Questions tagged [c++]
C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language.
432
questions
4
votes
1
answer
624
views
How to add STL to Local Types in Ida Pro?
How to add STL to Local Types in Ida Pro?
I can import debug information from a pdb file along with STL types, but I can't manually add STL types to Local Types.
Also I can't import STL when I click &...
user42316
4
votes
1
answer
501
views
Compile C# like C++?
After reading the ins and outs of compilation differences between C# and C++ , my question is, cant we compile the C#application (or dll) with Visual Studio (or with other program), so similarly to C++...
- 643
4
votes
1
answer
6k
views
How can a format string vulnerability be used to write a specific string into memory?
I think I understand how a format string vulnerability works, but what I have seen so far it can only be used to increase the value of an integer.
Can format string vulnerability also be used to ...
4
votes
2
answers
5k
views
Where the pointer to virtual function table is located?
I used to think that the pointer to the Virtual Function Table (VFT, also Virtual Method Table, VMT) is the very first 32-bit word of the object binary representation.
But now I see a VFT whose index ...
4
votes
2
answers
827
views
How can I find my variables in the running process?
I'm new with reversing and I did the following experiment just intent to help my understanding. I created a very simple 64-bit c++ program.
#include <iostream>
#include <string>
using ...
- 175
4
votes
1
answer
2k
views
What are the first 16 bytes in .rodata section?
What are the first 16 bytes in the .rodata section?
For example, I have the following code:
#include <cstdio>
void myprintf(const char* ptr) {
printf("%p\n", ptr);
}
int main() {
...
- 143
4
votes
1
answer
3k
views
Patching a string using DLL injection and OllyDbg
I'm a novice when it comes to RE but I'm trying to get into it. I have a background in C/C++ so doing the development side of things should be a breeze (aside from when assembly has to be used, im ...
- 153
4
votes
1
answer
2k
views
getting the static address/offset of a variable
I'm fairly new to reverse engineering at all and I'm currently struggling to get the static offset/address of a variable of a program I've written myself.
So I've written the following program in C++,...
- 153
4
votes
2
answers
2k
views
ASM code hook/patching with trampoline function
I am stuck on making (my little self-task for learning) that thing:
Basically it should be something like Themida or VMProtect (do mutation, virtualization, etc.), but in my case,
i want to take ASM ...
- 41
4
votes
2
answers
3k
views
what is COERCE_FLOAT in ida Hex-Rays' C++ pseudocode?
I was reversing and then i've found a definition as COERCE_FLOAT:
float v28;
float v29;
v29 = COERCE_FLOAT(&v30);
v28 = COERCE_FLOAT(&v31); // what is this?
I've searched and
found that it ...
- 197
4
votes
2
answers
3k
views
Is there a way to import debug/symbol information of a C++ DOS executable to IDA?
I have an old DOS program compiled using Borland C++ (1991 version)
The end of the executable contains many strings preceded by an underscore which looks like debug/symbol information :
eg: ...
- 371
4
votes
1
answer
120
views
What does a C++ identifier ending in $_## mean?
In trying to understand a .so from an Android game made with Cocos2d-x, I've come across identifiers like the following (after demangling):
SceneActionMap::updateTalkMode(float)::$_37
SceneActionMap::...
- 73
4
votes
2
answers
2k
views
Import functions from executable
I've injected a DLL into an existing game.
I can import functions and variables like this:
typedef const wchar_t* (__fastcall *get_string_t)(const char*, int, const char*, int);
get_string_t ...
- 241
4
votes
2
answers
496
views
How to reverse a game and inject a dll in client program?
I am trying to make a bot for a game. But when I open the game in debugger like Ollydbg or in x64dbg the game simply closes and also it doesn't appears in the Attach to the process list in File menu ...
- 41
4
votes
1
answer
2k
views
Modifying address found through IDA
I'm trying to inject code into a small game I wrote to keep the health up forever, I want to do this by injecting code into the game that would set the health to 10 before each render() call, causing ...
- 173
4
votes
1
answer
3k
views
Extracting a private key from memory
I'm trying to extract a private key used to encrypt communications in a game modification (SA-MP, closed source, runs on Windows), which uses RakNet for it's communications and presumably encryption. ...
- 51
4
votes
1
answer
2k
views
Reverse engineering a flutter built apk
I was trying to reverse engineer an apk built with flutter. I actually feel like reversing flutter built apps did not get much reverse writeups on the community. one of the tools for the task ...
- 299
4
votes
0
answers
177
views
How to correctly inject a [jump + address] instruction into another process (code injection)?
I am trying to inject a jump instruction into another process (External injection), although the injection operation has been completed the address was not correct.
For example:
unsigned int addr = ...
- 269
4
votes
0
answers
1k
views
IDA Free vs IDA Home (to have Lumina)
I use actually IDA Free and I want to know what do you think of IDA Home (particulary for the Lumina function).
I don't found in Google a tool to know for exemple the functions recognized by the ...
3
votes
2
answers
712
views
How to compile c, cpp and python code as "Released/Final" version?
I want to know if there are ways to compile C, C++ and Python code in order to not be able to reverse engineering it over Linux or not?
I have heard there are some ways over Windows to do it, but I ...
- 331
3
votes
3
answers
592
views
Strange vtable setup in constructor disassembly
In a program I'm trying to recover data structures I've discovered the following strange (ARM) disassembly code:
ctor_1:
ldr r1, =vtable_base
str r1, [r0] ;r0 always contains ...
- 85
3
votes
2
answers
183
views
Are some special chars(<>) in function names not supported by windbg/cdb?
I have a function in a binary like this class<class1::class2>::function. I can't directly use commands like bp, u, x on the function. The only option I have right now is x class* and then look ...
- 2,629
3
votes
2
answers
602
views
C++ Unary equals (unary operator=)
In C++ binaries, I find Qt methods like ??4QString@@QEAAAEAV0@AEBV0@@Z which demangle to
public: class QString & __ptr64 __cdecl QString::operator=(class QString const & __ptr64) __ptr64
or ...
- 131
3
votes
1
answer
1k
views
Finding AddressOfEntryPoint for a 64-bit process
Okay, so in the following code-snippet I am starting a notepad.exe process in a suspended state and trying to get the AddressOfEntryPoint of the process. Problem is I can't seem to find the actual ...
- 33
3
votes
3
answers
2k
views
Insert logging into existing binary code, ARM
I want to add logging to some function(s) in the shared (.so) library. (ARM, Android, a mix of Arm and Thumb modes; C++, some functions are virtual and therefore nameless, invoked via VFT.)
Does ...
3
votes
1
answer
412
views
What is "nullsub_XXX" in vtable in IDA
When I looking in a vtable structure in IDA pro, I know that ___cxa_pure_virtual means that the function is virtual.
But what does nullsub_XXX mean in a vtable structure?
- 183
3
votes
1
answer
220
views
Figure out with fopen
Can anyone explain, why fopen takes as argument- not a file name- according to code takes some off_6A5D8C:
.text:00537F9F push offset stru_6C4E40 ; FILE *
.text:00537FA4 ...
- 331
3
votes
2
answers
1k
views
Is pointer decryption possible?
I’m pretty new to reverse engineering, so bear with me...
I’m trying to get a few struct definitions (or whatever they’re called) from this one binary. After some time fiddling around with it, I’ve ...
- 33
3
votes
3
answers
2k
views
Modifying Windows DLLs
I find myself playing in strange territory lately, venturing far outside my comfort zone to test some theories. At present I want to return True every time a specific program calls IsDebuggerPresent, ...
- 83
3
votes
1
answer
1k
views
How do I reverse an exe packed with an unknown packer?
I got an assignment to analize an exe file with 97% entropy. It's obviously packed but I got no results from Protection Id or PEid about which packer it used...
How can I unpack it if it's possible? ...
- 33
3
votes
1
answer
598
views
How to bypass anti debugger? IDA Pro
Im new to reverse engineering and doing a crackme that requires me to make a keygen, yes i know making a keygen isn't a beginner task however im stuborn, i am trying to debug the program to understand ...
- 31
3
votes
3
answers
842
views
IAT Hook via Kernel Driver
I've wrote a kernel driver recently and it does multiple things, but I wanted to add a IAT hook for a certain driver.
I want to hook the IAT of another driver from my driver if that makes sense.
So I ...
- 49
3
votes
1
answer
773
views
Win32 Structured Exception Handling in MS C++ - Mapping compiler code to assembly code
I am trying to read through Matt Pietrek article on "A Crash Course on the Depths of Win32 Structured Exception Handling" linked here. In the section titled Compiler-level SEH, he writes:
Now that ...
- 319
3
votes
1
answer
1k
views
Interacting with command line programs in Hopper disassembler (Mac OS 10.9)
To test the debugging capabilities of Hopper, I wrote a simple C++ command line application, and tried to run it on the remote debugging server (with gdb). However, I learned after I failed to be able ...
- 474
3
votes
2
answers
7k
views
What is operator new(unsigned int)?
In the disassembler output (ARM) I see:
BLX _Znwj
where BLX is ARM procedure call and _Znwj is demangled as
$ c++filt _Znwj
operator new(unsigned int)
What does that operator new do? Is it ...
3
votes
1
answer
438
views
Need help understanding XOR cipher
I am trying to modify a save file for a game. I think it is using an XOR cipher to encrypt it. Looking though the disassembly I think I found the function that decrypts it. I ran the assembly ...
- 133
3
votes
1
answer
459
views
IDA pro 6.9, what does "lambda" in type notation mean in C++ reversed code
I was looking into a C++ program compiled for aarch64 with ida pro 6.9 and came across something really weird:
somescope::SomeClass<false>::some_name<somescope::SomeClass<false>::...
- 33
3
votes
1
answer
5k
views
How to print all functions of a binary using radare2 c/c++ API
I need to write a program (in c++), that among other things needs to know all functions of a given PE file. Basically, It's an equivalent of opening a binary with "r2 -A binary_name" and then entering ...
- 31
3
votes
1
answer
898
views
Can i see non-static members of a class with IDA?
I was making C++ addon headers for BlockLauncher Addon with IDA, reverse engineering libminecraftpe.so file.
While doing that, i got trouble.
I want to see specific class's non-static members but i ...
- 165
3
votes
2
answers
2k
views
Forcing a call to an object instance method
I've instrumented an application using Frida.RE. I can hook the constructor of a C++ class of my interest, let's call this MyClass::MyClass().
I want to call the non-static MyClass::SomeMethod() on ...
- 153
3
votes
1
answer
192
views
Trying to identify a Binary-Search-Tree structure
Let's say I make a std::map in C++, and ADDR is their address in memory. When I look at this place in memory I will find a pointer and in ADDR + 4 will be the amount of elements in the container. Now, ...
- 31
3
votes
1
answer
873
views
Finding the main function without symbols
for a C/C++ program compiled on windows using the x86 architecture, what is the best way to find the main function within disassembled code?
I've found various answers to questions similar to this, ...
- 133
3
votes
1
answer
270
views
Do all class instances have a relative address/offset and can i make a copy of any class pointer?
I'm familiar with finding a player base pointer as-well as other values in games, and finding offsets and such.
And I have applied that to some of my own code in the past.
But does this practice ...
- 195
3
votes
2
answers
327
views
ARMCC/C++ Empty Vtable entries
I am reversing an application for the 3ds which are compiled with ARMCC.
I found the vtables of the key classes and have a problem figuring out how the C++ representation of these was.
Vtable of ...
- 131
3
votes
1
answer
174
views
Connecting a Motion Simulator to GTA
I'm trying to connect a real-life motion simulator to my pc gaming rig one game at a time. Since all the GTA games are super hackable (with respect to physics, map, & texture hacking), AND the ...
- 33
3
votes
1
answer
81
views
How does this Is64BitOS pointer-arithmetic-based function work?
Reversed this function. It works. But stepping through I can't figure out how. Why does this work?
bool _Is64BitOS(void) {
unsigned int version = *(unsigned int*)0x7FFE026C;
unsigned int ...
- 155
3
votes
2
answers
426
views
Injecting C++ code, while also maximizing compatibility with other injections
Using the New Vegas Script Extender C++ API for Fallout New Vegas, I am able to write to the process' memory directly at runtime through a .dll plugin that's loaded by the NVSE injector. But it is not ...
- 65
3
votes
1
answer
548
views
DLL Injection Call Address In Target
I have an address that is located in a dll loaded by my target process. I would like to call this address using dll injection.
For now my dll looks like this:
BOOL APIENTRY DllMain(HMODULE hModule, ...
- 153
3
votes
1
answer
257
views
What's the purpose of arithmetic shifts by zero bits?
In a recent assignment, I disassembled a binary written in C++.
In a few places throughout the program I came across shift operations by zero bits something like written below (The exact code/IDA isn'...
- 33
3
votes
1
answer
2k
views
How to intercept a call to function with known name from known DLL
First of all I wasn't very much into reversing until now, so excuse me if my question is dumb.
I have a windows DLL most likely made with Visual C++. It's been developed in 1998 and has Mfc42.dll (4....
- 131