Questions tagged [c++]

C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language.

60 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
7
votes
0answers
813 views

Red Alert 2 Windows 8 DirectDraw compatibility

The game Red Alert 2 runs on Windows 8, but as soon as I inject a DLL (via ddraw.dll or an extra DLL) it stops drawing buttons on the main menu. With the DLL it still work fine in windowed mode and it ...
6
votes
0answers
606 views

Reliable way to recognize STL template classes?

Since the template classes are different between instantiation, it is extremely difficult for library recognition using universal patterns. But the control flow graph and references to system call of ...
5
votes
0answers
738 views

Python library for linux to demangle MSVC decorated names

I am looking for a python library for linux which can demangle the function names which are mangled by MSVC. for example : Project!??0?$allocator@D@std@@QAE@XZ to Project!public: __thiscall ...
3
votes
0answers
28 views

How can I tell whether or not a given library method is being referenced by a consumer program statically in OOP languages?

Preface: This question is about source code reverse engineering and static analysis. Meaning, there is no built code available but I have access to the source code of the program. Imagine I'm looking ...
3
votes
0answers
309 views

Reverse engineering android native packer

im trying to Reverse engineering an android app and the app have 4 folders in the /data/data/{package} folder ├───app_dexprotector │ 823517D25836B88F1C499C02370A047E.dat │ ...
3
votes
0answers
200 views

Find vtable without complete object locator

I am learning to reverse Visual C++ objects. I usually find the vtable (or VMT of VFT, however you call it) of the object using a cross reference to its CompleteObjectLocator that I found in the ...
3
votes
0answers
847 views

STL map and map entry structures for IDA/HexRays

I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long ...
2
votes
0answers
249 views

IDA Hex-Rays structure inline functions recognition

I've seen multiple posts about the subject, but mine is a little bit more specific about what I want to achieve. I have many times situations where Hex-Rays decompiler outputs 16 lines of code and I ...
2
votes
1answer
269 views

PE32+ executable : .text segment encryption

I am working on PE segment encryption(in C++). I completed the PE32 .text segment encryption. I added stub segment to the PE that will decrypt .text segment at runtime. Used inline assembly in the ...
2
votes
3answers
176 views

Injecting C++ code, while also maximizing compatibility with other injections

Using the New Vegas Script Extender C++ API for Fallout New Vegas, I am able to write to the process' memory directly at runtime through a .dll plugin that's loaded by the NVSE injector. But it is not ...
2
votes
0answers
106 views

How to return a list of vtable methods?

I'm relatively new to scripting environments in disassemblers. What I am looking for is a way to dump all of the vtable methods from a C++ disassembly in such a way that I can access them later for ...
2
votes
0answers
525 views

Dump c++ class definitions from .exe + .pdb on windows

Is there any way to dump C++ class definitions on windows if executable and PDB files are available. I've seen this done before using gdb but haven't had any luck doing this on windows. I've tried ...
2
votes
0answers
230 views

Calling original function that uses unconventional calling convention

I'm using MinHook to hook a static function with the following signature: float __usercall RadarManager::Add_Blip@<xmm0>(int position@<ecx>, int shape@<edx>, int colorId, float ...
2
votes
0answers
103 views

Patching a variable's type in an executable file

Let's say i have a program.In this program i have a variable named PacketSize of type Short.I want to change the variable's type to Int. Now if i am able to locate this variable's location in the ...
2
votes
0answers
341 views

Looking to RE a Ducky Shine 5

I know how to program in C++/C# and a few other low level languages. I'm however in the dark about reverse engineering firmware etc. I was wondering if anyone could point me towards some learning ...
2
votes
0answers
321 views

Is it possible to get address of function that implement virtual

I have address of virtual function in export table , is it possible to get implementation function address, that makes whole logic of virtual ? Code sample: this is virtual function that goes to ...
2
votes
0answers
242 views

How to include these exception handle symbols in x86 assembly code?

The test is on 32bit x86 Linux, with g++ 4.6.3. So basically I use a IDA pro script to recover the .gcc_excpt_table and .eh_frame sections from binary compiled from C++ language. Basically I want to ...
1
vote
0answers
39 views

Alternative to MS Detours (32 bit)

I have used MS Detours for one project in c++ and work perfectly. I have created a clone of this application (95% of the some code) to hook another file (a GOG game with DRM free), but this time crash ...
1
vote
0answers
54 views

Reverse engineering old mmo

I am newish to reverse engineering and have a question about a problem with IDA Pro. I am trying to reverse engineer an old mmo game. Anyone know why dword_ calls show as "dd ?"? Float numbers and ...
1
vote
1answer
47 views

What is the mdisp field in RTTI for throw used for?

First of here is the article from which I'm looking up the fields. I was trying out different combinations to see how they affect the RTTI for a C++ throw. It seems that having a virtual base class ...
1
vote
0answers
27 views

Go back to the original entry point after executing the instructions in the newly added segment- PE32+, C++

I am learning PE32+ (64 bit) files. I have added a new section to the PE32+ file and made the new section as the entry point. Some simple instructions are added in the new segment. Now I want to go to ...
1
vote
0answers
74 views

Dump the value of register into file

I've reverse engineering little game on windows 32bit. I found a string in executable which was interesting for me (it is a board game and this string represents the fact that somebody made a move ...
1
vote
0answers
179 views

Ghidra - Export namespaces

I am currently learning to use ghidra, and I found the Symbol Tree. Ghidra found some namespaces that I would like to export. These namespaces don't even have to be readable, just reusable, such that ...
1
vote
0answers
581 views

Finding function call (with arguments) in ELF file

I have two kinds of ELF files, built from C++. .so files: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, BuildID[sha1]=5e751e769912aef28bc63b888e5e4904b867a180, ...
1
vote
0answers
208 views

Finding lua C functions compiled binary

So i am trying to "hack" a game however not for cheating purposes. I am looking to extend the games scripting functionality through a DLL that can look for processes and return them. The game I am ...
1
vote
0answers
345 views

IDA 7 handling strings in debugger pseudocode

When running a remote debugger to a linux server, is there a way to get IDA (7.0) to properly handle strings? When I go to the pseudocode view, I get things like this; v7 = sub_804AD60((std::string *)...
1
vote
0answers
321 views

Trying to identify block of code which generates 256 bit key

I'm reversing a C++ program using IDA PRO to examine how the some data is stored, encrypted and decrypted. I've managed to identify the data is encrypted with AES CBC 16 block and 256 bit key. I have ...
1
vote
0answers
244 views

Compression algorithm working with bitstream

I'm trying to reverse decompression algorithm for one of old games. After some reversing I found that it reads bit stream, not byte by byte. It looks like this: std::vector<uint32_t> TABLE_1 = {...
1
vote
0answers
114 views

IDA sdk delete user struct member prevent creating gap

I have a problem using IDA SDK function del_struc_member(struc_t *sptr, ea_t offset) , If i use it on a member, it creates a gap[4] on the offset ( for dword type), it doesn't recalc the struct and ...
1
vote
0answers
172 views

Is it possible to correctly disassemble STL inlines?

Is it possible to correctly disassemble STL inlines with IDA? STL inlines are not detected by FLAIR just because they are inline not functions. For example how can I know that the code I see ...
1
vote
0answers
132 views

Call again function with new parameters

I developing online game. I have full sources for server, but game client I am using is closed-source so I need to do some reverse engineering there. So for 2 weeks I am trying to properly call ...
1
vote
0answers
290 views

Extracting information from a windows executable

I've been given the task of writing a functional clone for an executable since we don't have the source code. None of the .NET tools at my disposable recognise it and loading the thing into a text ...
1
vote
0answers
445 views

Static binary instrumentation tools for android .so libraries?

I'm trying to statically inject code into an android app. The best way would be to use APKStudio and the like, but there are very harsh restrictions on the device and the app itself, so that apk ...
1
vote
0answers
391 views

Calling Lua by C/C++ in compiled applications

So, currently I've been reverse engineering an application, that allows Lua coding. Because for some special purposes, I need to call Lua directly by C/C++ coding. However, as this application is ...
1
vote
1answer
608 views

Problem to understand execution of payload (shellcode)

I know that there are lot of (good) tutorials regarding this topic, but after reading them, I really cant follow their thoughts (e.g.: Smashing The Stack For Fun And Profit): The problem is that we ...
0
votes
0answers
57 views

Easy way to attach a DLL to a Game

I like to attach a dll to a game to add more features. The DLL is 95% done, the problem is find the best and easy way to load this dll from the Game. My idea is use this technique: dinput_ori.dll (...
0
votes
0answers
41 views

Question about basic hooking concept

I have created a c++ complete project to hook GOG game and work perfectly (this add a unofficial Force Feedback support). To to it I have found on github a custom version of d3d9.dll with with DllMain ...
0
votes
0answers
27 views

understand how call __usercall function

I have disassable with ida this function: int __usercall sub_4F314A@<eax>(char *Src@<ecx>, int a2@<edx>, int a3, int a4, int a5, int a6) I attach the original assembly: can you ...
0
votes
0answers
51 views

How to reverse engineer structs

I am new to reverse engineering, really new, I am able to reverse engineer vtables and getting function indices for each of them (with the help of the original SDK of the software that I work with), ...
0
votes
0answers
22 views

Watching a TLS Slot value in x64dbg

I am new to reverse engineering and I was trying to debug why a 3rd party application was crashing when I m injecting my DLL in it. (There are some cases where it didn't crash) So I was able to figure ...
0
votes
0answers
28 views

Doubts about a pointer in a DLL

I am working with the dll of a software in which I am not with access at the moment, analyzing the source code in static analysis tools, I realized that it receives a pointer as one of the parameters, ...
0
votes
0answers
79 views

C166/C167 code analyzing

Recently I try to reverse piece of assembly code that written for C166/C167 Arch. But I have a problem with some places for convert to C code, such as: loc_1892: mov r9, #4 add r9, r0 mov ...
0
votes
0answers
36 views

Crash after hook a function

I have hooked a sound function that work within the game menu after, when the battle start, the game will crash. The function at the first parameter get correctly the sound file name, before the ...
0
votes
0answers
30 views

Data XREF in IDAPro (C166/167 Arch)

try to reverse some algo in c167 arch. in a part of the file i saw a variable that located in XRAM mov to accumulator registers and finally xor with other registers. as below: mov r1, word_E1C4 ...
0
votes
0answers
44 views

Change value of memory in a debugger?

So I got this app loaded in x64, there is a function, let's say "HeatGainedPerShot", which is basically the value which an object gains everytime it fires, Such a value would normally exist ...
0
votes
0answers
59 views

DLL injection (Failed to inject)

I have found this complete and easy example to test the function hook: https://github.com/Zer0Mem0ry/Detour #include <Windows.h> #include <iostream> #include "detours.h" #...
0
votes
0answers
29 views

IDA SDK Assemble instruction

What's the method of assembling instructions in IDA SDK c language? Is that possible by passing insn_t* or str like option available in IDA [Edit->Patch program->Assemble]
0
votes
0answers
28 views

Some more questions related to C++ exceptions (catchHigh)

I've came up with the most convoluted example but still can't find the purpose of the catchHigh field. I find it that the right handler can be selected simply by looking at the tryblock map from start ...
0
votes
1answer
158 views

c++ reading process memory with injected DLL

The reading works fine until it reaches base+27.058.176(bytes) address. At this address VirtualProtect() failes with error 487 (Attempt to access invalid address). Why does it return this error? Btw ...
0
votes
0answers
62 views

Detouring function cause exception access violation

i am learning to detouring functions, but i run into one that i cannot be resolved. I use the Detour lib from microsoft, and a custom method. Both cause the same problem, the function is hooked and ...