Questions tagged [c++]
C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language.
432
questions
0
votes
0
answers
472
views
DLL injection (Failed to inject)
I have found this complete and easy example to test the function hook:
https://github.com/Zer0Mem0ry/Detour
#include <Windows.h>
#include <iostream>
#include "detours.h"
#...
- 279
0
votes
1
answer
573
views
How i can grab a pointer or hook the process procedure without creating a global hook [closed]
i am trying to hook wndproc in an game, to do that i am injecting a dll into their memory, my problem is i don't wanna do a Global Hook to the wndproc, i want to get a pointer to his procedure to do ...
- 3
0
votes
0
answers
217
views
Some more questions related to C++ exceptions (catchHigh)
I've came up with the most convoluted example but still can't find the purpose of the catchHigh field. I find it that the right handler can be selected simply by looking at the tryblock map from start ...
- 455
0
votes
1
answer
1k
views
c++ reading process memory with injected DLL
The reading works fine until it reaches base+27.058.176(bytes) address. At this address VirtualProtect() failes with error 487 (Attempt to access invalid address).
Why does it return this error? Btw ...
- 11
0
votes
0
answers
28
views
Understanding obscure function names [duplicate]
I have seen functions like this before in disassembly but don't have a clue what they are. Their names are extremely confusing. Would someone be able to explain what these are?
- 105
0
votes
0
answers
249
views
Detouring function cause exception access violation
i am learning to detouring functions, but i run into one that i cannot be resolved.
I use the Detour lib from microsoft, and a custom method.
Both cause the same problem, the function is hooked and ...
- 101
0
votes
0
answers
3k
views
Lua script decode method?
I have a game plugin that enables the lua script encryption.I tried to decode it but it seems used many useless encode method to let you cannot understand it.It seem like some enctypted lua script ...
- 1
0
votes
1
answer
651
views
Abusing the strlen output
My question is related to the strlen function from the C and C++.
I am reversing a program, that reads a byte data from allocated memory and sends to the strlen directly. To be completely honest ...
0
votes
1
answer
208
views
Writing a DLL in C# vs C++? [closed]
I am trying to make a client-sided anticheat which would work similar to BattlEye or GameGuard. In order to do this, I want to create a DLL which would do the cheat verification, which then I would ...
- 103
0
votes
1
answer
2k
views
Trying to understand *((_DWORD *) in IDA pro
Hi I am trying to understand pseudocode from this game I'm currently modifying.
if ( v11 == 501736410 ) // case 0x1DE7E3DA: //"Weapon"
{
*((_DWORD *)v6 + 326) = 3;
}
else if (...
0
votes
0
answers
349
views
How Do i create a simple Detour Library
Quite new to Reverse Engineering and making Detour Functions, Just need some form of clarification here, i am trying to make a Simple x86 Detour library and i have worked on something using some ...
- 1
0
votes
0
answers
317
views
x64 hook Fails on Messagebox
Quite new to the intels so i might not know much , I just need some form of direction here.
I am trying to do a simple 64 bit hook detour for function hooking
I do it like so :
The detour hook ...
- 1
0
votes
1
answer
777
views
What does "Process exited cleanly (number)" mean?
I'm trying to bypass the security that checks if a file is modified on an android app and will crash without error if modified. It have around 10 fake crashes. I have bypassed some of them in smali ...
- 133
0
votes
1
answer
479
views
Translating ida macros and pseudocode into C++/C
What would be the translated C output of this hexrays decompiler pseudocode? The values of v6 and v5 are floats just as v8. The value of xmmword_108365D0 is 7FFFFFFF7FFFFFFF7FFFFFFF7FFFFFFFh
v8 = (...
0
votes
1
answer
783
views
It's possible call a function outside a original thread?
Example:
I have a function in a process on the memory address: 0xABCDEF, but that function cannot be called outside of original thread, it's possible to call it or hook it somehow?
To what i'm going ...
- 197
0
votes
1
answer
329
views
Detour null function
I've been trying to detour a nullsub, this function is used with log purposes, but as the program is compiled under release flags it got removed and I'd like to restore it.
IDA reports as follow:
....
- 3
0
votes
0
answers
50
views
Means of generating file hashes
I'm working with a relatively well secured program. In addition to memory validation checks during run time, the actual file integrity is checked at start. Both checks are synced with the server and I'...
- 185
0
votes
1
answer
386
views
What is, and why, "byte[ ] + number" in this IDA pseudocode?
This is a decompile of an .so file, so it originated from C or C++. Can you kindly try to explain to me what this does?
How would one rewrite this into readable code? I don't mind any programming ...
- 1
0
votes
1
answer
1k
views
Calling internal functions via dll injection - runtime error
I am trying to modify closed source game client that works with my game server. The purpose of that is being able to add new graphical elements into the client.
I have read a lot of tutorials about ...
- 109
0
votes
1
answer
2k
views
VirtualProtect a function isn't working.
I've been trying to make some modding tools for quake live by reverse engineering, and I have this function. I rebased my program to 0x0, and did pretty much everything to set me up. However, when I ...
- 31
-1
votes
2
answers
946
views
Add Section to pe file function error [closed]
I'm having some strange errors with the following function which adds a section to a pe executable. When I run the program I get the success message, when I proceed to try to open the executable in ...
- 31
-1
votes
1
answer
81
views
Is there any windows API to execute thread on atomic mode? [closed]
Is there any windows API (application program interface) to execute thread on atomic mode?
- 121
-1
votes
1
answer
655
views
How to call and what means: _DWORD *__thiscall
I have one question maybe you can help, I always find this functions in IDA:
void __thiscall sub_79340(_BYTE *this, int a2, int a3, int a4)
And I use them like this:
// talkChannel
typedef DWORD(...
- 161
-1
votes
1
answer
110
views
What does std::string::oprator__unsigned_long do?
I am new to reverse c++ program.
I met this code from r2 decompilation.
pcVar6 = (char *)sym.imp.std::string::operator___unsigned_long
(&...
- 1
-1
votes
1
answer
339
views
Fuzz Test Suite for C/C++ Command Line Argument/Standard Input programs
I have implemented a basic coverage guided fuzzer that is sending inputs to programs accepting ONE command line argument or ONE standard input. I am trying to find a complex code to fuzz that can meet ...
-1
votes
2
answers
669
views
How can I get the process information in windows without using APIs?
I want to write a program to obtain the information of process, for the purpose of detecting and combating malware. I can use C++ and Win32 APIs to finish it, but I then started suspecting those APIs ...
- 1
-1
votes
2
answers
224
views
which windows API called when execute wmic qfe get hotfixid command?
which windows API called when execute this command
wmic qfe get hotfixid
command?
- 121
-1
votes
1
answer
114
views
How return type works [closed]
I declared this
int returnDummy() {
return 0x100;
}
and compile as a static libray.
What result will be returned if I declare the prototype like this,
bool returnDummy();
and link upper static ...
- 31
-2
votes
1
answer
2k
views
How can I locate exported functions of an EXE or DLL? [closed]
I am trying to do some experimenting with certain system files (DLLs, EXEs) in Windows and would like to know how I can get information about the functions that they contain. I want to be able to call ...
- 177
-2
votes
1
answer
621
views
How decompilation works? [closed]
what is the theory behind the subject of translate assembly code to pseudo code?
Could you explain few words ? Also some book about it?
- 11
-2
votes
1
answer
106
views
Hash from pseudocode [closed]
What is the hash? Generated from ida pro
int __fastcall hash(_BYTE *a1)
{
_BYTE *v1; // r4@1
int v2; // r5@1
int v3; // r6@1
v1 = a1;
v2 = 0;
v3 = 1;
while ( *v1 )
{
v3 = (*v1 + ...
-2
votes
1
answer
1k
views
Aside from Assembly, should I learn C or C++?
With Malware/Virus analysis being heavily dependant on one's ability to read the the Assembly Code generated by the Disassembler... being familiar with the Assembly Language is naturally the most ...
