for 7 years, 8 months
  • Last seen more than a month ago
Does pintool work with virtual/symbolic CPU
1 votes

I am looking for Dynamic Symbolic Execution tools Probably nitpicking, but as your question is about PIN, this tool falls under the DBI (Dynamic Binary Instrumentation) tool category, it has nothing ...

View answer
How to create function prototype that recognizes arguments passed by reference in IDA Pro
Accepted answer
7 votes

My guess is that the function signature should be something like: int __usercall Call_HTTP@<eax>(int x, int y, void* http_object@<edi>); __usercall means the calling convention for the ...

View answer
How should I approach debugging a PE which create a large database?
Accepted answer
5 votes

If the problem is the time it takes for IDA to rebase the IDB when debugging, then some possible solutions: Disable ASLR from module, so it keeps loading at the same base address (same base address ...

View answer
How do you efficiently record EIP of a target continuously?
Accepted answer
3 votes

I would go for Dynamic Binary Instrumentation (DBI). Logging rIP is a standard application for DBI. On windows there are at least 3 well known DBI frameworks: Intel PIN DynamoRIO DynInst Logging ...

View answer
When to use Windbg and Ollydbg?
4 votes

WinDbg uses debugging information (pdb/symbol files) for debugging. So ,for example say I get a unknown exe (malicious) can I debug it since I'll not be having its .pdb Yes. Symbols are one of Windbg'...

View answer
Target of offset into import directory unclear
Accepted answer
2 votes

If ebx really points to an IMAGE_IMPORT_DESCRIPTOR, then [ebx+20h] points to the name field of the next IMAGE_IMPORT_DESCRIPTOR. mov eax, [ebx+20h] ; 0x20 = 0x14 + 0xc where 0x14 is sizeof(...

View answer
IDAPython load PDB-file of analysed binary
2 votes

According to the SDK, the PDB loader is implemented as an IDA plugin (see the SDK, e.g: \idasdk67\plugins\pdb). The plugin name is "pdb", so you can call the plugin directly, like this: idaapi....

View answer