Questions tagged [c++]

C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language.

Filter by
Sorted by
Tagged with
-1 votes
1 answer
89 views

How to call and what means: _DWORD *__thiscall

I have one question maybe you can help, I always find this functions in IDA: void __thiscall sub_79340(_BYTE *this, int a2, int a3, int a4) And I use them like this: // talkChannel typedef DWORD(...
user avatar
  • 31
1 vote
1 answer
51 views

Calling function with string as parameter

I'm trying to call a function in a game that makes my character sending a message. I already called a few functions in this game but this one has a tricky parameter. The function signature should be ...
user avatar
  • 31
0 votes
0 answers
47 views

Can't get Visual C++ to generate the same code give by Ghidra

I'm using visual c++ to create a mock dll that I'm trying to reverse using Ghidra and I'm doing good progress so far, however I'm stuck in a function that ghidra gives me the following: ...
user avatar
1 vote
1 answer
108 views

Strange DWORD/QWORD C++ Strings in decompilation

I have never seen something like this before but I assume this is some kind of way C++ allocates dynamic strings. In my decompilation listing in Ghidra I see something like: local_14 = DAT_00404004 ^...
user avatar
  • 23
1 vote
2 answers
61 views

Relationship between compiled bytes of jmp instruction and target memory address

I'm very new to all this, so sorry if I mess up and/or am unclear. I'm working on reverse engineering assault cube, where a lot of people start, and I'm struggling to understand how this one AOB ...
user avatar
0 votes
0 answers
60 views

Harden C++ against decompilation

I have a small C++ program that contains a "secret" string that must be hard to find in the object code, e.g., #include <iostream> int main() { std::string a = "super-secret-...
user avatar
1 vote
2 answers
194 views

How to find specific function in IDA pro

Apologies if this account question may sound a bit stupid but I really need help with something Let's say I had a function that looks something like this : #undef curl_easy_setopt CURLcode ...
user avatar
1 vote
2 answers
62 views

C++, Windows UI Automation and DaVinci Resolve

I've been researching this topic for a while, but the information is extremely limited and very confusing. DaVinci Resolve is an editing and color grading software, its tools are so many and so ...
user avatar
0 votes
0 answers
15 views

Print CMarkupSTL object with GDB

CMarkupSTL is contain XML. How can I print that XML with GDB while I debug process? I run on Arm Linux
user avatar
1 vote
1 answer
40 views

Removing empty blocks ida api

i have a c++ module that removes empty block it used to work well but now I'm porting it to ida 7.7 I'm having issues. mba_t *mba; mba->remove_empty_blocks(); It throws following error "...
user avatar
  • 73
1 vote
2 answers
133 views

Is it possible/feasible to decompile a program written in C++ to C?

I've not seen a lot of material on this. I've seen people attempting to bring a C++ program back to C++ code, and claiming how hard it is, but C code from C++ program? I don't know. If it is possible, ...
user avatar
1 vote
1 answer
49 views

Can a MSVC class have a deletion destructor without a vftable?

I'm reversing the following smart pointee-like MSVC class Buffer : public Referencable with IDA / Hexrays: struct Referencable { int m_refs; }; struct Buffer : Referencable { void* m_pData; }; ...
user avatar
  • 983
0 votes
1 answer
87 views

Understanding the meaning of EBP + 0xffff98b4

I'm currently reverse-engineering an old game from 2003 to extend its functionality. I have now found what I am looking for and since it was written in C++ I'm trying to re-create the used classes. I ...
user avatar
0 votes
0 answers
79 views

What do these offsets in the function calls mean?

I am using Ghidra to reverse enigneer a PE file, and I found a lot of function calls that look like this: (**(code **)(*(longlong *) inBunch + 0x30))(inBunch, local_res18, 4); I am very confused, ...
user avatar
0 votes
1 answer
50 views

Constructors testing for strange in-stack value

This is something that I found in a lot of constructors that have to do with classes that inherit from other classes. I have a vague idea as to why it's done, but I'd rather have it confirmed before ...
user avatar
2 votes
1 answer
100 views

How do I reverse engineer structs that are put as parameters in a function

how do I go around figuring out where to reverse engineer a struct? As shown in the picture below, I have this function called "struct dynamic_array" which I want to reverse engineer and ...
user avatar
2 votes
2 answers
93 views

How to restore struct fields

I have an object named ComputeService::RPC that is being used as input in a function inside a binary file: __int64 __fastcall ComputeService::Rpc::GetClientProcessId(ComputeService::Rpc *this) pc *...
user avatar
  • 451
1 vote
1 answer
86 views

How could I find a call of a function thats only referenced inside a vftable?

So I have this function which I'm trying to figure out the arguments to. However, all the xrefs of it point to a VFTable. How would I find a call for this function?
user avatar
  • 11
0 votes
1 answer
42 views

One class with different sizes

After looking at some basic examples of how C++ classes are compiled by MSVC, I tried to apply the knowledge to a DLL I'm working on. While searching for a class to start with, I came across ...
user avatar
0 votes
1 answer
179 views

How do I get all sections in a PE file using C++?

So I am wondering how can I get all sections and their info from a dumped PE file on the disk, using C++. I have the entire PE loaded on a buffer, the NT headers, and hopefully the DOS headers. I need ...
user avatar
2 votes
1 answer
212 views

How to hook to a system function

How to hook to external library function, such as OpenGL for example. I have a function used by the program I am trying to change behaviour of. The function is: lVar17 = glfwCreateWindow(uVar22,uVar25,...
user avatar
  • 146
1 vote
0 answers
46 views

Scraping data from an audio analyzer application

Briefly: I have an app that analyzes audio files and classifies them into 4 or 5 categories, how would one go about scraping the category each audio file belongs to? What is a good place to start? ...
user avatar
1 vote
0 answers
26 views

Make avaible x64 C++ exceptions on manually mapped module

I am trying to bind Lua on manually mapped module. As you can see clearly on here. They are using C++ or C exceptions on their API and there is no way to avoid them. I wonder to know if there are ...
user avatar
  • 11
0 votes
0 answers
22 views

Missing definition of `FuncDefn`

So I used latest (10.0.4) Ghidra to decompile a x86 binary to c file and h header/ then I preprocessed it with the msvc cl compiler but in the result, while parsing it - turns out the typedefs for ...
user avatar
  • 383
1 vote
1 answer
75 views

IntelPin, Ins_Insertcall?

please help me with Intel Pin: I print each instruction to the console and I want to insert +++++ after it using Ins_Insertcall: VOID CpuidCalled(const CONTEXT* ctxt) { std::cerr << "+++++&...
user avatar
  • 21
1 vote
1 answer
107 views

How is it possible to generate C++ class header from a .dll or ELF file?

I loaded a dynamic library file to IDA. I can clearly see the function signatures from the "Function name list". There are RTTI items in the "Structures" tab as well, but I don't ...
user avatar
  • 204
0 votes
1 answer
127 views

IDA interpretation of switch-case statement

This is my first question on this forum, so I hope that it would not be offensive or redundant. So recently I am attempting to developing some kernel extensions for Apple's macOS using the IOKit ...
user avatar
  • 3
3 votes
3 answers
263 views

IAT Hook via Kernel Driver

I've wrote a kernel driver recently and it does multiple things, but I wanted to add a IAT hook for a certain driver. I want to hook the IAT of another driver from my driver if that makes sense. So I ...
user avatar
  • 49
1 vote
1 answer
104 views

Analyze Arm Linux CPP binary in Ida Pro

I tried to open CPP binary with Ida. Most of the code analyze well . The problem is that there are lot of vtables(Ida doesn't recognize them as vtables) that I need to reach them manually and pressO (...
user avatar
0 votes
0 answers
52 views

Graphics Tablet turn off the blinking Corner Lights (XP-Pen Deco Pro MW)

I have the "XP-Pen Deco Pro MW" and currently have the following problem: The device has corner lights which constantly blink, when the pen is in the area of the corners. I guess its to show ...
user avatar
0 votes
1 answer
93 views

How to declare a constructor in reversed class?

I wonder how to declare the reference to a constructor to a reversed class, i.e. I have a class say Game and it has a constructor at a certain address. It is declared like this: game.h namespace ...
user avatar
  • 146
3 votes
1 answer
168 views

What is "nullsub_XXX" in vtable in IDA

When I looking in a vtable structure in IDA pro, I know that ___cxa_pure_virtual means that the function is virtual. But what does nullsub_XXX mean in a vtable structure?
user avatar
  • 73
1 vote
1 answer
167 views

Hex-rays decompiler incorrect logic

I'm practicing reverse engineering in IDA and I created an example application in Visual C++ to practice working with classes/structs and the decompiler output seems to be incorrect - I would like to ...
user avatar
  • 151
0 votes
0 answers
136 views

IDA does not load PDB file

I have C++ project compiled (debug) with Visual Studio 2019, and I have IDA 5.0 Free version. When I load my .EXE file, IDA does not load correspond PDB file and return message: PDB total 0 symbol ...
user avatar
  • 113
1 vote
0 answers
110 views

Passing a String into a Function With GDB

So, I have a function with the prototype according to GDB: {std::string (std::string)} 0x56027729e545 <function(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator&...
user avatar
  • 11
0 votes
0 answers
72 views

The way to determine how the decompiled constructor is structured

I have the following constructor decompiled by Ghidra, i.e. Game. I know some of the functions, which are part of that constructor. And thus I have created my interpretation of that structure. But I ...
user avatar
  • 146
1 vote
0 answers
34 views

What is the correct argument for the disassembled function / constructor?

I have the following code disassembled by Ghidra. It first initialises the local variable of the particular type (local_68) and then passes it to the constructor. The variable seems to be initialised ...
user avatar
  • 146
0 votes
1 answer
54 views

libuv - spoofing user-agent problem

Im trying to give an app "second life" (gamedev "banned" User-Agent of this tool to avoid requests from it). This app is using websocket to get real-time result and then use this ...
user avatar
1 vote
1 answer
62 views

Using struct objects and constructors in hooked function

Will try to reword the actual question so it is hopefully more descriptive and clear of what I am after: So, there is a function main, which I have successfully hooked. The hooked version looks like ...
user avatar
  • 146
0 votes
0 answers
55 views

Does loading custom PDB help reversing behemoth program?

What I reverse : Old 4~8mb games compiled with vc++ 2006~2008(depends on version), whose source code is lost. It(they) has the mixtures of their custom structures, classes and directX sdk ...
user avatar
0 votes
1 answer
101 views

Can't find references (xref) to function

I am reversing a function and when I trying to see its references, it doesn't show me the calls to the function. It only show the place of the object in RVA. Is there a plug-in or something that I ...
user avatar
  • 451
1 vote
1 answer
117 views

Inconsistency in function addresses of the hooked functions (address shift)

I came across "a strange" inconsistency in terms of the function addresses in the particular application. First, the main function is hooked successfully, the address is derived in a fashion:...
user avatar
  • 146
1 vote
1 answer
241 views

DetourAttach breaks with Illegal Instruction 0xC000001D

I am trying to detour a function using DetourAttach() in the following fashion: hooks::logDebug("swresample-3Proxy.log", fmt::format("Try to attach hook. Function {:p}, hook {:p}.",...
user avatar
  • 146
0 votes
1 answer
73 views

How to call your version of the existing function using proxy dll?

I have bits of code which decompiles a small part of the existing program. I have added it to the proxy dll. The code to the existing functions is hooked through Detour and looks like below (gui.h and ...
user avatar
  • 146
1 vote
1 answer
234 views

convert C++ code to python code

while I'm doing RE using ghidra i saw this code byte bVar1; byte bVar2; uint uVar3; uVar3 = 0; while (bVar2 = (byte)uVar3, (char)bVar2 < '\b') { bVar1 = *(byte *)(uVar3 + param_1) ^...
user avatar
0 votes
0 answers
80 views

Ida pro doesn't demangle all function names

I am using Ida Pro 7.0 and working with a binary (firmware) written in C++ .Fortunately there are symbols in the firmware and I know function names but Ida didn't manage to demangle all function ...
user avatar
  • 1
0 votes
1 answer
139 views

How do I interpret this double offset?

While looking at that old game I've found a class CStr that is used in an unusual (to me) manner. Most of the times a member of CStr is used, it's done as follows. In both cases, this is a CStr *. ...
user avatar
0 votes
1 answer
88 views

IDA API: Writing a plugin - How can I ensure that analysis has completed?

I have been reading through the API documentation here and As far as I can tell there are three ways to wait for the analysis to finish. get_auto_state auto_wait auto_is_ok Looking at the API if ...
user avatar
  • 723
2 votes
1 answer
73 views

What C++ construct could emit such Watcom C++ 10.5 assembler listing?

Based on the assembler listings, a C++ object is locally allocated on the stack without constructing the object in the caller routine and the callee takes the address to the allocated stack space and ...
user avatar
  • 23
0 votes
2 answers
246 views

How to prevent File Modification in C++

so i want to protect my software against reverse-engineering and i want to add checksum verification to prevent patching the binary but the problem that if i added a checksum verification the binary ...
user avatar

1
2 3 4 5
8