Questions tagged [c++]
C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language.
432
questions
4
votes
1
answer
2k
views
Reverse engineering a flutter built apk
I was trying to reverse engineer an apk built with flutter. I actually feel like reversing flutter built apps did not get much reverse writeups on the community. one of the tools for the task ...
CommunityBot
- 1
2
votes
1
answer
721
views
Can't find references (xref) to function
I am reversing a function and when I trying to see its references, it doesn't show me the calls to the function. It only show the place of the object in RVA.
Is there a plug-in or something that I ...
CommunityBot
- 1
0
votes
1
answer
85
views
Get hardcoded char array from compiled C++ source
It is well known that literal strings can be retrieved from C++ compilates. For example, the output of
g++ a.cpp
on
int main(void)
{
const char * secret0 = "abcdefghijklmnopqrstuvwxyz";
...
CommunityBot
- 1
-1
votes
0
answers
62
views
How to convert to C++ code
cseg01:000564EF mov edx, offset Linear_Region_20_Start
cseg01:000564F4 mov eax, offset Linear_Region_20_End
cseg01:000564F9 sub eax, edx
...
- 331
1
vote
2
answers
448
views
How do I get the start address of the 'code section' and its size to know the end address?
I am trying to read the binary code in the text section of an executable game file (PE) programmatically but I don't know the start address and the end address of the text section.
I am using C++/...
0
votes
0
answers
42
views
MS-DOS 32 bit mode Timer interrupt
My application works in 32 bit MS-DOS mode with dos4gw.exe extender. variables unknown_bool_0004AA8A = 1, unknown_bool_0004AAA0 = 1.
cseg01:0004AAB3 mov eax, offset Proc_Addr1
...
- 331
0
votes
1
answer
62
views
Updating legacy library in an already compiled binary
I'm dealing with a reverse engineering challenge involving a binary application that was statically compiled with a legacy library. While the legacy library is not vulnerable, it lacks certain ...
- 4,470
0
votes
1
answer
43
views
Assembler OR operation
Is this asm code:
or unknown_byte_0004AAA7, 1
dseg05:000C7FDC unknown_byte_0004AAA7 db 0
equivalent to this C++ code below?
bool unknown_byte_0004AAA7 = 0;
unknown_byte_0004AAA7 = ...
- 121
1
vote
1
answer
118
views
What means this code?
cseg01:00020DB8 mov eax, offset screen_with_height
cseg01:00045704 mov dword ptr [eax+0Ah], 0
cseg01:0004570B call sub_466F8 ; call some proc
...
- 9,178
0
votes
1
answer
44
views
Making zero terminated string WATCOM compiler
This is WATCOM compiler. Assembler code below try create random 8 letters to compose zero terminated string.
cseg01:0001F544 Try_Write_To_Disk proc near ; CODE XREF: Check_CDRom+46p
cseg01:...
- 16.3k
0
votes
0
answers
47
views
How many bytes allocated for buffer?
There is start of function:
cseg01:0001F4C8 Check_CDRom proc near ; CODE XREF: Init+Ap
cseg01:0001F4C8
cseg01:0001F4C8 var_24 = byte ptr -24h
cseg01:0001F4C8
cseg01:0001F4C8 ...
- 331
0
votes
1
answer
79
views
Creating the SkiFree 2 dream... An introduction [closed]
I am no programmer but I like to do it for my own purpose and entertainment. As in earlier posts I said:
Excuse me, I am just liking to use the SkiFree source code for my very own purpose. The purpose ...
- 31
1
vote
1
answer
131
views
Retrieve & dump type information from IDA Pro
I want to retrieve IDA Pro .idb database's each type info, such as:
size and name of a structure;
each member variable type and name;
each member variable size and offset;
And dump it to a .h file ...
- 9,178
1
vote
1
answer
224
views
Identifying C/C++ Library Functions
I am attempting to reverse-engineer an old DOS executable, which seems to have been compiled around 1992 using Microsoft's C compiler at the time.
When opening the executable in Ghidra no imports are ...
- 579
1
vote
0
answers
30
views
Retrieve functionality to button - game patching
I'm patching an old game, and I want the retrieve the toggle fullscreen functionality it's supposed to have.
In the menu, in the display tab, there is a disabled option of fullscreen mode that you can ...
- 21
0
votes
1
answer
1k
views
c++ reading process memory with injected DLL
The reading works fine until it reaches base+27.058.176(bytes) address. At this address VirtualProtect() failes with error 487 (Attempt to access invalid address).
Why does it return this error? Btw ...
CommunityBot
- 1
0
votes
2
answers
95
views
How does IDA know the symbol names for classes and interfaces?
I am reversing a 32 bit library used by a Linux game (I am sure someone might recognize the engine used). I was messing around with cutter and when trying to compare it to IDA, which I have used in ...
- 103
1
vote
1
answer
201
views
Function pointer reference
I need to hook 10/20 functions like these:
static void* __cdecl HookFunction1(char *FileName, int a2, int a3, int a4);
__declspec(naked) void HookFunction2(char *Src, int pedx, int
a3, ...
CommunityBot
- 1
0
votes
0
answers
33
views
How can I make a quick tracer for a PE file?
INTRODUCTION:
I made my tracer on the event debug loop, but after I compared its speed characteristics with the same PinTool or similar tools, I realized that my tracer is several dozen times slower ...
- 11
2
votes
1
answer
215
views
IDA: Demangled name simplification in idapython
With idapython I would like to get demangled names with the name simplification (bottom of page) applied to them.
For example, the following function:
Python> ida_name.demangle_name(idc....
- 36.4k
1
vote
1
answer
95
views
How can i remove dead code and opaque predicates?
I have the following problem on my agenda: There is an obfuscated .exe (this is a virus that I am investigating) in addition to having an MBA, etc. bullshit, he has Opaque predicates and dead code, I ...
- 11
2
votes
3
answers
2k
views
Help reversing code which uses ATL::CStringT
I'm attempting to learn reversing techniques using IDA on an exe built with VC/MFC, and could use a little initial help learning some patterns for simplifying the decompiled code.
IDA found ...
- 111
32
votes
1
answer
9k
views
What kinds of steps can I take to make my C++ application harder to reverse engineer?
If I am building a C++ application and I want to make it more difficult to reverse engineer, what steps can I take to do this?
Does the choice of compiler affect this?
What about compiler flags, ...
- 257
2
votes
2
answers
437
views
C++, Windows UI Automation and DaVinci Resolve
I've been researching this topic for a while, but the information is extremely limited and very confusing.
DaVinci Resolve is an editing and color grading software, its tools are so many and so ...
- 119
3
votes
0
answers
48
views
How can I create an `__m128i` datatype with Frida?
I'm working on reversing a c++ binary and it has a function that I want to call with Frida.
Here's the function signature from IDA: const __m128i *__fastcall sub_0123(__m128i * a1);
It doesn't seem ...
- 131
3
votes
0
answers
142
views
IDA ATL C++ class reconstruction
I'm currently using IDA Pro to analyze a dll, but IDA Pro doesn't analyze ATL standard classes properly, including CString, so I'm trying to reconstruct the classes manually, but I'm having some ...
- 71
4
votes
1
answer
624
views
How to add STL to Local Types in Ida Pro?
How to add STL to Local Types in Ida Pro?
I can import debug information from a pdb file along with STL types, but I can't manually add STL types to Local Types.
Also I can't import STL when I click &...
- 10.9k
4
votes
2
answers
496
views
How to reverse a game and inject a dll in client program?
I am trying to make a bot for a game. But when I open the game in debugger like Ollydbg or in x64dbg the game simply closes and also it doesn't appears in the Attach to the process list in File menu ...
- 10.9k
3
votes
0
answers
282
views
How would I crack a software that has Xor encryption
So, before you shout at me to go on google I would just like to say I am new to reverse Engineering. Like I have been doing it for a hour. So, I was doing a bunch of crackmes.one using the search all ...
CommunityBot
- 1
3
votes
1
answer
598
views
How to bypass anti debugger? IDA Pro
Im new to reverse engineering and doing a crackme that requires me to make a keygen, yes i know making a keygen isn't a beginner task however im stuborn, i am trying to debug the program to understand ...
- 61
2
votes
1
answer
93
views
libuv - spoofing user-agent problem
Im trying to give an app "second life" (gamedev "banned" User-Agent of this tool to avoid requests from it).
This app is using websocket to get real-time result and then use this ...
CommunityBot
- 1
22
votes
1
answer
19k
views
How to organize vtables in IDA Pro?
I am using IDA Pro to disassemble a C++ behemoth with 1600+ classes, many of them having pure virtual methods.
Some classes also are made up of multiple base classes, in hierarchies 5+ levels deep.
...
- 1,083
1
vote
1
answer
105
views
What is the output for this and how?
*(_BYTE *)(Key + Integer_count - 1) + 79
Here : Key = 0x22EC278 (dw 'Âx')
or
Stack[000015B8]:0019FC2C db 78h ; x
Stack[000015B8]:0019FC2D db 0C2h ; Â
Stack[000015B8]:0019FC2E db 2Eh ; .
Stack[...
5
votes
1
answer
2k
views
Why is fastcall used for replacing thiscall functions in memory instead of cdecl?
Assume I were to be reversing some game which processes all of it's movement client side and have determined some function to be of the type:
bool __thiscall Player::CanJump(Player *this)
that I ...
2
votes
1
answer
127
views
Reversing C++ Classes in ARM
I have unstripped linux arm binary,
The code calls functions in class object reference like so:
LDR R3, [R6]
MOV R1, R7
MOV R0, R6
LDR R3, [R3,#0xC] ; (...
- 171
2
votes
0
answers
113
views
I trying rewrite asm to c++ [closed]
This code generates an API key. I use it in an android app as .so file,
but I need to rewrite it to java from c++. How do I translate?
push rbp
push r15
push r14
push r13
push r12
push ...
- 2,629
7
votes
2
answers
2k
views
Identifying possible structs in C/C++ disassembly
I'm currently working on taking apart a game (Soul Reaver: Legacy of Kain) and I often come across odd looking sections such as this in the decompiler
*(_DWORD *)(a2 + 16) = a2 + 624;
*(_DWORD *)(...
- 441
2
votes
2
answers
712
views
C++ hide string parameter for string viewer
bool isLaunched = CreateProcessW(
L"C:\\Windows\\System32\\Notepad.exe", // Should be shown in any string viewer or decompiler.
0x0,
0x0,
0x0,
TRUE,
0,
0x0,
...
CommunityBot
- 1
2
votes
1
answer
286
views
IDA API: Writing a plugin - How can I ensure that analysis has completed?
I have been reading through the API documentation here and As far as I can tell there are three ways to wait for the analysis to finish.
get_auto_state
auto_wait
auto_is_ok
Looking at the API if ...
CommunityBot
- 1
3
votes
0
answers
76
views
purpose for using a == &a
I'm debugging dns.exe in Windows10 1809 and I'm really confused about one condition that often appeared in this file
WPP_GLOBAL_Control == &WPP_GLOBAL_Control
Actually, I have seen this kind of ...
- 313
3
votes
1
answer
81
views
How does this Is64BitOS pointer-arithmetic-based function work?
Reversed this function. It works. But stepping through I can't figure out how. Why does this work?
bool _Is64BitOS(void) {
unsigned int version = *(unsigned int*)0x7FFE026C;
unsigned int ...
- 10.9k
9
votes
3
answers
1k
views
Is there a name for this kind of "obfuscation" for the machine code from C++?
I was trying to reverse engineer an android ndk (arm) using ida pro on a static analysis. However, it appears there are a lot of useless jumps to the same place and with random values set to R1 to ...
- 59
4
votes
0
answers
177
views
How to correctly inject a [jump + address] instruction into another process (code injection)?
I am trying to inject a jump instruction into another process (External injection), although the injection operation has been completed the address was not correct.
For example:
unsigned int addr = ...
- 269
5
votes
0
answers
198
views
Cannot find references to functions in vtables
First time doing RE work and I am working on a rather large C++ binary.
In Ghidra, there are many functions that do not appear to have any meaningful references to them (unlike some functions where ...
- 151
1
vote
0
answers
156
views
Easy way to attach a DLL to a Game
I like to attach a dll to a game to add more features.
The DLL is 95% done, the problem is find the best and easy way to load this dll from the Game.
My idea is use this technique:
dinput_ori.dll (...
CommunityBot
- 1
3
votes
2
answers
802
views
PE32+ executable : .text segment encryption
I am working on PE segment encryption(in C++). I completed the PE32 .text segment encryption. I added stub segment to the PE that will decrypt .text segment at runtime. Used inline assembly in the ...
CommunityBot
- 1
2
votes
2
answers
1k
views
turning decompiled C++ code into writable C++
Here's my scenario I currently have a DLL that was made in like 2003 archived that has data and functions I still need to use and I'm also 90% sure the DLL doesn't work correctly as its too outdated. (...
- 8,388
2
votes
0
answers
99
views
statically placing hooks on PE file's IAT
recently I started writing my own PE library for C++, and wanted to implement static IAT/EAT hooking, (basically hooking by patching the file instead of hooking at runtime), I managed to successfully ...
- 21
1
vote
0
answers
185
views
How to find the the event handler function for a QtAbstractButton?
I am not very familiar with Qt to begin with but basic PyQt tutorial showed that a button object is linked with its handler using the connect method that takes in as its argument the function that ...
- 10.9k
1
vote
1
answer
112
views
I have gotten three different entry points which one is the correct one?
I am trying to get the entry point of an executable game file.
I have used 3 ways, 2 programs, and 1 c++ code.
C++ Code:
HMODULE GetModuleHandle(CONST CHAR* ModuleName, DWORD ProcessId) {
HMODULE ...
- 269