Questions tagged [c++]

C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language.

Filter by
Sorted by
Tagged with
4
votes
1answer
3k views

Patching a string using DLL injection and OllyDbg

I'm a novice when it comes to RE but I'm trying to get into it. I have a background in C/C++ so doing the development side of things should be a breeze (aside from when assembly has to be used, im ...
4
votes
1answer
3k views

How to reverse command line arguments?

I am working on a console windows executable. So far what I figured out is that the executable checks number of command line arguments. Afterwards, it branches out depending on the number of arguments ...
4
votes
1answer
1k views

getting the static address/offset of a variable

I'm fairly new to reverse engineering at all and I'm currently struggling to get the static offset/address of a variable of a program I've written myself. So I've written the following program in C++,...
4
votes
2answers
1k views

ASM code hook/patching with trampoline function

I am stuck on making (my little self-task for learning) that thing: Basically it should be something like Themida or VMProtect (do mutation, virtualization, etc.), but in my case, i want to take ASM ...
4
votes
2answers
2k views

what is COERCE_FLOAT in ida Hex-Rays' C++ pseudocode?

I was reversing and then i've found a definition as COERCE_FLOAT: float v28; float v29; v29 = COERCE_FLOAT(&v30); v28 = COERCE_FLOAT(&v31); // what is this? I've searched and found that it ...
4
votes
2answers
2k views

Is there a way to import debug/symbol information of a C++ DOS executable to IDA?

I have an old DOS program compiled using Borland C++ (1991 version) The end of the executable contains many strings preceded by an underscore which looks like debug/symbol information : eg: ...
4
votes
1answer
85 views

What does a C++ identifier ending in $_## mean?

In trying to understand a .so from an Android game made with Cocos2d-x, I've come across identifiers like the following (after demangling): SceneActionMap::updateTalkMode(float)::$_37 SceneActionMap::...
4
votes
2answers
1k views

Import functions from executable

I've injected a DLL into an existing game. I can import functions and variables like this: typedef const wchar_t* (__fastcall *get_string_t)(const char*, int, const char*, int); get_string_t ...
4
votes
1answer
1k views

Modifying address found through IDA

I'm trying to inject code into a small game I wrote to keep the health up forever, I want to do this by injecting code into the game that would set the health to 10 before each render() call, causing ...
4
votes
1answer
2k views

Extracting a private key from memory

I'm trying to extract a private key used to encrypt communications in a game modification (SA-MP, closed source, runs on Windows), which uses RakNet for it's communications and presumably encryption. ...
3
votes
2answers
583 views

How to compile c, cpp and python code as “Released/Final” version?

I want to know if there are ways to compile C, C++ and Python code in order to not be able to reverse engineering it over Linux or not? I have heard there are some ways over Windows to do it, but I ...
3
votes
3answers
311 views

Strange vtable setup in constructor disassembly

In a program I'm trying to recover data structures I've discovered the following strange (ARM) disassembly code: ctor_1: ldr r1, =vtable_base str r1, [r0] ;r0 always contains ...
3
votes
2answers
556 views

C++ Unary equals (unary operator=)

In C++ binaries, I find Qt methods like ??4QString@@QEAAAEAV0@AEBV0@@Z which demangle to public: class QString & __ptr64 __cdecl QString::operator=(class QString const & __ptr64) __ptr64 or ...
3
votes
1answer
245 views

Finding AddressOfEntryPoint for a 64-bit process

Okay, so in the following code-snippet I am starting a notepad.exe process in a suspended state and trying to get the AddressOfEntryPoint of the process. Problem is I can't seem to find the actual ...
3
votes
3answers
2k views

Insert logging into existing binary code, ARM

I want to add logging to some function(s) in the shared (.so) library. (ARM, Android, a mix of Arm and Thumb modes; C++, some functions are virtual and therefore nameless, invoked via VFT.) Does ...
3
votes
1answer
116 views

Figure out with fopen

Can anyone explain, why fopen takes as argument- not a file name- according to code takes some off_6A5D8C: .text:00537F9F push offset stru_6C4E40 ; FILE * .text:00537FA4 ...
3
votes
2answers
737 views

Is pointer decryption possible?

I’m pretty new to reverse engineering, so bear with me... I’m trying to get a few struct definitions (or whatever they’re called) from this one binary. After some time fiddling around with it, I’ve ...
3
votes
2answers
115 views

How can I find my variables in the running process?

I'm new with reversing and I did the following experiment just intent to help my understanding. I created a very simple 64-bit c++ program. #include <iostream> #include <string> using ...
3
votes
1answer
1k views

Interacting with command line programs in Hopper disassembler (Mac OS 10.9)

To test the debugging capabilities of Hopper, I wrote a simple C++ command line application, and tried to run it on the remote debugging server (with gdb). However, I learned after I failed to be able ...
3
votes
2answers
5k views

What is operator new(unsigned int)?

In the disassembler output (ARM) I see: BLX _Znwj where BLX is ARM procedure call and _Znwj is demangled as $ c++filt _Znwj operator new(unsigned int) What does that operator new do? Is it ...
3
votes
1answer
337 views

Need help understanding XOR cipher

I am trying to modify a save file for a game. I think it is using an XOR cipher to encrypt it. Looking though the disassembly I think I found the function that decrypts it. I ran the assembly ...
3
votes
1answer
276 views

IDA pro 6.9, what does “lambda” in type notation mean in C++ reversed code

I was looking into a C++ program compiled for aarch64 with ida pro 6.9 and came across something really weird: somescope::SomeClass<false>::some_name<somescope::SomeClass<false>::...
3
votes
1answer
4k views

How to print all functions of a binary using radare2 c/c++ API

I need to write a program (in c++), that among other things needs to know all functions of a given PE file. Basically, It's an equivalent of opening a binary with "r2 -A binary_name" and then entering ...
3
votes
1answer
1k views

Identifying possible structs in C/C++ disassembly

I'm currently working on taking apart a game (Soul Reaver: Legacy of Kain) and I often come across odd looking sections such as this in the decompiler *(_DWORD *)(a2 + 16) = a2 + 624; *(_DWORD *)(...
3
votes
1answer
589 views

Win32 Structured Exception Handling in MS C++ - Mapping compiler code to assembly code

I am trying to read through Matt Pietrek article on "A Crash Course on the Depths of Win32 Structured Exception Handling" linked here. In the section titled Compiler-level SEH, he writes: Now that ...
3
votes
1answer
791 views

Can i see non-static members of a class with IDA?

I was making C++ addon headers for BlockLauncher Addon with IDA, reverse engineering libminecraftpe.so file. While doing that, i got trouble. I want to see specific class's non-static members but i ...
3
votes
2answers
1k views

Forcing a call to an object instance method

I've instrumented an application using Frida.RE. I can hook the constructor of a C++ class of my interest, let's call this MyClass::MyClass(). I want to call the non-static MyClass::SomeMethod() on ...
3
votes
2answers
228 views

ARMCC/C++ Empty Vtable entries

I am reversing an application for the 3ds which are compiled with ARMCC. I found the vtables of the key classes and have a problem figuring out how the C++ representation of these was. Vtable of ...
3
votes
1answer
156 views

Connecting a Motion Simulator to GTA

I'm trying to connect a real-life motion simulator to my pc gaming rig one game at a time. Since all the GTA games are super hackable (with respect to physics, map, & texture hacking), AND the ...
3
votes
1answer
215 views

DLL Injection Call Address In Target

I have an address that is located in a dll loaded by my target process. I would like to call this address using dll injection. For now my dll looks like this: BOOL APIENTRY DllMain(HMODULE hModule, ...
3
votes
1answer
206 views

What's the purpose of arithmetic shifts by zero bits?

In a recent assignment, I disassembled a binary written in C++. In a few places throughout the program I came across shift operations by zero bits something like written below (The exact code/IDA isn'...
3
votes
1answer
1k views

How to intercept a call to function with known name from known DLL

First of all I wasn't very much into reversing until now, so excuse me if my question is dumb. I have a windows DLL most likely made with Visual C++. It's been developed in 1998 and has Mfc42.dll (4....
3
votes
0answers
30 views

How can I tell whether or not a given library method is being referenced by a consumer program statically in OOP languages?

Preface: This question is about source code reverse engineering and static analysis. Meaning, there is no built code available but I have access to the source code of the program. Imagine I'm looking ...
3
votes
0answers
341 views

IDA Hex-Rays structure inline functions recognition

I've seen multiple posts about the subject, but mine is a little bit more specific about what I want to achieve. I have many times situations where Hex-Rays decompiler outputs 16 lines of code and I ...
3
votes
2answers
366 views

PE32+ executable : .text segment encryption

I am working on PE segment encryption(in C++). I completed the PE32 .text segment encryption. I added stub segment to the PE that will decrypt .text segment at runtime. Used inline assembly in the ...
3
votes
1answer
405 views

Reverse engineering android native packer

im trying to Reverse engineering an android app and the app have 4 folders in the /data/data/{package} folder ├───app_dexprotector │ 823517D25836B88F1C499C02370A047E.dat │ ...
3
votes
0answers
271 views

Find vtable without complete object locator

I am learning to reverse Visual C++ objects. I usually find the vtable (or VMT of VFT, however you call it) of the object using a cross reference to its CompleteObjectLocator that I found in the ...
3
votes
0answers
1k views

STL map and map entry structures for IDA/HexRays

I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long ...
3
votes
0answers
516 views

Hooking the BootClassLoader [closed]

According to Wikipedia, there are 3 class loaders. The Boot Class-Loader which loads everything in RT.jar and /../jre/lib Then the extensions class loader and the system class loader. I'm only ...
2
votes
1answer
213 views

can someone help me with this map format?

I've been messing around in visual studio for half an hour trying to figure out how to properly display maps from a file, but all I can output is hot garbage, all I know is that the maps are 64x64, ...
2
votes
2answers
1k views

Reversing simple hello world in C++ [closed]

Can someone explain me why a simple C++ application - #include <iostream> int main() { std::cout << "Hello world!"; return 0; } compiled with MSVC 2012 looks very weird in IDA / ...
2
votes
2answers
922 views

What does the function do while it returns 0?

I wrote a simple C++ code and compiled it in VS 2013. I am trying to understand what happen after return 0. int main(){ ... return 0; ... } The assembly code of return 0, translates to the xor ...
2
votes
2answers
401 views

What compiler uses a calling convention that uses EAX as the first argument, then pushes onto the stack?

I recently asked to question: How can an IA-32 program seemingly compiled with MSVC send its sole argument via EAX? After posting the question, I found that another function passed the first argument ...
2
votes
1answer
541 views

Visual studio memory allocation reverse engineering

I compile this code with Visual studio 2010 compiler: #include "stdafx.h" #include <iostream> int main() { int *p; p = new int(255); delete []p; } The disassembly of it, is different ...
2
votes
1answer
764 views

IDA and Ghidra Reversing

I have several questions about IDA and Ghidra (for MIPS and ARM): Is there any option to load an executable file with all its libraries? For example, I want to enter inside a function which its ...
2
votes
1answer
12k views

Decrypting Lua Files

I am trying to decrypt a lua file which has been encrypting using a key. Some background to the LUA file. Its from an android Game i decompiled the APK and found that all the lua files are encrypted. ...
2
votes
2answers
1k views

Identifying structures in C++

I have a large c++ program and I have found a pointer to an object of interest. I want to be able to identidy that object by atleast the constructor. What are some methods I can use to identify the ...
2
votes
5answers
9k views

Run PE File - (Executable) From Memory

Would be grateful for your suggestion.Trying to run a 32/64bit on (Windows 10- 64 bit /Visual studio) program which tries to run an executable from memory.This is for my learning purpose. #include &...
2
votes
1answer
1k views

How to analyse a poorly documented DLL API?

I'm working on a sensor with PSI5 interface and I'm using PSI Simulyzer box to simulate the environment during testing. This box comes with a software (some sort of digital oscilloscope) to make the ...
2
votes
2answers
663 views

Reverse Engineer Float and Double Types in C++

I would like to get to the code that makes floats and doubles work. The reason why I'm trying is that I need to introduce a new floating point type defined by the military that is not supported ...

1
2
3 4 5
7