Questions tagged [c++]

C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language.

Filter by
Sorted by
Tagged with
2
votes
2answers
385 views

What compiler uses a calling convention that uses EAX as the first argument, then pushes onto the stack?

I recently asked to question: How can an IA-32 program seemingly compiled with MSVC send its sole argument via EAX? After posting the question, I found that another function passed the first argument ...
1
vote
1answer
116 views

How can an IA-32 program seemingly compiled with MSVC send its sole argument via EAX? [duplicate]

A C++ program I'm looking at appears to have been compiled with MSVC. It links to MSVCR100.dll, contains MSVC's security cookie code and uses the Microsoft mangling scheme. However, one of the ...
1
vote
0answers
134 views

Call again function with new parameters

I developing online game. I have full sources for server, but game client I am using is closed-source so I need to do some reverse engineering there. So for 2 weeks I am trying to properly call ...
0
votes
1answer
720 views

Calling internal functions via dll injection - runtime error

I am trying to modify closed source game client that works with my game server. The purpose of that is being able to add new graphical elements into the client. I have read a lot of tutorials about ...
2
votes
0answers
258 views

Calling original function that uses unconventional calling convention

I'm using MinHook to hook a static function with the following signature: float __usercall RadarManager::Add_Blip@<xmm0>(int position@<ecx>, int shape@<edx>, int colorId, float ...
3
votes
2answers
223 views

ARMCC/C++ Empty Vtable entries

I am reversing an application for the 3ds which are compiled with ARMCC. I found the vtables of the key classes and have a problem figuring out how the C++ representation of these was. Vtable of ...
1
vote
2answers
4k views

Getting the correct memory address for a specific value

I was watching this series of videos and I noticed that his memory addresses were not changing every time he restarted the game and/or olly. In addition, his comments seemed to stick around and he was ...
3
votes
0answers
972 views

STL map and map entry structures for IDA/HexRays

I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long ...
3
votes
1answer
261 views

IDA pro 6.9, what does “lambda” in type notation mean in C++ reversed code

I was looking into a C++ program compiled for aarch64 with ida pro 6.9 and came across something really weird: somescope::SomeClass<false>::some_name<somescope::SomeClass<false>::...
0
votes
1answer
126 views

IDA: Two calls of a same function

I was reversing some executable and came across to this code: As I found out later, it's using function pointer to call function sub_4011C0 and that could be the reason. My question is why does ...
0
votes
2answers
959 views

Calling a function of a game inside a function hook

How can you call a game function inside a function hook? For example, I hooked the recv function of winsock. Then, I examined a packet. This packet has the value of my current hp. I check the hp. If ...
0
votes
3answers
1k views

In Memory DLL Injection

I am currently working on learning how different types of DLL injection can be performed. Right now I am able to run a function by: Opening the remote process; Allocating memory in remote process; ...
1
vote
1answer
210 views

Finding variable reference in cpp

Let's bring example We have string 0000000000bd2906 db "CurrentKey", 0 ; DATA XREF=sub_555670+3390 And it's used here 00000000005563ae lea rsi, qword [0xbd2906] ; "CurrentKey" Disassembler ...
2
votes
0answers
212 views

Unable to use C++ to read memory image file [closed]

I'm using winpmem to create a memory image. I would like to create an interface that would allow a user to search for various patterns in the image. I'm using C++ to open and read the file but I am ...
1
vote
2answers
282 views

How to monitor specific variables in a running process?

I would like to monitor, record, specific variables in an application but I am not sure what is the right way to approach this problem. The application is a mix of C(5%) and C++(95%) and it is ...
0
votes
1answer
1k views

C++ Anti Kernel Debugger?

What are some things I can do to do anti kernel debugging from user-mode C++? I already use ZwQuerySystemInformation to query for SystemKernelDebuggerInformation.
0
votes
2answers
117 views

Function Address Changes When Gets Referenced elsewhere

i have been trying to get the address of a function and use that hex number for other calculations. I have read that you cannot get the address of a function like you get the address of a variable in ...
8
votes
2answers
1k views

Is there a name for this kind of “obfuscation” for the machine code from C++?

I was trying to reverse engineer an android ndk (arm) using ida pro on a static analysis. However, it appears there are a lot of useless jumps to the same place and with random values set to R1 to ...
1
vote
1answer
508 views

Trying to call DLL's functions from my exe

I am new here and I have a question for you guys (C++) I will try to describe my situation with some details so that you can understand this better. This might be long(er) but it might be necessary ...
3
votes
1answer
3k views

How to print all functions of a binary using radare2 c/c++ API

I need to write a program (in c++), that among other things needs to know all functions of a given PE file. Basically, It's an equivalent of opening a binary with "r2 -A binary_name" and then entering ...
1
vote
1answer
182 views

“Proper” way to recreate undocumented structs / classes given memory layout in C++?

Firstly I acknowledge that this is very borderline opinionated, but I'd like to emphasize this is more a thing of possibilities given some shortcomings of the default just writing down the offsets of ...
0
votes
1answer
456 views

How does look “this” variable in C++ at the assembly level?

How to properly define these so many this variables in C++ programs. Is it a structure or something else at the assembly level? For example, this function seems to allocate heap memory. int ...
2
votes
2answers
1k views

Identifying structures in C++

I have a large c++ program and I have found a pointer to an object of interest. I want to be able to identidy that object by atleast the constructor. What are some methods I can use to identify the ...
0
votes
1answer
529 views

how do I define an address with a module and an offset in c++

I'm trying to define an address so that I can edit its memory later, however I can't figure out a way to access it. The base address is "program.exe"+00D23440 and has an offset of +30 Normally you ...
-1
votes
1answer
884 views

Aside from Assembly, should I learn C or C++?

With Malware/Virus analysis being heavily dependant on one's ability to read the the Assembly Code generated by the Disassembler... being familiar with the Assembly Language is naturally the most ...
2
votes
1answer
138 views

Determining an application's library call behaviour

I have a closed source Linux library libfoo that makes calls into another closed source library libbar for additional (mostly unneeded) features. However, I can't use libbar for ethical reasons, so I ...
1
vote
1answer
123 views

How to get the address of a function definition?

So im wondering how i can retrieve the adress of the definition instead of the adress of the declaration via dereferencing the startaddress of a c++ function. To be more concrete: My function to ...
0
votes
1answer
442 views

Newbie unpacking diffculties

I'm trying to unpack a small application I compiled with VS2015 (v140_xp) and packed with UPX 3.93 (option -1). The application checks for IsDebuggerPresent and uses std::cout, nothing fancy. The ...
1
vote
1answer
2k views

How does new operator internally work in C++?

The articles explaining the internals of malloc and free in glibc are abundant in number. However, I'd like to know how dynamic memory management works in C++, specifically the nitty gritty of new and ...
0
votes
2answers
746 views

c++ version of MOV AL,BYTE PTR DS:[ESI]

I'm writing a keygen for a crack-me exercise. I have a problem with handling byte assignments the crack-me performs several times using instructions like MOV AL,BYTE PTR DS:[ESI] (move byte from ...
3
votes
1answer
1k views

Identifying possible structs in C/C++ disassembly

I'm currently working on taking apart a game (Soul Reaver: Legacy of Kain) and I often come across odd looking sections such as this in the decompiler *(_DWORD *)(a2 + 16) = a2 + 624; *(_DWORD *)(...
-1
votes
2answers
539 views

How can I get the process information in windows without using APIs?

I want to write a program to obtain the information of process, for the purpose of detecting and combating malware. I can use C++ and Win32 APIs to finish it, but I then started suspecting those APIs ...
4
votes
1answer
1k views

Modifying address found through IDA

I'm trying to inject code into a small game I wrote to keep the health up forever, I want to do this by injecting code into the game that would set the health to 10 before each render() call, causing ...
0
votes
1answer
101 views

MSVC Generates Weird Code for Volatile Local Variable

I want to know how MSVC 2010 generates code for volatile local variable and have done a test. This simple test function uses a volatile local variable: int proc1(int a, int b) { int volatile ...
2
votes
0answers
103 views

Patching a variable's type in an executable file

Let's say i have a program.In this program i have a variable named PacketSize of type Short.I want to change the variable's type to Int. Now if i am able to locate this variable's location in the ...
2
votes
2answers
1k views

Modifying Windows DLLs

I find myself playing in strange territory lately, venturing far outside my comfort zone to test some theories. At present I want to return True every time a specific program calls IsDebuggerPresent, ...
1
vote
1answer
793 views

Assembly and C++

I'm trying to learn Reverse Engineering, at this time I compile C++ code without any optimization and see the correspond assembly in IDA's disassembler, but there are some parts of the code, where I ...
0
votes
1answer
714 views

Question about reading addresses/offsets in C++ within a hooked function

I'm a beginner at this and I'm following tutorials but I am kind of stuck. I found a function that accesses all characters X position in game. I found this using Cheat Engine and here's how it looks: ...
-1
votes
2answers
186 views

which windows API called when execute wmic qfe get hotfixid command?

which windows API called when execute this command wmic qfe get hotfixid command?
-2
votes
1answer
545 views

How decompilation works? [closed]

what is the theory behind the subject of translate assembly code to pseudo code? Could you explain few words ? Also some book about it?
0
votes
1answer
1k views

VirtualProtect a function isn't working.

I've been trying to make some modding tools for quake live by reverse engineering, and I have this function. I rebased my program to 0x0, and did pretty much everything to set me up. However, when I ...
0
votes
1answer
505 views

It's possible call a function outside a original thread?

Example: I have a function in a process on the memory address: 0xABCDEF, but that function cannot be called outside of original thread, it's possible to call it or hook it somehow? To what i'm going ...
1
vote
2answers
899 views

C/C++ to Assembly language

Is there any book or articles related to how C/C++ code is converted to assembly language, I mean common patterns for a specific compiler, etc?
1
vote
1answer
728 views

C++ to assembly, GCC vs CL

I have following C++ code: int main(){ int a = 1; double d = 1.2; return 0; } and get the following assembly using GCC 6.2 -m32: main: lea ecx, [esp+4] and esp, -8 ...
4
votes
2answers
2k views

what is COERCE_FLOAT in ida Hex-Rays' C++ pseudocode?

I was reversing and then i've found a definition as COERCE_FLOAT: float v28; float v29; v29 = COERCE_FLOAT(&v30); v28 = COERCE_FLOAT(&v31); // what is this? I've searched and found that it ...
2
votes
2answers
388 views

Programmatically reverse-engineering a dynamic dispatch method

Background: I want to convert Qt RTTI into symbols, to more easily navigate a large executable. If you don't know already, Qt is a C++ application framework based on a message passing system. Since C+...
0
votes
1answer
1k views

Reverse Engineering Exported DLL Function

I am trying to read the arguments sent to an external dll file "FlashToolLib.dll". My hook function is never triggered, I am guessing because I have the address wrong. I have tried the address in ...
1
vote
1answer
195 views

Question about IDA 6.8, also why its creating unnecessary vars

recently I've been learning to do RE. I made a simple program in 10 seconds that I was going to mess around with in IDA. #include <iostream> int main(int argc, char* argv[]) { printf("...
1
vote
1answer
1k views

Is it possible ( or how) to dump source code/machine code from memory?

I am actually working for the side of software protection. But in order to properly protect my source code ( be it .Net or C++), I would need to understand what is achievable ( and not achievable) ...
0
votes
1answer
348 views

Using HEX editor and making 4 chars from 3 chars [closed]

I need to replace a single string in a bin. The actual string has 3 chars and the new one must have 4.If I use a hex editor this will make the exe useless.So is there any way to add bytes there to ...

1 2 3
4
5
7