Questions tagged [c++]
C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language.
29
questions
12
votes
1
answer
634
views
Are those code snippets and file paths in a C++ binary some sort of standard debug information?
This C++ binary has code snippets and paths to sourcecode files everywhere, which is probably some sort of debug info.
Is this something standard? (Is this RTTI)
If so, how is this called?
Are there ...
- 3,059
32
votes
1
answer
9k
views
What kinds of steps can I take to make my C++ application harder to reverse engineer?
If I am building a C++ application and I want to make it more difficult to reverse engineer, what steps can I take to do this?
Does the choice of compiler affect this?
What about compiler flags, ...
- 927
23
votes
1
answer
6k
views
Static analysis of C++ binaries
When reverse engineering binaries compiled from C++, it is common to see many indirect calls to function pointers in vtables. To determine where these calls lead, one must always be aware of the ...
- 1,234
9
votes
1
answer
10k
views
How to find the location of the vtable?
Actually, I am trying to learn a little about vtable overflows. So, my learning documents state the following:
The main point to realize is that whenever we declare a C++ class
with virtual ...
- 443
7
votes
1
answer
4k
views
How to recover the exception info from .gcc_except_table and .eh_handle sections?
For C++ program with try catch defined, when using g++ to compile it into assembly code (test is on x86 32bit Linux, g++ 4.6.3)
g++ -S cppexcept.cc
A specified section called .gcc_except_table is ...
- 2,465
5
votes
2
answers
1k
views
What is stored in typeinfo (GNU C++, Android NDK, ARM)
IDA annotates some items as: typeinfo for _classname_.
What is that typeinfo, is it the same as type_info?
What information may be extracted from it? (e.g. I'd like to know the object size or virtual ...
2
votes
1
answer
2k
views
Custom UI buttons
I just started using IDA and OllyDbg, although I am experienced developer but before this I was reverse engineering only Java and .Net code which is much more easy task comparing of what I need to do ...
- 153
2
votes
1
answer
19k
views
Decrypting Lua Files
I am trying to decrypt a lua file which has been encrypting using a key. Some background to the LUA file. Its from an android Game i decompiled the APK and found that all the lua files are encrypted.
...
- 31
11
votes
1
answer
6k
views
Dll injection and GetProcAddress with the winapi
So i just read a little bit about how one would go about for injecting a dll into a running program on Wikipedia (the CreateRemoteThread idea). I followed the steps described and eventually got it ...
- 369
9
votes
1
answer
6k
views
BYTE3, does it mean the third or fourth byte of an int? IDB file that's already supplied
I've got a program that i'm trying to debug a little bit by trying to make sense of a function or two, there's already some info that i've downloaded via a idb file and it's helped me get somewhere. ...
- 369
7
votes
1
answer
2k
views
Why two virtual destructors?
The beginning of the virtual function table (VFT, also virtual method table, VMT) disasembled by IDA goes as:
_ZTV13QSystemLocale DCD 0, _ZTI13QSystemLocale, _ZN13QSystemLocaleD2Ev+1, ...
7
votes
2
answers
4k
views
How to recover information stored in .ctors section?
Test is on x86, 32-bit Linux. I am using g++ 4.6.3 and objdump 2.22
Here is a simple C++ code I am working on:
#include <iostream>
using namespace std;
main()
{
cout << "Hello ...
- 2,465
5
votes
1
answer
5k
views
Find the C++ STL functions in a binary
I have a binary file (actually, an operating system for an ARM embedded device which also contains some high-level apps (hard coded in the user interface)).
I know some parts of the operating system ...
- 53
5
votes
1
answer
3k
views
Writing an exploit for sample-application
I understand the principles of exploiting a classical stack-based buffer-overflow, and now I want to practice it. Therefore I wrote the following test-application:
#include <stdio.h>
#include &...
- 63
4
votes
1
answer
659
views
mov ecx, arg - How to replicate in C++?
I frequently see code formatted like this:
push arg
push arg
(...)
mov ecx, arg
call function
If I need to call that function in Assembly, it's fine. But since I know how to consistently get the ...
- 185
3
votes
1
answer
2k
views
How to intercept a call to function with known name from known DLL
First of all I wasn't very much into reversing until now, so excuse me if my question is dumb.
I have a windows DLL most likely made with Visual C++. It's been developed in 1998 and has Mfc42.dll (4....
- 131
3
votes
0
answers
2k
views
STL map and map entry structures for IDA/HexRays
I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long ...
- 131
2
votes
2
answers
129
views
VC 6 C++ Exception handling, nTryBlocks=0, pTryBlockMap=0 , how?why?
I'm trying to decompile an old binary (about 20 year old).
The program uses exceptions.
I found some FuncInfo but they do not contain any pTryBlockMap and nTryBlocks is 0.
I've tried many options ...
- 23
2
votes
1
answer
159
views
What is the mdisp field in RTTI for throw used for?
First of here is the article from which I'm looking up the fields.
I was trying out different combinations to see how they affect the RTTI for a C++ throw. It seems that having a virtual base class ...
- 455
2
votes
1
answer
283
views
Call instruction changed while running
While debugging and reverse-engineering my exe, I have found a very weird thing.
call ds:GetModuleFileNameA
This call instruction is formed with below hex bytes in IDA.
FF 15 24 C0 41 00
(I think ...
2
votes
2
answers
764
views
What compiler uses a calling convention that uses EAX as the first argument, then pushes onto the stack?
I recently asked to question: How can an IA-32 program seemingly compiled with MSVC send its sole argument via EAX? After posting the question, I found that another function passed the first argument ...
1
vote
2
answers
2k
views
How to set breakpoint on C++ symbols?
How to set breakpoint on this C++ symbol?
bp qmgr!TokenHandle::operator-:
Could not resolve error at 'qmgr!TokenHandle::operator-:'
in windbg?
- 121
1
vote
0
answers
554
views
Trying to identify block of code which generates 256 bit key
I'm reversing a C++ program using IDA PRO to examine how the some data is stored, encrypted and decrypted.
I've managed to identify the data is encrypted with AES CBC 16 block and 256 bit key. I have ...
- 113
1
vote
1
answer
646
views
What is all this code for?
In order to be able to effectively reverse assembly one needs to understand how different compilers work, and what are the common code generation patterns. If you do not know them, you spent much more ...
- 155
1
vote
1
answer
889
views
DetourAttach breaks with Illegal Instruction 0xC000001D
I am trying to detour a function using DetourAttach() in the following fashion:
hooks::logDebug("swresample-3Proxy.log", fmt::format("Try to attach hook. Function {:p}, hook {:p}.",...
- 326
1
vote
1
answer
171
views
How can an IA-32 program seemingly compiled with MSVC send its sole argument via EAX? [duplicate]
A C++ program I'm looking at appears to have been compiled with MSVC. It links to MSVCR100.dll, contains MSVC's security cookie code and uses the Microsoft mangling scheme. However, one of the ...
0
votes
1
answer
245
views
How to declare a constructor in reversed class?
I wonder how to declare the reference to a constructor to a reversed class, i.e. I have a class say Game and it has a constructor at a certain address.
It is declared like this:
game.h
namespace ...
- 326
0
votes
1
answer
2k
views
How do I get all sections in a PE file using C++?
So I am wondering how can I get all sections and their info from a dumped PE file on the disk, using C++.
I have the entire PE loaded on a buffer, the NT headers, and hopefully the DOS headers.
I need ...
- 28
-1
votes
2
answers
937
views
Add Section to pe file function error [closed]
I'm having some strange errors with the following function which adds a section to a pe executable. When I run the program I get the success message, when I proceed to try to open the executable in ...
- 31