Questions tagged [c++]

C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language.

Filter by
Sorted by
Tagged with
0
votes
0answers
32 views

IDA exported header full of errors

Im a noob when it comes to using reverse engineering tooling. I am doing a reversing challenge (pwn adventure 3 CTF) and I am exporting the various types from IDA. The thing is, the header files are ...
0
votes
1answer
61 views

How i can grab a pointer or hook the process procedure without creating a global hook [closed]

i am trying to hook wndproc in an game, to do that i am injecting a dll into their memory, my problem is i don't wanna do a Global Hook to the wndproc, i want to get a pointer to his procedure to do ...
0
votes
1answer
23 views

Windows PE64 throw error while allocating heap for unknown reason?

For some reason i'm not aware of ( some heap allocation limit ) while allocating memory for some classes, an application ( win64 ) raises this exception: DumpedMini Result[0] Exception Code[...
3
votes
2answers
534 views

C++ Unary equals (unary operator=)

In C++ binaries, I find Qt methods like ??4QString@@QEAAAEAV0@AEBV0@@Z which demangle to public: class QString & __ptr64 __cdecl QString::operator=(class QString const & __ptr64) __ptr64 or ...
2
votes
1answer
52 views

How to set the type of a variable or function to an std::string?

I'm using IDA Pro and have identified a function that takes an std::string as an argument. However when I click on the function and "Set Item Type", entering its definition: std::__ndk1::...
1
vote
1answer
67 views

Latest VMProtect vs Latest Themida [closed]

I am working on an app to archive some important files in a compressed-encrypted format, What is the best for me to use (Virtualization) VMProtector or Themida ? Thanks in advance
1
vote
0answers
21 views

Pe 32 Add Export function Segment by Extending with dll or Patching pe

I need to add new function inside pe32 module.dll Export Table , in dynamic way if possible ( via extending with dll ) or by patching pe32 module.dll What can u suggest to solve this ?
0
votes
0answers
24 views

IDA SDK Assemble instruction

What's the method of assembling instructions in IDA SDK c language? Is that possible by passing insn_t* or str like option available in IDA [Edit->Patch program->Assemble]
2
votes
1answer
35 views

Register edx and CreateDevice function DX

I disassemble CreateDevice function from my DirectX code and commented each paratemer: .text:0043F485 mov eax, [ebp+lpParam] .text:0043F488 add eax, 730h .text:...
1
vote
1answer
50 views

Variable var_4 filled with value -1

Who can explain to me, why this line code there is before each jmp or end of some part of code where there is label. What this line of code is to do? mov [ebp+var_4], 0FFFFFFFFh This is WinMain ...
1
vote
0answers
51 views

Reverse engineering old mmo

I am newish to reverse engineering and have a question about a problem with IDA Pro. I am trying to reverse engineer an old mmo game. Anyone know why dword_ calls show as "dd ?"? Float numbers and ...
3
votes
1answer
143 views

Finding AddressOfEntryPoint for a 64-bit process

Okay, so in the following code-snippet I am starting a notepad.exe process in a suspended state and trying to get the AddressOfEntryPoint of the process. Problem is I can't seem to find the actual ...
0
votes
0answers
23 views

Some more questions related to C++ exceptions (catchHigh)

I've came up with the most convoluted example but still can't find the purpose of the catchHigh field. I find it that the right handler can be selected simply by looking at the tryblock map from start ...
0
votes
1answer
61 views

Patching memory

I've successfully reversed and patched an application on windows, but patching the executable on disk triggers a CRC check and prevents it from loading. I've used x64dbg and have the addresses I need (...
1
vote
1answer
31 views

What is the mdisp field in RTTI for throw used for?

First of here is the article from which I'm looking up the fields. I was trying out different combinations to see how they affect the RTTI for a C++ throw. It seems that having a virtual base class ...
1
vote
1answer
227 views

IDA and Ghidra Reversing

I have several questions about IDA and Ghidra (for MIPS and ARM): Is there any option to load an executable file with all its libraries? For example, I want to enter inside a function which its ...
-1
votes
1answer
57 views

What does std::string::oprator__unsigned_long do?

I am new to reverse c++ program. I met this code from r2 decompilation. pcVar6 = (char *)sym.imp.std::string::operator___unsigned_long (&...
2
votes
2answers
61 views

undname.exe: invalid undecorated names

I've discovered undname.exe today and tried it on several functions. I got some incorrect results and I'm wondering why. I see two main reasons that could do that: The mangling can change between ...
1
vote
2answers
130 views

What does this decompiled line mean?

__dest = (byte *)(**(code **)(*plVar5 + 0x10))(plVar5,(ulonglong)(numBytes + 1)); memcpy(__dest,param_2,numBytes + 1); Can someone please explain what the first line does step by step? I get that ...
0
votes
1answer
76 views

c++ reading process memory with injected DLL

The reading works fine until it reaches base+27.058.176(bytes) address. At this address VirtualProtect() failes with error 487 (Attempt to access invalid address). Why does it return this error? Btw ...
0
votes
2answers
86 views

Smart approach or Brute force?

Background: I'm a beginner reverse engineer and I wanted to try writing my own c++ programs and reverse-engineering them. I wrote something and I'm not sure a smart way of reversing it. Usually, I can ...
2
votes
1answer
83 views

I can't set a hardware breakpoint on RIP + N-byte after calling NtContinue()

#include <Windows.h> int handle_exception (EXCEPTION_POINTERS *exception_pointers) { exception_pointers->ContextRecord->Rip += 4; return EXCEPTION_CONTINUE_EXECUTION; } int main (...
0
votes
0answers
17 views

Understanding obscure function names [duplicate]

I have seen functions like this before in disassembly but don't have a clue what they are. Their names are extremely confusing. Would someone be able to explain what these are?
0
votes
0answers
53 views

Detouring function cause exception access violation

i am learning to detouring functions, but i run into one that i cannot be resolved. I use the Detour lib from microsoft, and a custom method. Both cause the same problem, the function is hooked and ...
0
votes
0answers
355 views

Lua script decode method?

I have a game plugin that enables the lua script encryption.I tried to decode it but it seems used many useless encode method to let you cannot understand it.It seem like some enctypted lua script ...
-2
votes
1answer
71 views

Hash from pseudocode [closed]

What is the hash? Generated from ida pro int __fastcall hash(_BYTE *a1) { _BYTE *v1; // r4@1 int v2; // r5@1 int v3; // r6@1 v1 = a1; v2 = 0; v3 = 1; while ( *v1 ) { v3 = (*v1 + ...
4
votes
1answer
586 views

Ghidra can't see basic functions in my files?

I made a simple program in C++ using Visual Studio 2019 to learn. When I open the file with Ghidra, it doesn't seem to detect my functions and I don't know what I'm doing wrong. My program is simple: ...
0
votes
1answer
101 views

Extracting functions of .obj file (compiled by myself with Visual Studio 19) --> extracts wrong data

How can I find only real functions not data garbage like section..debug_S_105 ? * I need to collect function data (assembler code) of Open Source C++ Files which I compile with Visual Studio 19 (sln ...
1
vote
2answers
123 views

Byte-patch a JMP

I have an address and I want to byte-patch it because there is a JMP that I want to block. But when I NOP it, the game just crash because it corrupt the function. So, I don't know what to do for block ...
1
vote
0answers
205 views

IDA Hex-Rays structure inline functions recognition

I've seen multiple posts about the subject, but mine is a little bit more specific about what I want to achieve. I have many times situations where Hex-Rays decompiler outputs 16 lines of code and I ...
2
votes
2answers
49 views

VC 6 C++ Exception handling, nTryBlocks=0, pTryBlockMap=0 , how?why?

I'm trying to decompile an old binary (about 20 year old). The program uses exceptions. I found some FuncInfo but they do not contain any pTryBlockMap and nTryBlocks is 0. I've tried many options ...
2
votes
1answer
192 views

can someone help me with this map format?

I've been messing around in visual studio for half an hour trying to figure out how to properly display maps from a file, but all I can output is hot garbage, all I know is that the maps are 64x64, ...
0
votes
1answer
85 views

indirect return value address

I have usercall with calling convention I do not fully understand, it returns std::string but IDA recognize it as void. I've noticed that every calle reads from x8/w8 afterwards, from wikipedia; ...
2
votes
1answer
73 views

Arrangement of variables on the stack - out of order?

I was practicing some reverse engineering crack-mes as part of our university curriculum, and I have a question around the arrangement of variables on the stack. I have a very basic C++ code, like ...
1
vote
0answers
26 views

Go back to the original entry point after executing the instructions in the newly added segment- PE32+, C++

I am learning PE32+ (64 bit) files. I have added a new section to the PE32+ file and made the new section as the entry point. Some simple instructions are added in the new segment. Now I want to go to ...
0
votes
1answer
80 views

Abusing the strlen output

My question is related to the strlen function from the C and C++. I am reversing a program, that reads a byte data from allocated memory and sends to the strlen directly. To be completely honest ...
3
votes
3answers
238 views

Strange vtable setup in constructor disassembly

In a program I'm trying to recover data structures I've discovered the following strange (ARM) disassembly code: ctor_1: ldr r1, =vtable_base str r1, [r0] ;r0 always contains ...
2
votes
1answer
228 views

PE32+ executable : .text segment encryption

I am working on PE segment encryption(in C++). I completed the PE32 .text segment encryption. I added stub segment to the PE that will decrypt .text segment at runtime. Used inline assembly in the ...
1
vote
1answer
261 views

Why is fastcall used for replacing thiscall functions in memory instead of cdecl?

Assume I were to be reversing some game which processes all of it's movement client side and have determined some function to be of the type: bool __thiscall Player::CanJump(Player *this) that I ...
0
votes
1answer
92 views

How to determine when/where pointers in .ctors get mapped?

So I am learning about ELF, and am looking through a binary in Ghidra as I do. I've made sense of the ELF header, and now I am looking through the program header table. My binary has a bunch of ...
0
votes
1answer
95 views

Writing a DLL in C# vs C++? [closed]

I am trying to make a client-sided anticheat which would work similar to BattlEye or GameGuard. In order to do this, I want to create a DLL which would do the cheat verification, which then I would ...
0
votes
1answer
121 views

What is, and why, “byte[ ] + number” in this IDA pseudocode?

This is a decompile of an .so file, so it originated from C or C++. Can you kindly try to explain to me what this does? How would one rewrite this into readable code? I don't mind any programming ...
0
votes
1answer
175 views

Possible to get address of DRIVER OBJECT programmatically?

I am looking into getting the address of a dispatch routine. For example, I can get it with windbg easily like so: 0: kd> !drvobj HEVD 2 Driver object (ffffa70752fdbe30) is for: \Driver\HEVD ...
0
votes
1answer
295 views

Trying to understand *((_DWORD *) in IDA pro

Hi I am trying to understand pseudocode from this game I'm currently modifying. if ( v11 == 501736410 ) // case 0x1DE7E3DA: //"Weapon" { *((_DWORD *)v6 + 326) = 3; } else if (...
1
vote
3answers
146 views

Injecting C++ code, while also maximizing compatibility with other injections

Using the New Vegas Script Extender C++ API for Fallout New Vegas, I am able to write to the process' memory directly at runtime through a .dll plugin that's loaded by the NVSE injector. But it is not ...
2
votes
1answer
214 views

Reverse getline(cin, text)

I'm trying to solve a crackme that was made in C++, and I was able to "recreate" a function call, through the library calls the program made. Here's the piece of code that I'm trying to reverse: ...
2
votes
4answers
232 views

Understanding RE output of a simple C++ program

I am trying to learn RE and I decided to explore this field by reverse engineering a simple C++ program, which I post here: SIMPLE C++ PROGRAM #include <iostream> int main() { int value; ...
1
vote
2answers
711 views

Patching JNZ (two byte opcode) into JMP near (one byte opcode)?

I've been tinkering with Fallout New Vegas, and have focused on modifying a very simple record that's hardcoded in the game engine. It's called an Imagespace Modifier, which is a very basic shader ...
0
votes
2answers
69 views

Figuring out correct user input key from final key + generated buffer

I've recently gotten into reversing crackmes, and I seem to always fail at the ones similar to this. The final key that the program uses for comparison is not the key that should be used as input, ...
5
votes
4answers
170 views

What information may supply the uninitialized data to security team?

When I was reversing some well known Android chat applications (I can not disclose which specific ones, but all of them where owned by companies with 1 billion+ capital and have hundreds of millions ...

1
2 3 4 5 6