Questions tagged [c++]

C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language.

Filter by
Sorted by
Tagged with
0
votes
0answers
10 views

Unrecognized function

There is function: push 65h push edi call sub_5D8750 In this case, function takes 65 bytes to be filled with zeros, and edi is memory address starting from which to fill these 65 bytes with ...
0
votes
1answer
59 views

How do I find missing/undefined vtable functions in IDA64?

I'm reverse engineering a game and came across some function calls like the ones shown below, how do I find where these functions are located / decompile them? (*(BaseClient->int640 + 304))(...
1
vote
1answer
50 views

Extracting strings from binary files (.exe)

This question has been asked quite a lot especially on stackoverflow, but the solutions/replies are not clear or extensive. What I`m looking for is to build what Strings does from Sysinternals. My ...
6
votes
1answer
2k views

Why can C# applications be reverse-compiled with variable names while C++ ones can't?

Why can programs written in C# be reverse-compiled essentially to their original form with variables names (such as dnSpy) while C++ decompilers (such as Ghidra) are unable to decode the variable ...
0
votes
0answers
39 views

WMI Spoofing by Fastprox.dll Hooking

I m trying to spoof WMI output by hooking the fastprox.dll. Here is the code I m working on: typedef HRESULT(__stdcall* tGetFunc)(IWbemClassObject*, LPCWSTR, LONG, VARIANT*, CIMTYPE*, long*); static ...
0
votes
1answer
217 views

Modifying program using IDA/Hexrays decompilation pseudocode

A bit long-winded, apologies in advance. Updates to the question are at the end. I'm experimenting with hooking functions in a program & modifying them based on the decompilation pseudocode from ...
-1
votes
0answers
38 views

Recommendations for C++ Junk Code Generator / Obfuscator

Is there any recommendations for open-sourced C++ junk code generator? I would like to add junk code to my application. I've tried to download this tool but couldn't download :( Thanks a bunch for ...
0
votes
0answers
36 views

exports kernel Windows for informations on hardware

Good day! I develop small security software and use a driver like any modern security software. Can you please tell me if there are any exported functions from ntoskrnl.exe or hal.dll or other kernel ...
0
votes
0answers
24 views

c# - Eject Injected Dll From Proc. Then Re-Inject Capability

I made a simple c# application to inject .dll to given process. But I also want to have a capability to eject then depending on user's choice, can re-inject the same .dll to same process. I'm working ...
2
votes
3answers
228 views

Injecting C++ code, while also maximizing compatibility with other injections

Using the New Vegas Script Extender C++ API for Fallout New Vegas, I am able to write to the process' memory directly at runtime through a .dll plugin that's loaded by the NVSE injector. But it is not ...
0
votes
0answers
14 views

x64dbg & Ghidra change combobox properties app in Visual C++ MFC

Hello in the program code the property combobox is changed from enable to disable I would like to change that the program does not change this property. I have found commands that assign new items to ...
0
votes
2answers
41 views

What is the first argument (rdi) to operator+ on x86_64 SystemV?

I'm looking through a block of disassembled C++ which works with several std::string instances. I had been confused by several calls to various versions of std::operator+, but this call seems ...
0
votes
0answers
33 views

How to replace a segment with a single structure consisting of the data in that segment - programmatically?

So I have something like this (I copied this from my other plugin functionality which simply creates a copy paste structure from the frame containing stack variables, while deleting them and then ...
0
votes
0answers
42 views

Is there a way to aid the IDA decompiling process?

I want to make all local variables contained in a structure with appropriate padding put in the gaps (unused parts of the frame). I want to do the same for the global data. And I want to rename ...
1
vote
1answer
57 views

IDA SDK - can't understand the output of displacement query functions?

OK so I want to parse x86 instructions with IDA SDK. However I can't understand the output, I have this code (that is executed after decode_insn at each operand that is present (type not 0)): //op is ...
8
votes
2answers
16k views

What is a non-virtual thunk?

In real code I have encountered some "non-virtual thunk" functions: ; `non-virtual thunk to'QTextCodecPlugin::create(QString const&) EXPORT _ZThn8_N16QTextCodecPlugin6createERK7QString ...
2
votes
1answer
653 views

Trying to call function in process via DLL injection, need help in IDA if possible

I'm trying to create a bot for a game called "Mech Warrior Online". I've just completed my DLL injector which I want to use as mean to call function from the MWO client such as (fire, move, look ...
3
votes
1answer
405 views

Reverse engineering android native packer

im trying to Reverse engineering an android app and the app have 4 folders in the /data/data/{package} folder ├───app_dexprotector │ 823517D25836B88F1C499C02370A047E.dat │ ...
0
votes
1answer
52 views

Making a Android Toast via JNI, i.e. calling Java methods via JNI

Concerning the outputting of an Toast, I found that there are some ways to make a Toast, that invoke calling a FindClass on JNIEnv object with the android/widget/Toast parameter, but I found no ...
1
vote
1answer
94 views

What encoding is this?

This is a picture of the encoded code. I'm just wondering what is the encoding that it is using.
2
votes
2answers
118 views

Why this ASM represents Virtual Function call?

I'm referring to this question that was asked previously: Virtual functions call asm I'm wondering how is it possible to know whether this ASM listing represents Virtual Functions calls? What's in the ...
0
votes
2answers
76 views

C++ hide string parameter for string viewer

bool isLaunched = CreateProcessW( L"C:\\Windows\\System32\\Notepad.exe", // Should be shown in any string viewer or decompiler. 0x0, 0x0, 0x0, TRUE, 0, 0x0, ...
0
votes
1answer
38 views

How to avoid database / code mismatch when developing and debugging your own code in IDA?

This seems like a very basic use case and I can't get it to work properly. I'm developing my own test application in Visual Studio c++. I want to test it through several IDA debugging sessions. Every ...
0
votes
1answer
85 views

What are the way I can reverse engineer an obfuscated C++ program?

I am reverse engineering an program. I encountered a problem where I can't reverse engineer it as the program code is obfuscated. I realised the program is obfuscated thanks to my friend who noticed ...
1
vote
1answer
77 views

What is the mdisp field in RTTI for throw used for?

First of here is the article from which I'm looking up the fields. I was trying out different combinations to see how they affect the RTTI for a C++ throw. It seems that having a virtual base class ...
1
vote
0answers
467 views

Static binary instrumentation tools for android .so libraries?

I'm trying to statically inject code into an android app. The best way would be to use APKStudio and the like, but there are very harsh restrictions on the device and the app itself, so that apk ...
0
votes
1answer
777 views

Is it possible to get back to a compilable form of source code using IDA pro [duplicate]

I am familiar with debuggers and sorts. I was going through a program and noticed that IDA does make some mistakes on what it decides what on its pseudo code will be. Is there a list of common ...
0
votes
1answer
50 views

Converting a data address offset to the equivalent struct in a C++ module

I have an offset to a property within a player class that I need to access data from. It's made of a specific struct that I have already assembled. IDA reports the accessing offset as so: v32 = ( v3 + ...
0
votes
1answer
54 views

How use signature pattern for hooking

I like to replace the static function address: AddressOfHookSoundFunction = (DWORD)GetModuleHandleA("myfile.exe") + 0x0F3B65; // good: 4406117 (integer) using signature pattern: SigScan ...
0
votes
1answer
41 views

Function pointer reference

I need to hook 10/20 functions like these: static void* __cdecl HookFunction1(char *FileName, int a2, int a3, int a4); __declspec(naked) void HookFunction2(char *Src, int pedx, int a3, ...
3
votes
2answers
366 views

PE32+ executable : .text segment encryption

I am working on PE segment encryption(in C++). I completed the PE32 .text segment encryption. I added stub segment to the PE that will decrypt .text segment at runtime. Used inline assembly in the ...
8
votes
1answer
869 views

Red Alert 2 Windows 8 DirectDraw compatibility

The game Red Alert 2 runs on Windows 8, but as soon as I inject a DLL (via ddraw.dll or an extra DLL) it stops drawing buttons on the main menu. With the DLL it still work fine in windowed mode and it ...
1
vote
1answer
49 views

How to split bytes into instructions in binary ELF file for x86

I'm working on a static code injector for ELF files. I need to "steal" some bytes in order to write jump to my code on their place and then execute stolen instructions somewhere in the ...
0
votes
0answers
50 views

Tracing all (or most of) function calls in a specific Android app

I'm having a problem, where I'm trying to trace some function calls in an Android app, that uses JNI for about all of its work. More specifically, a function call, in JNI, that makes (IIRC Android ...
0
votes
1answer
929 views

Decrypting Lua Files from game

I'm truing to decrypt LUA scrpits from cocos2dx game (for wiki). Links to files of game: libhellolua.so (cocos2dx external library) example encrypted LUA-scripts (*.abc files) I was reading a ...
2
votes
2answers
86 views

C++ structure containing a RTTI getter function?

I'm working on reversing a C++ application and I've come across a structure that contains a getter function that returns TypeDescriptor*, I've read some articles on RTTI and reversing C++ but can't ...
-1
votes
1answer
317 views

c++ reading process memory with injected DLL

The reading works fine until it reaches base+27.058.176(bytes) address. At this address VirtualProtect() failes with error 487 (Attempt to access invalid address). Why does it return this error? Btw ...
4
votes
1answer
110 views

Understand/Reverse simple (but good quality) TTS engine

For quite a long time I wanted to add TTS (text-to-speech) to my MCU applications and I tried quite few of them with more or less success always hitting a wall that either quality is not good or ...
1
vote
1answer
54 views

Hook naked function with CPU registers

I need to hook this function: .text:005589CB sub_5589CB proc near ; CODE XREF: AddHealth(int,long)+1A↑j .text:005589CB ; sub_5328D8+98E↑p ... ...
1
vote
1answer
52 views

how can ı debug encrypted dll with x32dbg and look getregistery request

I have an executable with 2 .dll calls 1 of this dll is guard.dll others name is guardlib.dll both of them is encrypted c++ library file and they are called before executable entry point. I can bypass ...
1
vote
1answer
103 views

Why does decompiling a C++ using Snowman yield some full variable names and some obfuscated ones?

I decompiled a C++ exe file using Snowman, hoping to see if it was malware or not (Although, honestly, I have no clue how to continue that - The file is really large, and the decompilation mostly ...
1
vote
1answer
123 views

how to hook __usercall function with microsoft detours

I need to hook a __usercall function in particular I need to read only the first parameter: char __usercall sub_4F3E6D@<al>(char *Src@<ecx>, int a2@<edx>, int a3, int a4, char a5, ...
0
votes
0answers
39 views

Detours ws2_32.dll [Send]

I have a program that calls send (), I need to change the host to my own, but this does not work (either the program crashes or the request does not reach the server) - I log requests on the server. ...
0
votes
2answers
229 views

how to use class member function defined in a exe within a dll

I have an executable (.exe) containing some classes and functions definition and plan on using those functions from within a DLL, although I know to call a regular C style function using calling ...
1
vote
2answers
169 views

STL Data Structures Hex-Rays

We all know that reversing STL code is no fun. To make it easier, I usually create some of the strucutres so I can reference the created STL structures in another custom structure. For example, msvc - ...
0
votes
1answer
24 views

How can a debugger break on dynamic loaded libraries?

I think I have a massive understanding problem with the following issue: Usually the loader will fix the Import Table for the modules that have been loaded, right, so if I set a breakpoint on ...
4
votes
2answers
2k views

Is there a way to import debug/symbol information of a C++ DOS executable to IDA?

I have an old DOS program compiled using Borland C++ (1991 version) The end of the executable contains many strings preceded by an underscore which looks like debug/symbol information : eg: ...
0
votes
1answer
130 views

which is harder to reverse engineer? [closed]

I'm planning on writing a windows application, used everywhere in my home country. I will code it in C++, but my question is which would you consider better to use? win32api Visual C++ MFC I'm ...
3
votes
0answers
30 views

How can I tell whether or not a given library method is being referenced by a consumer program statically in OOP languages?

Preface: This question is about source code reverse engineering and static analysis. Meaning, there is no built code available but I have access to the source code of the program. Imagine I'm looking ...
0
votes
0answers
71 views

Easy way to attach a DLL to a Game

I like to attach a dll to a game to add more features. The DLL is 95% done, the problem is find the best and easy way to load this dll from the Game. My idea is use this technique: dinput_ori.dll (...

1
2 3 4 5
7