Questions tagged [pointer]
The pointer tag has no summary.
34 questions
3 votes
1 answer
245 views
Is there a way to find all constant pointers in IDA Pro?
I would like to know all the constants used for memory access except for non-pointer constants (e.g. argument) in IDA Pro. Is there such a way?
- 131
1 vote
0 answers
178 views
How to convert addresses shown by IDA when statically analyzing a DLL to real addresses in runtime
In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like ...
- 11
0 votes
2 answers
1k views
How to set a variable as "pointer to struct" in IDA in order to automatically replace offsets by field names?
In IDA, I have the following disassembly code (from an old 16-bit DOS application) : les bx, _Foo mov word ptr es:[bx+84h], 0FFFFh mov word ptr es:[bx+8Ch], 0FFFFh mov word ptr es:[bx+...
- 381
0 votes
1 answer
157 views
Decompilers points to non-existing virtual function
As part of solving the Hidden password challenge, I found an condition calls a virtual function the v14 points to v8 variable : and the functions in the program does not make sense for me, there is ...
- 137
1 vote
1 answer
4k views
How to define "code" variable type in Ghidra
Of all the confusing parts of Ghidra, I'd like to ask about the "code" keyword. A similar question was asked here. However, I am not asking what the keyword is, but how to interpret/define ...
- 21
2 votes
0 answers
135 views
CR16C architecture code pointers in Ghidra?
On CompactRISC CR16C architecture, because instructions only start at even-numbered addresses, code pointers (as used by JAL, JUMP, Jcond) are shifted one bit to the right. These are distinct from ...
- 43
0 votes
1 answer
105 views
Does psVar[-6] refer to 6*sizeof(psVar) bytes before psVar? Can you avoid the negative index?
In this decompiled code, does psVar8[-6] refer to 6*sizeof(psVar8) == 12 bytes before psVar8? psVar8 = (short *)(&DAT_1412345b4 + named_index * 0x20); do { if (psVar8[-6] == 0) break; // ... } ...
- 175
2 votes
2 answers
302 views
IDA PRO decompiler expression last question (pseudocode)
memory=VirtualAlloc(lpAddress, 3*v48, flAllocationType, 16*v19); ..... shellcode=(int (__stdcall *)(_DWORD, _DWORD))memory; ..... shellcode(&hkernel32, 0) If ...
- 21
0 votes
1 answer
1k views
How to see the function definition of a function pointer in Ghidra
i was wondering how to get to the function definition of a function pointer. Currently i have a function which is called in the following way: iVar = (*DAT)(param_2, PTR_s) When i press on *DAT i see ...
- 11
2 votes
1 answer
455 views
Comparing the static address of the vtable of a class, to the pointer to it held by the object
I know this is compiler/ABI dependent, not necessarily standardized, etc. I've always assumed, from what I've read in several places (e.g. an answer here or the example in wikipedia), that a typical ...
1 vote
2 answers
227 views
what does an integer modulus 32 cast to (byte *) points to?
As part of a CTF challenge I have to understand the inner workings of a cryptlock type malware, and use it to decrypt a file containing the flag. I used GHIDRA to decompile the binary. The encryption ...
- 11
0 votes
1 answer
86 views
What does this custom piece of frame manipulation code from a router binary do?
I've decompiled a custom router ELF binary using Hex-Rays and have recently come across the following function in the binary: pkt_hdr_t *__cdecl pkt_hdr_from_frame(frame_t *frame, uint16_t *remaining) ...
- 277
1 vote
1 answer
266 views
Function pointer reference
I need to hook 10/20 functions like these: static void* __cdecl HookFunction1(char *FileName, int a2, int a3, int a4); __declspec(naked) void HookFunction2(char *Src, int pedx, int a3, ...
- 289
0 votes
1 answer
706 views
How i can grab a pointer or hook the process procedure without creating a global hook [closed]
i am trying to hook wndproc in an game, to do that i am injecting a dll into their memory, my problem is i don't wanna do a Global Hook to the wndproc, i want to get a pointer to his procedure to do ...
- 3
9 votes
4 answers
10k views
What is the difference between MOV and LEA in example?
Looking at an assembly code snippet I see: lea rax, [rbp-0x50] Which tells me that the rax register now points to whatever value is in rbp-hex(50). Question. Would I achieve the same result doing ...
- 321