1

i created a program for testing, very simple in c++. is ask for password if it is match is print correct, if no it is print "bad".

i try to find with ida where is the function of what i made.

but i can find it only with the strings.

there is a different way to find it?, i mean not by the string? maybe with the debugger step by step? or something else? because in other programs i don't have strings, and its hard for me to find function.

2 Answers 2

1

There are a couple of ways to find the main() function. In IDA you can set the debugger to break on the entry point. This is sometimes not the main() function, but if you break there you can single-step until you reach the main function. You can also often find main() in the list of functions in IDA because main is one of the symbols. This is probably the simplest way to identify the function but it sounds like that is not working for you.

4
  • i tried to break the in the entry point, and i did step by step with the debugger, but he didn't reach to the main(). you have more tricks?
    – yoni
    Apr 4, 2019 at 17:18
  • What compiler did you use? Is this a windowed application? Also, what OS? Apr 4, 2019 at 17:28
  • visual studio 2017
    – yoni
    Apr 4, 2019 at 17:49
  • and windows 10.
    – yoni
    Apr 4, 2019 at 18:41
0

Okay, the strings are arguably one of the first things any reverse engineer will look at. They're the proverbial "low-hanging fruit", if they're there.

However, you could reason about your sample under investigation first.

For example if you know it's a Windows program and it shows a dialog you could first check to see if it uses the usual APIs for that. Perhaps there is a dialog resource in the binary and you can look for the dialog ID/name to spot the call to the respective Win32 API (e.g. CreateDialogParamW).

Oftentimes there will be several APIs that could be used to achieve the same result. In that case a look at the import table(s) can help find clues.

Similarly a look at the import table(s) could reveal which string processing APIs are being used. A naïve approach to "checking a password" would be something along the lines of strcmp or similar functions. With Unicode on Windows it'd be wcscmp. Again, other functions exist to achieve a similar effect.

And this means in order to reverse engineer something you need to be familiar with the environment in which your sample under investigation is supposed to run. This is even more important in cases where clues such as strings are absent or scarce. You need to be familiar with libraries providing certain functionality alone in order to be able to tell where to look further.

But checking a password doesn't necessarily mean that you are comparing strings (it probably is in your case, though). It could mean that the password itself has been run through some function (usually called hash function or similar) to arrive at a value representative of the password string. Then the comparison would be between that value and your input string being run through the same (or an equivalent) function.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.