Questions tagged [c++]

C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language.

Filter by
Sorted by
Tagged with
1
vote
0answers
30 views

Go back to the original entry point after executing the instructions in the newly added segment- PE32+, C++

I am learning PE32+ (64 bit) files. I have added a new section to the PE32+ file and made the new section as the entry point. Some simple instructions are added in the new segment. Now I want to go to ...
1
vote
0answers
76 views

Dump the value of register into file

I've reverse engineering little game on windows 32bit. I found a string in executable which was interesting for me (it is a board game and this string represents the fact that somebody made a move ...
1
vote
0answers
223 views

Ghidra - Export namespaces

I am currently learning to use ghidra, and I found the Symbol Tree. Ghidra found some namespaces that I would like to export. These namespaces don't even have to be readable, just reusable, such that ...
1
vote
0answers
747 views

Finding function call (with arguments) in ELF file

I have two kinds of ELF files, built from C++. .so files: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, BuildID[sha1]=5e751e769912aef28bc63b888e5e4904b867a180, ...
1
vote
0answers
249 views

Finding lua C functions compiled binary

So i am trying to "hack" a game however not for cheating purposes. I am looking to extend the games scripting functionality through a DLL that can look for processes and return them. The game I am ...
1
vote
0answers
426 views

IDA 7 handling strings in debugger pseudocode

When running a remote debugger to a linux server, is there a way to get IDA (7.0) to properly handle strings? When I go to the pseudocode view, I get things like this; v7 = sub_804AD60((std::string *)...
1
vote
0answers
366 views

Trying to identify block of code which generates 256 bit key

I'm reversing a C++ program using IDA PRO to examine how the some data is stored, encrypted and decrypted. I've managed to identify the data is encrypted with AES CBC 16 block and 256 bit key. I have ...
1
vote
0answers
250 views

Compression algorithm working with bitstream

I'm trying to reverse decompression algorithm for one of old games. After some reversing I found that it reads bit stream, not byte by byte. It looks like this: std::vector<uint32_t> TABLE_1 = {...
1
vote
0answers
128 views

IDA sdk delete user struct member prevent creating gap

I have a problem using IDA SDK function del_struc_member(struc_t *sptr, ea_t offset) , If i use it on a member, it creates a gap[4] on the offset ( for dword type), it doesn't recalc the struct and ...
1
vote
0answers
179 views

Is it possible to correctly disassemble STL inlines?

Is it possible to correctly disassemble STL inlines with IDA? STL inlines are not detected by FLAIR just because they are inline not functions. For example how can I know that the code I see ...
1
vote
0answers
134 views

Call again function with new parameters

I developing online game. I have full sources for server, but game client I am using is closed-source so I need to do some reverse engineering there. So for 2 weeks I am trying to properly call ...
1
vote
0answers
293 views

Extracting information from a windows executable

I've been given the task of writing a functional clone for an executable since we don't have the source code. None of the .NET tools at my disposable recognise it and loading the thing into a text ...
1
vote
3answers
2k views

Can't find the base address of a function with IDA PRO (compiled with vs2015)

Hi so I was just trying to learn reverse-engineering and when I open my program in IDA pro I find this address sub_11330 (rebased to 0) https://gyazo.com/1c34d2c31f29583f05d0dd4d956d6f74 however when ...
1
vote
0answers
64 views

Constructing a mesh from triangle data (plane, svec, tvec) [closed]

I am trying to obtain some mesh data from a game which stores its collision surfaces for props/models in an array of "CollTri" structures which looks like this (taken from the limited source code I ...
1
vote
0answers
467 views

Static binary instrumentation tools for android .so libraries?

I'm trying to statically inject code into an android app. The best way would be to use APKStudio and the like, but there are very harsh restrictions on the device and the app itself, so that apk ...
1
vote
0answers
94 views

VLAs in C++ - seemingly nonsential compiler code [duplicate]

I've been wondering, why all the hassle with variable length arrays (such as int x[n])? Theoretically, it's just another local variable, so it's merely a matter of subtracting the appropriate value ...
1
vote
2answers
339 views

Does MSVCXXX.dll means that the PE file is compiled by Microsoft Visual C?

While viewing the PE headers and imported functions of some programs designed with visual C. I found that they all include one of these functions: MSVCRT.DLL MSVCR80.DLL MSVCR90.DLL MSVCR100D.DLL ...
1
vote
0answers
405 views

Calling Lua by C/C++ in compiled applications

So, currently I've been reverse engineering an application, that allows Lua coding. Because for some special purposes, I need to call Lua directly by C/C++ coding. However, as this application is ...
1
vote
1answer
612 views

Problem to understand execution of payload (shellcode)

I know that there are lot of (good) tutorials regarding this topic, but after reading them, I really cant follow their thoughts (e.g.: Smashing The Stack For Fun And Profit): The problem is that we ...
0
votes
2answers
985 views

Calling a function of a game inside a function hook

How can you call a game function inside a function hook? For example, I hooked the recv function of winsock. Then, I examined a packet. This packet has the value of my current hp. I check the hp. If ...
0
votes
1answer
102 views

MSVC Generates Weird Code for Volatile Local Variable

I want to know how MSVC 2010 generates code for volatile local variable and have done a test. This simple test function uses a volatile local variable: int proc1(int a, int b) { int volatile ...
0
votes
1answer
1k views

Inline assembly does not compile [closed]

I am currently learning how to hook some functions, and I simply want to insert this simple inline assembly: __asm { CMP [ebp + 8], 1 JNZ short 01311723 jmp [jmpBackAddy] } But Visual ...
0
votes
1answer
257 views

C++/C++11/C++0x in application to Reverse-engineering [closed]

Is there any libraries for Reverse engineering/exploitation for the C++11/C++/C programming language ? I am currently learning C based languages and would like to know if there are any libraries for ...
0
votes
2answers
41 views

What is the first argument (rdi) to operator+ on x86_64 SystemV?

I'm looking through a block of disassembled C++ which works with several std::string instances. I had been confused by several calls to various versions of std::operator+, but this call seems ...
0
votes
1answer
217 views

Modifying program using IDA/Hexrays decompilation pseudocode

A bit long-winded, apologies in advance. Updates to the question are at the end. I'm experimenting with hooking functions in a program & modifying them based on the decompilation pseudocode from ...
0
votes
1answer
153 views

Can I force GDB breakpoints and disassemble?

Sorry English isn't my first language. I noticed something when setting breakpoints in GDB. It appears that they are ignored if symbols aren't loaded. I have found it weird how GDB behaves when there ...
0
votes
1answer
103 views

Unrecognized sequence of bytes

I have this piece of code: .text:00537FDE push offset a3Rrrrrrrrrrrrr ; "3L+ÐÐÐÐÐÐÐÐÐÐÐÐÐ+ÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐøû9\n" .text:00537FE3 call sub_5606A0 Where ...
0
votes
1answer
634 views

In IDA, i want to get symbol by using IDAPython

I'm currently reversing some C++ Binary (macOS Kernel Extension). But, there are a lot of vtable functions, so i want to make some vtable structures by using IDAPython. I know how to make structure ...
0
votes
1answer
1k views

C++ Anti Kernel Debugger?

What are some things I can do to do anti kernel debugging from user-mode C++? I already use ZwQuerySystemInformation to query for SystemKernelDebuggerInformation.
0
votes
1answer
1k views

How do I call this function in inline ASM? (MSVC++)

void __usercall sub_101A7850@<eax>(int a1@<edx>, int a2@<ecx>, int a3, int a4, int a5, int a6) My first attempt (crashes): __declspec(naked) void __stdcall callit(const int& a1,...
0
votes
2answers
224 views

how to use class member function defined in a exe within a dll

I have an executable (.exe) containing some classes and functions definition and plan on using those functions from within a DLL, although I know to call a regular C style function using calling ...
0
votes
2answers
95 views

Smart approach or Brute force?

Background: I'm a beginner reverse engineer and I wanted to try writing my own c++ programs and reverse-engineering them. I wrote something and I'm not sure a smart way of reversing it. Usually, I can ...
0
votes
1answer
526 views

How can I intercept syscall libc function in C++ without writing any code in C file

How can intercept libc function in C++ using LD_PRELOAD. I want to write code only in C++ file and all the logic of symbol fishing (dlsym) must be in C++ file. Please give an example.
0
votes
1answer
454 views

When to create a keygen versus when to bypass the security jumps

I am a newbie reverse engineer. I was wondering: assuming I want to crack a program (With the permission of the author of course) and I have detected the Assembly where the program begins to check the ...
0
votes
1answer
186 views

What are zero terminated strings below vftable in RTTI?

I am reversing a class, which has RTTI information. It has 2 virtual functions in its vftable, and in IDA Pro I can see some kind of zero terminated strings below the last vfunction. Here's how it ...
0
votes
2answers
787 views

Help reversing code which uses ATL::CStringT

I'm attempting to learn reversing techniques using IDA on an exe built with VC/MFC, and could use a little initial help learning some patterns for simplifying the decompiled code. IDA found ...
0
votes
1answer
129 views

IDA: Two calls of a same function

I was reversing some executable and came across to this code: As I found out later, it's using function pointer to call function sub_4011C0 and that could be the reason. My question is why does ...
0
votes
3answers
1k views

In Memory DLL Injection

I am currently working on learning how different types of DLL injection can be performed. Right now I am able to run a function by: Opening the remote process; Allocating memory in remote process; ...
0
votes
2answers
121 views

Function Address Changes When Gets Referenced elsewhere

i have been trying to get the address of a function and use that hex number for other calculations. I have read that you cannot get the address of a function like you get the address of a variable in ...
0
votes
2answers
758 views

c++ version of MOV AL,BYTE PTR DS:[ESI]

I'm writing a keygen for a crack-me exercise. I have a problem with handling byte assignments the crack-me performs several times using instructions like MOV AL,BYTE PTR DS:[ESI] (move byte from ...
0
votes
1answer
351 views

Using HEX editor and making 4 chars from 3 chars [closed]

I need to replace a single string in a bin. The actual string has 3 chars and the new one must have 4.If I use a hex editor this will make the exe useless.So is there any way to add bytes there to ...
0
votes
1answer
229 views

Whats going on in this Class Constructor?

meanwhile, I am learning more and more how to reverse engineer. Ive figured out tons of stuff already, but I came to the point, where I just need some little explanation whats going on in the ...
0
votes
1answer
791 views

How can i get offset of class member manualy(without source of )

I have a simple C++ program compiled with Visual Studio 2005. I know that this program has a class base with a member variable x. How can I identify the variable x when looking at the x86? Here is a ...
0
votes
1answer
777 views

Is it possible to get back to a compilable form of source code using IDA pro [duplicate]

I am familiar with debuggers and sorts. I was going through a program and noticed that IDA does make some mistakes on what it decides what on its pseudo code will be. Is there a list of common ...
0
votes
1answer
85 views

What are the way I can reverse engineer an obfuscated C++ program?

I am reverse engineering an program. I encountered a problem where I can't reverse engineer it as the program code is obfuscated. I realised the program is obfuscated thanks to my friend who noticed ...
0
votes
1answer
130 views

which is harder to reverse engineer? [closed]

I'm planning on writing a windows application, used everywhere in my home country. I will code it in C++, but my question is which would you consider better to use? win32api Visual C++ MFC I'm ...
0
votes
1answer
58 views

Variable location address

There is variable in data section: .data:00427000 dword_427000 dd 64h Base address of code is: .text:00411000 ; Segment type: Pure code How to calculate actual address and location in memory of ...
0
votes
1answer
93 views

How can I modify these?

So I'm onto something interesting, I asked the less direct way but failed to meet the requirements in terms of explanation So here it is, how would I go about editing these the same way I would go ...
0
votes
1answer
173 views

best approach to hook function

I have found 2 source code example to hook a function. Example1: #include "detours.h" #include "sigscan.h" // this is the function that the program // will jump to when sum() is ...
0
votes
1answer
93 views

IDA exported header full of errors

Im a noob when it comes to using reverse engineering tooling. I am doing a reversing challenge (pwn adventure 3 CTF) and I am exporting the various types from IDA. The thing is, the header files are ...

1
3 4
5
6 7