Questions tagged [c]
General purpose programming language that uses the procedural and structured programming paradigm.
252
questions
1
vote
2answers
44 views
Intercepting game function with C and Assembler, game unstable with minimum changes
I am reverse engeneering a really old game (Mu 97d) for the sake of adding new things to the game.
What I am doing is intercepting the game with a DLL, and in the DLL do the calculations so I can add ...
1
vote
0answers
83 views
which has better pseudocode? IDA or Ghidra [closed]
I would like to know which of the two has a better pseudo code generator in C, IDA or Ghidra, if possible, point out the strengths and low points of each one.
1
vote
1answer
57 views
Is Ghidra's decompilation of ARMv7 strb.w instruction broken?
I'm currently disassembling some firmware, when I stumbled across the following code snippet produced by Ghidra (the names are already my own ones):
void memset(byte *addr,byte value,int count)
...
1
vote
2answers
53 views
Newbie problems exploiting a format string vulnerability
I encountered a print format vulnerability challenge in a CTF. I don't know anything about these vulnerabilities, so I'm working my way through Saif El-Sherei's format string exploitation tutorial ...
1
vote
2answers
47 views
Simple angr example not working
I am trying to learn angr from beginning. Due to lack of simple tutorials I programmed my own little executable which angr should solve.
The C code looks as follows:
#include <stdio.h>
#...
1
vote
1answer
95 views
Ghidra scripting get information from decompile window
I am using Ghidra and when clicking for example in the decompile window on a specific raw, it change the cursor in the assembly window to the exact location in the assembly. Is there any option to do ...
0
votes
0answers
33 views
Parsing C header files from DWARF Debug File
I have a Linux executable that has a linked .debug file containing DWARF debug info and I would like to find a way to parse C headers for types defined in the executable. Using gdb and ptype I can ...
1
vote
1answer
33 views
Why does this x64 stack have other bytes and seems to be in reverse order?
I wrote the following small C program and you can also see the stack in the screenshot. My question is twofold:
How come there are entire rows of other data between the 3 stack strings?
Why is my ...
0
votes
0answers
39 views
Develop a Hello World plugin for Ollydbg
I wanted to write a plugin for Ollydbg 2 which shows just a simple message. I write the following one but it doesn't load in ollydbg. I am using ollydbg 2 and my DLL can't load by it. Where is the ...
0
votes
1answer
138 views
Ghidra error when edit main signature function
I'm new to ghidra.
I download the easy_reverse from crackme.one and open the executable file in ghidra.
When I'm trying to edit the main function signature I get an error: Can't parse name: argv[].
I ...
0
votes
1answer
73 views
How can I debug open source C code for Linux?
I want to debug & reverse engineer open source code such as this project. I usually use CLion to write and debug C code on Linux. I've also used GDB. What steps do I need to take to download a ...
2
votes
1answer
90 views
Why is there no call to strcpy in assembly?
I try to better understand assembly and currently playing around with some compiled c snippets.
I have the following snippet:
#include <stdio.h>
#include <string.h>
int main() {
char ...
0
votes
0answers
46 views
What does the file pointer of fgets actually point to in linux?
So i was reversing a 64 bit ELF binary, and it did a call to fgets, and based on documentation the third argument of fgets is a file pointer.
now the weird part was that the third argument in this ...
0
votes
0answers
45 views
Python based static c analysis tools
I want to analyze some open-source C code, and I'm looking for a static analysis python library for C, preferably open-source. Any ideas/suggestions, based on your experience?
-2
votes
1answer
71 views
Hash from pseudocode [closed]
What is the hash? Generated from ida pro
int __fastcall hash(_BYTE *a1)
{
_BYTE *v1; // r4@1
int v2; // r5@1
int v3; // r6@1
v1 = a1;
v2 = 0;
v3 = 1;
while ( *v1 )
{
v3 = (*v1 + ...
0
votes
0answers
44 views
Performing Buffer overflow in Linux
I have buffer overflow in a program i check(it is an array of pointers, and i can overflow the data in the first pointer), but the data i can write is not on the stack, it is on a space the system ...
1
vote
2answers
133 views
High-level langage decompiler on WIndows
So I have been using Binary ninja and I was wondering if there was any other tool except IDA or any binary ninja plugin that would transform assembly code into high level code, I already tried binja-...
1
vote
0answers
73 views
Some obstacles in reversing a JNI Native library
I deleted my last question (it was not still answered and none's effort was wasted) as I got back and thought to re-read JNI documentation, to find I misinterpreted some bits. Things are now clearer
...
0
votes
3answers
141 views
I'm looking for a list of C vulnerabilities like OWASP Top 10
I'm looking for a list of all vulnerabilities that can be present in C so I can practice them all.
I found this: Category:C/C++, but it's not of much use.
0
votes
0answers
58 views
How to detect the language of an assembly code? How radare does it?
I've opened an executable in Radare2 (on Cutter) and it says that it was written in C language. Is it just a guess or there is a good way to find in which language a binary was written?
1
vote
1answer
65 views
Is there a handy assembly to mock app conversion tool?
It might be too silly of a question, but here you go.
Suppose you have some software that contains a tricky nested assembly sequence (like this one) you try to reverse engineer. brain*[pen&paper] ...
1
vote
1answer
59 views
How to create an executable that keeps the same virtual address on different runs
I want to create an executable that keeps the same virtual address during different execution runs.
This is definitely possible because I've seen these files in CTFs(Capture the flag) where the ...
1
vote
2answers
95 views
Detecting and solutions of stack smash protection
This video https://youtube.com/watch?v=4HxUmbOcN6Y presents how modern compilers protect stack overflows with stack cookies and function __stack_chk_fail.
How can one identify if a binary has stack ...
1
vote
2answers
221 views
Methods for preventing IDA decompiler
I want to write a C function, such that hex-rays decompiler will fail on it. I want to do it for study purposes, and not for an actual anti-reversing method. Do you have any recommendations/approaches ...
1
vote
2answers
119 views
How to solve this anti-disassembler trick?
I have this __asm instruction in C code:
int func_0x8b4c55a0()
{
__asm
{
call $ +5
add[esp],5
ret
}
}
int main()
{
char cVar1;
if ((cVar1 = ...
2
votes
1answer
2k views
Best way to protect source code of .exe program running on Python?
I am developing proprietary software that would be distributed in a form of .exe file. In order to use it, users will have to authenticate with their whitelist credentials (username + password).
The ...
0
votes
1answer
80 views
Abusing the strlen output
My question is related to the strlen function from the C and C++.
I am reversing a program, that reads a byte data from allocated memory and sends to the strlen directly. To be completely honest ...
1
vote
1answer
265 views
Why is fastcall used for replacing thiscall functions in memory instead of cdecl?
Assume I were to be reversing some game which processes all of it's movement client side and have determined some function to be of the type:
bool __thiscall Player::CanJump(Player *this)
that I ...
1
vote
1answer
141 views
mfc140 dll , what is the usage?
While I open exe file in ida I can see lot of calls to mfc140_6153
or mfc140_8718.
What are those functions ? what they do ?
thanks
0
votes
1answer
121 views
What is, and why, “byte[ ] + number” in this IDA pseudocode?
This is a decompile of an .so file, so it originated from C or C++. Can you kindly try to explain to me what this does?
How would one rewrite this into readable code? I don't mind any programming ...
2
votes
1answer
141 views
Unable to properly analyze a very simple C-compiled program
I'm a RE beginner and I decided to start writing my own simple code for practice.
I wrote a simple code which uses a winAPI function called CreateProcess to start a calc.exe, I've wrote it in C and ...
1
vote
2answers
863 views
Local variables and addition not shown in Ghidra
I am having some troubles with my learning of Assembly and reverse engineering. Specifically, I am learning about Global vs Local variables. For Global variables I have managed to get insights in ...
4
votes
1answer
1k views
Simple C program disassembled with Ghidra
I am trying to figure out what is going on with my simple example programs, when I disassemble them with Ghidra. I am not sure whether this is some strange Ghidra behaviour or something that is set by ...
-1
votes
1answer
192 views
What is the following assembly code doing? [closed]
str fp,[sp, -4]!
add fp, sp, #0
sub sp, sp, #12
str r0, [fp, #-8]
str r1 [fp, #-12]
L5:
ldr r3, [fp, #-8]
ldrb r3, [r3]
cmp r3, #0
beq .L2
ldr r3, [fp, #-12]
ldrb r3, [r3]
cmp r3, #0
beq .L2
ldr r3, [...
0
votes
1answer
331 views
Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking?
So i was trying to hook the ZwQuerySystemInformation or NtZwQuerySystemInformation using IAT, but i found out that these are not inside the IAT inside the memory nor in the PE file
but maybe i am not ...
-1
votes
1answer
122 views
Understanding (pseudo-)C function from a video game [closed]
I recently found a function using IDA within a game that creates a CRC from a string. I don't understand much of the code or how the game takes in the string as data.
__int64 __fastcall ITF::...
0
votes
0answers
44 views
Add MessageBox statically modify
So i'm doing this challenge which i have an exe file and a dll all i have to do is
modify it statically to pop a MessageBox.
The exe file is loading the dll which load the MessageBox, with ollydbg ...
2
votes
3answers
410 views
Elf x86_64 adding function
I'm trying to see if I can append function code in the .text section of an ELF while still maintaining the execution flow of the original ELF. Ideally, I want to call the new function but that's it's ...
0
votes
2answers
146 views
Unable to exploit format string vulenrability on Ubuntu 18.04.2 LTS
I am studying from "Hacking: The Art of Exploitation" and in program fmt_vuln.c format string is exploited. I am getting Segmentation Fault error.
Checking position of AAAA on stack:
$ ./fmt_vuln ...
0
votes
0answers
47 views
Examining Stack Frame in GDB
I am learning exploitation from the book "Hacking: The Art of Exploitation". In the program an integer variable auth_flag is declared after a char array password_buffer. So on stack frame first ...
1
vote
0answers
84 views
Static binary instrumentation
I am working on a class project. I need to find out static features of a program (without executing it).
Backward branches (loops)
Conditional branches (potential threads with load imbalance)
...
1
vote
1answer
544 views
How to pass param to execve to execute cat a file in x64 Asm? [closed]
I want execve("/bin/cat",["/bin/cat","/test/file"],NULL).
Here is my asm
xor %rdx, %rdx
push %rdx
sub $0x16, %rsp
movb $0x2f, 7(%rsp)
movl $0x2f6e6962, 8(%rsp)
movl $0x746163, 12(%rsp)
leaq 7(%rsp)...
1
vote
2answers
160 views
Trouble when reverse engineering a industrial robot software in order to get some values
For the bit of background, I'm a robotic engineer.
Robotics manufactures hide some parameters of their robots in order to avoid their competition. Now, I need these data to compute the dynamics model ...
1
vote
0answers
106 views
Reconstructing struct/union-based IPC protocol wire format
I'm embarking on my first reverse-engineering adventure. I think I've picked a rather dense piece of steak to start out with.
I have three C programs which communicate together using an unknown IPC ...
2
votes
1answer
446 views
Reverse a call to mmap()
I am currently reverse a challenge to learn. But why is the parameter of mmap (containing fd) at 4294967295?
(Is it not supposed to exist? No files are open with open, just before.)
1
vote
0answers
172 views
Mysterious chunk of code in IOLI crackme0x06 challenge
I've been struggling to understand a very strange piece of x86 assembly code from the IOLI crackme0x06 challenge.
Context
But first of all, here is the context : I've successfully cracked the ...
3
votes
2answers
360 views
x86 shellcode leads to segmentation fault
I want to execute execve("/bin/dash", &"/bin/dash", NULL) on Ubuntu 64 bit with the following 32 bit shellcode:
global _start
_start:
xor eax, eax ; set eax = 0 to push a null without using ...
0
votes
1answer
1k views
Ghidra pseudocode to Java/C
I have this piece of code generated from Ghidra
void __cdecl FUNCTION(uint *key,uint *text)
{
undefined uVar1;
ushort uVar2;
uint *puVar3;
uint *puVar4;
uint *puVar5;
int iVar6;
uint ...
4
votes
1answer
112 views
How to find the index of static ilbrary functions in the PLT of the binary?
So right now I'm trying to resolve function calls and their names in my reversing tool
the problem I'm having is that library functions such as printf and fwrite and such do not have a corresponding ...
2
votes
3answers
259 views
Is the main function's name in the symbol table of C & C++ programs always 'main'? if not, how to find the name?
So I'm trying to write a reversing tool that parses symbol table to find the main function's address
right now all the binaries I'm checking the name of main function is still main in symbol table
...
