Questions tagged [c++]

C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language.

Filter by
Sorted by
Tagged with
0
votes
0answers
34 views

Question about basic hooking concept

I have created a c++ complete project to hook GOG game and work perfectly (this add a unofficial Force Feedback support). To to it I have found on github a custom version of d3d9.dll with with DllMain ...
1
vote
0answers
32 views

Alternative to MS Detours (32 bit)

I have used MS Detours for one project in c++ and work perfectly. I have created a clone of this application (95% of the some code) to hook another file (a GOG game with DRM free), but this time crash ...
0
votes
0answers
24 views

understand how call __usercall function

I have disassable with ida this function: int __usercall sub_4F314A@<eax>(char *Src@<ecx>, int a2@<edx>, int a3, int a4, int a5, int a6) I attach the original assembly: can you ...
0
votes
0answers
40 views

How to reverse engineer structs

I am new to reverse engineering, really new, I am able to reverse engineer vtables and getting function indices for each of them (with the help of the original SDK of the software that I work with), ...
0
votes
1answer
51 views

Variable location address

There is variable in data section: .data:00427000 dword_427000 dd 64h Base address of code is: .text:00411000 ; Segment type: Pure code How to calculate actual address and location in memory of ...
0
votes
0answers
21 views

Watching a TLS Slot value in x64dbg

I am new to reverse engineering and I was trying to debug why a 3rd party application was crashing when I m injecting my DLL in it. (There are some cases where it didn't crash) So I was able to figure ...
0
votes
0answers
27 views

Doubts about a pointer in a DLL

I am working with the dll of a software in which I am not with access at the moment, analyzing the source code in static analysis tools, I realized that it receives a pointer as one of the parameters, ...
0
votes
0answers
72 views

C166/C167 code analyzing

Recently I try to reverse piece of assembly code that written for C166/C167 Arch. But I have a problem with some places for convert to C code, such as: loc_1892: mov r9, #4 add r9, r0 mov ...
0
votes
0answers
34 views

Crash after hook a function

I have hooked a sound function that work within the game menu after, when the battle start, the game will crash. The function at the first parameter get correctly the sound file name, before the ...
0
votes
0answers
28 views

Data XREF in IDAPro (C166/167 Arch)

try to reverse some algo in c167 arch. in a part of the file i saw a variable that located in XRAM mov to accumulator registers and finally xor with other registers. as below: mov r1, word_E1C4 ...
0
votes
1answer
31 views

Can I force GDB breakpoints and disassemble?

Sorry English isn't my first language. I noticed something when setting breakpoints in GDB. It appears that they are ignored if symbols aren't loaded. I have found it weird how GDB behaves when there ...
0
votes
1answer
90 views

How can I modify these?

So I'm onto something interesting, I asked the less direct way but failed to meet the requirements in terms of explanation So here it is, how would I go about editing these the same way I would go ...
0
votes
0answers
43 views

Change value of memory in a debugger?

So I got this app loaded in x64, there is a function, let's say "HeatGainedPerShot", which is basically the value which an object gains everytime it fires, Such a value would normally exist ...
0
votes
1answer
101 views

Unrecognized sequence of bytes

I have this piece of code: .text:00537FDE push offset a3Rrrrrrrrrrrrr ; "3L+ÐÐÐÐÐÐÐÐÐÐÐÐÐ+ÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐøû9\n" .text:00537FE3 call sub_5606A0 Where ...
0
votes
1answer
89 views

best approach to hook function

I have found 2 source code example to hook a function. Example1: #include "detours.h" #include "sigscan.h" // this is the function that the program // will jump to when sum() is ...
0
votes
0answers
43 views

DLL injection (Failed to inject)

I have found this complete and easy example to test the function hook: https://github.com/Zer0Mem0ry/Detour #include <Windows.h> #include <iostream> #include "detours.h" #...
3
votes
1answer
104 views

Figure out with fopen

Can anyone explain, why fopen takes as argument- not a file name- according to code takes some off_6A5D8C: .text:00537F9F push offset stru_6C4E40 ; FILE * .text:00537FA4 ...
0
votes
1answer
62 views

IDA exported header full of errors

Im a noob when it comes to using reverse engineering tooling. I am doing a reversing challenge (pwn adventure 3 CTF) and I am exporting the various types from IDA. The thing is, the header files are ...
0
votes
1answer
72 views

How i can grab a pointer or hook the process procedure without creating a global hook [closed]

i am trying to hook wndproc in an game, to do that i am injecting a dll into their memory, my problem is i don't wanna do a Global Hook to the wndproc, i want to get a pointer to his procedure to do ...
0
votes
1answer
29 views

Windows PE64 throw error while allocating heap for unknown reason?

For some reason i'm not aware of ( some heap allocation limit ) while allocating memory for some classes, an application ( win64 ) raises this exception: DumpedMini Result[0] Exception Code[...
3
votes
2answers
546 views

C++ Unary equals (unary operator=)

In C++ binaries, I find Qt methods like ??4QString@@QEAAAEAV0@AEBV0@@Z which demangle to public: class QString & __ptr64 __cdecl QString::operator=(class QString const & __ptr64) __ptr64 or ...
2
votes
1answer
81 views

How to set the type of a variable or function to an std::string?

I'm using IDA Pro and have identified a function that takes an std::string as an argument. However when I click on the function and "Set Item Type", entering its definition: std::__ndk1::...
1
vote
1answer
160 views

Latest VMProtect vs Latest Themida [closed]

I am working on an app to archive some important files in a compressed-encrypted format, What is the best for me to use (Virtualization) VMProtector or Themida ? Thanks in advance
2
votes
1answer
40 views

Pe 32 Add Export function Segment by Extending with dll or Patching pe

I need to add new function inside pe32 module.dll Export Table , in dynamic way if possible ( via extending with dll ) or by patching pe32 module.dll What can u suggest to solve this ?
0
votes
0answers
28 views

IDA SDK Assemble instruction

What's the method of assembling instructions in IDA SDK c language? Is that possible by passing insn_t* or str like option available in IDA [Edit->Patch program->Assemble]
2
votes
1answer
41 views

Register edx and CreateDevice function DX

I disassemble CreateDevice function from my DirectX code and commented each paratemer: .text:0043F485 mov eax, [ebp+lpParam] .text:0043F488 add eax, 730h .text:...
1
vote
1answer
58 views

Variable var_4 filled with value -1

Who can explain to me, why this line code there is before each jmp or end of some part of code where there is label. What this line of code is to do? mov [ebp+var_4], 0FFFFFFFFh This is WinMain ...
1
vote
0answers
52 views

Reverse engineering old mmo

I am newish to reverse engineering and have a question about a problem with IDA Pro. I am trying to reverse engineer an old mmo game. Anyone know why dword_ calls show as "dd ?"? Float numbers and ...
3
votes
1answer
166 views

Finding AddressOfEntryPoint for a 64-bit process

Okay, so in the following code-snippet I am starting a notepad.exe process in a suspended state and trying to get the AddressOfEntryPoint of the process. Problem is I can't seem to find the actual ...
0
votes
0answers
25 views

Some more questions related to C++ exceptions (catchHigh)

I've came up with the most convoluted example but still can't find the purpose of the catchHigh field. I find it that the right handler can be selected simply by looking at the tryblock map from start ...
0
votes
1answer
72 views

Patching memory

I've successfully reversed and patched an application on windows, but patching the executable on disk triggers a CRC check and prevents it from loading. I've used x64dbg and have the addresses I need (...
1
vote
1answer
35 views

What is the mdisp field in RTTI for throw used for?

First of here is the article from which I'm looking up the fields. I was trying out different combinations to see how they affect the RTTI for a C++ throw. It seems that having a virtual base class ...
2
votes
1answer
286 views

IDA and Ghidra Reversing

I have several questions about IDA and Ghidra (for MIPS and ARM): Is there any option to load an executable file with all its libraries? For example, I want to enter inside a function which its ...
-1
votes
1answer
58 views

What does std::string::oprator__unsigned_long do?

I am new to reverse c++ program. I met this code from r2 decompilation. pcVar6 = (char *)sym.imp.std::string::operator___unsigned_long (&...
2
votes
2answers
74 views

undname.exe: invalid undecorated names

I've discovered undname.exe today and tried it on several functions. I got some incorrect results and I'm wondering why. I see two main reasons that could do that: The mangling can change between ...
1
vote
2answers
167 views

What does this decompiled line mean?

__dest = (byte *)(**(code **)(*plVar5 + 0x10))(plVar5,(ulonglong)(numBytes + 1)); memcpy(__dest,param_2,numBytes + 1); Can someone please explain what the first line does step by step? I get that ...
0
votes
1answer
122 views

c++ reading process memory with injected DLL

The reading works fine until it reaches base+27.058.176(bytes) address. At this address VirtualProtect() failes with error 487 (Attempt to access invalid address). Why does it return this error? Btw ...
0
votes
2answers
87 views

Smart approach or Brute force?

Background: I'm a beginner reverse engineer and I wanted to try writing my own c++ programs and reverse-engineering them. I wrote something and I'm not sure a smart way of reversing it. Usually, I can ...
2
votes
1answer
90 views

I can't set a hardware breakpoint on RIP + N-byte after calling NtContinue()

#include <Windows.h> int handle_exception (EXCEPTION_POINTERS *exception_pointers) { exception_pointers->ContextRecord->Rip += 4; return EXCEPTION_CONTINUE_EXECUTION; } int main (...
0
votes
0answers
18 views

Understanding obscure function names [duplicate]

I have seen functions like this before in disassembly but don't have a clue what they are. Their names are extremely confusing. Would someone be able to explain what these are?
0
votes
0answers
62 views

Detouring function cause exception access violation

i am learning to detouring functions, but i run into one that i cannot be resolved. I use the Detour lib from microsoft, and a custom method. Both cause the same problem, the function is hooked and ...
0
votes
0answers
689 views

Lua script decode method?

I have a game plugin that enables the lua script encryption.I tried to decode it but it seems used many useless encode method to let you cannot understand it.It seem like some enctypted lua script ...
-2
votes
1answer
71 views

Hash from pseudocode [closed]

What is the hash? Generated from ida pro int __fastcall hash(_BYTE *a1) { _BYTE *v1; // r4@1 int v2; // r5@1 int v3; // r6@1 v1 = a1; v2 = 0; v3 = 1; while ( *v1 ) { v3 = (*v1 + ...
5
votes
1answer
719 views

Ghidra can't see basic functions in my files?

I made a simple program in C++ using Visual Studio 2019 to learn. When I open the file with Ghidra, it doesn't seem to detect my functions and I don't know what I'm doing wrong. My program is simple: ...
0
votes
1answer
148 views

Extracting functions of .obj file (compiled by myself with Visual Studio 19) --> extracts wrong data

How can I find only real functions not data garbage like section..debug_S_105 ? * I need to collect function data (assembler code) of Open Source C++ Files which I compile with Visual Studio 19 (sln ...
1
vote
2answers
151 views

Byte-patch a JMP

I have an address and I want to byte-patch it because there is a JMP that I want to block. But when I NOP it, the game just crash because it corrupt the function. So, I don't know what to do for block ...
1
vote
0answers
228 views

IDA Hex-Rays structure inline functions recognition

I've seen multiple posts about the subject, but mine is a little bit more specific about what I want to achieve. I have many times situations where Hex-Rays decompiler outputs 16 lines of code and I ...
2
votes
2answers
53 views

VC 6 C++ Exception handling, nTryBlocks=0, pTryBlockMap=0 , how?why?

I'm trying to decompile an old binary (about 20 year old). The program uses exceptions. I found some FuncInfo but they do not contain any pTryBlockMap and nTryBlocks is 0. I've tried many options ...
2
votes
1answer
203 views

can someone help me with this map format?

I've been messing around in visual studio for half an hour trying to figure out how to properly display maps from a file, but all I can output is hot garbage, all I know is that the maps are 64x64, ...
0
votes
1answer
105 views

indirect return value address

I have usercall with calling convention I do not fully understand, it returns std::string but IDA recognize it as void. I've noticed that every calle reads from x8/w8 afterwards, from wikipedia; ...

1
2 3 4 5 6