tandy put their sound chip on the 1A interrupt?
-
I might have explained this before, but normally a near call to a far function will break, because it'll pop 4 bytes off the stack for the return address, when the near call only pushed 2.
So you fix this by doing push CS first, so it'll pop the 2 from the call, and then the 2 you placed before.
but ghidra doesn't understand that this is what's happening, so it hallucinates it as a parameter to the function that's CS.
-
but ghidra doesn't understand that this is what's happening, so it hallucinates it as a parameter to the function that's CS.
so you'll see, for example, it decompiles a strlen as:
uint1 = strlen(0x1000, some_String);
which is less than useful
-
so you'll see, for example, it decompiles a strlen as:
uint1 = strlen(0x1000, some_String);
which is less than useful
this is "thing 9005 that you don't have to worry about anymore, thank fuck"
-
this is "thing 9005 that you don't have to worry about anymore, thank fuck"
in 32bit we do 32bit calls and 32bit returns.
in 64bit we do 64bit calls and 64bit returns.in 16bit we can do 16bit calls and 16 bits returns, 32bit calls and 32bit returns, and sometimes we do a 16bit call to a 32bit return because it's slightly fewer bytes
-
in 32bit we do 32bit calls and 32bit returns.
in 64bit we do 64bit calls and 64bit returns.in 16bit we can do 16bit calls and 16 bits returns, 32bit calls and 32bit returns, and sometimes we do a 16bit call to a 32bit return because it's slightly fewer bytes
one of my favorite stupid methods of reversing is "break it"
what's this function do? well, lemme disable it, and see what breaks.
Apparently this is the "restore the image under the cursor" function.
-
F myrmepropagandist shared this topic
