Questions tagged [c]
General purpose programming language that uses the procedural and structured programming paradigm.
275
questions
0
votes
1answer
32 views
Reverse engineering mode X VGA function(s)
I'm trying to reverse engineer an old DOS game. At the moment I'm stuck at a function that implements some functionality of VGA running in mode X. My issue is that any of the available sample codes on ...
0
votes
1answer
42 views
Assuming x is a number smaller than 0xff what happens to x after the assignment LOBYTE(x)=x-1?
I understand that LOBYTE is an IDA macro for retrieving the lower byte of a variable. My question is what is the difference between the result of x=x-1 and LOBYTE(x)=x-1 when x is smaller than or ...
1
vote
1answer
35 views
Link decompiled C code to Assembly (retdec decompiled object into C code, but with many errors, i found the kill switch which i need to edit)
I am using retdec to decompile a piece of software. It has a "kill switch" to detect if it's being run in an untrusted environment, in the decompiled code it just a simple
if (env_untrusted()...
1
vote
1answer
40 views
Call libc functions from the payload statically injected into ELF binary
I am working on ELF-injector, which given some payload (currently it's an assembly file with .text section only) will inject it into ELF binary. I had related post here.
Now I would like to make it ...
0
votes
1answer
34 views
Visual c compiler options
I ask if exist some c compiler option that can "keep" some imformation after compile that can be visible when I disassamble with IDA.
This because I need to find a particular funciton with ...
3
votes
1answer
122 views
ELF binary injection
I am currently working on an ELF-injector and my approach is standard: find code cave (long enough sequence of 0's), rewrite it with the instructions I want to execute and then jump back to the start ...
0
votes
0answers
34 views
How the return address of the notesearch program was calculated in “The Art Of Exploitation”
I am reading the book "The Are Of Exploitation" 2nd Edition by Jon Erikson and there is something I don't understand about the calculation of the return address.
In page 137 it covers the ...
0
votes
0answers
61 views
Delphi mt38 CRC (Tricore 1766 Arch)
I want to calculate CRC32 for Delphi mt38 and found the below assembly algorithm and converted it to C. It seems that this algorithm is defined for n = 256 or 1024. I want to calculate CRC32 for n = ...
0
votes
1answer
57 views
Converting rep movsd to to C without memcpy
So I am currently in the stages of creating binexact version of functions in decompiled code. I noticed that in this function the rep movsd is called and logically this is translated as Qmemcpy/memcpy ...
0
votes
1answer
52 views
Custom IDA Decompilation Format
Is there a way to customize the format of IDA's decompiled code?
e.g.
char buf[7]; // [rsp+5h] [rbp-1Fh]
to
char buf[ 7 ]; // [ rsp + 5h ] [ rbp - 1Fh ]
or
switch (c)
to
switch( c )
0
votes
0answers
53 views
Binary bomb lab, can't find starting number and having problem recognizing pattern
The following is the assembly dump of a binary bomb from bomb lab Basically, you have to come up with a 6 number sequence to defuse the bomb, however, I am having trouble finding the first number and ...
1
vote
1answer
118 views
Why can't find hardcoded string in the disassembled program?
I've wrote a simple program to print something on the screen as below:
ebra@him:/tmp/tuts$ cat sample.c
#include <stdio.h>
int main()
{
puts("Sample!");
}
ebra@him:/tmp/tuts$ ...
-1
votes
1answer
74 views
Why I get 0xc00000005?
I'm trying to use RunPE technique (For learning).
First, I tried it on Windows XP(32-bit) and no error occurs but, the injected code for(HelloWorld) didn't run.
Then, I tried to use it on Windows 7 ...
0
votes
0answers
49 views
Reverse an encryption algorithem in APK .so file
I try to reverse a cipher algorithm (I guess Tiny Encryption Algorithm (TEA)) in an android application. But I have a serious problem in initializing arguments. How I can understand that I have ...
0
votes
2answers
155 views
how to use class member function defined in a exe within a dll
I have an executable (.exe) containing some classes and functions definition and plan on using those functions from within a DLL, although I know to call a regular C style function using calling ...
0
votes
0answers
21 views
What is the meaning of call ds:ApiName[registry*constant] in IDA .asm files?
I have a dataset of .ASM files generated by IDA (dont have the corresponding file)
now there are a lot of calls like this :
.text:00637114 5F pop edi
.text:...
0
votes
1answer
38 views
Application only Crashes on CPU with SHA extension
Have an application that only crashes if CPU has SHA extensions. After some investigation find a hashing routine that only occurs if CPU has SHA extensions.
I'm trying to confirm if issue is with ...
5
votes
2answers
969 views
Difference between Main and Entry
Sometimes, I see while disassembling a binary that there is the main function. but sometimes, instead of main, there is entry function.
I want to know what is the difference between entry and main.
0
votes
0answers
98 views
C166/C167 code analyzing
Recently I try to reverse piece of assembly code that written for C166/C167 Arch.
But I have a problem with some places for convert to C code, such as:
loc_1892:
mov r9, #4
add r9, r0
mov ...
1
vote
1answer
81 views
How to restrict angr to printable characters
I have a binary that scanfs and then does some checks and returns either FAIL or SUCCESS that has SUCCESS for multiple inputs. Although only one of the inputs has only printable characters. How do I ...
0
votes
1answer
52 views
Buffer space in C
I was wondering if there is some way to get information about buffer size via reversing the binary, created in C language. can we also know how many buffers we have created while writing that script.
...
2
votes
1answer
150 views
How do we decompile java so easy?
I have seen a lot of videos where everyone is decompiling the jar files so easily. but I learnt that we cannot decompile any compiled file so easily. I have a little bit of experience in Gidhra. I ...
0
votes
1answer
84 views
2 byte format string attacks
Protostar
I was doing the protostar format string (3rd challenge). where we have to change the value of a variable target with format string buffer overflow. so, I came up to this medium article: ...
0
votes
1answer
138 views
How to find function start in stripped binary?
Given C code, are the function addresses from the ELF the same as those in the stripped version?
I don't have any specific code in mind. Just trying to learn in general how to find the function ...
1
vote
1answer
98 views
how could i follow a system call from a dll -> kernel driver syscall
basically i would like to follow (system calls / internal calls) that basically lands in the kernel i would like for example to debug a specific dll ex : ntdll.dll and follow it to (NtXXX) function ...
2
votes
3answers
99 views
Intercepting game function with C and Assembler, game unstable with minimum changes
I am reverse engeneering a really old game (Mu 97d) for the sake of adding new things to the game.
What I am doing is intercepting the game with a DLL, and in the DLL do the calculations so I can add ...
1
vote
0answers
195 views
which has better pseudocode? IDA or Ghidra [closed]
I would like to know which of the two has a better pseudo code generator in C, IDA or Ghidra, if possible, point out the strengths and low points of each one.
1
vote
1answer
86 views
Is Ghidra's decompilation of ARMv7 strb.w instruction broken?
I'm currently disassembling some firmware, when I stumbled across the following code snippet produced by Ghidra (the names are already my own ones):
void memset(byte *addr,byte value,int count)
...
2
votes
2answers
87 views
Newbie problems exploiting a format string vulnerability
I encountered a print format vulnerability challenge in a CTF. I don't know anything about these vulnerabilities, so I'm working my way through Saif El-Sherei's format string exploitation tutorial ...
1
vote
2answers
181 views
Simple angr example not working
I am trying to learn angr from beginning. Due to lack of simple tutorials I programmed my own little executable which angr should solve.
The C code looks as follows:
#include <stdio.h>
#...
2
votes
1answer
307 views
Ghidra scripting get information from decompile window
I am using Ghidra and when clicking for example in the decompile window on a specific raw, it change the cursor in the assembly window to the exact location in the assembly. Is there any option to do ...
0
votes
0answers
63 views
Parsing C header files from DWARF Debug File
I have a Linux executable that has a linked .debug file containing DWARF debug info and I would like to find a way to parse C headers for types defined in the executable. Using gdb and ptype I can ...
1
vote
1answer
36 views
Why does this x64 stack have other bytes and seems to be in reverse order?
I wrote the following small C program and you can also see the stack in the screenshot. My question is twofold:
How come there are entire rows of other data between the 3 stack strings?
Why is my ...
0
votes
0answers
45 views
Develop a Hello World plugin for Ollydbg
I wanted to write a plugin for Ollydbg 2 which shows just a simple message. I write the following one but it doesn't load in ollydbg. I am using ollydbg 2 and my DLL can't load by it. Where is the ...
1
vote
1answer
425 views
Ghidra error when edit main signature function
I'm new to ghidra.
I download the easy_reverse from crackme.one and open the executable file in ghidra.
When I'm trying to edit the main function signature I get an error: Can't parse name: argv[].
I ...
0
votes
1answer
80 views
How can I debug open source C code for Linux?
I want to debug & reverse engineer open source code such as this project. I usually use CLion to write and debug C code on Linux. I've also used GDB. What steps do I need to take to download a ...
3
votes
1answer
142 views
Why is there no call to strcpy in assembly?
I try to better understand assembly and currently playing around with some compiled c snippets.
I have the following snippet:
#include <stdio.h>
#include <string.h>
int main() {
char ...
0
votes
0answers
57 views
What does the file pointer of fgets actually point to in linux?
So i was reversing a 64 bit ELF binary, and it did a call to fgets, and based on documentation the third argument of fgets is a file pointer.
now the weird part was that the third argument in this ...
0
votes
0answers
46 views
Python based static c analysis tools
I want to analyze some open-source C code, and I'm looking for a static analysis python library for C, preferably open-source. Any ideas/suggestions, based on your experience?
-2
votes
1answer
72 views
Hash from pseudocode [closed]
What is the hash? Generated from ida pro
int __fastcall hash(_BYTE *a1)
{
_BYTE *v1; // r4@1
int v2; // r5@1
int v3; // r6@1
v1 = a1;
v2 = 0;
v3 = 1;
while ( *v1 )
{
v3 = (*v1 + ...
0
votes
0answers
48 views
Performing Buffer overflow in Linux
I have buffer overflow in a program i check(it is an array of pointers, and i can overflow the data in the first pointer), but the data i can write is not on the stack, it is on a space the system ...
1
vote
2answers
152 views
High-level langage decompiler on WIndows
So I have been using Binary ninja and I was wondering if there was any other tool except IDA or any binary ninja plugin that would transform assembly code into high level code, I already tried binja-...
1
vote
0answers
175 views
Some obstacles in reversing a JNI Native library
I deleted my last question (it was not still answered and none's effort was wasted) as I got back and thought to re-read JNI documentation, to find I misinterpreted some bits. Things are now clearer
...
1
vote
3answers
160 views
I'm looking for a list of C vulnerabilities like OWASP Top 10
I'm looking for a list of all vulnerabilities that can be present in C so I can practice them all.
I found this: Category:C/C++, but it's not of much use.
0
votes
0answers
65 views
How to detect the language of an assembly code? How radare does it?
I've opened an executable in Radare2 (on Cutter) and it says that it was written in C language. Is it just a guess or there is a good way to find in which language a binary was written?
1
vote
1answer
70 views
Is there a handy assembly to mock app conversion tool?
It might be too silly of a question, but here you go.
Suppose you have some software that contains a tricky nested assembly sequence (like this one) you try to reverse engineer. brain*[pen&paper] ...
2
votes
1answer
66 views
How to create an executable that keeps the same virtual address on different runs
I want to create an executable that keeps the same virtual address during different execution runs.
This is definitely possible because I've seen these files in CTFs(Capture the flag) where the ...
1
vote
2answers
131 views
Detecting and solutions of stack smash protection
This video https://youtube.com/watch?v=4HxUmbOcN6Y presents how modern compilers protect stack overflows with stack cookies and function __stack_chk_fail.
How can one identify if a binary has stack ...
1
vote
2answers
335 views
Methods for preventing IDA decompiler
I want to write a C function, such that hex-rays decompiler will fail on it. I want to do it for study purposes, and not for an actual anti-reversing method. Do you have any recommendations/approaches ...
1
vote
2answers
142 views
How to solve this anti-disassembler trick?
I have this __asm instruction in C code:
int func_0x8b4c55a0()
{
__asm
{
call $ +5
add[esp],5
ret
}
}
int main()
{
char cVar1;
if ((cVar1 = ...
