Questions tagged [c++]
C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language.
457
questions
0
votes
0
answers
35
views
Extending a Struct in a Compiled Executable
I'm currently extending an existing compiled executable (32 bit) using DLL proxying. My goal is to add a new member to a struct that exists in the original executable. For that, I modify the original ...
- 1
0
votes
0
answers
34
views
Understanding emulation & tracking IP within a process
I'm working on an end-of-year project for my studies and I was thinking of writing some sort of process emulation debugging tool. What I mean by this is, I want to write a debugger without actually ...
0
votes
0
answers
111
views
Extract flag from .exe file
I have to extract a flag from a test.exe file. The respective flag is run as an argument for the test.exe file => "test.exe FlagName" and in this way I will reach the next flag.
I ...
0
votes
0
answers
63
views
x86 When we use fastcall, why does caller clean stack?
In fastcall functions, the callee cleans the stack and returns the value in eax. This completes the function call.And actually we put first two arguments in ecx and edx, still caller cleans stack 8 ...
- 1
0
votes
0
answers
47
views
How to get which Tedit is referenced when retrieving text
Reversing a borland builder 6 application, I came across this function: @Controls@TControl@GetText$qqrv
Now, the two parameters for the function are:
LEA param_2=>local_8,[EBP + -0x4]
MOV param_1,...
- 1
0
votes
0
answers
43
views
Find Dereference And Write to Offset of Pointer
I want to find objects within a large C++ codebase that have a function that writes to 16 bytes offset off a pointer stored in an instance variable.
So for example given the code has:
MyClass object1 =...
- 11
0
votes
2
answers
88
views
Finding the address of a function in an exe that I have the source code of
I've been playing around with some leaked source codes and I find that locating a function in source in the compiled exe is not so straight forward. And i'm thinking what are the ways to get that ...
- 3
0
votes
0
answers
55
views
Ida Pro: Get original type of typedef from local types with the IDA C++ API
I've been poking around with the IDA C++ SDK and I'm writing something to dump all local types into a json file. I have it all working but typedefs. Example typedef int BOOL
I'm trying to get the ...
0
votes
1
answer
60
views
How to split a variable into 2 variables in pseudo c code generated by IDA?
Some times IDA's decompiler translates more than variables into a single variable or an array of varibles, for example, I have 2 variables
A a; // size = 30h
B b; // size = 60h
but IDA gives
A arr[3];...
- 103
1
vote
1
answer
55
views
Which interrupt was called
cseg01:00046E80 sub_46E80 proc near ; CODE XREF: sub_46ED8+81p
cseg01:00046E80 ; sub_47164+6Dp
cseg01:00046E80 000 ...
- 363
0
votes
1
answer
57
views
Shift operation and subtract in code
There is C++ code:
int16_t ** g_Meshes;
int32_t m_MeshPtrCount;
int16_t * g_MeshBase;
uint32_t *mesh_indices;
for (int i = 0; i < m_MeshPtrCount; i++)
{
g_Meshes[i] = &g_MeshBase[...
- 363
0
votes
0
answers
32
views
How to draw invisible entities (glow) with DX11?
I'm trying to understand how GLOW hacks work. In some games like CSGO you can just overwrite the memory address to 1 and glow chams are enabled. So you can see people through the walls like in this ...
- 161
0
votes
0
answers
30
views
How to access the demangled auto comment?
In this example, IDA has demangled the boost::fibers::context::active name normally, and you can access that name with ida_name.get_ea_name(ea, GN_SHORT|GN_DEMANGLED|GN_VISIBLE). But the function name,...
0
votes
1
answer
139
views
Hooking a function
So, I'm attempting to create a mod for an older game, Fable: The Lost Chapters. I was able to find the MacOS release of the game, which contains symbols, and I was also able to find a leaked debug ...
- 1
0
votes
1
answer
46
views
Hook: can call string::size() but crashing when reading string data... how to read without crash?
I'm hooking a function that reads and decrypt files and my idea is to read the buffer once it's decrypted:
typedef void(__thiscall* _readFileContents)(DWORD* _resourceManager, std::string* buffer, std:...
- 161
2
votes
0
answers
156
views
Vtables in objects with inheritance in IDA
I'm struggling to get object inheritance working in IDA.
The original structure is as follows:
INoticeSource : INoticeSink
IRTTITypeInfo : IUnknown, INoticeSource
IPersist : IUnknown
IPersistStream : ...
- 21
0
votes
2
answers
154
views
How can I debug if the program closes directly?
I'm trying to debug a game and it's closing under few circumstances:
When debugging (solved by hooking IsDebuggerPresent to return false when called by the game)
When setting a memory/hardware ...
- 161
0
votes
1
answer
136
views
How can I change the data type of `puVar1` in this C++ function?
I was reversing ( new to the reversing world of course) being using Ghidra for this. I get a C++ function AppChat::__Status::setDescription(ErrorCode param_1). Within this function, there's a variable ...
- 309
0
votes
1
answer
155
views
Where to find the Visual C++ 6.0 CRT Source Code?
I want to see MSVCRT's implementation details for the old Microsoft Visual Studio C++ 6.0 compiler. On newer Visual Studio versions, it is located in /VC/crt/src/ directory, but there is no such ...
- 33
0
votes
1
answer
88
views
Flag 200h open file
cseg01:00056938 mov edx, offset var_byte_0004DCC8
cseg01:0005693D mov eax, offset hmi_drv_str
cseg01:00056942 call strcpy_
cseg01:00056947 ...
- 363
1
vote
1
answer
114
views
Where is IDA getting this symbol?
I'm currently researching how a certain malware works and patches some stuff in a certain Android's library.
Inspecting the library -which is stripped- in IDA I was able to get the symbol for a ...
- 13
0
votes
1
answer
92
views
Patch all calls to a single function using IDC
I am quite new in reverse-engineering and programming in general, sorry in advance if this question is dumb. It goes like this:
In c++ disassembled code exist calls to a certain function. 2 thousand ...
0
votes
0
answers
59
views
Windows kernel Dev
I'm writing a basic program that'd allow me to list the running processes on a windows system but by simply trying to go through the ActiveProcessLinks of the _EPROCESS structure.The problem I'm ...
- 1
0
votes
1
answer
87
views
How to call unexported function in a third party DLL while having its PDB?
I'm new to reverse engineering and recently met with a problem:
I have the dll and pdb of a debug version third party module, but I don't have its source codes. Now I want to write a piece of C++ code ...
- 103
0
votes
0
answers
36
views
Compiler settings for show main func in IDA
Why in dissasemble code in IDA, some programs have func "main" in begin (in start window in IDA) like this:
cseg01:00038460 ; =============== S U B R O U T I N E =============================...
- 363
2
votes
1
answer
1k
views
How to search a sequence of instructions in Ghidra?
I'd like to identify in Ghidra a specific sequence of instructions, which I get from MSVC Debug in Visual Studio compiling my own function:
What I'm looking for so is (for the same DLL, decompiled in ...
- 87
0
votes
0
answers
76
views
Is game hacking all about memory manipulation?
I wanted to know if game hacking is all about manipulating memory ?
and If we need anything more than, this topics for game hacking ?
memory manipulation
Reverse engineering
Windows internals
C++ ...
- 1
0
votes
0
answers
57
views
MS-DOS 32 bit mode Timer interrupt
My application works in 32 bit MS-DOS mode with dos4gw.exe extender. variables unknown_bool_0004AA8A = 1, unknown_bool_0004AAA0 = 1.
cseg01:0004AAB3 mov eax, offset Proc_Addr1
...
- 363
0
votes
1
answer
46
views
Assembler OR operation
Is this asm code:
or unknown_byte_0004AAA7, 1
dseg05:000C7FDC unknown_byte_0004AAA7 db 0
equivalent to this C++ code below?
bool unknown_byte_0004AAA7 = 0;
unknown_byte_0004AAA7 = ...
- 363
0
votes
1
answer
72
views
Updating legacy library in an already compiled binary
I'm dealing with a reverse engineering challenge involving a binary application that was statically compiled with a legacy library. While the legacy library is not vulnerable, it lacks certain ...
- 3
1
vote
1
answer
141
views
What means this code?
cseg01:00020DB8 mov eax, offset screen_with_height
cseg01:00045704 mov dword ptr [eax+0Ah], 0
cseg01:0004570B call sub_466F8 ; call some proc
...
- 363
0
votes
1
answer
138
views
Get hardcoded char array from compiled C++ source
It is well known that literal strings can be retrieved from C++ compilates. For example, the output of
g++ a.cpp
on
int main(void)
{
const char * secret0 = "abcdefghijklmnopqrstuvwxyz";
...
- 101
0
votes
1
answer
47
views
Making zero terminated string WATCOM compiler
This is WATCOM compiler. Assembler code below try create random 8 letters to compose zero terminated string.
cseg01:0001F544 Try_Write_To_Disk proc near ; CODE XREF: Check_CDRom+46p
cseg01:...
- 363
0
votes
0
answers
53
views
How many bytes allocated for buffer?
There is start of function:
cseg01:0001F4C8 Check_CDRom proc near ; CODE XREF: Init+Ap
cseg01:0001F4C8
cseg01:0001F4C8 var_24 = byte ptr -24h
cseg01:0001F4C8
cseg01:0001F4C8 ...
- 363
0
votes
1
answer
90
views
Creating the SkiFree 2 dream... An introduction [closed]
I am no programmer but I like to do it for my own purpose and entertainment. As in earlier posts I said:
Excuse me, I am just liking to use the SkiFree source code for my very own purpose. The purpose ...
- 31
1
vote
1
answer
268
views
Retrieve & dump type information from IDA Pro
I want to retrieve IDA Pro .idb database's each type info, such as:
size and name of a structure;
each member variable type and name;
each member variable size and offset;
And dump it to a .h file ...
- 33
1
vote
1
answer
807
views
Identifying C/C++ Library Functions
I am attempting to reverse-engineer an old DOS executable, which seems to have been compiled around 1992 using Microsoft's C compiler at the time.
When opening the executable in Ghidra no imports are ...
- 165
1
vote
0
answers
46
views
Retrieve functionality to button - game patching
I'm patching an old game, and I want the retrieve the toggle fullscreen functionality it's supposed to have.
In the menu, in the display tab, there is a disabled option of fullscreen mode that you can ...
- 21
0
votes
2
answers
225
views
How does IDA know the symbol names for classes and interfaces?
I am reversing a 32 bit library used by a Linux game (I am sure someone might recognize the engine used). I was messing around with cutter and when trying to compare it to IDA, which I have used in ...
- 103
2
votes
1
answer
485
views
IDA: Demangled name simplification in idapython
With idapython I would like to get demangled names with the name simplification (bottom of page) applied to them.
For example, the following function:
Python> ida_name.demangle_name(idc....
- 123
1
vote
1
answer
181
views
How can i remove dead code and opaque predicates?
I have the following problem on my agenda: There is an obfuscated .exe (this is a virus that I am investigating) in addition to having an MBA, etc. bullshit, he has Opaque predicates and dead code, I ...
- 11
3
votes
0
answers
60
views
How can I create an `__m128i` datatype with Frida?
I'm working on reversing a c++ binary and it has a function that I want to call with Frida.
Here's the function signature from IDA: const __m128i *__fastcall sub_0123(__m128i * a1);
It doesn't seem ...
- 131
3
votes
0
answers
250
views
IDA ATL C++ class reconstruction
I'm currently using IDA Pro to analyze a dll, but IDA Pro doesn't analyze ATL standard classes properly, including CString, so I'm trying to reconstruct the classes manually, but I'm having some ...
- 71
4
votes
2
answers
2k
views
How to bypass anti debugger? IDA Pro
Im new to reverse engineering and doing a crackme that requires me to make a keygen, yes i know making a keygen isn't a beginner task however im stuborn, i am trying to debug the program to understand ...
- 41
4
votes
1
answer
1k
views
How to add STL to Local Types in Ida Pro?
How to add STL to Local Types in Ida Pro?
I can import debug information from a pdb file along with STL types, but I can't manually add STL types to Local Types.
Also I can't import STL when I click &...
user42316
4
votes
1
answer
3k
views
Reverse engineering a flutter built apk
I was trying to reverse engineer an apk built with flutter. I actually feel like reversing flutter built apps did not get much reverse writeups on the community. one of the tools for the task ...
- 309
1
vote
1
answer
114
views
What is the output for this and how?
*(_BYTE *)(Key + Integer_count - 1) + 79
Here : Key = 0x22EC278 (dw 'Âx')
or
Stack[000015B8]:0019FC2C db 78h ; x
Stack[000015B8]:0019FC2D db 0C2h ; Â
Stack[000015B8]:0019FC2E db 2Eh ; .
Stack[...
- 31
2
votes
1
answer
196
views
Reversing C++ Classes in ARM
I have unstripped linux arm binary,
The code calls functions in class object reference like so:
LDR R3, [R6]
MOV R1, R7
MOV R0, R6
LDR R3, [R3,#0xC] ; (...
- 21
2
votes
0
answers
130
views
I trying rewrite asm to c++ [closed]
This code generates an API key. I use it in an android app as .so file,
but I need to rewrite it to java from c++. How do I translate?
push rbp
push r15
push r14
push r13
push r12
push ...
- 21
3
votes
0
answers
86
views
purpose for using a == &a
I'm debugging dns.exe in Windows10 1809 and I'm really confused about one condition that often appeared in this file
WPP_GLOBAL_Control == &WPP_GLOBAL_Control
Actually, I have seen this kind of ...
- 313