Questions tagged [c++]

C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language.

Filter by
Sorted by
Tagged with
4
votes
1answer
2k views

Patching a string using DLL injection and OllyDbg

I'm a novice when it comes to RE but I'm trying to get into it. I have a background in C/C++ so doing the development side of things should be a breeze (aside from when assembly has to be used, im ...
2
votes
3answers
145 views

Virtual Method that returns <this>?

In my vtable i found a method that simply returns ecx. Now im confused as to what this tries to accomplish ? Is this a known useful sequence ?
2
votes
1answer
637 views

Trying to call function in process via DLL injection, need help in IDA if possible

I'm trying to create a bot for a game called "Mech Warrior Online". I've just completed my DLL injector which I want to use as mean to call function from the MWO client such as (fire, move, look ...
0
votes
1answer
227 views

Detour null function

I've been trying to detour a nullsub, this function is used with log purposes, but as the program is compiled under release flags it got removed and I'd like to restore it. IDA reports as follow: ....
1
vote
2answers
1k views

Extract decrypted token from EXE

EDIT As some people have pointed out, this exe file classifies as a 'virus' on some analysers. I can assure you this exe is from a very trusted source, and is actually part of a large puzzle (which ...
15
votes
1answer
9k views

How to organize vtables in IDA Pro?

I am using IDA Pro to disassemble a C++ behemoth with 1600+ classes, many of them having pure virtual methods. Some classes also are made up of multiple base classes, in hierarchies 5+ levels deep. ...
1
vote
3answers
2k views

Can't find the base address of a function with IDA PRO (compiled with vs2015)

Hi so I was just trying to learn reverse-engineering and when I open my program in IDA pro I find this address sub_11330 (rebased to 0) https://gyazo.com/1c34d2c31f29583f05d0dd4d956d6f74 however when ...
4
votes
2answers
2k views

Is there a way to import debug/symbol information of a C++ DOS executable to IDA?

I have an old DOS program compiled using Borland C++ (1991 version) The end of the executable contains many strings preceded by an underscore which looks like debug/symbol information : eg: ...
2
votes
0answers
341 views

Looking to RE a Ducky Shine 5

I know how to program in C++/C# and a few other low level languages. I'm however in the dark about reverse engineering firmware etc. I was wondering if anyone could point me towards some learning ...
0
votes
1answer
704 views

How can i get offset of class member manualy(without source of )

I have a simple C++ program compiled with Visual Studio 2005. I know that this program has a class base with a member variable x. How can I identify the variable x when looking at the x86? Here is a ...
2
votes
0answers
321 views

Is it possible to get address of function that implement virtual

I have address of virtual function in export table , is it possible to get implementation function address, that makes whole logic of virtual ? Code sample: this is virtual function that goes to ...
0
votes
1answer
886 views

Global C++ classes/variables, strange initialisation

I apologise for the length of this post, though I have taken the time to make it as readable as I can and included my ideas and thinking where possible so this post might be useful to other readers ...
1
vote
2answers
278 views

Adding Features to a Released PC Game

I've just recently finished a C++ class at my university, and I'm curious about game-modding/reverse engineering. My ultimate goal is to add features that were missing from the latest version of a ...
-1
votes
1answer
473 views

How does a C++ constructor look like on binary level?

So, I've been playing around with something again, and I encountered an issue I consider to be strange. IDA (around other less powerful debuggers/disassmeblers) offers a list of functions (with their ...
1
vote
2answers
877 views

Are vTable pointers always located inside a module?

Assuming the standard VC++ vTable layout: Heap-Addr TableAddr +-----------+ +-----------+ | TableAddr | ----> | Funcion-1 | ----> Exec region of module +-----------+ +---...
8
votes
1answer
7k views

What does a C++ class look like in assembly

I am planning to do some reverse engineering on an application that was written in a object oriented way. And now I'm kind of curious what a C++ class would look like in assembly. I already found out ...
1
vote
1answer
134 views

Return by Value/Call by Value internals

Good evening, fellow experts. I'm fiddling around with something and right now I'm stuck. I want to modify the behaviour of an application (Windows 7, 64bit). Therefore, I inject a DLL into the ...
1
vote
1answer
608 views

Problem to understand execution of payload (shellcode)

I know that there are lot of (good) tutorials regarding this topic, but after reading them, I really cant follow their thoughts (e.g.: Smashing The Stack For Fun And Profit): The problem is that we ...
5
votes
1answer
2k views

Writing an exploit for sample-application

I understand the principles of exploiting a classical stack-based buffer-overflow, and now I want to practice it. Therefore I wrote the following test-application: #include <stdio.h> #include &...
3
votes
1answer
758 views

Can i see non-static members of a class with IDA?

I was making C++ addon headers for BlockLauncher Addon with IDA, reverse engineering libminecraftpe.so file. While doing that, i got trouble. I want to see specific class's non-static members but i ...
1
vote
1answer
494 views

What is all this code for?

In order to be able to effectively reverse assembly one needs to understand how different compilers work, and what are the common code generation patterns. If you do not know them, you spent much more ...
2
votes
1answer
2k views

Anti reverse engineering tools that are easy to set up

I will be distributing a c++ application, and I was wondering if there was any tools available to add an extra layer of security against reverse engineering. I'm looking for a quick fix because I don'...
0
votes
1answer
1k views

How do I call this function in inline ASM? (MSVC++)

void __usercall sub_101A7850@<eax>(int a1@<edx>, int a2@<ecx>, int a3, int a4, int a5, int a6) My first attempt (crashes): __declspec(naked) void __stdcall callit(const int& a1,...
4
votes
1answer
585 views

mov ecx, arg - How to replicate in C++?

I frequently see code formatted like this: push arg push arg (...) mov ecx, arg call function If I need to call that function in Assembly, it's fine. But since I know how to consistently get the ...
1
vote
1answer
113 views

Where is the function cssyyparse code in webkit project? [closed]

Recently, I have viewed webkit source code and there is a function 'cssyyparse' which I cannot find c++ body code. Ther is only declaration of function cssyyparse. // CSSParser.cpp extern int ...
0
votes
0answers
46 views

Means of generating file hashes

I'm working with a relatively well secured program. In addition to memory validation checks during run time, the actual file integrity is checked at start. Both checks are synced with the server and I'...
5
votes
0answers
738 views

Python library for linux to demangle MSVC decorated names

I am looking for a python library for linux which can demangle the function names which are mangled by MSVC. for example : Project!??0?$allocator@D@std@@QAE@XZ to Project!public: __thiscall ...
2
votes
1answer
1k views

How to analyse a poorly documented DLL API?

I'm working on a sensor with PSI5 interface and I'm using PSI Simulyzer box to simulate the environment during testing. This box comes with a software (some sort of digital oscilloscope) to make the ...
2
votes
2answers
644 views

Reverse Engineer Float and Double Types in C++

I would like to get to the code that makes floats and doubles work. The reason why I'm trying is that I need to introduce a new floating point type defined by the military that is not supported ...
2
votes
1answer
504 views

Visual studio memory allocation reverse engineering

I compile this code with Visual studio 2010 compiler: #include "stdafx.h" #include <iostream> int main() { int *p; p = new int(255); delete []p; } The disassembly of it, is different ...
2
votes
1answer
582 views

How do I find a collision for a simple hash algorithm

I have the following hash algorithm: unsigned long specialNum=0x4E67C6A7; unsigned int ch; char inputVal[]=" AAPB2GXG"; for(int i=0;i<strlen(inputVal);i++) ...
5
votes
3answers
1k views

Hash algorithm written in C decompiled with IDA

I have been working on rewriting a program, although it uses a hash to fingerprint the file, I have used IDA to find the function doing the hash and what it is doing to the file before it sends it to ...
2
votes
2answers
919 views

What does the function do while it returns 0?

I wrote a simple C++ code and compiled it in VS 2013. I am trying to understand what happen after return 0. int main(){ ... return 0; ... } The assembly code of return 0, translates to the xor ...
1
vote
1answer
97 views

How can I recover / locate non-virtual class methods at run-time?

I know how to find and hook virtual methods by crawling an object's RTTI. I cannot find enough information about non-virtual class methods. Is there anyway to identify non-virtual class methods at ...
2
votes
1answer
486 views

Need to recover C++ code from binary of server and client

We have an old 2D space shooter multiplayer game community form late 1990s. The game is still alive today but the problem is the creators of the game are no where to be found and the source code is ...
1
vote
1answer
125 views

Chrome Vulnerability Issue

My fuzzer recently crashed chrome and dumped what appears to be an exploitable vulnerability. I'm having an issue debugging it, as the referenced source appears incompatible with the version of chrome ...
2
votes
1answer
2k views

Extracting a private key from memory

I'm trying to extract a private key used to encrypt communications in a game modification (SA-MP, closed source, runs on Windows), which uses RakNet for it's communications and presumably encryption. ...
1
vote
0answers
63 views

Constructing a mesh from triangle data (plane, svec, tvec) [closed]

I am trying to obtain some mesh data from a game which stores its collision surfaces for props/models in an array of "CollTri" structures which looks like this (taken from the limited source code I ...
3
votes
0answers
482 views

Hooking the BootClassLoader [closed]

According to Wikipedia, there are 3 class loaders. The Boot Class-Loader which loads everything in RT.jar and /../jre/lib Then the extensions class loader and the system class loader. I'm only ...
1
vote
0answers
445 views

Static binary instrumentation tools for android .so libraries?

I'm trying to statically inject code into an android app. The best way would be to use APKStudio and the like, but there are very harsh restrictions on the device and the app itself, so that apk ...
1
vote
1answer
1k views

Borland C++ runtime startup

I'm trying to reverse engineer an ages-old game compiled with Borland C++ in 1995. So far, I have found out that start @0x401000 passes to __startup in cw3220.dll (which apparently is Borland's C++ ...
9
votes
1answer
1k views

Becoming A Better Reverse Engineer

I have been looking on the net and all I see when it comes to reverse engineering are a bunch of silly crackme tutorials. I want to be better at taking code from assembly to c or c++. I am getting the ...
1
vote
1answer
751 views

Cannot call function (properly) in C++

I am developing a DLL for the purpose of injecting it into a running process for a game. I've found the memory addresses to some key functions(via Immunity Debugger) and I am trying to call those ...
0
votes
1answer
1k views

Convert C/C++ function to raw bytes [closed]

I'm planning to inject a thread into another process and unfortunately I need to write the thread function in raw bytes and can't just compile it in my program and then copy it over. The thread needs ...
2
votes
0answers
60 views

How to know the C++ try/throw/catch block size and address from machine code? [duplicate]

I'm doing a project that reorders basic blocks inside a function at runtime in C++ under 64-bit Linux. The reordering process includes updating instructions like "jmp". One problem is that if the ...
3
votes
1answer
144 views

Connecting a Motion Simulator to GTA

I'm trying to connect a real-life motion simulator to my pc gaming rig one game at a time. Since all the GTA games are super hackable (with respect to physics, map, & texture hacking), AND the ...
1
vote
1answer
718 views

Is it possible to get back to a compilable form of source code using IDA pro [duplicate]

I am familiar with debuggers and sorts. I was going through a program and noticed that IDA does make some mistakes on what it decides what on its pseudo code will be. Is there a list of common ...
8
votes
3answers
8k views

Reverse Engineering of data structures in games

I am currently participating in a reverse code engineering seminar for my studies in informatics: games engineering and was assigned the topic about "Identifying data structures". After an extensive ...
0
votes
1answer
3k views

LoadLibrary from memory

I use http://www.joachim-bauch.de/tutorials/loading-a-dll-from-memory/ to loadlibrary from memory. but when use in my code "throw" program crashing. What's the problem? code i use like this: #...
2
votes
0answers
242 views

How to include these exception handle symbols in x86 assembly code?

The test is on 32bit x86 Linux, with g++ 4.6.3. So basically I use a IDA pro script to recover the .gcc_excpt_table and .eh_frame sections from binary compiled from C++ language. Basically I want to ...

1
3 4
5
6 7