Exetools  

Go Back   Exetools > General > Community Tools

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 04-17-2015, 03:56
mr.exodia mr.exodia is offline
Retired Moderator
 
Join Date: Nov 2011
Posts: 783
Rept. Given: 490
Rept. Rcvd 1,123 Times in 305 Posts
Thanks Given: 89
Thanks Rcvd at 716 Times in 333 Posts
mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299
Hey,

Nice seeing you added debugger capabilities! I have a few questions if you don't mind

What is this 'DIA' thing you are talking about to load symbols? Is it open source? I could not find it anywhere (though maybe my search terms were off).

And could you maybe give me some pointers as to how you recognize functions and local variables? Do you scan all instructions and populate a nice graph or do you do a linear scan with some algorithms to detect functions or maybe a combination? I am interested in this because I want to implement some of this in x64dbg

Another small thing, is the arrow location just 'wrong' or is is placed between instructions for a reason? See this screenshot: http://prntscr.com/6ukf81

On and before I forget it, could you share some insight on how you implemented these python functions? I saw the python libs, but do you have some trick to auto generate the required function definitions or is it all manual work?

Greetings
Reply With Quote
  #2  
Old 04-17-2015, 05:51
cyberbob's Avatar
cyberbob cyberbob is offline
VIP
 
Join Date: Aug 2004
Posts: 95
Rept. Given: 23
Rept. Rcvd 119 Times in 29 Posts
Thanks Given: 6
Thanks Rcvd at 46 Times in 16 Posts
cyberbob Reputation: 100-199 cyberbob Reputation: 100-199
Quote:
Originally Posted by mr.exodia View Post
What is this 'DIA' thing you are talking about to load symbols? Is it open source?
it's open source, comes with Visual Studio you should have it in VS path e.g. "c:\Program Files (x86)\Microsoft Visual Studio 12.0\DIA SDK\Samples"

Quote:
Originally Posted by mr.exodia View Post
And could you maybe give me some pointers as to how you recognize functions and local variables?
first I scan to find begin and the end of the function (it's not always an easy task) and then just 'walk' the function marking, recording instructions related to stack pointer.

Quote:
Originally Posted by mr.exodia View Post
Another small thing, is the arrow location just 'wrong' or is is placed between instructions for a reason?
there is no reason, it's calculated based on QFontMetrics lineSpacing. Please change font to get hopefully more accurate position but personally it did not bother me that its a millimeter off.

Quote:
Originally Posted by mr.exodia View Post
On and before I forget it, could you share some insight on how you implemented these python functions? I saw the python libs, but do you have some trick to auto generate the required function definitions or is it all manual work?
it's manual work but you could use SWIG if you have a lot of functions.

Cheers
Reply With Quote
Reply

Tags
disassembler

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



All times are GMT +8. The time now is 15:32.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )