Questions tagged [c++]
C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language.
432
questions
3
votes
1
answer
2k
views
How to intercept a call to function with known name from known DLL
First of all I wasn't very much into reversing until now, so excuse me if my question is dumb.
I have a windows DLL most likely made with Visual C++. It's been developed in 1998 and has Mfc42.dll (4....
- 131
3
votes
1
answer
790
views
Trying to call function in process via DLL injection, need help in IDA if possible
I'm trying to create a bot for a game called "Mech Warrior Online". I've just completed my DLL injector which I want to use as mean to call function from the MWO client such as (fire, move, look ...
- 41
3
votes
0
answers
48
views
How can I create an `__m128i` datatype with Frida?
I'm working on reversing a c++ binary and it has a function that I want to call with Frida.
Here's the function signature from IDA: const __m128i *__fastcall sub_0123(__m128i * a1);
It doesn't seem ...
- 131
3
votes
0
answers
148
views
IDA ATL C++ class reconstruction
I'm currently using IDA Pro to analyze a dll, but IDA Pro doesn't analyze ATL standard classes properly, including CString, so I'm trying to reconstruct the classes manually, but I'm having some ...
- 71
3
votes
0
answers
77
views
purpose for using a == &a
I'm debugging dns.exe in Windows10 1809 and I'm really confused about one condition that often appeared in this file
WPP_GLOBAL_Control == &WPP_GLOBAL_Control
Actually, I have seen this kind of ...
- 313
3
votes
0
answers
283
views
How would I crack a software that has Xor encryption
So, before you shout at me to go on google I would just like to say I am new to reverse Engineering. Like I have been doing it for a hour. So, I was doing a bunch of crackmes.one using the search all ...
- 31
3
votes
2
answers
805
views
PE32+ executable : .text segment encryption
I am working on PE segment encryption(in C++). I completed the PE32 .text segment encryption. I added stub segment to the PE that will decrypt .text segment at runtime. Used inline assembly in the ...
- 49
3
votes
0
answers
533
views
Find vtable without complete object locator
I am learning to reverse Visual C++ objects.
I usually find the vtable (or VMT of VFT, however you call it) of the object using a cross reference to its CompleteObjectLocator that I found in the ...
- 131
3
votes
0
answers
2k
views
STL map and map entry structures for IDA/HexRays
I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long ...
- 131
3
votes
0
answers
658
views
Hooking the BootClassLoader [closed]
According to Wikipedia, there are 3 class loaders.
The Boot Class-Loader which loads everything in RT.jar and /../jre/lib
Then the extensions class loader and the system class loader.
I'm only ...
- 31
2
votes
1
answer
264
views
can someone help me with this map format?
I've been messing around in visual studio for half an hour trying to figure out how to properly display maps from a file, but all I can output is hot garbage, all I know is that the maps are 64x64, ...
- 31
2
votes
2
answers
1k
views
Reversing simple hello world in C++ [closed]
Can someone explain me why a simple C++ application -
#include <iostream>
int main()
{
std::cout << "Hello world!";
return 0;
}
compiled with MSVC 2012 looks very weird in IDA / ...
- 149
2
votes
2
answers
1k
views
What does the function do while it returns 0?
I wrote a simple C++ code and compiled it in VS 2013. I am trying to understand what happen after return 0.
int main(){
...
return 0;
...
}
The assembly code of return 0, translates to the xor ...
- 279
2
votes
2
answers
794
views
What compiler uses a calling convention that uses EAX as the first argument, then pushes onto the stack?
I recently asked to question: How can an IA-32 program seemingly compiled with MSVC send its sole argument via EAX? After posting the question, I found that another function passed the first argument ...
2
votes
1
answer
613
views
Visual studio memory allocation reverse engineering
I compile this code with Visual studio 2010 compiler:
#include "stdafx.h"
#include <iostream>
int main() {
int *p;
p = new int(255);
delete []p;
}
The disassembly of it, is different ...
- 139
2
votes
1
answer
2k
views
IDA and Ghidra Reversing
I have several questions about IDA and Ghidra (for MIPS and ARM):
Is there any option to load an executable file with all its libraries?
For example, I want to enter inside a function which its ...
- 71
2
votes
1
answer
19k
views
Decrypting Lua Files
I am trying to decrypt a lua file which has been encrypting using a key. Some background to the LUA file. Its from an android Game i decompiled the APK and found that all the lua files are encrypted.
...
- 31
2
votes
2
answers
2k
views
Identifying structures in C++
I have a large c++ program and I have found a pointer to an object of interest. I want to be able to identidy that object by atleast the constructor. What are some methods I can use to identify the ...
- 143
2
votes
1
answer
219
views
IDA: Demangled name simplification in idapython
With idapython I would like to get demangled names with the name simplification (bottom of page) applied to them.
For example, the following function:
Python> ida_name.demangle_name(idc....
- 123
2
votes
2
answers
451
views
How to restore struct fields
I have an object named ComputeService::RPC that is being used as input in a function inside a binary file:
__int64 __fastcall ComputeService::Rpc::GetClientProcessId(ComputeService::Rpc *this)
pc *...
- 573
2
votes
5
answers
13k
views
Run PE File - (Executable) From Memory
Would be grateful for your suggestion.Trying to run a 32/64bit on (Windows 10- 64 bit /Visual studio) program which tries to run an executable from memory.This is for my learning purpose.
#include &...
- 21
2
votes
1
answer
483
views
How to hook to a system function
How to hook to external library function, such as OpenGL for example.
I have a function used by the program I am trying to change behaviour of. The function is:
lVar17 = glfwCreateWindow(uVar22,uVar25,...
- 326
2
votes
1
answer
2k
views
How to analyse a poorly documented DLL API?
I'm working on a sensor with PSI5 interface and I'm using PSI Simulyzer box to simulate the environment during testing. This box comes with a software (some sort of digital oscilloscope) to make the ...
- 123
2
votes
2
answers
764
views
Reverse Engineer Float and Double Types in C++
I would like to get to the code that makes floats and doubles work. The reason why I'm trying is that I need to introduce a new floating point type defined by the military that is not supported ...
- 121
2
votes
1
answer
1k
views
Using a DLL proxy fails due to an unknown error
I'm using a dll proxy with the code described here, but having tons of trouble.
First, I use VS2012 on Windows 7 and the target is on Windows XP. So I needed to:
Install VCRedist on the target ...
- 121
2
votes
1
answer
2k
views
Custom UI buttons
I just started using IDA and OllyDbg, although I am experienced developer but before this I was reverse engineering only Java and .Net code which is much more easy task comparing of what I need to do ...
- 153
2
votes
1
answer
93
views
libuv - spoofing user-agent problem
Im trying to give an app "second life" (gamedev "banned" User-Agent of this tool to avoid requests from it).
This app is using websocket to get real-time result and then use this ...
- 33
2
votes
1
answer
2k
views
Extracting strings from binary files (.exe)
This question has been asked quite a lot especially on stackoverflow, but the solutions/replies are not clear or extensive.
What I`m looking for is to build what Strings does from Sysinternals. My ...
- 141
2
votes
2
answers
266
views
Why this ASM represents Virtual Function call?
I'm referring to this question that was asked previously:
Virtual functions call asm
I'm wondering how is it possible to know whether this ASM listing represents Virtual Functions calls? What's in the ...
- 168
2
votes
2
answers
374
views
C++ structure containing a RTTI getter function?
I'm working on reversing a C++ application and I've come across a structure that contains a getter function that returns TypeDescriptor*, I've read some articles on RTTI and reversing C++ but can't ...
- 103
2
votes
2
answers
331
views
undname.exe: invalid undecorated names
I've discovered undname.exe today and tried it on several functions. I got some incorrect results and I'm wondering why. I see two main reasons that could do that:
The mangling can change between ...
- 187
2
votes
1
answer
859
views
Reverse getline(cin, text)
I'm trying to solve a crackme that was made in C++, and I was able to
"recreate" a function call, through the library calls the program made. Here's the piece of code that I'm trying to reverse:
...
- 69
2
votes
3
answers
2k
views
Help reversing code which uses ATL::CStringT
I'm attempting to learn reversing techniques using IDA on an exe built with VC/MFC, and could use a little initial help learning some patterns for simplifying the decompiled code.
IDA found ...
- 121
2
votes
1
answer
189
views
Determining an application's library call behaviour
I have a closed source Linux library libfoo that makes calls into another closed source library libbar for additional (mostly unneeded) features. However, I can't use libbar for ethical reasons, so I ...
- 123
2
votes
2
answers
549
views
Programmatically reverse-engineering a dynamic dispatch method
Background: I want to convert Qt RTTI into symbols, to more easily navigate a large executable.
If you don't know already, Qt is a C++ application framework based on a message passing system. Since C+...
2
votes
1
answer
670
views
How do I find a collision for a simple hash algorithm
I have the following hash algorithm:
unsigned long specialNum=0x4E67C6A7;
unsigned int ch;
char inputVal[]=" AAPB2GXG";
for(int i=0;i<strlen(inputVal);i++)
...
- 203
2
votes
2
answers
1k
views
How to programmatically identify binary calling convention?
I have a problem where I'm instrumenting stripped binaries; I don't know the start of main(). But there's always an init(), and init() calls libc_start_main(), which receives a pointer to main.
If I ...
- 163
2
votes
2
answers
620
views
What is stored in the virtual function table? (Android NDK, GNU C++)
I see that the virtual method table (VMT, a.k.a. VFT) contains some odd values, e.g.:
obj:0x123c1a8 [704] vmt:0x611f77f8
data: 0123c1a8 f8 77 1f 61 00 96 23 01 00 00 00 00 c4 e0 b4 5c 00 00 00 00 00 ...
2
votes
1
answer
130
views
Reversing C++ Classes in ARM
I have unstripped linux arm binary,
The code calls functions in class object reference like so:
LDR R3, [R6]
MOV R1, R7
MOV R0, R6
LDR R3, [R3,#0xC] ; (...
- 21
2
votes
1
answer
341
views
How do I reverse engineer structs that are put as parameters in a function
how do I go around figuring out where to reverse engineer a struct?
As shown in the picture below, I have this function called "struct dynamic_array" which I want to reverse engineer and ...
2
votes
1
answer
290
views
IDA API: Writing a plugin - How can I ensure that analysis has completed?
I have been reading through the API documentation here and As far as I can tell there are three ways to wait for the analysis to finish.
get_auto_state
auto_wait
auto_is_ok
Looking at the API if ...
- 773
2
votes
1
answer
581
views
Can't debug process with IDA Windbg debugger: "Could not initialize WinDbg engine with error: %1 is not a valid Win32 application"
I tried to debug a C++ that I created but I am getting the following error:
I have this C:\Program Files (x86)\Windows Kits\10\Debuggers\x64 in the PATH environment variable (based on this answer), ...
- 573
2
votes
1
answer
705
views
Making a Android Toast via JNI, i.e. calling Java methods via JNI
Concerning the outputting of an Toast, I found that there are some ways to make a Toast, that invoke calling a FindClass on JNIEnv object with the android/widget/Toast parameter, but I found no ...
- 143
2
votes
1
answer
640
views
Pe 32 Add Export function Segment by Extending with dll or Patching pe
I need to add new function inside pe32 module.dll Export Table , in dynamic way if possible ( via extending with dll ) or by patching pe32 module.dll
What can u suggest to solve this ?
- 272
2
votes
1
answer
71
views
Register edx and CreateDevice function DX
I disassemble CreateDevice function from my DirectX code and commented each paratemer:
.text:0043F485 mov eax, [ebp+lpParam]
.text:0043F488 add eax, 730h
.text:...
- 333
2
votes
1
answer
167
views
What is the mdisp field in RTTI for throw used for?
First of here is the article from which I'm looking up the fields.
I was trying out different combinations to see how they affect the RTTI for a C++ throw. It seems that having a virtual base class ...
- 455
2
votes
1
answer
262
views
I can't set a hardware breakpoint on RIP + N-byte after calling NtContinue()
#include <Windows.h>
int handle_exception (EXCEPTION_POINTERS *exception_pointers) {
exception_pointers->ContextRecord->Rip += 4;
return EXCEPTION_CONTINUE_EXECUTION;
}
int main (...
- 131
2
votes
1
answer
2k
views
Decrypting Lua Files from game
I'm truing to decrypt LUA scrpits from cocos2dx game (for wiki).
Links to files of game:
libhellolua.so (cocos2dx external library)
example encrypted LUA-scripts (*.abc files)
I was reading a ...
- 21
2
votes
2
answers
1k
views
Why are there so much more functions in ida than my source code?
I am trying to learn how to use IDA Pro 6.8 to analyze binaries. However, there are much more functions in ida function list than my code. For example, there is a function in source code that calls ...
- 23
2
votes
1
answer
317
views
Call instruction changed while running
While debugging and reverse-engineering my exe, I have found a very weird thing.
call ds:GetModuleFileNameA
This call instruction is formed with below hex bytes in IDA.
FF 15 24 C0 41 00
(I think ...
