Questions tagged [c++]
C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language.
457
questions
0
votes
0
answers
59
views
Windows kernel Dev
I'm writing a basic program that'd allow me to list the running processes on a windows system but by simply trying to go through the ActiveProcessLinks of the _EPROCESS structure.The problem I'm ...
- 1
0
votes
0
answers
36
views
Compiler settings for show main func in IDA
Why in dissasemble code in IDA, some programs have func "main" in begin (in start window in IDA) like this:
cseg01:00038460 ; =============== S U B R O U T I N E =============================...
- 363
0
votes
0
answers
76
views
Is game hacking all about memory manipulation?
I wanted to know if game hacking is all about manipulating memory ?
and If we need anything more than, this topics for game hacking ?
memory manipulation
Reverse engineering
Windows internals
C++ ...
- 1
0
votes
0
answers
57
views
MS-DOS 32 bit mode Timer interrupt
My application works in 32 bit MS-DOS mode with dos4gw.exe extender. variables unknown_bool_0004AA8A = 1, unknown_bool_0004AAA0 = 1.
cseg01:0004AAB3 mov eax, offset Proc_Addr1
...
- 363
0
votes
1
answer
138
views
Get hardcoded char array from compiled C++ source
It is well known that literal strings can be retrieved from C++ compilates. For example, the output of
g++ a.cpp
on
int main(void)
{
const char * secret0 = "abcdefghijklmnopqrstuvwxyz";
...
- 101
0
votes
0
answers
53
views
How many bytes allocated for buffer?
There is start of function:
cseg01:0001F4C8 Check_CDRom proc near ; CODE XREF: Init+Ap
cseg01:0001F4C8
cseg01:0001F4C8 var_24 = byte ptr -24h
cseg01:0001F4C8
cseg01:0001F4C8 ...
- 363
0
votes
2
answers
225
views
How does IDA know the symbol names for classes and interfaces?
I am reversing a 32 bit library used by a Linux game (I am sure someone might recognize the engine used). I was messing around with cutter and when trying to compare it to IDA, which I have used in ...
- 103
0
votes
0
answers
180
views
Can't get Visual C++ to generate the same code give by Ghidra
I'm using visual c++ to create a mock dll that I'm trying to reverse using Ghidra and I'm doing good progress so far, however I'm stuck in a function that ghidra gives me the following:
...
- 101
0
votes
1
answer
3k
views
How do I get all sections in a PE file using C++?
So I am wondering how can I get all sections and their info from a dumped PE file on the disk, using C++.
I have the entire PE loaded on a buffer, the NT headers, and hopefully the DOS headers.
I need ...
- 28
0
votes
0
answers
742
views
IDA does not load PDB file
I have C++ project compiled (debug) with Visual Studio 2019, and I have IDA 5.0 Free version. When I load my .EXE file, IDA does not load correspond PDB file and return message: PDB total 0 symbol ...
- 363
0
votes
0
answers
230
views
The way to determine how the decompiled constructor is structured
I have the following constructor decompiled by Ghidra, i.e. Game. I know some of the functions, which are part of that constructor. And thus I have created my interpretation of that structure. But I ...
- 328
0
votes
0
answers
111
views
Does loading custom PDB help reversing behemoth program?
What I reverse :
Old 4~8mb games compiled with vc++ 2006~2008(depends on version), whose source code is lost.
It(they) has the mixtures of their custom structures, classes and directX sdk ...
- 1
0
votes
1
answer
157
views
How to call your version of the existing function using proxy dll?
I have bits of code which decompiles a small part of the existing program. I have added it to the proxy dll. The code to the existing functions is hooked through Detour and looks like below (gui.h and ...
- 328
0
votes
0
answers
323
views
Ida pro doesn't demangle all function names
I am using Ida Pro 7.0 and working with a binary (firmware) written in C++ .Fortunately there are symbols in the firmware and I know function names but Ida didn't manage to demangle all function ...
- 1
0
votes
1
answer
115
views
How to make sense of the pointer in reversed function call?
I have the code below, derived from the reversed function in the original application:
gladius::world::World::create(*(gladius::world::World**)(*(char*)(this + 0x5e8) + 0x50));
The create function ...
- 328
0
votes
1
answer
421
views
Proxy dll doesn't load the original dll
I have relatively simple code here for the proxy DllMain() function:
BOOL APIENTRY DllMain(HMODULE hDll, DWORD reason, LPVOID reserved)
{
if (reason != DLL_PROCESS_ATTACH) {
return TRUE;
}
...
- 328
0
votes
1
answer
89
views
Modify main function for C++ game file
I am trying to modify the main function for a specific decompiled .exe. More specifically, I want to remove the reference to GUI from that .exe file, so that GUI doesn't get initialised on the startup ...
- 328
0
votes
0
answers
64
views
exports kernel Windows for informations on hardware
Good day! I develop small security software and use a driver like any modern security software. Can you please tell me if there are any exported functions from ntoskrnl.exe or hal.dll or other kernel ...
- 21
0
votes
0
answers
157
views
x64dbg & Ghidra change combobox properties app in Visual C++ MFC
Hello in the program code the property combobox is changed from enable to disable I would like to change that the program does not change this property. I have found commands that assign new items to ...
- 1
0
votes
0
answers
83
views
Is there a way to aid the IDA decompiling process?
I want to make all local variables contained in a structure with appropriate padding put in the gaps (unused parts of the frame). I want to do the same for the global data. And I want to rename ...
- 475
0
votes
0
answers
189
views
Detours ws2_32.dll [Send]
I have a program that calls send (), I need to change the host to my own, but this does not work (either the program crashes or the request does not reach the server) - I log requests on the server. ...
- 1
0
votes
1
answer
146
views
How can a debugger break on dynamic loaded libraries?
I think I have a massive understanding problem with the following issue:
Usually the loader will fix the Import Table for the modules that have been loaded, right, so if I set a breakpoint on ...
- 35
0
votes
0
answers
313
views
Watching a TLS Slot value in x64dbg
I am new to reverse engineering and I was trying to debug why a 3rd party application was crashing when I m injecting my DLL in it. (There are some cases where it didn't crash)
So I was able to figure ...
- 101
0
votes
0
answers
227
views
Crash after hook a function
I have hooked a sound function that work within the game menu after, when the battle start, the game will crash.
The function at the first parameter get correctly the sound file name, before the ...
- 289
0
votes
0
answers
154
views
Change value of memory in a debugger?
So I got this app loaded in x64, there is a function, let's say
"HeatGainedPerShot", which is basically the value which an object gains everytime it fires,
Such a value would normally exist ...
0
votes
0
answers
531
views
DLL injection (Failed to inject)
I have found this complete and easy example to test the function hook:
https://github.com/Zer0Mem0ry/Detour
#include <Windows.h>
#include <iostream>
#include "detours.h"
#...
- 289
0
votes
1
answer
673
views
How i can grab a pointer or hook the process procedure without creating a global hook [closed]
i am trying to hook wndproc in an game, to do that i am injecting a dll into their memory, my problem is i don't wanna do a Global Hook to the wndproc, i want to get a pointer to his procedure to do ...
- 3
0
votes
0
answers
249
views
Some more questions related to C++ exceptions (catchHigh)
I've came up with the most convoluted example but still can't find the purpose of the catchHigh field. I find it that the right handler can be selected simply by looking at the tryblock map from start ...
- 475
0
votes
1
answer
1k
views
c++ reading process memory with injected DLL
The reading works fine until it reaches base+27.058.176(bytes) address. At this address VirtualProtect() failes with error 487 (Attempt to access invalid address).
Why does it return this error? Btw ...
- 11
0
votes
0
answers
29
views
Understanding obscure function names [duplicate]
I have seen functions like this before in disassembly but don't have a clue what they are. Their names are extremely confusing. Would someone be able to explain what these are?
- 105
0
votes
0
answers
277
views
Detouring function cause exception access violation
i am learning to detouring functions, but i run into one that i cannot be resolved.
I use the Detour lib from microsoft, and a custom method.
Both cause the same problem, the function is hooked and ...
- 101
0
votes
0
answers
3k
views
Lua script decode method?
I have a game plugin that enables the lua script encryption.I tried to decode it but it seems used many useless encode method to let you cannot understand it.It seem like some enctypted lua script ...
- 1
0
votes
1
answer
726
views
Abusing the strlen output
My question is related to the strlen function from the C and C++.
I am reversing a program, that reads a byte data from allocated memory and sends to the strlen directly. To be completely honest ...
0
votes
1
answer
241
views
Writing a DLL in C# vs C++? [closed]
I am trying to make a client-sided anticheat which would work similar to BattlEye or GameGuard. In order to do this, I want to create a DLL which would do the cheat verification, which then I would ...
- 103
0
votes
1
answer
2k
views
Trying to understand *((_DWORD *) in IDA pro
Hi I am trying to understand pseudocode from this game I'm currently modifying.
if ( v11 == 501736410 ) // case 0x1DE7E3DA: //"Weapon"
{
*((_DWORD *)v6 + 326) = 3;
}
else if (...
0
votes
0
answers
381
views
How Do i create a simple Detour Library
Quite new to Reverse Engineering and making Detour Functions, Just need some form of clarification here, i am trying to make a Simple x86 Detour library and i have worked on something using some ...
- 1
0
votes
0
answers
355
views
x64 hook Fails on Messagebox
Quite new to the intels so i might not know much , I just need some form of direction here.
I am trying to do a simple 64 bit hook detour for function hooking
I do it like so :
The detour hook ...
- 1
0
votes
1
answer
883
views
What does "Process exited cleanly (number)" mean?
I'm trying to bypass the security that checks if a file is modified on an android app and will crash without error if modified. It have around 10 fake crashes. I have bypassed some of them in smali ...
- 133
0
votes
1
answer
495
views
Translating ida macros and pseudocode into C++/C
What would be the translated C output of this hexrays decompiler pseudocode? The values of v6 and v5 are floats just as v8. The value of xmmword_108365D0 is 7FFFFFFF7FFFFFFF7FFFFFFF7FFFFFFFh
v8 = (...
0
votes
1
answer
843
views
It's possible call a function outside a original thread?
Example:
I have a function in a process on the memory address: 0xABCDEF, but that function cannot be called outside of original thread, it's possible to call it or hook it somehow?
To what i'm going ...
- 197
0
votes
1
answer
347
views
Detour null function
I've been trying to detour a nullsub, this function is used with log purposes, but as the program is compiled under release flags it got removed and I'd like to restore it.
IDA reports as follow:
....
- 3
0
votes
0
answers
50
views
Means of generating file hashes
I'm working with a relatively well secured program. In addition to memory validation checks during run time, the actual file integrity is checked at start. Both checks are synced with the server and I'...
- 185
0
votes
1
answer
432
views
What is, and why, "byte[ ] + number" in this IDA pseudocode?
This is a decompile of an .so file, so it originated from C or C++. Can you kindly try to explain to me what this does?
How would one rewrite this into readable code? I don't mind any programming ...
- 1
0
votes
1
answer
1k
views
Calling internal functions via dll injection - runtime error
I am trying to modify closed source game client that works with my game server. The purpose of that is being able to add new graphical elements into the client.
I have read a lot of tutorials about ...
- 109
0
votes
1
answer
2k
views
VirtualProtect a function isn't working.
I've been trying to make some modding tools for quake live by reverse engineering, and I have this function. I rebased my program to 0x0, and did pretty much everything to set me up. However, when I ...
- 31
-1
votes
2
answers
982
views
Add Section to pe file function error [closed]
I'm having some strange errors with the following function which adds a section to a pe executable. When I run the program I get the success message, when I proceed to try to open the executable in ...
- 31
-1
votes
1
answer
84
views
Is there any windows API to execute thread on atomic mode? [closed]
Is there any windows API (application program interface) to execute thread on atomic mode?
- 121
-1
votes
1
answer
888
views
How to call and what means: _DWORD *__thiscall
I have one question maybe you can help, I always find this functions in IDA:
void __thiscall sub_79340(_BYTE *this, int a2, int a3, int a4)
And I use them like this:
// talkChannel
typedef DWORD(...
- 161
-1
votes
1
answer
114
views
What does std::string::oprator__unsigned_long do?
I am new to reverse c++ program.
I met this code from r2 decompilation.
pcVar6 = (char *)sym.imp.std::string::operator___unsigned_long
(&...
- 1
-1
votes
1
answer
346
views
Fuzz Test Suite for C/C++ Command Line Argument/Standard Input programs
I have implemented a basic coverage guided fuzzer that is sending inputs to programs accepting ONE command line argument or ONE standard input. I am trying to find a complex code to fuzz that can meet ...
