Questions tagged [c++]

C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language.

Filter by
Sorted by
Tagged with
10
votes
1answer
563 views

Are those code snippets and file paths in a C++ binary some sort of standard debug information?

This C++ binary has code snippets and paths to sourcecode files everywhere, which is probably some sort of debug info. Is this something standard? (Is this RTTI) If so, how is this called? Are there ...
29
votes
1answer
8k views

What kinds of steps can I take to make my C++ application harder to reverse engineer?

If I am building a C++ application and I want to make it more difficult to reverse engineer, what steps can I take to do this? Does the choice of compiler affect this? What about compiler flags, ...
21
votes
1answer
6k views

Static analysis of C++ binaries

When reverse engineering binaries compiled from C++, it is common to see many indirect calls to function pointers in vtables. To determine where these calls lead, one must always be aware of the ...
8
votes
1answer
8k views

How to find the location of the vtable?

Actually, I am trying to learn a little about vtable overflows. So, my learning documents state the following: The main point to realize is that whenever we declare a C++ class with virtual ...
7
votes
1answer
4k views

How to recover the exception info from .gcc_except_table and .eh_handle sections?

For C++ program with try catch defined, when using g++ to compile it into assembly code (test is on x86 32bit Linux, g++ 4.6.3) g++ -S cppexcept.cc A specified section called .gcc_except_table is ...
5
votes
2answers
1k views

What is stored in typeinfo (GNU C++, Android NDK, ARM)

IDA annotates some items as: typeinfo for _classname_. What is that typeinfo, is it the same as type_info? What information may be extracted from it? (e.g. I'd like to know the object size or virtual ...
2
votes
1answer
1k views

Custom UI buttons

I just started using IDA and OllyDbg, although I am experienced developer but before this I was reverse engineering only Java and .Net code which is much more easy task comparing of what I need to do ...
7
votes
2answers
3k views

How to recover information stored in .ctors section?

Test is on x86, 32-bit Linux. I am using g++ 4.6.3 and objdump 2.22 Here is a simple C++ code I am working on: #include <iostream> using namespace std; main() { cout << "Hello ...
5
votes
1answer
3k views

Writing an exploit for sample-application

I understand the principles of exploiting a classical stack-based buffer-overflow, and now I want to practice it. Therefore I wrote the following test-application: #include <stdio.h> #include &...
4
votes
1answer
603 views

mov ecx, arg - How to replicate in C++?

I frequently see code formatted like this: push arg push arg (...) mov ecx, arg call function If I need to call that function in Assembly, it's fine. But since I know how to consistently get the ...
3
votes
1answer
1k views

How to intercept a call to function with known name from known DLL

First of all I wasn't very much into reversing until now, so excuse me if my question is dumb. I have a windows DLL most likely made with Visual C++. It's been developed in 1998 and has Mfc42.dll (4....
2
votes
2answers
467 views

What compiler uses a calling convention that uses EAX as the first argument, then pushes onto the stack?

I recently asked to question: How can an IA-32 program seemingly compiled with MSVC send its sole argument via EAX? After posting the question, I found that another function passed the first argument ...
10
votes
1answer
5k views

Dll injection and GetProcAddress with the winapi

So i just read a little bit about how one would go about for injecting a dll into a running program on Wikipedia (the CreateRemoteThread idea). I followed the steps described and eventually got it ...
6
votes
1answer
2k views

Why two virtual destructors?

The beginning of the virtual function table (VFT, also virtual method table, VMT) disasembled by IDA goes as: _ZTV13QSystemLocale DCD 0, _ZTI13QSystemLocale, _ZN13QSystemLocaleD2Ev+1, ...
5
votes
1answer
4k views

Find the C++ STL functions in a binary

I have a binary file (actually, an operating system for an ARM embedded device which also contains some high-level apps (hard coded in the user interface)). I know some parts of the operating system ...
3
votes
0answers
1k views

STL map and map entry structures for IDA/HexRays

I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long ...
2
votes
2answers
69 views

VC 6 C++ Exception handling, nTryBlocks=0, pTryBlockMap=0 , how?why?

I'm trying to decompile an old binary (about 20 year old). The program uses exceptions. I found some FuncInfo but they do not contain any pTryBlockMap and nTryBlocks is 0. I've tried many options ...
2
votes
1answer
145 views

Call instruction changed while running

While debugging and reverse-engineering my exe, I have found a very weird thing. call ds:GetModuleFileNameA This call instruction is formed with below hex bytes in IDA. FF 15 24 C0 41 00 (I think ...
2
votes
1answer
15k views

Decrypting Lua Files

I am trying to decrypt a lua file which has been encrypting using a key. Some background to the LUA file. Its from an android Game i decompiled the APK and found that all the lua files are encrypted. ...
7
votes
1answer
5k views

BYTE3, does it mean the third or fourth byte of an int? IDB file that's already supplied

I've got a program that i'm trying to debug a little bit by trying to make sense of a function or two, there's already some info that i've downloaded via a idb file and it's helped me get somewhere. ...
2
votes
1answer
93 views

What is the mdisp field in RTTI for throw used for?

First of here is the article from which I'm looking up the fields. I was trying out different combinations to see how they affect the RTTI for a C++ throw. It seems that having a virtual base class ...
1
vote
1answer
126 views

How can an IA-32 program seemingly compiled with MSVC send its sole argument via EAX? [duplicate]

A C++ program I'm looking at appears to have been compiled with MSVC. It links to MSVCR100.dll, contains MSVC's security cookie code and uses the Microsoft mangling scheme. However, one of the ...
1
vote
1answer
75 views

DetourAttach breaks with Illegal Instruction 0xC000001D

I am trying to detour a function using DetourAttach() in the following fashion: hooks::logDebug("swresample-3Proxy.log", fmt::format("Try to attach hook. Function {:p}, hook {:p}.",...
1
vote
1answer
542 views

What is all this code for?

In order to be able to effectively reverse assembly one needs to understand how different compilers work, and what are the common code generation patterns. If you do not know them, you spent much more ...
1
vote
0answers
411 views

Trying to identify block of code which generates 256 bit key

I'm reversing a C++ program using IDA PRO to examine how the some data is stored, encrypted and decrypted. I've managed to identify the data is encrypted with AES CBC 16 block and 256 bit key. I have ...
1
vote
2answers
2k views

How to set breakpoint on C++ symbols?

How to set breakpoint on this C++ symbol? bp qmgr!TokenHandle::operator-: Could not resolve error at 'qmgr!TokenHandle::operator-:' in windbg?
0
votes
1answer
81 views

How to declare a constructor in reversed class?

I wonder how to declare the reference to a constructor to a reversed class, i.e. I have a class say Game and it has a constructor at a certain address. It is declared like this: game.h namespace ...
-1
votes
2answers
812 views

Add Section to pe file function error [closed]

I'm having some strange errors with the following function which adds a section to a pe executable. When I run the program I get the success message, when I proceed to try to open the executable in ...