Questions tagged [c++]
C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language.
93
questions with no upvoted or accepted answers
6
votes
0
answers
843
views
Reliable way to recognize STL template classes?
Since the template classes are different between instantiation, it is extremely difficult for library recognition using universal patterns.
But the control flow graph and references to system call of ...
- 428
5
votes
0
answers
198
views
Cannot find references to functions in vtables
First time doing RE work and I am working on a rather large C++ binary.
In Ghidra, there are many functions that do not appear to have any meaningful references to them (unlike some functions where ...
- 151
5
votes
0
answers
923
views
Python library for linux to demangle MSVC decorated names
I am looking for a python library for linux which can demangle the function names which are mangled by MSVC.
for example :
Project!??0?$allocator@D@std@@QAE@XZ
to
Project!public: __thiscall
...
- 265
4
votes
1
answer
2k
views
Reverse engineering a flutter built apk
I was trying to reverse engineer an apk built with flutter. I actually feel like reversing flutter built apps did not get much reverse writeups on the community. one of the tools for the task ...
- 299
4
votes
0
answers
177
views
How to correctly inject a [jump + address] instruction into another process (code injection)?
I am trying to inject a jump instruction into another process (External injection), although the injection operation has been completed the address was not correct.
For example:
unsigned int addr = ...
- 269
4
votes
0
answers
1k
views
IDA Free vs IDA Home (to have Lumina)
I use actually IDA Free and I want to know what do you think of IDA Home (particulary for the Lumina function).
I don't found in Google a tool to know for exemple the functions recognized by the ...
3
votes
0
answers
48
views
How can I create an `__m128i` datatype with Frida?
I'm working on reversing a c++ binary and it has a function that I want to call with Frida.
Here's the function signature from IDA: const __m128i *__fastcall sub_0123(__m128i * a1);
It doesn't seem ...
- 131
3
votes
0
answers
142
views
IDA ATL C++ class reconstruction
I'm currently using IDA Pro to analyze a dll, but IDA Pro doesn't analyze ATL standard classes properly, including CString, so I'm trying to reconstruct the classes manually, but I'm having some ...
- 71
3
votes
0
answers
76
views
purpose for using a == &a
I'm debugging dns.exe in Windows10 1809 and I'm really confused about one condition that often appeared in this file
WPP_GLOBAL_Control == &WPP_GLOBAL_Control
Actually, I have seen this kind of ...
- 313
3
votes
0
answers
282
views
How would I crack a software that has Xor encryption
So, before you shout at me to go on google I would just like to say I am new to reverse Engineering. Like I have been doing it for a hour. So, I was doing a bunch of crackmes.one using the search all ...
- 31
3
votes
0
answers
792
views
IDA Hex-Rays structure inline functions recognition
I've seen multiple posts about the subject, but mine is a little bit more specific about what I want to achieve.
I have many times situations where Hex-Rays decompiler outputs 16 lines of code and I ...
3
votes
0
answers
532
views
Find vtable without complete object locator
I am learning to reverse Visual C++ objects.
I usually find the vtable (or VMT of VFT, however you call it) of the object using a cross reference to its CompleteObjectLocator that I found in the ...
- 131
3
votes
0
answers
2k
views
STL map and map entry structures for IDA/HexRays
I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long ...
- 131
2
votes
0
answers
99
views
statically placing hooks on PE file's IAT
recently I started writing my own PE library for C++, and wanted to implement static IAT/EAT hooking, (basically hooking by patching the file instead of hooking at runtime), I managed to successfully ...
- 21
2
votes
0
answers
52
views
Reversing internal function, can't call it with injected DLL
I'm currently learning RE. I've chosen to do so by trying to RE Skyrim for PC. I'm trying to call the ingame function for printing to the console, I'm doing this via an Injected DLL.
The function call ...
- 21
2
votes
0
answers
507
views
Passing a String into a Function With GDB
So, I have a function with the prototype according to GDB:
{std::string (std::string)} 0x56027729e545
<function(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator&...
- 21
2
votes
1
answer
721
views
Can't find references (xref) to function
I am reversing a function and when I trying to see its references, it doesn't show me the calls to the function. It only show the place of the object in RVA.
Is there a plug-in or something that I ...
- 573
2
votes
0
answers
37
views
How can I tell whether or not a given library method is being referenced by a consumer program statically in OOP languages?
Preface: This question is about source code reverse engineering and static analysis. Meaning, there is no built code available but I have access to the source code of the program.
Imagine I'm looking ...
- 1,830
2
votes
0
answers
484
views
Ghidra - Export namespaces
I am currently learning to use ghidra, and I found the Symbol Tree.
Ghidra found some namespaces that I would like to export.
These namespaces don't even have to be readable, just reusable, such that ...
- 21
2
votes
0
answers
278
views
How to return a list of vtable methods?
I'm relatively new to scripting environments in disassemblers. What I am looking for is a way to dump all of the vtable methods from a C++ disassembly in such a way that I can access them later for ...
- 1,236
2
votes
0
answers
955
views
Dump c++ class definitions from .exe + .pdb on windows
Is there any way to dump C++ class definitions on windows if executable and PDB files are available. I've seen this done before using gdb but haven't had any luck doing this on windows. I've tried ...
- 21
2
votes
0
answers
448
views
Calling original function that uses unconventional calling convention
I'm using MinHook to hook a static function with the following signature:
float __usercall RadarManager::Add_Blip@<xmm0>(int position@<ecx>, int shape@<edx>, int colorId, float ...
- 133
2
votes
0
answers
115
views
Patching a variable's type in an executable file
Let's say i have a program.In this program i have a variable named PacketSize of type Short.I want to change the variable's type to Int.
Now if i am able to locate this variable's location in the ...
- 29
2
votes
0
answers
349
views
Looking to RE a Ducky Shine 5
I know how to program in C++/C# and a few other low level languages. I'm however in the dark about reverse engineering firmware etc. I was wondering if anyone could point me towards some learning ...
- 21
2
votes
0
answers
367
views
Is it possible to get address of function that implement virtual
I have address of virtual function in export table , is it possible to get implementation function address, that makes whole logic of virtual ?
Code sample:
this is virtual function that goes to ...
- 272
2
votes
0
answers
271
views
How to include these exception handle symbols in x86 assembly code?
The test is on 32bit x86 Linux, with g++ 4.6.3.
So basically I use a IDA pro script to recover the .gcc_excpt_table and .eh_frame sections from binary compiled from C++ language.
Basically I want to ...
- 2,475
2
votes
1
answer
527
views
Why module address is different in Cheat Engine than in x32dbg?
Why the module address is different in Cheat Engine than in x32dbg?
I'm trying to read this:
My c++ attempt:
#include "pch.h"
#include "Functions.h"
#include "offsets.h"...
1
vote
0
answers
30
views
Retrieve functionality to button - game patching
I'm patching an old game, and I want the retrieve the toggle fullscreen functionality it's supposed to have.
In the menu, in the display tab, there is a disabled option of fullscreen mode that you can ...
- 21
1
vote
0
answers
185
views
How to find the the event handler function for a QtAbstractButton?
I am not very familiar with Qt to begin with but basic PyQt tutorial showed that a button object is linked with its handler using the connect method that takes in as its argument the function that ...
- 119
1
vote
0
answers
139
views
problem with hooking __usercall function and asm code
I need a hook function with the __usercall convention.
I already hooked functions that were defined as __usercall and __userpurge, but this time it's __usercall with arguments that are also passed ...
- 11
1
vote
0
answers
58
views
Is there any available source code which is Windows 64 bit compatible that can disassemble binary code?
I'm writing a program that takes as input a single byte of binary (machine code from code segment) and converts it into assembly. I've done some searching online but have yet to find anything helpful. ...
- 11
1
vote
0
answers
345
views
How can I hook structure members in frida
I have a code like this:
class CURLNetRequest : public CNetRequestBase
{
DEFINE_LOGCLASS;
struct ProxySettings
{
void initFromConfig();
String host;
...
- 299
1
vote
0
answers
78
views
Problem to hook a parameter with _thiscall function
I have hooked correctly many games using detours without problems but now I have a problem with this __thiscall function:
.text:00488DA0 ; =============== S U B R O U T I N E ==========================...
- 279
1
vote
0
answers
125
views
How to debug C++ module/function call used in .net application?
I'm currently debugging a .net application by using dnSpy. There is a function where I have call like this
<Module>.X.Y.Z.Initialize(ptr, ptr2, flag);
The function belongs to a DLL and ...
1
vote
0
answers
91
views
SetPixel seem not work on some external window
I have succefully hooked a game and I need to do read and write with GetPixel and SetPixel to the game window.
To do a test I have created this code:
Here my hooked function:
My_hooked_function(int a3)...
- 279
1
vote
0
answers
90
views
Capstone Disassembler to Extract OpCode from Malware and Benign Executables in C++
The project that I am trying to develop has as a vital component, specifically a machine learning based malware detection system. The way in which I decided to teach the detection system in order to ...
- 31
1
vote
0
answers
582
views
Getting helpful information on classes in Ghidra?
I'm an intern at an engineering firm that's being contracted to decompile some ELF32 files on an ARM device compiled with GCC. Currently, we're using Ghidra, but no one at the firm (including me) ...
- 11
1
vote
0
answers
91
views
What change to the source code would produce an LT compare rather than an OLT compare in MIPS assembly?
I need some help reverse engineering a function in MIPS assembly. It was compiled for the PlayStation 2's EmotionEngine CPU. My goal is to produce a matching decomp of the function; it is the proof-of-...
- 11
1
vote
0
answers
96
views
Disassemble Executable Automatically in C++
I have 2 types of files, namely benign and malware. I would like to build a malware detection system based on the assembly language used by these files, by using machine learning. The language that I ...
- 31
1
vote
0
answers
52
views
Scraping data from an audio analyzer application
Briefly:
I have an app that analyzes audio files and classifies them into 4 or 5 categories, how would one go about scraping the category each audio file belongs to? What is a good place to start?
...
1
vote
0
answers
40
views
Make avaible x64 C++ exceptions on manually mapped module
I am trying to bind Lua on manually mapped module. As you can see clearly on here.
They are using C++ or C exceptions on their API and there is no way to avoid them.
I wonder to know if there are ...
- 11
1
vote
0
answers
69
views
What is the correct argument for the disassembled function / constructor?
I have the following code disassembled by Ghidra. It first initialises the local variable of the particular type (local_68) and then passes it to the constructor. The variable seems to be initialised ...
- 326
1
vote
0
answers
93
views
How to create an algorithm in C...(or C# or C++, basically in "a programming language")
After a LOT of sending challenges and recording the responses I've 'broken' the "encryption" in my car's immobiliser...the reason for doing it is so I can use the engine and transmission in ...
- 11
1
vote
0
answers
53
views
Unrecognized function
There is function:
push 65h
push edi
call sub_5D8750
In this case, function takes 65 bytes to be filled with zeros, and edi is memory address starting from which to fill these 65 bytes with ...
- 331
1
vote
0
answers
48
views
How to replace a segment with a single structure consisting of the data in that segment - programmatically?
So I have something like this (I copied this from my other plugin functionality which simply creates a copy paste structure from the frame containing stack variables, while deleting them and then ...
- 455
1
vote
0
answers
1k
views
Tracing all (or most of) function calls in a specific Android app
I'm having a problem, where I'm trying to trace some function calls in an Android app, that uses JNI for about all of its work. More specifically, a function call, in JNI, that makes (IIRC Android ...
- 143
1
vote
1
answer
201
views
Function pointer reference
I need to hook 10/20 functions like these:
static void* __cdecl HookFunction1(char *FileName, int a2, int a3, int a4);
__declspec(naked) void HookFunction2(char *Src, int pedx, int
a3, ...
- 279
1
vote
0
answers
156
views
Easy way to attach a DLL to a Game
I like to attach a dll to a game to add more features.
The DLL is 95% done, the problem is find the best and easy way to load this dll from the Game.
My idea is use this technique:
dinput_ori.dll (...
- 279
1
vote
0
answers
137
views
Alternative to MS Detours (32 bit)
I have used MS Detours for one project in c++ and work perfectly.
I have created a clone of this application (95% of the some code) to hook another file (a GOG game with DRM free), but this time crash ...
- 279
1
vote
0
answers
592
views
C166/C167 code analyzing
Recently I try to reverse piece of assembly code that written for C166/C167 Arch.
But I have a problem with some places for convert to C code, such as:
loc_1892:
mov r9, #4
add r9, r0
mov ...
- 147