Questions tagged [c]
General purpose programming language that uses the procedural and structured programming paradigm.
213
questions
0
votes
0answers
27 views
Static binary instrumentation
I am working on a class project. I need to find out static features of a program (with executing it).
Backward branches (loops)
Conditional branches (potential threads with load imbalance)
Interrupts ...
1
vote
1answer
51 views
How to pass param to execve to execute cat a file in x64 Asm?
I want execve("/bin/cat",["/bin/cat","/test/file"],NULL).
Here is my asm
xor %rdx, %rdx
push %rdx
sub $0x16, %rsp
movb $0x2f, 7(%rsp)
movl $0x2f6e6962, 8(%rsp)
movl $0x746163, 12(%rsp)
leaq 7(%rsp)...
1
vote
2answers
114 views
Trouble when reverse engineering a industrial robot software in order to get some values
For the bit of background, I'm a robotic engineer.
Robotics manufactures hide some parameters of their robots in order to avoid their competition. Now, I need these data to compute the dynamics model ...
1
vote
0answers
28 views
Reconstructing struct/union-based IPC protocol wire format
I'm embarking on my first reverse-engineering adventure. I think I've picked a rather dense piece of steak to start out with.
I have three C programs which communicate together using an unknown IPC ...
2
votes
1answer
322 views
Reverse a call to mmap()
I am currently reverse a challenge to learn. But why is the parameter of mmap (containing fd) at 4294967295?
(Is it not supposed to exist? No files are open with open, just before.)
1
vote
0answers
105 views
Mysterious chunk of code in IOLI crackme0x06 challenge
I've been struggling to understand a very strange piece of x86 assembly code from the IOLI crackme0x06 challenge.
Context
But first of all, here is the context : I've successfully cracked the ...
3
votes
1answer
78 views
x86 shellcode leads to segmentation fault
I want to execute execve("/bin/dash", &"/bin/dash", NULL) on Ubuntu 64 bit with the following 32 bit shellcode:
global _start
_start:
xor eax, eax ; set eax = 0 to push a null without using ...
0
votes
1answer
175 views
Ghidra pseudocode to Java/C
I have this piece of code generated from Ghidra
void __cdecl FUNCTION(uint *key,uint *text)
{
undefined uVar1;
ushort uVar2;
uint *puVar3;
uint *puVar4;
uint *puVar5;
int iVar6;
uint ...
3
votes
1answer
79 views
How to find the index of static ilbrary functions in the PLT of the binary?
So right now I'm trying to resolve function calls and their names in my reversing tool
the problem I'm having is that library functions such as printf and fwrite and such do not have a corresponding ...
1
vote
3answers
116 views
Is the main function's name in the symbol table of C & C++ programs always 'main'? if not, how to find the name?
So I'm trying to write a reversing tool that parses symbol table to find the main function's address
right now all the binaries I'm checking the name of main function is still main in symbol table
...
0
votes
0answers
26 views
Changing pseudocode based on FPU fmul behaviour
A 3D software was compiled in which a typical x/4096f was translated as:
fmul ds:f4096
where f4096 equals to: 0.00024414062
Example decompiled pseudocode as-is:
skeletonMemoryPointer[i].pos = *(...
-1
votes
1answer
52 views
Fuzz Test Suite for C/C++ Command Line Argument/Standard Input programs
I have implemented a basic coverage guided fuzzer that is sending inputs to programs accepting ONE command line argument or ONE standard input. I am trying to find a complex code to fuzz that can meet ...
3
votes
1answer
62 views
GetWindowLongPtr with undocumented nIndex of -1
I'm trying to reverse functionality of scrollbars in comctrl32.dll and I keep witnessing them calling GetWindowLongPtr function with undocumented index -1 as such:
Does anybody know what that ...
1
vote
0answers
155 views
Illegal instruction fault in stack based buffer overflow
I wrote this short C program to practice buffer overflow exploits:
#include <stdio.h>
#include <string.h>
#include <stddef.h>
#include <inttypes.h>
char *decode(char *s){
...
3
votes
0answers
95 views
Reverse engineering android native packer
im trying to Reverse engineering an android app and the app have 4 folders in the /data/data/{package} folder
├───app_dexprotector
│ 823517D25836B88F1C499C02370A047E.dat
│ ...
-1
votes
1answer
117 views
How can I convert the following assembly code to pseudo code?
I got the following disassembly code in IDA pro. I really find it hard to convert it into pseudo code.
push ebp
mov ebp, esp
sub esp, 14h
mov dword ptr [ebp-14h], 1
mov dword ptr [ebp-10h], 2
mov ...
-1
votes
1answer
86 views
How can I convert the following disassembly code to pseudo code or C code?
I used IDA pro to get the following disassembly code. I am having difficulty converting it into the equivalent c code.
mov dword ptr [ebp-8], 1
mov dword ptr [ebp-4], 0
loc_401014:
cmp dword ptr [...
4
votes
1answer
132 views
Reverse engineering a compression algorithm to decompress ASCII text (LZ-variant?)
Reposted from StackOverflow as is.
I'm trying to decompress a very long text block from an ARMv5t powered Gameboy Advance ROM, which was compressed using some kind of custom LZ-esque compression ...
0
votes
1answer
122 views
Is there any decompiler, which can produce a compilable result?
I would like to decompile a 32bit linux executable to C, modify some parts of it, and then compile it back. I do not care if the C code is not pretty and really hard to maintain. The only thing I care ...
1
vote
1answer
70 views
(CTF) Speed up assembly by hooking to an static function
For a CTF I have a fairly slow recursive function. I just need to cached the previous results in a dictionary and get them instead. I did it but had to reverse engineer the code. I was wondering if ...
-1
votes
2answers
131 views
CreateThread returns true but thread doesn't run [closed]
I have a PE executable which uses threads to handle most of its functionality. It uses CreateThread API to spawn local threads to handle functions.
The call to the CreateThread returns a valid handle ...
4
votes
2answers
372 views
Which operators use sal, shl, sar or shr
Which operators in C language would result in assembly commands such as sal, shl, sar or shr for example?
0
votes
1answer
95 views
why code at .rodata executes [closed]
How come the following code executes if buf* is @ rodata segment ?
#include <stdio.h>
char *buf[] = {
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\
\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\...
0
votes
1answer
171 views
How int3 looks like in C
This is assembly code that can catch debugger with int 3 :
MOV ECX, ExceptionHandler
MOV DWORD PTR FS:[0], ExceptionHandler
INT3
///there is debugger!!!
ExceptionHandler:
////no ...
-2
votes
1answer
167 views
Why dont use memcpy? [closed]
Why using memcpy can cause to stack overFlow?
memcpy get the number of bytes to copy, so what is the problem , and how memcpy_s fix it?
2
votes
2answers
208 views
Why are there so much more functions in ida than my source code?
I am trying to learn how to use IDA Pro 6.8 to analyze binaries. However, there are much more functions in ida function list than my code. For example, there is a function in source code that calls ...
-1
votes
1answer
667 views
How to convert assembly to pseudo code? [closed]
I have the following assembly. I don't know how to follow assembly. I was wondering if there is a way to convert assembly to a human readable pseudo code or better yet C code:
init:
mov eax, [ebp+...
0
votes
1answer
230 views
How can I intercept syscall libc function in C++ without writing any code in C file
How can intercept libc function in C++ using LD_PRELOAD. I want to write code only in C++ file and all the logic of symbol fishing (dlsym) must be in C++ file.
Please give an example.
2
votes
1answer
143 views
Finding the main function without symbols
for a C/C++ program compiled on windows using the x86 architecture, what is the best way to find the main function within disassembled code?
I've found various answers to questions similar to this, ...
-2
votes
1answer
193 views
Can someone please help me reverse engineer this assembly code to C please! [closed]
I am really bad at understanding assembly code and the way it works. I have little problems given to me in Assembly code and I have to reverse engineer it to C, but I have been doing really bad job at ...
0
votes
1answer
111 views
Changing local variable in caller from callee in C?
I'm implementing a function which is going to perform some time-consuming task, and I'd like to hack the benchmarking part a bit by changing the variable indicating the CPU time my function has ...
0
votes
1answer
1k views
What does this assembly language program output?
I have been struggling with this for a long time. I have the following assembly language code:
.intel_syntax noprefix
.bits 32
.global asm0
asm0:
push ebp
mov ebp,esp
mov eax,DWORD ...
-1
votes
1answer
290 views
How can I decompile the CC2650 .hex file to C?
I want to decompile it to C, or at least assembly the CC2650 hex file (Bluetooth Low Energy Sensor Tag), that provide TI.
My goal is to know the specific way used by CC2650 to generate the LTK.
I'll ...
6
votes
4answers
7k views
Purpose of test eax,eax after a strcmp
This is my first program i am trying to reverse and my intro to this field.
The C program will test if two strings match, and it will printf() a message for each occasion.
This is what the reversed ...
1
vote
1answer
329 views
problem with scanf/fgets in angr stdin exploration
I want to solve this very basic crackme using angr:
#include <stdio.h>
#include <string.h>
int main(int argc, char *argv[]) {
char buffer[64];
printf("Mot de passe:\n");
...
1
vote
1answer
155 views
Injecting exe file into process fails on windows 7 but works on windows 10 / Execution library function fails, access denied
I'm trying to inject my executable payload into remote process.
I allocated memory in remote process, I converted raw payload using RVA addressing. I applied relocations and imports table.
When I'm ...
0
votes
1answer
44 views
How to protect memory area, not segment or page!
I want to protect the certain memory area, like 0x12345678 ~ 0x12345679.
so if another thread accesses to that area, I want to generate exception.
To solve my problem, I've found and used ...
1
vote
1answer
67 views
Generate this assembly from a c program
I want to generate this assembly code:
mov ecx, <absolute address of func1>
call ecx
How can I write and compile C code which generates this code?
3
votes
1answer
1k views
Understanding Program Arguments on the Stack in Assembly
To self-teach myself reverse engineering, I am writing small C programs and reversing them in order to understands how the compiler sees my code. However, I am having quite tough time understanding ...
0
votes
1answer
181 views
Translating ida macros and pseudocode into C++/C
What would be the translated C output of this hexrays decompiler pseudocode? The values of v6 and v5 are floats just as v8. The value of xmmword_108365D0 is 7FFFFFFF7FFFFFFF7FFFFFFF7FFFFFFFh
v8 = (...
4
votes
1answer
213 views
How do I find out what section variables and strings are defined in?
Given a simple program like this,
void main (int argc, char * argv[] ) {
char * arr[] = {"foo", "bar", "baz"};
*(arr[0]) = 'F';
printf( "%s", arr[0] );
}
How do I find out what section ...
3
votes
1answer
122 views
Basic hello world stack manipulation troubles
I'm a beginner in reverse engineering, and as a beginner I started to read "Reverse Engineering for beginers".
Here is the hello world program from the book (taken from chapter 3, page 12) :
Now ...
1
vote
1answer
320 views
Reading from text file and printing it in IDA Pro
I have a text.txt file and I want to read it and print its content in the Output Window of IDA Pro (Free version).
I wrote an .idc script as follows:
#include <idc.idc>
static main() {
...
2
votes
3answers
640 views
Android- hiding private keys in .so file
I am working on an application where we need to encrypt certain assets at compile time in Gradle. We then need to decrypt them with the same private key, so we are using a symmetric key system but we ...
2
votes
2answers
412 views
ASM code hook/patching with trampoline function
I am stuck on making (my little self-task for learning) that thing:
Basically it should be something like Themida or VMProtect (do mutation, virtualization, etc.), but in my case,
i want to take ASM ...
1
vote
2answers
106 views
How can I deal with exception handler in Visual C/C++ inline assembly?
I have disassembled a function in IDA Pro and I want to compile it into my project in visual c inline assembly... I'm still a newbie, so let me apologize if I don't use the right terminology...(I'm ...
1
vote
1answer
218 views
Capstone: What's the purpose of the 'address' argument in cs_disasm()?
I'm trying to play around with the Capstone Disassembler in C.
In the documentation they show the following use of the cs_disasm() function:
from here
count = cs_disasm(handle, CODE, sizeof(CODE)-1, ...
1
vote
5answers
269 views
C representation of simple assembly
I have the following very simple X86 assembly:
shr cx, 1
jae short <addr>
So basically, the jump will be taken if the Carry flag is not set. In the case of shr, CF will be set to the value of ...
0
votes
1answer
348 views
Patching branch on assembly code
I compile this code
1. #include <stdio.h>
2. void F(int a, int b)
3. {
4. int c= a+b;
5. int d= a*b;
6. }
7. void printAll()
8. {
9. printf("test1");
10. printf("test2");
11. ...
0
votes
2answers
327 views
explain c compile code
I compile c code to arm with this site https://godbolt.org/
int F(int a, int b)
{
int c=0;
for(int i=0;i<=10;i++)
{
c+=a+b;
}
return c;
}
the result was
F(int, ...
