Questions tagged [c++]
C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language.
425
questions
32
votes
1
answer
9k
views
What kinds of steps can I take to make my C++ application harder to reverse engineer?
If I am building a C++ application and I want to make it more difficult to reverse engineer, what steps can I take to do this?
Does the choice of compiler affect this?
What about compiler flags, ...
- 927
23
votes
1
answer
6k
views
Static analysis of C++ binaries
When reverse engineering binaries compiled from C++, it is common to see many indirect calls to function pointers in vtables. To determine where these calls lead, one must always be aware of the ...
- 1,234
22
votes
1
answer
18k
views
How to organize vtables in IDA Pro?
I am using IDA Pro to disassemble a C++ behemoth with 1600+ classes, many of them having pure virtual methods.
Some classes also are made up of multiple base classes, in hierarchies 5+ levels deep.
...
- 377
12
votes
1
answer
634
views
Are those code snippets and file paths in a C++ binary some sort of standard debug information?
This C++ binary has code snippets and paths to sourcecode files everywhere, which is probably some sort of debug info.
Is this something standard? (Is this RTTI)
If so, how is this called?
Are there ...
- 3,059
11
votes
1
answer
6k
views
Dll injection and GetProcAddress with the winapi
So i just read a little bit about how one would go about for injecting a dll into a running program on Wikipedia (the CreateRemoteThread idea). I followed the steps described and eventually got it ...
- 369
10
votes
9
answers
8k
views
Is it "theoretically" possible/impossible to reverse any binary?
I know that reverse engineering from binary to source code (e.g. C++) is generally considered hard or impossible but has any computer scientist actually proven "mathematically" that it's impossible or ...
- 253
10
votes
2
answers
25k
views
What is a non-virtual thunk?
In real code I have encountered some "non-virtual thunk" functions:
; `non-virtual thunk to'QTextCodecPlugin::create(QString const&)
EXPORT _ZThn8_N16QTextCodecPlugin6createERK7QString
...
10
votes
1
answer
4k
views
Filling C++ interface method names in the disassembly in IDA
I have a C++ header with interfaces (classes with all methods pure virtual).
I also have a binary which returns pointers to these interfaces.
I debugged while running and received the virtual table ...
- 201
10
votes
1
answer
1k
views
What does this memory pattern pointing from the thread-local storage mean?
An application I am currently looking add is using Threads and accessing something via the thread-local storage. It is compiled with Visual C++ (probably 6.0).
First question would be, where can I ...
- 3,059
9
votes
2
answers
7k
views
How difficult is to decompile C++ file?
I am writing an Android app with AES encryption and I am going to save AES key as a string to a C++ file with extension .cpp.
I am also going to create an iOS app which will use the same AES key. Is ...
- 91
9
votes
1
answer
1k
views
Becoming A Better Reverse Engineer
I have been looking on the net and all I see when it comes to reverse engineering are a bunch of silly crackme tutorials. I want to be better at taking code from assembly to c or c++. I am getting the ...
- 773
9
votes
1
answer
6k
views
BYTE3, does it mean the third or fourth byte of an int? IDB file that's already supplied
I've got a program that i'm trying to debug a little bit by trying to make sense of a function or two, there's already some info that i've downloaded via a idb file and it's helped me get somewhere. ...
- 369
9
votes
3
answers
1k
views
Is there a name for this kind of "obfuscation" for the machine code from C++?
I was trying to reverse engineer an android ndk (arm) using ida pro on a static analysis. However, it appears there are a lot of useless jumps to the same place and with random values set to R1 to ...
- 118
9
votes
1
answer
10k
views
How to find the location of the vtable?
Actually, I am trying to learn a little about vtable overflows. So, my learning documents state the following:
The main point to realize is that whenever we declare a C++ class
with virtual ...
- 443
9
votes
1
answer
3k
views
Encrypting text in binary files
Text strings are usually easily read in a binary file using any editor that supports ASCII encoding of hexadecimal values. These text snippets can be easily studied and altered by a reverse engineer.
...
- 4,755
9
votes
1
answer
991
views
Red Alert 2 Windows 8 DirectDraw compatibility
The game Red Alert 2 runs on Windows 8, but as soon as I inject a DLL (via ddraw.dll or an extra DLL) it stops drawing buttons on the main menu. With the DLL it still work fine in windowed mode and it ...
- 241
8
votes
3
answers
5k
views
Hook end/middle of function
How could I hook anywhere but the beginning of a function? I'm trying to add features to a third party executable, and I need it to execute it's code completely, then pass its data onto my function. I ...
- 203
8
votes
1
answer
9k
views
What does a C++ class look like in assembly
I am planning to do some reverse engineering on an application that was written in a object oriented way. And now I'm kind of curious what a C++ class would look like in assembly. I already found out ...
- 199
8
votes
1
answer
328
views
Disassemble communication protocol for an old device
I have an old device connected to personal computer via specific PCI card. Device is handled with C++ control application, which is not able to run on new versions of Windows. Manufacturer of that ...
- 183
7
votes
2
answers
4k
views
How to recover information stored in .ctors section?
Test is on x86, 32-bit Linux. I am using g++ 4.6.3 and objdump 2.22
Here is a simple C++ code I am working on:
#include <iostream>
using namespace std;
main()
{
cout << "Hello ...
- 2,465
7
votes
3
answers
9k
views
Reverse Engineering of data structures in games
I am currently participating in a reverse code engineering seminar for my studies in informatics: games engineering and was assigned the topic about "Identifying data structures". After an extensive ...
- 181
7
votes
1
answer
3k
views
Why can C# applications be reverse-compiled with variable names while C++ ones can't?
Why can programs written in C# be reverse-compiled essentially to their original form with variables names (such as dnSpy) while C++ decompilers (such as Ghidra) are unable to decode the variable ...
- 173
7
votes
2
answers
4k
views
How can I access an internal DLL function or piece of data externally?
I'm writing in C++ and doing an exercise to familiarize myself with DLLs and shared objects (.so). How can I access internals without exporting them? GetProcAddress returns null on a call of an ...
- 380
7
votes
1
answer
4k
views
How to recover the exception info from .gcc_except_table and .eh_handle sections?
For C++ program with try catch defined, when using g++ to compile it into assembly code (test is on x86 32bit Linux, g++ 4.6.3)
g++ -S cppexcept.cc
A specified section called .gcc_except_table is ...
- 2,465
7
votes
1
answer
2k
views
Why two virtual destructors?
The beginning of the virtual function table (VFT, also virtual method table, VMT) disasembled by IDA goes as:
_ZTV13QSystemLocale DCD 0, _ZTI13QSystemLocale, _ZN13QSystemLocaleD2Ev+1, ...
7
votes
2
answers
1k
views
Making Visual C++ harder to reverse engineer
This is similar in nature to this question and this question; I'm interested in what compiler settings to enabled/disable to make a Visual C++ harder to reverse engineer.
Here's a few compiler flags ...
- 173
7
votes
2
answers
2k
views
Identifying possible structs in C/C++ disassembly
I'm currently working on taking apart a game (Soul Reaver: Legacy of Kain) and I often come across odd looking sections such as this in the decompiler
*(_DWORD *)(a2 + 16) = a2 + 624;
*(_DWORD *)(...
6
votes
3
answers
2k
views
Determining if a variable is local or an argument passed to a function
How can you determine if a variable is a local variable of the function or an argument passed to the function?
- 373
6
votes
1
answer
7k
views
Get section's names and headers for a file using C++
I'm implementing a software for performing some PE classification. Among the features values I'm gathering from each PE are, the amount of sections, the name of sections, image section headers.
I have ...
- 223
6
votes
2
answers
3k
views
Intel PIN: How to access the INS object from inside an analysis function?
A typical PIN code snippet looks like this (taken from the official manual):
// This function is called before every instruction is executed
// and prints the IP
VOID printip(VOID *ip) { fprintf(...
- 1,540
6
votes
1
answer
409
views
How to find event functions called by UI components in a C++/DirectX program
I have a program written in C++ with DirectX (as far as I know). The user interface has menus with buttons and other UI components. To automate a process I would like to find the function called by an ...
- 3,059
6
votes
0
answers
824
views
Reliable way to recognize STL template classes?
Since the template classes are different between instantiation, it is extremely difficult for library recognition using universal patterns.
But the control flow graph and references to system call of ...
- 428
5
votes
3
answers
1k
views
Hash algorithm written in C decompiled with IDA
I have been working on rewriting a program, although it uses a hash to fingerprint the file, I have used IDA to find the function doing the hash and what it is doing to the file before it sends it to ...
- 153
5
votes
1
answer
2k
views
Ghidra can't see basic functions in my files?
I made a simple program in C++ using Visual Studio 2019 to learn. When I open the file with Ghidra, it doesn't seem to detect my functions and I don't know what I'm doing wrong.
My program is simple:
...
- 53
5
votes
1
answer
5k
views
Find the C++ STL functions in a binary
I have a binary file (actually, an operating system for an ARM embedded device which also contains some high-level apps (hard coded in the user interface)).
I know some parts of the operating system ...
- 53
5
votes
1
answer
241
views
Understand/Reverse simple (but good quality) TTS engine
For quite a long time I wanted to add TTS (text-to-speech) to my MCU applications and I tried quite few of them with more or less success always hitting a wall that either quality is not good or ...
- 1,384
5
votes
1
answer
1k
views
Why did the program entry point become 'sub esp, 1C'?
I compiled the following C++ code with MinGW and opened it in OllyDbg 2.01. And the program stops at the following lines:
CPU Disasm
Address Hex dump Command ...
- 53
5
votes
1
answer
3k
views
How to reverse command line arguments?
I am working on a console windows executable. So far what I figured out is that the executable checks number of command line arguments. Afterwards, it branches out depending on the number of arguments ...
- 3,088
5
votes
1
answer
2k
views
Why is fastcall used for replacing thiscall functions in memory instead of cdecl?
Assume I were to be reversing some game which processes all of it's movement client side and have determined some function to be of the type:
bool __thiscall Player::CanJump(Player *this)
that I ...
- 53
5
votes
1
answer
3k
views
Writing an exploit for sample-application
I understand the principles of exploiting a classical stack-based buffer-overflow, and now I want to practice it. Therefore I wrote the following test-application:
#include <stdio.h>
#include &...
- 63
5
votes
2
answers
1k
views
What is stored in typeinfo (GNU C++, Android NDK, ARM)
IDA annotates some items as: typeinfo for _classname_.
What is that typeinfo, is it the same as type_info?
What information may be extracted from it? (e.g. I'd like to know the object size or virtual ...
5
votes
2
answers
186
views
Where can I find documentation for the name mangling scheme used by SunPro CC
I have a few SPARC binaries that have been compiled with what seems to be the SunPro CC compiler. The symbols in the binary are referring to a very early C++ implementation (pre-namespaces) and look ...
- 1,060
5
votes
1
answer
5k
views
How to simplify C++ standard template library in IDA?
I've a X64 DLL file which uses C++ standard library heavily. I've loaded the PDB symbol file in IDA and all the subroutines names sub_xxyz changes to std::xyz, which is as expected. But there are many ...
- 1,549
5
votes
1
answer
713
views
Reverse engineering android native packer
im trying to Reverse engineering an android app and the app have 4 folders in the /data/data/{package} folder
├───app_dexprotector
│ 823517D25836B88F1C499C02370A047E.dat
│ ...
- 71
5
votes
4
answers
211
views
What information may supply the uninitialized data to security team?
When I was reversing some well known Android chat applications (I can not disclose which specific ones, but all of them where owned by companies with 1 billion+ capital and have hundreds of millions ...
- 395
5
votes
0
answers
179
views
Cannot find references to functions in vtables
First time doing RE work and I am working on a rather large C++ binary.
In Ghidra, there are many functions that do not appear to have any meaningful references to them (unlike some functions where ...
- 151
5
votes
0
answers
916
views
Python library for linux to demangle MSVC decorated names
I am looking for a python library for linux which can demangle the function names which are mangled by MSVC.
for example :
Project!??0?$allocator@D@std@@QAE@XZ
to
Project!public: __thiscall
...
- 265
4
votes
6
answers
10k
views
How to match disassembled instructions back to C/C++ source?
Basically here's what I want to know, if you have a disassembled instruction say:
jz 0x8048e1a
And, you also have the source code. How do you go about figuring out what this instruction relates to ...
- 191
4
votes
1
answer
659
views
mov ecx, arg - How to replicate in C++?
I frequently see code formatted like this:
push arg
push arg
(...)
mov ecx, arg
call function
If I need to call that function in Assembly, it's fine. But since I know how to consistently get the ...
- 185
4
votes
3
answers
2k
views
compiled binary - what do disassembled instructions correspond to in C/C++ source (Linux GCC)
sorry about the messy title! Basically here's what I want to know.
This might sound a bit silly but, if you have a disassembled instruction say:
jz 0x8048e1a
and you also have the source code, how ...
- 191