Hints to reverse engineering a QT software

Question

I am facing a little bit of problem during reverse a QT application with Ollydbg or IDA.

This software use a protection schema to indetify the number of click made on a QList. After a random amount of click on list rows replace the content of the list with a blank string. That's give me troubles because the protection is dinamic.

Someone of you can point me to some hints to work with QT application or explain me how to identify an event (signal/slot) and work on it please?

Any help will be appreciated, i have searching a lot but there aren't tutorial or documentation about QT reversing...

Thanks

Answer 1

I would try another approach, without using Olly or IDA, get Cheat Engine, attach it to your software and give X clicks. Search that int value on C.E., and increment while searching too.
Cheat Engine will "catch" the variable faster than searching through regular debuggers. Set the var to 0 and lock it.
Yes, I know C.E. is not a reversing tool, but in this case, and given your RE experience, seems the most fit.
Or, send the link/.exe and I'm willing to help you.

Answer 2

Take a look at the file Properties->Details of "QtCore4.dll" it uses to see what Qt version it is.
Go to Qt website download page and get the matching version.
There are both full source and compiled distributions there.
You will probably have to rebuild it to match your application's compile settings.
For instance if you see the application is using "msvcr100.dll" then you know it's using "Visual Studio 2010".
This way you might be able to build compatible import libs to use from an injected DLL, and the example/samples should be close to your target for examination.

You should read up on at least the basics of Qt.

You say it's using a QList then take a look here: http://qt-project.org/doc/qt-4.8/qlist.html
Although that is not a widget, it must be some sort of list or list view type based on your description.

Look at the Qt imports in the application. Like at instances of the "QWidget" ctor for example to find out where various widgets are being created.

If you can inject a DLL you can probe by setting a hotkey to call static methods "QApplication::allWidgets()" or "QApplication::topLevelWidgets()" to get list of all the controls with info facilitated from accessors like "windowTitle()", etc.

The logical/obvious places to look are at the control that is being manipulated, and the mouse click signals/events that it has setup.

You just got to start digging in and break things down. Don't know your experience level, but in reversing often "the hard way" is the right and, or, the only way..