Questions tagged [c++]

C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language.

Filter by
Sorted by
Tagged with
1
vote
1answer
806 views

Assembly and C++

I'm trying to learn Reverse Engineering, at this time I compile C++ code without any optimization and see the correspond assembly in IDA's disassembler, but there are some parts of the code, where I ...
0
votes
1answer
733 views

Question about reading addresses/offsets in C++ within a hooked function

I'm a beginner at this and I'm following tutorials but I am kind of stuck. I found a function that accesses all characters X position in game. I found this using Cheat Engine and here's how it looks: ...
-1
votes
2answers
186 views

which windows API called when execute wmic qfe get hotfixid command?

which windows API called when execute this command wmic qfe get hotfixid command?
-2
votes
1answer
553 views

How decompilation works? [closed]

what is the theory behind the subject of translate assembly code to pseudo code? Could you explain few words ? Also some book about it?
0
votes
1answer
2k views

VirtualProtect a function isn't working.

I've been trying to make some modding tools for quake live by reverse engineering, and I have this function. I rebased my program to 0x0, and did pretty much everything to set me up. However, when I ...
0
votes
1answer
512 views

It's possible call a function outside a original thread?

Example: I have a function in a process on the memory address: 0xABCDEF, but that function cannot be called outside of original thread, it's possible to call it or hook it somehow? To what i'm going ...
1
vote
2answers
907 views

C/C++ to Assembly language

Is there any book or articles related to how C/C++ code is converted to assembly language, I mean common patterns for a specific compiler, etc?
1
vote
1answer
738 views

C++ to assembly, GCC vs CL

I have following C++ code: int main(){ int a = 1; double d = 1.2; return 0; } and get the following assembly using GCC 6.2 -m32: main: lea ecx, [esp+4] and esp, -8 ...
4
votes
2answers
2k views

what is COERCE_FLOAT in ida Hex-Rays' C++ pseudocode?

I was reversing and then i've found a definition as COERCE_FLOAT: float v28; float v29; v29 = COERCE_FLOAT(&v30); v28 = COERCE_FLOAT(&v31); // what is this? I've searched and found that it ...
2
votes
2answers
394 views

Programmatically reverse-engineering a dynamic dispatch method

Background: I want to convert Qt RTTI into symbols, to more easily navigate a large executable. If you don't know already, Qt is a C++ application framework based on a message passing system. Since C+...
0
votes
1answer
1k views

Reverse Engineering Exported DLL Function

I am trying to read the arguments sent to an external dll file "FlashToolLib.dll". My hook function is never triggered, I am guessing because I have the address wrong. I have tried the address in ...
1
vote
1answer
204 views

Question about IDA 6.8, also why its creating unnecessary vars

recently I've been learning to do RE. I made a simple program in 10 seconds that I was going to mess around with in IDA. #include <iostream> int main(int argc, char* argv[]) { printf("...
1
vote
1answer
1k views

Is it possible ( or how) to dump source code/machine code from memory?

I am actually working for the side of software protection. But in order to properly protect my source code ( be it .Net or C++), I would need to understand what is achievable ( and not achievable) ...
0
votes
1answer
352 views

Using HEX editor and making 4 chars from 3 chars [closed]

I need to replace a single string in a bin. The actual string has 3 chars and the new one must have 4.If I use a hex editor this will make the exe useless.So is there any way to add bytes there to ...
1
vote
2answers
2k views

How to set breakpoint on C++ symbols?

How to set breakpoint on this C++ symbol? bp qmgr!TokenHandle::operator-: Could not resolve error at 'qmgr!TokenHandle::operator-:' in windbg?
0
votes
1answer
1k views

Inline assembly does not compile [closed]

I am currently learning how to hook some functions, and I simply want to insert this simple inline assembly: __asm { CMP [ebp + 8], 1 JNZ short 01311723 jmp [jmpBackAddy] } But Visual ...
2
votes
1answer
44 views

Reversing assembler DCD directive list into a c++ variable

For example we have assembler variable "foo" defined as: .text:00001078 foo DCD 0xffffffff, 0xffffeeee How it(variable foo) would look like in c++(or whatever higher lang)???
1
vote
0answers
293 views

Extracting information from a windows executable

I've been given the task of writing a functional clone for an executable since we don't have the source code. None of the .NET tools at my disposable recognise it and loading the thing into a text ...
3
votes
1answer
589 views

Win32 Structured Exception Handling in MS C++ - Mapping compiler code to assembly code

I am trying to read through Matt Pietrek article on "A Crash Course on the Depths of Win32 Structured Exception Handling" linked here. In the section titled Compiler-level SEH, he writes: Now that ...
2
votes
1answer
91 views

What is an easy way to update the addresses of hooked functions in an exe

I have hooked into some functions in an exe. I was wondering if there were any simple ways to detect the memory addresses of these functions after the exe has a new build (not my exe). Is the best way ...
6
votes
0answers
629 views

Reliable way to recognize STL template classes?

Since the template classes are different between instantiation, it is extremely difficult for library recognition using universal patterns. But the control flow graph and references to system call of ...
2
votes
1answer
169 views

Avoid program detecting a thread being used [closed]

I'm writing a DLL for a program that needs to run in an infinite loop (with delays, of course). For example: while (true) { std::cout << "I am running.\n"; Sleep(1000); } I'm not sure ...
0
votes
1answer
230 views

Whats going on in this Class Constructor?

meanwhile, I am learning more and more how to reverse engineer. Ive figured out tons of stuff already, but I came to the point, where I just need some little explanation whats going on in the ...
2
votes
1answer
506 views

How can I call a function that acts like __thiscall, except the caller cleans the stack?

I'm trying to call a function with a function pointer in C++, but I can't find any convention that fits it. Its stack arguments are (right to left): func(float x, float y, int unk); ...but ecx needs ...
-1
votes
1answer
72 views

Is there any windows API to execute thread on atomic mode? [closed]

Is there any windows API (application program interface) to execute thread on atomic mode?
3
votes
1answer
206 views

What's the purpose of arithmetic shifts by zero bits?

In a recent assignment, I disassembled a binary written in C++. In a few places throughout the program I came across shift operations by zero bits something like written below (The exact code/IDA isn'...
2
votes
1answer
760 views

vTable size calculation (for MSVC)

I made some PE analysis script. One part is virtual functions extraction, I implemented vTables lookup using this schema. Actual algorithm of lookup is not important part of question. I don't know ...
5
votes
2answers
3k views

Intel PIN: How to access the INS object from inside an analysis function?

A typical PIN code snippet looks like this (taken from the official manual): // This function is called before every instruction is executed // and prints the IP VOID printip(VOID *ip) { fprintf(...
1
vote
1answer
865 views

Any easy way to decompile virtual function instances?

What I mean is when the Hex-Rays compiler gives me something like this: int v1; CreateSomeInterface(&v1); (*(int (__thiscall **)(int))(*(_DWORD *)v1 + 4))(0); And I have a C++ header with the ...
-1
votes
1answer
103 views

How return type works [closed]

I declared this int returnDummy() { return 0x100; } and compile as a static libray. What result will be returned if I declare the prototype like this, bool returnDummy(); and link upper static ...
3
votes
1answer
1k views

How to intercept a call to function with known name from known DLL

First of all I wasn't very much into reversing until now, so excuse me if my question is dumb. I have a windows DLL most likely made with Visual C++. It's been developed in 1998 and has Mfc42.dll (4....
4
votes
1answer
3k views

Patching a string using DLL injection and OllyDbg

I'm a novice when it comes to RE but I'm trying to get into it. I have a background in C/C++ so doing the development side of things should be a breeze (aside from when assembly has to be used, im ...
2
votes
3answers
146 views

Virtual Method that returns <this>?

In my vtable i found a method that simply returns ecx. Now im confused as to what this tries to accomplish ? Is this a known useful sequence ?
2
votes
1answer
653 views

Trying to call function in process via DLL injection, need help in IDA if possible

I'm trying to create a bot for a game called "Mech Warrior Online". I've just completed my DLL injector which I want to use as mean to call function from the MWO client such as (fire, move, look ...
0
votes
1answer
246 views

Detour null function

I've been trying to detour a nullsub, this function is used with log purposes, but as the program is compiled under release flags it got removed and I'd like to restore it. IDA reports as follow: ....
1
vote
2answers
1k views

Extract decrypted token from EXE

EDIT As some people have pointed out, this exe file classifies as a 'virus' on some analysers. I can assure you this exe is from a very trusted source, and is actually part of a large puzzle (which ...
17
votes
1answer
11k views

How to organize vtables in IDA Pro?

I am using IDA Pro to disassemble a C++ behemoth with 1600+ classes, many of them having pure virtual methods. Some classes also are made up of multiple base classes, in hierarchies 5+ levels deep. ...
1
vote
3answers
2k views

Can't find the base address of a function with IDA PRO (compiled with vs2015)

Hi so I was just trying to learn reverse-engineering and when I open my program in IDA pro I find this address sub_11330 (rebased to 0) https://gyazo.com/1c34d2c31f29583f05d0dd4d956d6f74 however when ...
4
votes
2answers
2k views

Is there a way to import debug/symbol information of a C++ DOS executable to IDA?

I have an old DOS program compiled using Borland C++ (1991 version) The end of the executable contains many strings preceded by an underscore which looks like debug/symbol information : eg: ...
2
votes
0answers
342 views

Looking to RE a Ducky Shine 5

I know how to program in C++/C# and a few other low level languages. I'm however in the dark about reverse engineering firmware etc. I was wondering if anyone could point me towards some learning ...
0
votes
1answer
794 views

How can i get offset of class member manualy(without source of )

I have a simple C++ program compiled with Visual Studio 2005. I know that this program has a class base with a member variable x. How can I identify the variable x when looking at the x86? Here is a ...
2
votes
0answers
333 views

Is it possible to get address of function that implement virtual

I have address of virtual function in export table , is it possible to get implementation function address, that makes whole logic of virtual ? Code sample: this is virtual function that goes to ...
0
votes
1answer
917 views

Global C++ classes/variables, strange initialisation

I apologise for the length of this post, though I have taken the time to make it as readable as I can and included my ideas and thinking where possible so this post might be useful to other readers ...
1
vote
2answers
298 views

Adding Features to a Released PC Game

I've just recently finished a C++ class at my university, and I'm curious about game-modding/reverse engineering. My ultimate goal is to add features that were missing from the latest version of a ...
-1
votes
1answer
493 views

How does a C++ constructor look like on binary level?

So, I've been playing around with something again, and I encountered an issue I consider to be strange. IDA (around other less powerful debuggers/disassmeblers) offers a list of functions (with their ...
1
vote
2answers
989 views

Are vTable pointers always located inside a module?

Assuming the standard VC++ vTable layout: Heap-Addr TableAddr +-----------+ +-----------+ | TableAddr | ----> | Funcion-1 | ----> Exec region of module +-----------+ +---...
7
votes
1answer
8k views

What does a C++ class look like in assembly

I am planning to do some reverse engineering on an application that was written in a object oriented way. And now I'm kind of curious what a C++ class would look like in assembly. I already found out ...
1
vote
1answer
136 views

Return by Value/Call by Value internals

Good evening, fellow experts. I'm fiddling around with something and right now I'm stuck. I want to modify the behaviour of an application (Windows 7, 64bit). Therefore, I inject a DLL into the ...
1
vote
1answer
612 views

Problem to understand execution of payload (shellcode)

I know that there are lot of (good) tutorials regarding this topic, but after reading them, I really cant follow their thoughts (e.g.: Smashing The Stack For Fun And Profit): The problem is that we ...
5
votes
1answer
2k views

Writing an exploit for sample-application

I understand the principles of exploiting a classical stack-based buffer-overflow, and now I want to practice it. Therefore I wrote the following test-application: #include <stdio.h> #include &...

1
3 4
5
6 7