Skip to main content
added 156 characters in body
Source Link
llm
  • 336
  • 1
  • 3

Load C header: https://www.hex-rays.com/products/ida/support/idadoc/1367.shtml i prepared this header-file for IDA: https://pastebin.com/PWNAAj7T, just load before analyze and hex-rays, then you will see much clearer whats happening

Load C header: https://www.hex-rays.com/products/ida/support/idadoc/1367.shtml i prepared this header-file for IDA: https://pastebin.com/PWNAAj7T, just load before analyze and hex-rays, then you will see much clearer whats happening

added 187 characters in body
Source Link
llm
  • 336
  • 1
  • 3

Load C header: https://www.hex-rays.com/products/ida/support/idadoc/1367.shtml

then follow every occurence of CDynamicData and tell IDA to use your struct type - that will help alot

Load C header: https://www.hex-rays.com/products/ida/support/idadoc/1367.shtml

then follow every occurence of CDynamicData and tell IDA to use your struct type - that will help alot

added 158 characters in body
Source Link
llm
  • 336
  • 1
  • 3
static_assert(sizeof(int) == 4, "wrong size"); // are we 32bit
typedef unsigned int _DWORD;
static_assert(sizeof(double*) == sizeof(_DWORD));

//1. find allocation(new) of CDynamicData then you know how many (vtable+)member-bytes the class containts
// give IDA a header with the class then is hex-rays able to give you even better results

#pragma pack(push,1)
class CDynamicData
{
public:
    //already known
    unsigned char unknown0 = 0;
    unsigned char unknown1 = 0;
    unsigned char unknown2 = 0;
    unsigned char unknown3 = 0;
    _DWORD unknown4 = 0;
    _DWORD unknown5 = 0;
    double* dyn_dat_values = nullptr;
    //unsigned char unknown6[x] -> fill that up 

    CDynamicData()
    {
       unknown0 = 0;
       unknown4 = 0;
       unknown5 = 0;
       dyn_dat_values = 0;
    }
};
#pragma pack(pop)

void test()
{
    assert(offsetof(CDynamicData, dyn_dat_values) == 12);

    CDynamicData dd;
    void* _this = ⅆ

    int v42 = 123456; // readIntValues...

    double* v20 = new (std::nothrow) double[v42];
    
    //*((_DWORD *)this + 3) = v20;
    assert((char*)&dd.dyn_dat_values == (char*)((_DWORD *)_this + 3));
    dd.dyn_dat_values = v20;

    double* v28 = dd.dyn_dat_values; // in code a int --> int == ptr-value

    double v22 = 123456.0; // scanf...
    //*(double *)(v28 + 8 * indice - 8) = v22;
    //start with pointer to double array, + 8 because of sizeof(double), -8 because of indice starting with 1 not 0
    int indice = 1; //= 1..n
    v28[indice - 1] = v22;
}
static_assert(sizeof(int) == 4, "wrong size"); // are we 32bit
typedef unsigned int _DWORD;
static_assert(sizeof(double*) == sizeof(_DWORD));

//1. find allocation(new) of CDynamicData then you know how many (vtable+)member-bytes the class containts
// give IDA a header with the class then is hex-rays able to give you even better results

#pragma pack(push,1)
class CDynamicData
{
public:
    //already known
    unsigned char unknown0 = 0;
    unsigned char unknown1 = 0;
    unsigned char unknown2 = 0;
    unsigned char unknown3 = 0;
    _DWORD unknown4 = 0;
    _DWORD unknown5 = 0;
    double* dyn_dat_values = nullptr;
    //unsigned char unknown6[x] -> fill that up
};
#pragma pack(pop)

void test()
{
    assert(offsetof(CDynamicData, dyn_dat_values) == 12);

    CDynamicData dd;
    void* _this = ⅆ

    int v42 = 123456; // readIntValues...

    double* v20 = new (std::nothrow) double[v42];
    
    //*((_DWORD *)this + 3) = v20;
    assert((char*)&dd.dyn_dat_values == (char*)((_DWORD *)_this + 3));
    dd.dyn_dat_values = v20;

    double* v28 = dd.dyn_dat_values; // in code a int --> int == ptr-value

    double v22 = 123456.0; // scanf...
    //*(double *)(v28 + 8 * indice - 8) = v22;
    //start with pointer to double array, + 8 because of sizeof(double), -8 because of indice starting with 1 not 0
    int indice = 1; //= 1..n
    v28[indice - 1] = v22;
}
static_assert(sizeof(int) == 4, "wrong size"); // are we 32bit
typedef unsigned int _DWORD;
static_assert(sizeof(double*) == sizeof(_DWORD));

//1. find allocation(new) of CDynamicData then you know how many (vtable+)member-bytes the class containts
// give IDA a header with the class then is hex-rays able to give you even better results

#pragma pack(push,1)
class CDynamicData
{
public:
    //already known
    unsigned char unknown0 = 0;
    unsigned char unknown1 = 0;
    unsigned char unknown2 = 0;
    unsigned char unknown3 = 0;
    _DWORD unknown4 = 0;
    _DWORD unknown5 = 0;
    double* dyn_dat_values = nullptr;
    //unsigned char unknown6[x] -> fill that up 

    CDynamicData()
    {
       unknown0 = 0;
       unknown4 = 0;
       unknown5 = 0;
       dyn_dat_values = 0;
    }
};
#pragma pack(pop)

void test()
{
    assert(offsetof(CDynamicData, dyn_dat_values) == 12);

    CDynamicData dd;
    void* _this = ⅆ

    int v42 = 123456; // readIntValues...

    double* v20 = new (std::nothrow) double[v42];
    
    //*((_DWORD *)this + 3) = v20;
    assert((char*)&dd.dyn_dat_values == (char*)((_DWORD *)_this + 3));
    dd.dyn_dat_values = v20;

    double* v28 = dd.dyn_dat_values; // in code a int --> int == ptr-value

    double v22 = 123456.0; // scanf...
    //*(double *)(v28 + 8 * indice - 8) = v22;
    //start with pointer to double array, + 8 because of sizeof(double), -8 because of indice starting with 1 not 0
    int indice = 1; //= 1..n
    v28[indice - 1] = v22;
}
added 161 characters in body
Source Link
llm
  • 336
  • 1
  • 3
Loading
added 528 characters in body
Source Link
llm
  • 336
  • 1
  • 3
Loading
added 76 characters in body
Source Link
llm
  • 336
  • 1
  • 3
Loading
added 844 characters in body
Source Link
llm
  • 336
  • 1
  • 3
Loading
added 199 characters in body
Source Link
llm
  • 336
  • 1
  • 3
Loading
added 442 characters in body
Source Link
llm
  • 336
  • 1
  • 3
Loading
Source Link
llm
  • 336
  • 1
  • 3
Loading