Questions tagged [c++]
C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language.
432
questions
1
vote
1
answer
137
views
Retrieve & dump type information from IDA Pro
I want to retrieve IDA Pro .idb database's each type info, such as:
size and name of a structure;
each member variable type and name;
each member variable size and offset;
And dump it to a .h file ...
- 33
1
vote
1
answer
352
views
Variable var_4 filled with value -1
Who can explain to me, why this line code there is before each jmp or end of some part of code where there is label. What this line of code is to do?
mov [ebp+var_4], 0FFFFFFFFh
This is WinMain ...
- 333
1
vote
2
answers
1k
views
What does this decompiled line mean?
__dest = (byte *)(**(code **)(*plVar5 + 0x10))(plVar5,(ulonglong)(numBytes + 1));
memcpy(__dest,param_2,numBytes + 1);
Can someone please explain what the first line does step by step? I get that ...
- 13
1
vote
1
answer
2k
views
In IDA, i want to get symbol by using IDAPython
I'm currently reversing some C++ Binary (macOS Kernel Extension).
But, there are a lot of vtable functions, so i want to make some vtable structures by using IDAPython.
I know how to make structure ...
- 11
1
vote
1
answer
105
views
Visual Win32 (UI) style?
what is the following image is about ? Is it design using win32 (UI) ?
the following image contains functions are being output from a DLL.
Can you help me to understand.
Suggest me anything which ...
- 81
1
vote
1
answer
826
views
C++ to assembly, GCC vs CL
I have following C++ code:
int main(){
int a = 1;
double d = 1.2;
return 0;
}
and get the following assembly using GCC 6.2 -m32:
main:
lea ecx, [esp+4]
and esp, -8
...
- 113
1
vote
1
answer
2k
views
Is it possible ( or how) to dump source code/machine code from memory?
I am actually working for the side of software protection. But in order to properly protect my source code ( be it .Net or C++), I would need to understand what is achievable ( and not achievable) ...
- 133
1
vote
1
answer
120
views
What means this code?
cseg01:00020DB8 mov eax, offset screen_with_height
cseg01:00045704 mov dword ptr [eax+0Ah], 0
cseg01:0004570B call sub_466F8 ; call some proc
...
- 333
1
vote
1
answer
417
views
Can I get a valid source code from this assembly?
I've used the IDA 8.0 Demo to retrieve (from a .DLL) the assembly code, such as:
; code
pxor xmm0, xmm0
ucomiss xmm0, xmm1
ja short loc_67F31600
movss xmm2, cs:...
- 113
1
vote
1
answer
116
views
Removing empty blocks ida api
i have a c++ module that removes empty block it used to work well but now I'm porting it to ida 7.7 I'm having issues.
mba_t *mba;
mba->remove_empty_blocks();
It throws following error
"...
- 73
1
vote
2
answers
2k
views
Is it possible/feasible to decompile a program written in C++ to C?
I've not seen a lot of material on this. I've seen people attempting to bring a C++ program back to C++ code, and claiming how hard it is, but C code from C++ program? I don't know.
If it is possible, ...
- 21
1
vote
1
answer
390
views
Hex-rays decompiler incorrect logic
I'm practicing reverse engineering in IDA and I created an example application in Visual C++ to practice working with classes/structs and the decompiler output seems to be incorrect - I would like to ...
- 170
1
vote
1
answer
273
views
Hook naked function with CPU registers
I need to hook this function:
.text:005589CB sub_5589CB proc near ; CODE XREF: AddHealth(int,long)+1A↑j
.text:005589CB ; sub_5328D8+98E↑p ...
...
- 279
1
vote
2
answers
1k
views
STL Data Structures Hex-Rays
We all know that reversing STL code is no fun. To make it easier, I usually create some of the strucutres so I can reference the created STL structures in another custom structure.
For example, msvc - ...
1
vote
1
answer
949
views
Assembly and C++
I'm trying to learn Reverse Engineering, at this time I compile C++ code without any optimization and see the correspond assembly in IDA's disassembler, but there are some parts of the code, where I ...
- 95
1
vote
2
answers
1k
views
C/C++ to Assembly language
Is there any book or articles related to how C/C++ code is converted to assembly language, I mean common patterns for a specific compiler, etc?
- 95
1
vote
1
answer
2k
views
Borland C++ runtime startup
I'm trying to reverse engineer an ages-old game compiled with Borland C++ in 1995. So far, I have found out that start @0x401000 passes to __startup in cw3220.dll (which apparently is Borland's C++ ...
- 175
1
vote
1
answer
241
views
Identifying C/C++ Library Functions
I am attempting to reverse-engineer an old DOS executable, which seems to have been compiled around 1992 using Microsoft's C compiler at the time.
When opening the executable in Ghidra no imports are ...
- 165
1
vote
1
answer
549
views
Strange DWORD/QWORD C++ Strings in decompilation
I have never seen something like this before but I assume this is some kind of way C++ allocates dynamic strings. In my decompilation listing in Ghidra I see something like:
local_14 = DAT_00404004 ^...
- 23
1
vote
2
answers
397
views
Relationship between compiled bytes of jmp instruction and target memory address
I'm very new to all this, so sorry if I mess up and/or am unclear. I'm working on reverse engineering assault cube, where a lot of people start, and I'm struggling to understand how this one AOB ...
- 13
1
vote
1
answer
118
views
IDA SDK - can't understand the output of displacement query functions?
OK so I want to parse x86 instructions with IDA SDK. However I can't understand the output, I have this code (that is executed after decode_insn at each operand that is present (type not 0)):
//op is ...
- 455
1
vote
1
answer
147
views
How to split bytes into instructions in binary ELF file for x86
I'm working on a static code injector for ELF files. I need to "steal" some bytes in order to write jump to my code on their place and then execute stolen instructions somewhere in the ...
1
vote
1
answer
931
views
Why does decompiling a C++ using Snowman yield some full variable names and some obfuscated ones?
I decompiled a C++ exe file using Snowman, hoping to see if it was malware or not (Although, honestly, I have no clue how to continue that - The file is really large, and the decompilation mostly ...
- 111
1
vote
1
answer
2k
views
Extracting functions of .obj file (compiled by myself with Visual Studio 19) --> extracts wrong data
How can I find only real functions not data garbage like section..debug_S_105 ? *
I need to collect function data (assembler code) of Open Source C++ Files which I compile with Visual Studio 19 (sln ...
- 23
1
vote
1
answer
960
views
indirect return value address
I have usercall with calling convention I do not fully understand, it returns std::string but IDA recognize it as void.
I've noticed that every calle reads from x8/w8 afterwards, from wikipedia;
...
- 273
1
vote
1
answer
382
views
Odd convention for accessing elements of an array?
While reverse engineering a game using the Hex Rays decompiler I was looking for how an array of NPC's was accessed. I found the array but I don't quite understand the unusual formula for getting the ...
1
vote
1
answer
150
views
Object references representation in pseudocode
I'm trying to understand how function calls are represented in Hex Rays' pseudocode, especially if the call expects pointers to objects.
Let's say I'm looking at a line of code in a function called ...
- 25
1
vote
1
answer
174
views
How can an IA-32 program seemingly compiled with MSVC send its sole argument via EAX? [duplicate]
A C++ program I'm looking at appears to have been compiled with MSVC. It links to MSVCR100.dll, contains MSVC's security cookie code and uses the Microsoft mangling scheme. However, one of the ...
1
vote
1
answer
358
views
Finding variable reference in cpp
Let's bring example
We have string
0000000000bd2906 db "CurrentKey", 0 ; DATA XREF=sub_555670+3390
And it's used here
00000000005563ae lea rsi, qword [0xbd2906] ; "CurrentKey"
Disassembler ...
user21284
1
vote
1
answer
575
views
Trying to call DLL's functions from my exe
I am new here and I have a question for you guys
(C++)
I will try to describe my situation with some details so that you can understand this better. This might be long(er) but it might be necessary ...
- 11
1
vote
1
answer
226
views
Question about IDA 6.8, also why its creating unnecessary vars
recently I've been learning to do RE.
I made a simple program in 10 seconds that I was going to mess around with in IDA.
#include <iostream>
int main(int argc, char* argv[])
{
printf("...
- 31
1
vote
2
answers
353
views
Adding Features to a Released PC Game
I've just recently finished a C++ class at my university, and I'm curious about game-modding/reverse engineering. My ultimate goal is to add features that were missing from the latest version of a ...
- 11
1
vote
1
answer
657
views
What is all this code for?
In order to be able to effectively reverse assembly one needs to understand how different compilers work, and what are the common code generation patterns. If you do not know them, you spent much more ...
- 155
1
vote
1
answer
117
views
How can I recover / locate non-virtual class methods at run-time?
I know how to find and hook virtual methods by crawling an object's RTTI. I cannot find enough information about non-virtual class methods.
Is there anyway to identify non-virtual class methods at ...
1
vote
1
answer
137
views
Chrome Vulnerability Issue
My fuzzer recently crashed chrome and dumped what appears to be an exploitable vulnerability. I'm having an issue debugging it, as the referenced source appears incompatible with the version of chrome ...
- 368
1
vote
1
answer
870
views
Cannot call function (properly) in C++
I am developing a DLL for the purpose of injecting it into a running process for a game. I've found the memory addresses to some key functions(via Immunity Debugger) and I am trying to call those ...
- 11
1
vote
1
answer
242
views
How do I map the std::_Ios_Openmode passed to basic_fstream to an actual value?
I am working on some ARM disassembly. A file is being operated on:
0000e550 sub r3, r11, #0x2d0
0000e554 mov r0, r3 ; /tmp/MAC
0000e558 ldr r1, = 0x9a60c ; 0xec04 (sub_e3a8 + 0x85c)
...
- 1,762
1
vote
2
answers
241
views
Reassembler toolchain
I'm looking for tools to:
Disassemble a function from a x86 Windows executable into an asm file.
Edit the file.
Assemble the file again into an object file that can then be linked into a DLL.
Inject ...
- 241
1
vote
2
answers
457
views
How do I get the start address of the 'code section' and its size to know the end address?
I am trying to read the binary code in the text section of an executable game file (PE) programmatically but I don't know the start address and the end address of the text section.
I am using C++/...
- 269
1
vote
1
answer
95
views
Turning very complicated arithmetic and reverse engineered check into useable code in C#
so I have this problem of me not understanding how to convert this one function into useable code in C#. Problem being that I am currently hooking into a game via C# and I want to rebuild a function ...
1
vote
1
answer
249
views
How can I override a x86 instruction in c++?
I am trying to replace a jmp instruction with a ret in c++. How can I do that?
- 21
1
vote
1
answer
197
views
Calling function with string as parameter
I'm trying to call a function in a game that makes my character sending a message.
I already called a few functions in this game but this one has a tricky parameter.
The function signature should be ...
- 161
1
vote
1
answer
178
views
Can a MSVC class have a deletion destructor without a vftable?
I'm reversing the following smart pointee-like MSVC class Buffer : public Referencable with IDA / Hexrays:
struct Referencable
{
int m_refs;
};
struct Buffer : Referencable
{
void* m_pData;
};
...
- 1,083
1
vote
1
answer
116
views
How could I find a call of a function thats only referenced inside a vftable?
So I have this function which I'm trying to figure out the arguments to.
However, all the xrefs of it point to a VFTable.
How would I find a call for this function?
- 21
1
vote
1
answer
184
views
IntelPin, Ins_Insertcall?
please help me with Intel Pin:
I print each instruction to the console and I want to insert +++++ after it using Ins_Insertcall:
VOID CpuidCalled(const CONTEXT* ctxt)
{
std::cerr << "+++++&...
- 21
1
vote
1
answer
678
views
How is it possible to generate C++ class header from a .dll or ELF file?
I loaded a dynamic library file to IDA. I can clearly see the function signatures from the "Function name list". There are RTTI items in the "Structures" tab as well, but I don't ...
- 204
1
vote
1
answer
382
views
Analyze Arm Linux CPP binary in Ida Pro
I tried to open CPP binary with Ida. Most of the code analyze well .
The problem is that there are lot of vtables(Ida doesn't recognize them as vtables) that I need to reach them manually and pressO (...
1
vote
1
answer
277
views
Using struct objects and constructors in hooked function
Will try to reword the actual question so it is hopefully more descriptive and clear of what I am after:
So, there is a function main, which I have successfully hooked. The hooked version looks like ...
- 326
1
vote
1
answer
148
views
Inconsistency in function addresses of the hooked functions (address shift)
I came across "a strange" inconsistency in terms of the function addresses in the particular application.
First, the main function is hooked successfully, the address is derived in a fashion:...
- 326
1
vote
1
answer
982
views
DetourAttach breaks with Illegal Instruction 0xC000001D
I am trying to detour a function using DetourAttach() in the following fashion:
hooks::logDebug("swresample-3Proxy.log", fmt::format("Try to attach hook. Function {:p}, hook {:p}.",...
- 326