Questions tagged [c++]
C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language.
432
questions
-1
votes
0
answers
62
views
How to convert to C++ code
cseg01:000564EF mov edx, offset Linear_Region_20_Start
cseg01:000564F4 mov eax, offset Linear_Region_20_End
cseg01:000564F9 sub eax, edx
...
- 331
0
votes
0
answers
42
views
MS-DOS 32 bit mode Timer interrupt
My application works in 32 bit MS-DOS mode with dos4gw.exe extender. variables unknown_bool_0004AA8A = 1, unknown_bool_0004AAA0 = 1.
cseg01:0004AAB3 mov eax, offset Proc_Addr1
...
- 331
0
votes
1
answer
43
views
Assembler OR operation
Is this asm code:
or unknown_byte_0004AAA7, 1
dseg05:000C7FDC unknown_byte_0004AAA7 db 0
equivalent to this C++ code below?
bool unknown_byte_0004AAA7 = 0;
unknown_byte_0004AAA7 = ...
- 331
0
votes
1
answer
62
views
Updating legacy library in an already compiled binary
I'm dealing with a reverse engineering challenge involving a binary application that was statically compiled with a legacy library. While the legacy library is not vulnerable, it lacks certain ...
- 3
1
vote
1
answer
118
views
What means this code?
cseg01:00020DB8 mov eax, offset screen_with_height
cseg01:00045704 mov dword ptr [eax+0Ah], 0
cseg01:0004570B call sub_466F8 ; call some proc
...
- 331
0
votes
1
answer
85
views
Get hardcoded char array from compiled C++ source
It is well known that literal strings can be retrieved from C++ compilates. For example, the output of
g++ a.cpp
on
int main(void)
{
const char * secret0 = "abcdefghijklmnopqrstuvwxyz";
...
- 101
0
votes
1
answer
44
views
Making zero terminated string WATCOM compiler
This is WATCOM compiler. Assembler code below try create random 8 letters to compose zero terminated string.
cseg01:0001F544 Try_Write_To_Disk proc near ; CODE XREF: Check_CDRom+46p
cseg01:...
- 331
0
votes
0
answers
47
views
How many bytes allocated for buffer?
There is start of function:
cseg01:0001F4C8 Check_CDRom proc near ; CODE XREF: Init+Ap
cseg01:0001F4C8
cseg01:0001F4C8 var_24 = byte ptr -24h
cseg01:0001F4C8
cseg01:0001F4C8 ...
- 331
0
votes
1
answer
79
views
Creating the SkiFree 2 dream... An introduction [closed]
I am no programmer but I like to do it for my own purpose and entertainment. As in earlier posts I said:
Excuse me, I am just liking to use the SkiFree source code for my very own purpose. The purpose ...
- 31
1
vote
1
answer
131
views
Retrieve & dump type information from IDA Pro
I want to retrieve IDA Pro .idb database's each type info, such as:
size and name of a structure;
each member variable type and name;
each member variable size and offset;
And dump it to a .h file ...
- 33
1
vote
1
answer
224
views
Identifying C/C++ Library Functions
I am attempting to reverse-engineer an old DOS executable, which seems to have been compiled around 1992 using Microsoft's C compiler at the time.
When opening the executable in Ghidra no imports are ...
- 165
1
vote
0
answers
30
views
Retrieve functionality to button - game patching
I'm patching an old game, and I want the retrieve the toggle fullscreen functionality it's supposed to have.
In the menu, in the display tab, there is a disabled option of fullscreen mode that you can ...
- 21
0
votes
2
answers
95
views
How does IDA know the symbol names for classes and interfaces?
I am reversing a 32 bit library used by a Linux game (I am sure someone might recognize the engine used). I was messing around with cutter and when trying to compare it to IDA, which I have used in ...
- 103
0
votes
0
answers
33
views
How can I make a quick tracer for a PE file?
INTRODUCTION:
I made my tracer on the event debug loop, but after I compared its speed characteristics with the same PinTool or similar tools, I realized that my tracer is several dozen times slower ...
- 11
2
votes
1
answer
215
views
IDA: Demangled name simplification in idapython
With idapython I would like to get demangled names with the name simplification (bottom of page) applied to them.
For example, the following function:
Python> ida_name.demangle_name(idc....
- 123
1
vote
1
answer
95
views
How can i remove dead code and opaque predicates?
I have the following problem on my agenda: There is an obfuscated .exe (this is a virus that I am investigating) in addition to having an MBA, etc. bullshit, he has Opaque predicates and dead code, I ...
- 11
3
votes
0
answers
48
views
How can I create an `__m128i` datatype with Frida?
I'm working on reversing a c++ binary and it has a function that I want to call with Frida.
Here's the function signature from IDA: const __m128i *__fastcall sub_0123(__m128i * a1);
It doesn't seem ...
- 131
3
votes
0
answers
142
views
IDA ATL C++ class reconstruction
I'm currently using IDA Pro to analyze a dll, but IDA Pro doesn't analyze ATL standard classes properly, including CString, so I'm trying to reconstruct the classes manually, but I'm having some ...
- 71
3
votes
1
answer
598
views
How to bypass anti debugger? IDA Pro
Im new to reverse engineering and doing a crackme that requires me to make a keygen, yes i know making a keygen isn't a beginner task however im stuborn, i am trying to debug the program to understand ...
- 31
4
votes
1
answer
624
views
How to add STL to Local Types in Ida Pro?
How to add STL to Local Types in Ida Pro?
I can import debug information from a pdb file along with STL types, but I can't manually add STL types to Local Types.
Also I can't import STL when I click &...
user42316
4
votes
1
answer
2k
views
Reverse engineering a flutter built apk
I was trying to reverse engineer an apk built with flutter. I actually feel like reversing flutter built apps did not get much reverse writeups on the community. one of the tools for the task ...
- 299
1
vote
1
answer
105
views
What is the output for this and how?
*(_BYTE *)(Key + Integer_count - 1) + 79
Here : Key = 0x22EC278 (dw 'Âx')
or
Stack[000015B8]:0019FC2C db 78h ; x
Stack[000015B8]:0019FC2D db 0C2h ; Â
Stack[000015B8]:0019FC2E db 2Eh ; .
Stack[...
- 31
2
votes
1
answer
127
views
Reversing C++ Classes in ARM
I have unstripped linux arm binary,
The code calls functions in class object reference like so:
LDR R3, [R6]
MOV R1, R7
MOV R0, R6
LDR R3, [R3,#0xC] ; (...
- 21
2
votes
0
answers
113
views
I trying rewrite asm to c++ [closed]
This code generates an API key. I use it in an android app as .so file,
but I need to rewrite it to java from c++. How do I translate?
push rbp
push r15
push r14
push r13
push r12
push ...
- 21
3
votes
0
answers
76
views
purpose for using a == &a
I'm debugging dns.exe in Windows10 1809 and I'm really confused about one condition that often appeared in this file
WPP_GLOBAL_Control == &WPP_GLOBAL_Control
Actually, I have seen this kind of ...
- 313
3
votes
1
answer
81
views
How does this Is64BitOS pointer-arithmetic-based function work?
Reversed this function. It works. But stepping through I can't figure out how. Why does this work?
bool _Is64BitOS(void) {
unsigned int version = *(unsigned int*)0x7FFE026C;
unsigned int ...
- 155
4
votes
0
answers
177
views
How to correctly inject a [jump + address] instruction into another process (code injection)?
I am trying to inject a jump instruction into another process (External injection), although the injection operation has been completed the address was not correct.
For example:
unsigned int addr = ...
- 269
5
votes
0
answers
198
views
Cannot find references to functions in vtables
First time doing RE work and I am working on a rather large C++ binary.
In Ghidra, there are many functions that do not appear to have any meaningful references to them (unlike some functions where ...
- 151
2
votes
2
answers
1k
views
turning decompiled C++ code into writable C++
Here's my scenario I currently have a DLL that was made in like 2003 archived that has data and functions I still need to use and I'm also 90% sure the DLL doesn't work correctly as its too outdated. (...
- 21
2
votes
0
answers
99
views
statically placing hooks on PE file's IAT
recently I started writing my own PE library for C++, and wanted to implement static IAT/EAT hooking, (basically hooking by patching the file instead of hooking at runtime), I managed to successfully ...
- 21
1
vote
0
answers
185
views
How to find the the event handler function for a QtAbstractButton?
I am not very familiar with Qt to begin with but basic PyQt tutorial showed that a button object is linked with its handler using the connect method that takes in as its argument the function that ...
- 119
1
vote
2
answers
448
views
How do I get the start address of the 'code section' and its size to know the end address?
I am trying to read the binary code in the text section of an executable game file (PE) programmatically but I don't know the start address and the end address of the text section.
I am using C++/...
- 269
1
vote
1
answer
112
views
I have gotten three different entry points which one is the correct one?
I am trying to get the entry point of an executable game file.
I have used 3 ways, 2 programs, and 1 c++ code.
C++ Code:
HMODULE GetModuleHandle(CONST CHAR* ModuleName, DWORD ProcessId) {
HMODULE ...
- 269
3
votes
0
answers
282
views
How would I crack a software that has Xor encryption
So, before you shout at me to go on google I would just like to say I am new to reverse Engineering. Like I have been doing it for a hour. So, I was doing a bunch of crackmes.one using the search all ...
- 31
2
votes
0
answers
52
views
Reversing internal function, can't call it with injected DLL
I'm currently learning RE. I've chosen to do so by trying to RE Skyrim for PC. I'm trying to call the ingame function for printing to the console, I'm doing this via an Injected DLL.
The function call ...
- 21
1
vote
0
answers
139
views
problem with hooking __usercall function and asm code
I need a hook function with the __usercall convention.
I already hooked functions that were defined as __usercall and __userpurge, but this time it's __usercall with arguments that are also passed ...
- 11
3
votes
1
answer
1k
views
How do I reverse an exe packed with an unknown packer?
I got an assignment to analize an exe file with 97% entropy. It's obviously packed but I got no results from Protection Id or PEid about which packer it used...
How can I unpack it if it's possible? ...
- 33
1
vote
1
answer
398
views
Can I get a valid source code from this assembly?
I've used the IDA 8.0 Demo to retrieve (from a .DLL) the assembly code, such as:
; code
pxor xmm0, xmm0
ucomiss xmm0, xmm1
ja short loc_67F31600
movss xmm2, cs:...
- 113
4
votes
0
answers
1k
views
IDA Free vs IDA Home (to have Lumina)
I use actually IDA Free and I want to know what do you think of IDA Home (particulary for the Lumina function).
I don't found in Google a tool to know for exemple the functions recognized by the ...
1
vote
1
answer
95
views
Turning very complicated arithmetic and reverse engineered check into useable code in C#
so I have this problem of me not understanding how to convert this one function into useable code in C#. Problem being that I am currently hooking into a game via C# and I want to rebuild a function ...
1
vote
0
answers
58
views
Is there any available source code which is Windows 64 bit compatible that can disassemble binary code?
I'm writing a program that takes as input a single byte of binary (machine code from code segment) and converts it into assembly. I've done some searching online but have yet to find anything helpful. ...
- 11
1
vote
0
answers
345
views
How can I hook structure members in frida
I have a code like this:
class CURLNetRequest : public CNetRequestBase
{
DEFINE_LOGCLASS;
struct ProxySettings
{
void initFromConfig();
String host;
...
- 299
1
vote
0
answers
78
views
Problem to hook a parameter with _thiscall function
I have hooked correctly many games using detours without problems but now I have a problem with this __thiscall function:
.text:00488DA0 ; =============== S U B R O U T I N E ==========================...
- 279
0
votes
1
answer
220
views
How to speed up finding a function from pseudocode in IDA?
I have a function with the pseudocode of
__int64 __fastcall sub_7FF7067A01F0(__int64 a1, __int64 a2, unsigned int a3)
{
if ( qword_7FF709F91498 )
return (*(__int64 (__fastcall **)(ID2D1Geometry *...
- 39
4
votes
2
answers
496
views
How to reverse a game and inject a dll in client program?
I am trying to make a bot for a game. But when I open the game in debugger like Ollydbg or in x64dbg the game simply closes and also it doesn't appears in the Attach to the process list in File menu ...
- 41
1
vote
0
answers
125
views
How to debug C++ module/function call used in .net application?
I'm currently debugging a .net application by using dnSpy. There is a function where I have call like this
<Module>.X.Y.Z.Initialize(ptr, ptr2, flag);
The function belongs to a DLL and ...
1
vote
0
answers
91
views
SetPixel seem not work on some external window
I have succefully hooked a game and I need to do read and write with GetPixel and SetPixel to the game window.
To do a test I have created this code:
Here my hooked function:
My_hooked_function(int a3)...
- 279
1
vote
0
answers
90
views
Capstone Disassembler to Extract OpCode from Malware and Benign Executables in C++
The project that I am trying to develop has as a vital component, specifically a machine learning based malware detection system. The way in which I decided to teach the detection system in order to ...
- 31
1
vote
0
answers
582
views
Getting helpful information on classes in Ghidra?
I'm an intern at an engineering firm that's being contracted to decompile some ELF32 files on an ARM device compiled with GCC. Currently, we're using Ghidra, but no one at the firm (including me) ...
- 11
1
vote
0
answers
91
views
What change to the source code would produce an LT compare rather than an OLT compare in MIPS assembly?
I need some help reverse engineering a function in MIPS assembly. It was compiled for the PlayStation 2's EmotionEngine CPU. My goal is to produce a matching decomp of the function; it is the proof-of-...
- 11