Questions tagged [c++]

C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language.

Filter by
Sorted by
Tagged with
1
vote
1answer
496 views

Trying to call DLL's functions from my exe

I am new here and I have a question for you guys (C++) I will try to describe my situation with some details so that you can understand this better. This might be long(er) but it might be necessary ...
3
votes
1answer
3k views

How to print all functions of a binary using radare2 c/c++ API

I need to write a program (in c++), that among other things needs to know all functions of a given PE file. Basically, It's an equivalent of opening a binary with "r2 -A binary_name" and then entering ...
1
vote
1answer
166 views

“Proper” way to recreate undocumented structs / classes given memory layout in C++?

Firstly I acknowledge that this is very borderline opinionated, but I'd like to emphasize this is more a thing of possibilities given some shortcomings of the default just writing down the offsets of ...
0
votes
1answer
455 views

How does look “this” variable in C++ at the assembly level?

How to properly define these so many this variables in C++ programs. Is it a structure or something else at the assembly level? For example, this function seems to allocate heap memory. int ...
2
votes
2answers
1k views

Identifying structures in C++

I have a large c++ program and I have found a pointer to an object of interest. I want to be able to identidy that object by atleast the constructor. What are some methods I can use to identify the ...
0
votes
1answer
459 views

how do I define an address with a module and an offset in c++

I'm trying to define an address so that I can edit its memory later, however I can't figure out a way to access it. The base address is "program.exe"+00D23440 and has an offset of +30 Normally you ...
-1
votes
1answer
796 views

Aside from Assembly, should I learn C or C++?

With Malware/Virus analysis being heavily dependant on one's ability to read the the Assembly Code generated by the Disassembler... being familiar with the Assembly Language is naturally the most ...
2
votes
1answer
135 views

Determining an application's library call behaviour

I have a closed source Linux library libfoo that makes calls into another closed source library libbar for additional (mostly unneeded) features. However, I can't use libbar for ethical reasons, so I ...
1
vote
1answer
116 views

How to get the address of a function definition?

So im wondering how i can retrieve the adress of the definition instead of the adress of the declaration via dereferencing the startaddress of a c++ function. To be more concrete: My function to ...
0
votes
1answer
388 views

Newbie unpacking diffculties

I'm trying to unpack a small application I compiled with VS2015 (v140_xp) and packed with UPX 3.93 (option -1). The application checks for IsDebuggerPresent and uses std::cout, nothing fancy. The ...
1
vote
1answer
2k views

How does new operator internally work in C++?

The articles explaining the internals of malloc and free in glibc are abundant in number. However, I'd like to know how dynamic memory management works in C++, specifically the nitty gritty of new and ...
0
votes
2answers
712 views

c++ version of MOV AL,BYTE PTR DS:[ESI]

I'm writing a keygen for a crack-me exercise. I have a problem with handling byte assignments the crack-me performs several times using instructions like MOV AL,BYTE PTR DS:[ESI] (move byte from ...
3
votes
1answer
1k views

Identifying possible structs in C/C++ disassembly

I'm currently working on taking apart a game (Soul Reaver: Legacy of Kain) and I often come across odd looking sections such as this in the decompiler *(_DWORD *)(a2 + 16) = a2 + 624; *(_DWORD *)(...
0
votes
2answers
525 views

How can I get the process information in windows without using APIs?

I want to write a program to obtain the information of process, for the purpose of detecting and combating malware. I can use C++ and Win32 APIs to finish it, but I then started suspecting those APIs ...
5
votes
1answer
1k views

Modifying address found through IDA

I'm trying to inject code into a small game I wrote to keep the health up forever, I want to do this by injecting code into the game that would set the health to 10 before each render() call, causing ...
0
votes
1answer
101 views

MSVC Generates Weird Code for Volatile Local Variable

I want to know how MSVC 2010 generates code for volatile local variable and have done a test. This simple test function uses a volatile local variable: int proc1(int a, int b) { int volatile ...
2
votes
0answers
103 views

Patching a variable's type in an executable file

Let's say i have a program.In this program i have a variable named PacketSize of type Short.I want to change the variable's type to Int. Now if i am able to locate this variable's location in the ...
3
votes
2answers
1k views

Modifying Windows DLLs

I find myself playing in strange territory lately, venturing far outside my comfort zone to test some theories. At present I want to return True every time a specific program calls IsDebuggerPresent, ...
1
vote
1answer
746 views

Assembly and C++

I'm trying to learn Reverse Engineering, at this time I compile C++ code without any optimization and see the correspond assembly in IDA's disassembler, but there are some parts of the code, where I ...
0
votes
1answer
662 views

Question about reading addresses/offsets in C++ within a hooked function

I'm a beginner at this and I'm following tutorials but I am kind of stuck. I found a function that accesses all characters X position in game. I found this using Cheat Engine and here's how it looks: ...
-1
votes
2answers
185 views

which windows API called when execute wmic qfe get hotfixid command?

which windows API called when execute this command wmic qfe get hotfixid command?
-2
votes
1answer
519 views

How decompilation works? [closed]

what is the theory behind the subject of translate assembly code to pseudo code? Could you explain few words ? Also some book about it?
0
votes
1answer
1k views

VirtualProtect a function isn't working.

I've been trying to make some modding tools for quake live by reverse engineering, and I have this function. I rebased my program to 0x0, and did pretty much everything to set me up. However, when I ...
0
votes
1answer
492 views

It's possible call a function outside a original thread?

Example: I have a function in a process on the memory address: 0xABCDEF, but that function cannot be called outside of original thread, it's possible to call it or hook it somehow? To what i'm going ...
1
vote
2answers
880 views

C/C++ to Assembly language

Is there any book or articles related to how C/C++ code is converted to assembly language, I mean common patterns for a specific compiler, etc?
1
vote
1answer
706 views

C++ to assembly, GCC vs CL

I have following C++ code: int main(){ int a = 1; double d = 1.2; return 0; } and get the following assembly using GCC 6.2 -m32: main: lea ecx, [esp+4] and esp, -8 ...
4
votes
2answers
2k views

what is COERCE_FLOAT in ida Hex-Rays' C++ pseudocode?

I was reversing and then i've found a definition as COERCE_FLOAT: float v28; float v29; v29 = COERCE_FLOAT(&v30); v28 = COERCE_FLOAT(&v31); // what is this? I've searched and found that it ...
2
votes
2answers
374 views

Programmatically reverse-engineering a dynamic dispatch method

Background: I want to convert Qt RTTI into symbols, to more easily navigate a large executable. If you don't know already, Qt is a C++ application framework based on a message passing system. Since C+...
0
votes
1answer
1k views

Reverse Engineering Exported DLL Function

I am trying to read the arguments sent to an external dll file "FlashToolLib.dll". My hook function is never triggered, I am guessing because I have the address wrong. I have tried the address in ...
1
vote
1answer
190 views

Question about IDA 6.8, also why its creating unnecessary vars

recently I've been learning to do RE. I made a simple program in 10 seconds that I was going to mess around with in IDA. #include <iostream> int main(int argc, char* argv[]) { printf("...
1
vote
1answer
1k views

Is it possible ( or how) to dump source code/machine code from memory?

I am actually working for the side of software protection. But in order to properly protect my source code ( be it .Net or C++), I would need to understand what is achievable ( and not achievable) ...
0
votes
1answer
331 views

Using HEX editor and making 4 chars from 3 chars [closed]

I need to replace a single string in a bin. The actual string has 3 chars and the new one must have 4.If I use a hex editor this will make the exe useless.So is there any way to add bytes there to ...
1
vote
2answers
1k views

How to set breakpoint on C++ symbols?

How to set breakpoint on this C++ symbol? bp qmgr!TokenHandle::operator-: Could not resolve error at 'qmgr!TokenHandle::operator-:' in windbg?
0
votes
1answer
1k views

Inline assembly does not compile [closed]

I am currently learning how to hook some functions, and I simply want to insert this simple inline assembly: __asm { CMP [ebp + 8], 1 JNZ short 01311723 jmp [jmpBackAddy] } But Visual ...
2
votes
1answer
43 views

Reversing assembler DCD directive list into a c++ variable

For example we have assembler variable "foo" defined as: .text:00001078 foo DCD 0xffffffff, 0xffffeeee How it(variable foo) would look like in c++(or whatever higher lang)???
1
vote
0answers
290 views

Extracting information from a windows executable

I've been given the task of writing a functional clone for an executable since we don't have the source code. None of the .NET tools at my disposable recognise it and loading the thing into a text ...
3
votes
1answer
546 views

Win32 Structured Exception Handling in MS C++ - Mapping compiler code to assembly code

I am trying to read through Matt Pietrek article on "A Crash Course on the Depths of Win32 Structured Exception Handling" linked here. In the section titled Compiler-level SEH, he writes: Now that ...
2
votes
1answer
90 views

What is an easy way to update the addresses of hooked functions in an exe

I have hooked into some functions in an exe. I was wondering if there were any simple ways to detect the memory addresses of these functions after the exe has a new build (not my exe). Is the best way ...
6
votes
0answers
606 views

Reliable way to recognize STL template classes?

Since the template classes are different between instantiation, it is extremely difficult for library recognition using universal patterns. But the control flow graph and references to system call of ...
2
votes
1answer
160 views

Avoid program detecting a thread being used [closed]

I'm writing a DLL for a program that needs to run in an infinite loop (with delays, of course). For example: while (true) { std::cout << "I am running.\n"; Sleep(1000); } I'm not sure ...
0
votes
1answer
218 views

Whats going on in this Class Constructor?

meanwhile, I am learning more and more how to reverse engineer. Ive figured out tons of stuff already, but I came to the point, where I just need some little explanation whats going on in the ...
2
votes
1answer
434 views

How can I call a function that acts like __thiscall, except the caller cleans the stack?

I'm trying to call a function with a function pointer in C++, but I can't find any convention that fits it. Its stack arguments are (right to left): func(float x, float y, int unk); ...but ecx needs ...
-1
votes
1answer
70 views

Is there any windows API to execute thread on atomic mode? [closed]

Is there any windows API (application program interface) to execute thread on atomic mode?
3
votes
1answer
200 views

What's the purpose of arithmetic shifts by zero bits?

In a recent assignment, I disassembled a binary written in C++. In a few places throughout the program I came across shift operations by zero bits something like written below (The exact code/IDA isn'...
2
votes
1answer
666 views

vTable size calculation (for MSVC)

I made some PE analysis script. One part is virtual functions extraction, I implemented vTables lookup using this schema. Actual algorithm of lookup is not important part of question. I don't know ...
5
votes
2answers
2k views

Intel PIN: How to access the INS object from inside an analysis function?

A typical PIN code snippet looks like this (taken from the official manual): // This function is called before every instruction is executed // and prints the IP VOID printip(VOID *ip) { fprintf(...
1
vote
1answer
812 views

Any easy way to decompile virtual function instances?

What I mean is when the Hex-Rays compiler gives me something like this: int v1; CreateSomeInterface(&v1); (*(int (__thiscall **)(int))(*(_DWORD *)v1 + 4))(0); And I have a C++ header with the ...
-1
votes
1answer
101 views

How return type works [closed]

I declared this int returnDummy() { return 0x100; } and compile as a static libray. What result will be returned if I declare the prototype like this, bool returnDummy(); and link upper static ...
4
votes
1answer
1k views

How to intercept a call to function with known name from known DLL

First of all I wasn't very much into reversing until now, so excuse me if my question is dumb. I have a windows DLL most likely made with Visual C++. It's been developed in 1998 and has Mfc42.dll (4....
4
votes
1answer
2k views

Patching a string using DLL injection and OllyDbg

I'm a novice when it comes to RE but I'm trying to get into it. I have a background in C/C++ so doing the development side of things should be a breeze (aside from when assembly has to be used, im ...