Questions tagged [c++]

C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language.

Filter by
Sorted by
Tagged with
0
votes
1answer
14 views

IntelPin, Ins_Insertcall?

please help me with Intel Pin: I print each instruction to the console and I want to insert +++++ after it using Ins_Insertcall: VOID CpuidCalled(const CONTEXT* ctxt) { std::cerr << "+++++&...
1
vote
1answer
38 views

How is it possible to generate C++ class header from a .dll or ELF file?

I loaded a dynamic library file to IDA. I can clearly see the function signatures from the "Function name list". There are RTTI items in the "Structures" tab as well, but I don't ...
0
votes
1answer
71 views

IDA interpretation of switch-case statement

This is my first question on this forum, so I hope that it would not be offensive or redundant. So recently I am attempting to developing some kernel extensions for Apple's macOS using the IOKit ...
2
votes
3answers
96 views

IAT Hook via Kernel Driver

I've wrote a kernel driver recently and it does multiple things, but I wanted to add a IAT hook for a certain driver. I want to hook the IAT of another driver from my driver if that makes sense. So I ...
0
votes
1answer
29 views

Hook/Call __thiscall first argument of which is probably a function or constructor (__thiscall ***) [closed]

int __thiscall sub_xx43780(int (__thiscall ***this)(void *, int, int), int a2, int a3) { int *v4; // edi int v5; // ebx int v6; // eax v4 = (int *)sub_xx3F070(); v5 = *v4; v6 = (**this)(...
0
votes
1answer
62 views

Analyze Arm Linux CPP binary in Ida Pro

I tried to open CPP binary with Ida. Most of the code analyze well . The problem is that there are lot of vtables(Ida doesn't recognize them as vtables) that I need to reach them manually and pressO (...
0
votes
0answers
16 views

Graphics Tablet turn off the blinking Corner Lights (XP-Pen Deco Pro MW)

I have the "XP-Pen Deco Pro MW" and currently have the following problem: The device has corner lights which constantly blink, when the pen is in the area of the corners. I guess its to show ...
0
votes
1answer
81 views

How to declare a constructor in reversed class?

I wonder how to declare the reference to a constructor to a reversed class, i.e. I have a class say Game and it has a constructor at a certain address. It is declared like this: game.h namespace ...
2
votes
1answer
106 views

What is "nullsub_XXX" in vtable in IDA

When I looking in a vtable structure in IDA pro, I know that ___cxa_pure_virtual means that the function is virtual. But what does nullsub_XXX mean in a vtable structure?
1
vote
1answer
131 views

Hex-rays decompiler incorrect logic

I'm practicing reverse engineering in IDA and I created an example application in Visual C++ to practice working with classes/structs and the decompiler output seems to be incorrect - I would like to ...
0
votes
0answers
41 views

IDA does not load PDB file

I have C++ project compiled (debug) with Visual Studio 2019, and I have IDA 5.0 Free version. When I load my .EXE file, IDA does not load correspond PDB file and return message: PDB total 0 symbol ...
1
vote
0answers
48 views

Passing a String into a Function With GDB

So, I have a function with the prototype according to GDB: {std::string (std::string)} 0x56027729e545 <function(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator&...
-2
votes
0answers
50 views

How do i fix IDA pro call analysis failed error?

this is the source code of the program - https://i.stack.imgur.com/vjhyp.png and this is ida pro throwing the error - https://i.stack.imgur.com/wmK1f.png Note: I'm trying to de-compile the big square
0
votes
0answers
67 views

The way to determine how the decompiled constructor is structured

I have the following constructor decompiled by Ghidra, i.e. Game. I know some of the functions, which are part of that constructor. And thus I have created my interpretation of that structure. But I ...
1
vote
0answers
26 views

What is the correct argument for the disassembled function / constructor?

I have the following code disassembled by Ghidra. It first initialises the local variable of the particular type (local_68) and then passes it to the constructor. The variable seems to be initialised ...
0
votes
1answer
40 views

libuv - spoofing user-agent problem

Im trying to give an app "second life" (gamedev "banned" User-Agent of this tool to avoid requests from it). This app is using websocket to get real-time result and then use this ...
1
vote
1answer
55 views

Using struct objects and constructors in hooked function

Will try to reword the actual question so it is hopefully more descriptive and clear of what I am after: So, there is a function main, which I have successfully hooked. The hooked version looks like ...
0
votes
0answers
51 views

Does loading custom PDB help reversing behemoth program?

What I reverse : Old 4~8mb games compiled with vc++ 2006~2008(depends on version), whose source code is lost. It(they) has the mixtures of their custom structures, classes and directX sdk ...
0
votes
1answer
64 views

Can't find references (xref) to function

I am reversing a function and when I trying to see its references, it doesn't show me the calls to the function. It only show the place of the object in RVA. Is there a plug-in or something that I ...
1
vote
1answer
111 views

Inconsistency in function addresses of the hooked functions (address shift)

I came across "a strange" inconsistency in terms of the function addresses in the particular application. First, the main function is hooked successfully, the address is derived in a fashion:...
1
vote
1answer
75 views

DetourAttach breaks with Illegal Instruction 0xC000001D

I am trying to detour a function using DetourAttach() in the following fashion: hooks::logDebug("swresample-3Proxy.log", fmt::format("Try to attach hook. Function {:p}, hook {:p}.",...
0
votes
1answer
60 views

How to call your version of the existing function using proxy dll?

I have bits of code which decompiles a small part of the existing program. I have added it to the proxy dll. The code to the existing functions is hooked through Detour and looks like below (gui.h and ...
1
vote
1answer
180 views

convert C++ code to python code

while I'm doing RE using ghidra i saw this code byte bVar1; byte bVar2; uint uVar3; uVar3 = 0; while (bVar2 = (byte)uVar3, (char)bVar2 < '\b') { bVar1 = *(byte *)(uVar3 + param_1) ^...
0
votes
0answers
54 views

Ida pro doesn't demangle all function names

I am using Ida Pro 7.0 and working with a binary (firmware) written in C++ .Fortunately there are symbols in the firmware and I know function names but Ida didn't manage to demangle all function ...
0
votes
1answer
128 views

How do I interpret this double offset?

While looking at that old game I've found a class CStr that is used in an unusual (to me) manner. Most of the times a member of CStr is used, it's done as follows. In both cases, this is a CStr *. ...
0
votes
1answer
53 views

IDA API: Writing a plugin - How can I ensure that analysis has completed?

I have been reading through the API documentation here and As far as I can tell there are three ways to wait for the analysis to finish. get_auto_state auto_wait auto_is_ok Looking at the API if ...
2
votes
1answer
65 views

What C++ construct could emit such Watcom C++ 10.5 assembler listing?

Based on the assembler listings, a C++ object is locally allocated on the stack without constructing the object in the caller routine and the callee takes the address to the allocated stack space and ...
0
votes
2answers
167 views

How to prevent File Modification in C++

so i want to protect my software against reverse-engineering and i want to add checksum verification to prevent patching the binary but the problem that if i added a checksum verification the binary ...
0
votes
1answer
83 views

How to make sense of the pointer in reversed function call?

I have the code below, derived from the reversed function in the original application: gladius::world::World::create(*(gladius::world::World**)(*(char*)(this + 0x5e8) + 0x50)); The create function ...
0
votes
0answers
43 views

Execute Python code/script inside a game with statically linked Python lib

I'm playing a game that's made in C++ and embeds Python (2.7) for the client interface and most of its functions. At first, this game used to have dynamically linked Python lib for embedding. So I ...
0
votes
2answers
92 views

How to identify method order in disassembled C++ object

Here are some chunks: v13 = cocos2d::FileUtils::getInstance(v9); (*(void (__fastcall **)(char *))(*(_DWORD *)v13 + 64))(&v46); v19 = cocos2d::FileUtils::getInstance(fileHandle); v21 = *(...
0
votes
1answer
65 views

determine proprietary 16-bit floating-point format

Background / Introducion CAN message Mercedes-Benz, cannot determine 16-bit data type for temperature. 7E 00 32 01 37 00 According to @rnd-ash (who has reverse engineered ACTIA Basic XS Monitor ...
0
votes
1answer
89 views

Proxy dll doesn't load the original dll

I have relatively simple code here for the proxy DllMain() function: BOOL APIENTRY DllMain(HMODULE hDll, DWORD reason, LPVOID reserved) { if (reason != DLL_PROCESS_ATTACH) { return TRUE; } ...
0
votes
1answer
73 views

How does Borland C++ 5 exception handling work?

So, I'm still working on reverse-engineering an 1996 game. I have cleared a lot of roadblocks, but one thing that continues to annoy me is exception handling and RTTI metadata. There is a function ...
0
votes
0answers
31 views

How to modify a function without disassembling the entire class

If I want to modify a function which has calls to other classes and functions in the application, but I don't want to reverse all of those other classes and leave them as they are, how do I go about ...
0
votes
1answer
75 views

Modify main function for C++ game file

I am trying to modify the main function for a specific decompiled .exe. More specifically, I want to remove the reference to GUI from that .exe file, so that GUI doesn't get initialised on the startup ...
2
votes
1answer
90 views

Why module address is different in Cheat Engine than in x32dbg?

Why the module address is different in Cheat Engine than in x32dbg? I'm trying to read this: My c++ attempt: #include "pch.h" #include "Functions.h" #include "offsets.h"...
3
votes
1answer
96 views

Trying to identify a Binary-Search-Tree structure

Let's say I make a std::map in C++, and ADDR is their address in memory. When I look at this place in memory I will find a pointer and in ADDR + 4 will be the amount of elements in the container. Now, ...
0
votes
2answers
145 views

convert code to python

i have snippet code that i want to convert to python to understand the types that ghidra use such *(byte *) and *(code *) and *(uchar *) etc.. the first code: void one(int param_1,int param_2) { int ...
1
vote
0answers
81 views

How to create an algorithm in C...(or C# or C++, basically in "a programming language")

After a LOT of sending challenges and recording the responses I've 'broken' the "encryption" in my car's immobiliser...the reason for doing it is so I can use the engine and transmission in ...
2
votes
1answer
88 views

Can't debug process with IDA Windbg debugger: "Could not initialize WinDbg engine with error: %1 is not a valid Win32 application"

I tried to debug a C++ that I created but I am getting the following error: I have this C:\Program Files (x86)\Windows Kits\10\Debuggers\x64 in the PATH environment variable (based on this answer), ...
0
votes
0answers
42 views

Unrecognized function

There is function: push 65h push edi call sub_5D8750 In this case, function takes 65 bytes to be filled with zeros, and edi is memory address starting from which to fill these 65 bytes with ...
2
votes
1answer
172 views

Extracting strings from binary files (.exe)

This question has been asked quite a lot especially on stackoverflow, but the solutions/replies are not clear or extensive. What I`m looking for is to build what Strings does from Sysinternals. My ...
0
votes
1answer
111 views

How do I find missing/undefined vtable functions in IDA64?

I'm reverse engineering a game and came across some function calls like the ones shown below, how do I find where these functions are located / decompile them? (*(BaseClient->int640 + 304))(...
6
votes
1answer
2k views

Why can C# applications be reverse-compiled with variable names while C++ ones can't?

Why can programs written in C# be reverse-compiled essentially to their original form with variables names (such as dnSpy) while C++ decompilers (such as Ghidra) are unable to decode the variable ...
0
votes
0answers
125 views

WMI Spoofing by Fastprox.dll Hooking

I m trying to spoof WMI output by hooking the fastprox.dll. Here is the code I m working on: typedef HRESULT(__stdcall* tGetFunc)(IWbemClassObject*, LPCWSTR, LONG, VARIANT*, CIMTYPE*, long*); static ...
0
votes
0answers
40 views

exports kernel Windows for informations on hardware

Good day! I develop small security software and use a driver like any modern security software. Can you please tell me if there are any exported functions from ntoskrnl.exe or hal.dll or other kernel ...
0
votes
0answers
49 views

c# - Eject Injected Dll From Proc. Then Re-Inject Capability

I made a simple c# application to inject .dll to given process. But I also want to have a capability to eject then depending on user's choice, can re-inject the same .dll to same process. I'm working ...
0
votes
0answers
44 views

x64dbg & Ghidra change combobox properties app in Visual C++ MFC

Hello in the program code the property combobox is changed from enable to disable I would like to change that the program does not change this property. I have found commands that assign new items to ...
0
votes
2answers
71 views

What is the first argument (rdi) to operator+ on x86_64 SystemV?

I'm looking through a block of disassembled C++ which works with several std::string instances. I had been confused by several calls to various versions of std::operator+, but this call seems ...

1
2 3 4 5
8