Skip to main content

Questions tagged [c++]

C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language.

Filter by
Sorted by
Tagged with
1 vote
2 answers
5k views

Getting the correct memory address for a specific value

I was watching this series of videos and I noticed that his memory addresses were not changing every time he restarted the game and/or olly. In addition, his comments seemed to stick around and he was ...
3asssains's user avatar
  • 111
1 vote
3 answers
3k views

Cyber security student wanting to start learning reverse engineering [duplicate]

I'm really interested in learning reverse engineering. Especially in regards to malware. Any help is much appreciated What should I learn before I start to learn reverse engineering? Is learning C/...
Alex Valdez's user avatar
1 vote
2 answers
2k views

Extract decrypted token from EXE

EDIT As some people have pointed out, this exe file classifies as a 'virus' on some analysers. I can assure you this exe is from a very trusted source, and is actually part of a large puzzle (which ...
Shai's user avatar
  • 137
1 vote
1 answer
258 views

Retrieve & dump type information from IDA Pro

I want to retrieve IDA Pro .idb database's each type info, such as: size and name of a structure; each member variable type and name; each member variable size and offset; And dump it to a .h file ...
void_17's user avatar
  • 33
1 vote
1 answer
376 views

Variable var_4 filled with value -1

Who can explain to me, why this line code there is before each jmp or end of some part of code where there is label. What this line of code is to do? mov [ebp+var_4], 0FFFFFFFFh This is WinMain ...
black4's user avatar
  • 343
1 vote
2 answers
1k views

What does this decompiled line mean?

__dest = (byte *)(**(code **)(*plVar5 + 0x10))(plVar5,(ulonglong)(numBytes + 1)); memcpy(__dest,param_2,numBytes + 1); Can someone please explain what the first line does step by step? I get that ...
hecya's user avatar
  • 13
1 vote
1 answer
2k views

In IDA, i want to get symbol by using IDAPython

I'm currently reversing some C++ Binary (macOS Kernel Extension). But, there are a lot of vtable functions, so i want to make some vtable structures by using IDAPython. I know how to make structure ...
jusun Lee's user avatar
1 vote
1 answer
109 views

Visual Win32 (UI) style?

what is the following image is about ? Is it design using win32 (UI) ? the following image contains functions are being output from a DLL. Can you help me to understand. Suggest me anything which ...
ReverserT's user avatar
1 vote
1 answer
838 views

C++ to assembly, GCC vs CL

I have following C++ code: int main(){ int a = 1; double d = 1.2; return 0; } and get the following assembly using GCC 6.2 -m32: main: lea ecx, [esp+4] and esp, -8 ...
Person.Junkie's user avatar
1 vote
1 answer
2k views

Is it possible ( or how) to dump source code/machine code from memory?

I am actually working for the side of software protection. But in order to properly protect my source code ( be it .Net or C++), I would need to understand what is achievable ( and not achievable) ...
Graviton's user avatar
  • 133
1 vote
1 answer
137 views

What means this code?

cseg01:00020DB8 mov eax, offset screen_with_height cseg01:00045704 mov dword ptr [eax+0Ah], 0 cseg01:0004570B call sub_466F8 ; call some proc ...
black4's user avatar
  • 343
1 vote
1 answer
1k views

Can I get a valid source code from this assembly?

I've used the IDA 8.0 Demo to retrieve (from a .DLL) the assembly code, such as: ; code pxor xmm0, xmm0 ucomiss xmm0, xmm1 ja short loc_67F31600 movss xmm2, cs:...
markzzz's user avatar
  • 87
1 vote
1 answer
138 views

Removing empty blocks ida api

i have a c++ module that removes empty block it used to work well but now I'm porting it to ida 7.7 I'm having issues. mba_t *mba; mba->remove_empty_blocks(); It throws following error "...
Ronny's user avatar
  • 73
1 vote
2 answers
2k views

Is it possible/feasible to decompile a program written in C++ to C?

I've not seen a lot of material on this. I've seen people attempting to bring a C++ program back to C++ code, and claiming how hard it is, but C code from C++ program? I don't know. If it is possible, ...
Luke Dunn's user avatar
1 vote
1 answer
476 views

Hex-rays decompiler incorrect logic

I'm practicing reverse engineering in IDA and I created an example application in Visual C++ to practice working with classes/structs and the decompiler output seems to be incorrect - I would like to ...
Naxin's user avatar
  • 180
1 vote
1 answer
319 views

Hook naked function with CPU registers

I need to hook this function: .text:005589CB sub_5589CB proc near ; CODE XREF: AddHealth(int,long)+1A↑j .text:005589CB ; sub_5328D8+98E↑p ... ...
user3449922's user avatar
1 vote
2 answers
2k views

STL Data Structures Hex-Rays

We all know that reversing STL code is no fun. To make it easier, I usually create some of the strucutres so I can reference the created STL structures in another custom structure. For example, msvc - ...
Martin Brooker's user avatar
1 vote
1 answer
964 views

Assembly and C++

I'm trying to learn Reverse Engineering, at this time I compile C++ code without any optimization and see the correspond assembly in IDA's disassembler, but there are some parts of the code, where I ...
J. Doe's user avatar
  • 95
1 vote
2 answers
1k views

C/C++ to Assembly language

Is there any book or articles related to how C/C++ code is converted to assembly language, I mean common patterns for a specific compiler, etc?
J. Doe's user avatar
  • 95
1 vote
1 answer
2k views

Borland C++ runtime startup

I'm trying to reverse engineer an ages-old game compiled with Borland C++ in 1995. So far, I have found out that start @0x401000 passes to __startup in cw3220.dll (which apparently is Borland's C++ ...
Skynet's user avatar
  • 175
1 vote
1 answer
53 views

Which interrupt was called

cseg01:00046E80 sub_46E80 proc near ; CODE XREF: sub_46ED8+81p cseg01:00046E80 ; sub_47164+6Dp cseg01:00046E80 000 ...
black4's user avatar
  • 343
1 vote
1 answer
105 views

Where is IDA getting this symbol?

I'm currently researching how a certain malware works and patches some stuff in a certain Android's library. Inspecting the library -which is stripped- in IDA I was able to get the symbol for a ...
Arget's user avatar
  • 13
1 vote
1 answer
761 views

Identifying C/C++ Library Functions

I am attempting to reverse-engineer an old DOS executable, which seems to have been compiled around 1992 using Microsoft's C compiler at the time. When opening the executable in Ghidra no imports are ...
jttri777's user avatar
  • 165
1 vote
1 answer
658 views

Strange DWORD/QWORD C++ Strings in decompilation

I have never seen something like this before but I assume this is some kind of way C++ allocates dynamic strings. In my decompilation listing in Ghidra I see something like: local_14 = DAT_00404004 ^...
John S.'s user avatar
  • 23
1 vote
2 answers
497 views

Relationship between compiled bytes of jmp instruction and target memory address

I'm very new to all this, so sorry if I mess up and/or am unclear. I'm working on reverse engineering assault cube, where a lot of people start, and I'm struggling to understand how this one AOB ...
owaowabeep's user avatar
1 vote
1 answer
120 views

IDA SDK - can't understand the output of displacement query functions?

OK so I want to parse x86 instructions with IDA SDK. However I can't understand the output, I have this code (that is executed after decode_insn at each operand that is present (type not 0)): //op is ...
rec's user avatar
  • 475
1 vote
1 answer
156 views

How to split bytes into instructions in binary ELF file for x86

I'm working on a static code injector for ELF files. I need to "steal" some bytes in order to write jump to my code on their place and then execute stolen instructions somewhere in the ...
Nazar Pasternak's user avatar
1 vote
1 answer
1k views

Why does decompiling a C++ using Snowman yield some full variable names and some obfuscated ones?

I decompiled a C++ exe file using Snowman, hoping to see if it was malware or not (Although, honestly, I have no clue how to continue that - The file is really large, and the decompilation mostly ...
Fly's user avatar
  • 111
1 vote
1 answer
2k views

Extracting functions of .obj file (compiled by myself with Visual Studio 19) --> extracts wrong data

How can I find only real functions not data garbage like section..debug_S_105 ? * I need to collect function data (assembler code) of Open Source C++ Files which I compile with Visual Studio 19 (sln ...
sandlord1's user avatar
1 vote
1 answer
398 views

Odd convention for accessing elements of an array?

While reverse engineering a game using the Hex Rays decompiler I was looking for how an array of NPC's was accessed. I found the array but I don't quite understand the unusual formula for getting the ...
Edward Severinsen's user avatar
1 vote
1 answer
156 views

Object references representation in pseudocode

I'm trying to understand how function calls are represented in Hex Rays' pseudocode, especially if the call expects pointers to objects. Let's say I'm looking at a line of code in a function called ...
oxident's user avatar
  • 25
1 vote
1 answer
178 views

How can an IA-32 program seemingly compiled with MSVC send its sole argument via EAX? [duplicate]

A C++ program I'm looking at appears to have been compiled with MSVC. It links to MSVCR100.dll, contains MSVC's security cookie code and uses the Microsoft mangling scheme. However, one of the ...
Ben Jaguar Marshall's user avatar
1 vote
1 answer
385 views

Finding variable reference in cpp

Let's bring example We have string 0000000000bd2906 db "CurrentKey", 0 ; DATA XREF=sub_555670+3390 And it's used here 00000000005563ae lea rsi, qword [0xbd2906] ; "CurrentKey" Disassembler ...
user avatar
1 vote
1 answer
584 views

Trying to call DLL's functions from my exe

I am new here and I have a question for you guys (C++) I will try to describe my situation with some details so that you can understand this better. This might be long(er) but it might be necessary ...
782458's user avatar
  • 11
1 vote
1 answer
229 views

Question about IDA 6.8, also why its creating unnecessary vars

recently I've been learning to do RE. I made a simple program in 10 seconds that I was going to mess around with in IDA. #include <iostream> int main(int argc, char* argv[]) { printf("...
Verideth's user avatar
1 vote
2 answers
359 views

Adding Features to a Released PC Game

I've just recently finished a C++ class at my university, and I'm curious about game-modding/reverse engineering. My ultimate goal is to add features that were missing from the latest version of a ...
Swamp's user avatar
  • 11
1 vote
1 answer
686 views

What is all this code for?

In order to be able to effectively reverse assembly one needs to understand how different compilers work, and what are the common code generation patterns. If you do not know them, you spent much more ...
Andrew Savinykh's user avatar
1 vote
1 answer
120 views

How can I recover / locate non-virtual class methods at run-time?

I know how to find and hook virtual methods by crawling an object's RTTI. I cannot find enough information about non-virtual class methods. Is there anyway to identify non-virtual class methods at ...
question_asker_777's user avatar
1 vote
1 answer
137 views

Chrome Vulnerability Issue

My fuzzer recently crashed chrome and dumped what appears to be an exploitable vulnerability. I'm having an issue debugging it, as the referenced source appears incompatible with the version of chrome ...
grepNstepN's user avatar
1 vote
1 answer
883 views

Cannot call function (properly) in C++

I am developing a DLL for the purpose of injecting it into a running process for a game. I've found the memory addresses to some key functions(via Immunity Debugger) and I am trying to call those ...
SuperA's user avatar
  • 11
1 vote
1 answer
247 views

How do I map the std::_Ios_Openmode passed to basic_fstream to an actual value?

I am working on some ARM disassembly. A file is being operated on: 0000e550 sub r3, r11, #0x2d0 0000e554 mov r0, r3 ; /tmp/MAC 0000e558 ldr r1, = 0x9a60c ; 0xec04 (sub_e3a8 + 0x85c) ...
Cybergibbons's user avatar
  • 1,762
1 vote
2 answers
245 views

Reassembler toolchain

I'm looking for tools to: Disassemble a function from a x86 Windows executable into an asm file. Edit the file. Assemble the file again into an object file that can then be linked into a DLL. Inject ...
XTF's user avatar
  • 241
1 vote
2 answers
664 views

How do I get the start address of the 'code section' and its size to know the end address?

I am trying to read the binary code in the text section of an executable game file (PE) programmatically but I don't know the start address and the end address of the text section. I am using C++/...
Lion King's user avatar
  • 269
1 vote
1 answer
103 views

Turning very complicated arithmetic and reverse engineered check into useable code in C#

so I have this problem of me not understanding how to convert this one function into useable code in C#. Problem being that I am currently hooking into a game via C# and I want to rebuild a function ...
Oliver Vedel Rasmussen's user avatar
1 vote
1 answer
276 views

How can I override a x86 instruction in c++?

I am trying to replace a jmp instruction with a ret in c++. How can I do that?
Mlemix's user avatar
  • 21
1 vote
1 answer
265 views

Calling function with string as parameter

I'm trying to call a function in a game that makes my character sending a message. I already called a few functions in this game but this one has a tricky parameter. The function signature should be ...
kuhi's user avatar
  • 161
1 vote
1 answer
222 views

Can a MSVC class have a deletion destructor without a vftable?

I'm reversing the following smart pointee-like MSVC class Buffer : public Referencable with IDA / Hexrays: struct Referencable { int m_refs; }; struct Buffer : Referencable { void* m_pData; }; ...
Ray's user avatar
  • 1,103
1 vote
1 answer
122 views

How could I find a call of a function thats only referenced inside a vftable?

So I have this function which I'm trying to figure out the arguments to. However, all the xrefs of it point to a VFTable. How would I find a call for this function?
Mlemix's user avatar
  • 21
1 vote
1 answer
200 views

IntelPin, Ins_Insertcall?

please help me with Intel Pin: I print each instruction to the console and I want to insert +++++ after it using Ins_Insertcall: VOID CpuidCalled(const CONTEXT* ctxt) { std::cerr << "+++++&...
ALex's user avatar
  • 21
1 vote
1 answer
793 views

How is it possible to generate C++ class header from a .dll or ELF file?

I loaded a dynamic library file to IDA. I can clearly see the function signatures from the "Function name list". There are RTTI items in the "Structures" tab as well, but I don't ...
Iter Ator's user avatar
  • 214

1
3 4
5
6 7
10