📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  Function Logging

Topic created on: September 24, 2007 09:19 CDT by bepetemish .

I know i posted something like this some time ago but im still stuck. This is the code of the application i want to log the function1 function from.
#include <cstdlib>
#include <iostream>

using namespace std;
void function1(int wat);

int main(int argc, char *argv[])
{
    function1(1);
    system("PAUSE");
    return EXIT_SUCCESS;
}

void function1(int wat)
{
     if(wat==1)
     {
     cout << "lol" << endl;
     }
     }


I want to know the address and the variables it needs and i want to find it using a debugger.

Can someone help me out with this(again)?

And im searching for correct terms:
- function1 = "user-defined function?"
- int wat = "function variable?"
- function1 address = "offset?"

ps. my other post was atleast half a year ago ;)

  aeppert     September 24, 2007 09:53.41 CDT
Before asking here - I would recommend going and searching Google for an introductory guide to Ollydbg.  After reading that and going through some tutorial samples, I believe you will be more likely to help yourself, thus ultimately learn the material, than any of us telling you how to do it here.

  anonymouse     September 24, 2007 11:41.08 CDT
like aeppert suggested you should get yourself familiarised with ollydbg or whichever debugger you prefer
debuggeing your own programs with source code quiet a few times and you are more than likely find answers on your own


anyway

start->run->cmd->edit->bepetemish.cpp -> copy paste -> alt+f /s alt+f/ x -> bcc32 -v bepetemish.cpp -> ollydbg bepetemish.exe


0040116F                 |.  837D 08 01    CMP     DWORD PTR SS:[EBP+8], 1

Stack SS:[0012FFC0]=004160FC (bepetemi.004160FC)
bepetemish.cpp:17.  if(wat==1)

so ebp+8 = wat

00401155                 |.  E8 12000000   CALL    bepetemi.function1                             ; \bepetemi.0040116C

0040116C bepetemi.function1   /$  55            PUSH    EBP

EBP=0012FFB8
Local call from main+5
bepetemish.cpp:15.  void function1(int wat)



to find thsi without the symbols you need certain basic understanding of how your variables functions and thier addresses will look like in disassembler , debugger

which will come if and only if you practice yourself and never by asking it and never by some one explaining it in ten lengthy pages with whatever examples he could muster

[/code]

simply stated if you cant understand what ebp is and why ebp+8 is your int wat then my answer obviously is simple piece of unintelligible crap

the oldschooleres used to call it zen or attaining zen

those terms you are looking for should click to you when you look at them you should recognize them instantly when you take a look at the maze of opcodes  staring on your face  it cant come by someone explaining it to you

  bepetemish     September 24, 2007 12:10.36 CDT
I think i know the how to handle ollydb and i know the basics of ASM.

Im going to take a closer look at your post tommorow when i'm behind my main computer again.

Oh, and the main reason why i was asking for terms is because i learned most of the things myself so i don't know how the "public" calls certain stuff.

Thanks,

Bepetemish

  bepetemish     September 25, 2007 12:09.54 CDT
anonymouse,

which tool did you use?

  aeppert     September 25, 2007 13:57.44 CDT
"anyway

start->run->cmd->edit->bepetemish.cpp -> copy paste -> alt+f /s alt+f/ x -> bcc32 -v bepetemish.cpp -> ollydbg bepetemish.exe"

From anonymouse's post...

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit