Questions tagged [c++]

C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language.

Filter by
Sorted by
Tagged with
0 votes
1 answer
95 views

Hooking a function

So, I'm attempting to create a mod for an older game, Fable: The Lost Chapters. I was able to find the MacOS release of the game, which contains symbols, and I was also able to find a leaked debug ...
Reaper's user avatar
  • 1
0 votes
1 answer
36 views

Hook: can call string::size() but crashing when reading string data... how to read without crash?

I'm hooking a function that reads and decrypt files and my idea is to read the buffer once it's decrypted: typedef void(__thiscall* _readFileContents)(DWORD* _resourceManager, std::string* buffer, std:...
kuhi's user avatar
  • 161
2 votes
0 answers
86 views

Vtables in objects with inheritance in IDA

I'm struggling to get object inheritance working in IDA. The original structure is as follows: INoticeSource : INoticeSink IRTTITypeInfo : IUnknown, INoticeSource IPersist : IUnknown IPersistStream : ...
ZivDero's user avatar
  • 21
0 votes
1 answer
81 views

How can I debug if the program closes directly?

I'm trying to debug a game and it's closing under few circumstances: When debugging (solved by hooking IsDebuggerPresent to return false when called by the game) When setting a memory/hardware ...
kuhi's user avatar
  • 161
0 votes
0 answers
54 views

How can I change the data type of `puVar1` in this C++ function?

I was reversing ( new to the reversing world of course) being using Ghidra for this. I get a C++ function AppChat::__Status::setDescription(ErrorCode param_1). Within this function, there's a variable ...
hanan's user avatar
  • 309
0 votes
1 answer
103 views

Where to find the Visual C++ 6.0 CRT Source Code?

I want to see MSVCRT's implementation details for the old Microsoft Visual Studio C++ 6.0 compiler. On newer Visual Studio versions, it is located in /VC/crt/src/ directory, but there is no such ...
void_17's user avatar
  • 33
0 votes
1 answer
84 views

Flag 200h open file

cseg01:00056938 mov edx, offset var_byte_0004DCC8 cseg01:0005693D mov eax, offset hmi_drv_str cseg01:00056942 call strcpy_ cseg01:00056947 ...
black4's user avatar
  • 333
1 vote
1 answer
92 views

Where is IDA getting this symbol?

I'm currently researching how a certain malware works and patches some stuff in a certain Android's library. Inspecting the library -which is stripped- in IDA I was able to get the symbol for a ...
Arget's user avatar
  • 13
0 votes
1 answer
77 views

Patch all calls to a single function using IDC

I am quite new in reverse-engineering and programming in general, sorry in advance if this question is dumb. It goes like this: In c++ disassembled code exist calls to a certain function. 2 thousand ...
flying_meatball's user avatar
0 votes
0 answers
52 views

Windows kernel Dev

I'm writing a basic program that'd allow me to list the running processes on a windows system but by simply trying to go through the ActiveProcessLinks of the _EPROCESS structure.The problem I'm ...
Essole's user avatar
  • 1
0 votes
1 answer
69 views

How to call unexported function in a third party DLL while having its PDB?

I'm new to reverse engineering and recently met with a problem: I have the dll and pdb of a debug version third party module, but I don't have its source codes. Now I want to write a piece of C++ code ...
猫宮かさね's user avatar
0 votes
0 answers
35 views

Compiler settings for show main func in IDA

Why in dissasemble code in IDA, some programs have func "main" in begin (in start window in IDA) like this: cseg01:00038460 ; =============== S U B R O U T I N E =============================...
black4's user avatar
  • 333
2 votes
1 answer
437 views

How to search a sequence of instructions in Ghidra?

I'd like to identify in Ghidra a specific sequence of instructions, which I get from MSVC Debug in Visual Studio compiling my own function: What I'm looking for so is (for the same DLL, decompiled in ...
markzzz's user avatar
  • 87
0 votes
0 answers
67 views

Is game hacking all about memory manipulation?

I wanted to know if game hacking is all about manipulating memory ? and If we need anything more than, this topics for game hacking ? memory manipulation Reverse engineering Windows internals C++ ...
Mahdi's user avatar
  • 1
0 votes
0 answers
55 views

MS-DOS 32 bit mode Timer interrupt

My application works in 32 bit MS-DOS mode with dos4gw.exe extender. variables unknown_bool_0004AA8A = 1, unknown_bool_0004AAA0 = 1. cseg01:0004AAB3 mov eax, offset Proc_Addr1 ...
black4's user avatar
  • 333
0 votes
1 answer
45 views

Assembler OR operation

Is this asm code: or unknown_byte_0004AAA7, 1 dseg05:000C7FDC unknown_byte_0004AAA7 db 0 equivalent to this C++ code below? bool unknown_byte_0004AAA7 = 0; unknown_byte_0004AAA7 = ...
black4's user avatar
  • 333
0 votes
1 answer
70 views

Updating legacy library in an already compiled binary

I'm dealing with a reverse engineering challenge involving a binary application that was statically compiled with a legacy library. While the legacy library is not vulnerable, it lacks certain ...
st0l4s's user avatar
  • 3
1 vote
1 answer
133 views

What means this code?

cseg01:00020DB8 mov eax, offset screen_with_height cseg01:00045704 mov dword ptr [eax+0Ah], 0 cseg01:0004570B call sub_466F8 ; call some proc ...
black4's user avatar
  • 333
0 votes
1 answer
116 views

Get hardcoded char array from compiled C++ source

It is well known that literal strings can be retrieved from C++ compilates. For example, the output of g++ a.cpp on int main(void) { const char * secret0 = "abcdefghijklmnopqrstuvwxyz"; ...
Nico Schlömer's user avatar
0 votes
1 answer
46 views

Making zero terminated string WATCOM compiler

This is WATCOM compiler. Assembler code below try create random 8 letters to compose zero terminated string. cseg01:0001F544 Try_Write_To_Disk proc near ; CODE XREF: Check_CDRom+46p cseg01:...
black4's user avatar
  • 333
0 votes
0 answers
49 views

How many bytes allocated for buffer?

There is start of function: cseg01:0001F4C8 Check_CDRom proc near ; CODE XREF: Init+Ap cseg01:0001F4C8 cseg01:0001F4C8 var_24 = byte ptr -24h cseg01:0001F4C8 cseg01:0001F4C8 ...
black4's user avatar
  • 333
0 votes
1 answer
83 views

Creating the SkiFree 2 dream... An introduction [closed]

I am no programmer but I like to do it for my own purpose and entertainment. As in earlier posts I said: Excuse me, I am just liking to use the SkiFree source code for my very own purpose. The purpose ...
Picaboo3's user avatar
1 vote
1 answer
214 views

Retrieve & dump type information from IDA Pro

I want to retrieve IDA Pro .idb database's each type info, such as: size and name of a structure; each member variable type and name; each member variable size and offset; And dump it to a .h file ...
void_17's user avatar
  • 33
1 vote
1 answer
511 views

Identifying C/C++ Library Functions

I am attempting to reverse-engineer an old DOS executable, which seems to have been compiled around 1992 using Microsoft's C compiler at the time. When opening the executable in Ghidra no imports are ...
jttri777's user avatar
  • 165
1 vote
0 answers
38 views

Retrieve functionality to button - game patching

I'm patching an old game, and I want the retrieve the toggle fullscreen functionality it's supposed to have. In the menu, in the display tab, there is a disabled option of fullscreen mode that you can ...
Yair Derry's user avatar
0 votes
2 answers
155 views

How does IDA know the symbol names for classes and interfaces?

I am reversing a 32 bit library used by a Linux game (I am sure someone might recognize the engine used). I was messing around with cutter and when trying to compare it to IDA, which I have used in ...
trxgnyp1's user avatar
  • 103
0 votes
0 answers
37 views

How can I make a quick tracer for a PE file?

INTRODUCTION: I made my tracer on the event debug loop, but after I compared its speed characteristics with the same PinTool or similar tools, I realized that my tracer is several dozen times slower ...
Swoke's user avatar
  • 11
2 votes
1 answer
350 views

IDA: Demangled name simplification in idapython

With idapython I would like to get demangled names with the name simplification (bottom of page) applied to them. For example, the following function: Python> ida_name.demangle_name(idc....
Blub's user avatar
  • 123
1 vote
1 answer
137 views

How can i remove dead code and opaque predicates?

I have the following problem on my agenda: There is an obfuscated .exe (this is a virus that I am investigating) in addition to having an MBA, etc. bullshit, he has Opaque predicates and dead code, I ...
Swoke's user avatar
  • 11
3 votes
0 answers
53 views

How can I create an `__m128i` datatype with Frida?

I'm working on reversing a c++ binary and it has a function that I want to call with Frida. Here's the function signature from IDA: const __m128i *__fastcall sub_0123(__m128i * a1); It doesn't seem ...
Myles Hollowed's user avatar
3 votes
0 answers
218 views

IDA ATL C++ class reconstruction

I'm currently using IDA Pro to analyze a dll, but IDA Pro doesn't analyze ATL standard classes properly, including CString, so I'm trying to reconstruct the classes manually, but I'm having some ...
short dragon's user avatar
4 votes
2 answers
1k views

How to bypass anti debugger? IDA Pro

Im new to reverse engineering and doing a crackme that requires me to make a keygen, yes i know making a keygen isn't a beginner task however im stuborn, i am trying to debug the program to understand ...
alias's user avatar
  • 41
4 votes
1 answer
951 views

How to add STL to Local Types in Ida Pro?

How to add STL to Local Types in Ida Pro? I can import debug information from a pdb file along with STL types, but I can't manually add STL types to Local Types. Also I can't import STL when I click &...
user avatar
4 votes
1 answer
3k views

Reverse engineering a flutter built apk

I was trying to reverse engineer an apk built with flutter. I actually feel like reversing flutter built apps did not get much reverse writeups on the community. one of the tools for the task ...
hanan's user avatar
  • 309
1 vote
1 answer
110 views

What is the output for this and how?

*(_BYTE *)(Key + Integer_count - 1) + 79 Here : Key = 0x22EC278 (dw 'Âx') or Stack[000015B8]:0019FC2C db 78h ; x Stack[000015B8]:0019FC2D db 0C2h ; Â Stack[000015B8]:0019FC2E db 2Eh ; . Stack[...
Satyam Singh's user avatar
2 votes
1 answer
164 views

Reversing C++ Classes in ARM

I have unstripped linux arm binary, The code calls functions in class object reference like so: LDR R3, [R6] MOV R1, R7 MOV R0, R6 LDR R3, [R3,#0xC] ; (...
Dinamo's user avatar
  • 21
2 votes
0 answers
124 views

I trying rewrite asm to c++ [closed]

This code generates an API key. I use it in an android app as .so file, but I need to rewrite it to java from c++. How do I translate? push rbp push r15 push r14 push r13 push r12 push ...
Master's user avatar
  • 21
3 votes
0 answers
81 views

purpose for using a == &a

I'm debugging dns.exe in Windows10 1809 and I'm really confused about one condition that often appeared in this file WPP_GLOBAL_Control == &WPP_GLOBAL_Control Actually, I have seen this kind of ...
anonymous bear's user avatar
3 votes
1 answer
109 views

How does this Is64BitOS pointer-arithmetic-based function work?

Reversed this function. It works. But stepping through I can't figure out how. Why does this work? bool _Is64BitOS(void) { unsigned int version = *(unsigned int*)0x7FFE026C; unsigned int ...
Pulpo's user avatar
  • 155
4 votes
0 answers
207 views

How to correctly inject a [jump + address] instruction into another process (code injection)?

I am trying to inject a jump instruction into another process (External injection), although the injection operation has been completed the address was not correct. For example: unsigned int addr = ...
Lion King's user avatar
  • 269
5 votes
0 answers
253 views

Cannot find references to functions in vtables

First time doing RE work and I am working on a rather large C++ binary. In Ghidra, there are many functions that do not appear to have any meaningful references to them (unlike some functions where ...
micheal65536's user avatar
2 votes
2 answers
2k views

turning decompiled C++ code into writable C++

Here's my scenario I currently have a DLL that was made in like 2003 archived that has data and functions I still need to use and I'm also 90% sure the DLL doesn't work correctly as its too outdated. (...
DB_Coding's user avatar
2 votes
0 answers
124 views

statically placing hooks on PE file's IAT

recently I started writing my own PE library for C++, and wanted to implement static IAT/EAT hooking, (basically hooking by patching the file instead of hooking at runtime), I managed to successfully ...
VEIL's user avatar
  • 21
1 vote
0 answers
254 views

How to find the the event handler function for a QtAbstractButton?

I am not very familiar with Qt to begin with but basic PyQt tutorial showed that a button object is linked with its handler using the connect method that takes in as its argument the function that ...
Ajaykrishnan R's user avatar
1 vote
2 answers
562 views

How do I get the start address of the 'code section' and its size to know the end address?

I am trying to read the binary code in the text section of an executable game file (PE) programmatically but I don't know the start address and the end address of the text section. I am using C++/...
Lion King's user avatar
  • 269
1 vote
1 answer
142 views

I have gotten three different entry points which one is the correct one?

I am trying to get the entry point of an executable game file. I have used 3 ways, 2 programs, and 1 c++ code. C++ Code: HMODULE GetModuleHandle(CONST CHAR* ModuleName, DWORD ProcessId) { HMODULE ...
Lion King's user avatar
  • 269
3 votes
0 answers
305 views

How would I crack a software that has Xor encryption

So, before you shout at me to go on google I would just like to say I am new to reverse Engineering. Like I have been doing it for a hour. So, I was doing a bunch of crackmes.one using the search all ...
user42257's user avatar
2 votes
0 answers
57 views

Reversing internal function, can't call it with injected DLL

I'm currently learning RE. I've chosen to do so by trying to RE Skyrim for PC. I'm trying to call the ingame function for printing to the console, I'm doing this via an Injected DLL. The function call ...
Tom James's user avatar
1 vote
0 answers
157 views

problem with hooking __usercall function and asm code

I need a hook function with the __usercall convention. I already hooked functions that were defined as __usercall and __userpurge, but this time it's __usercall with arguments that are also passed ...
user42122's user avatar
3 votes
1 answer
1k views

How do I reverse an exe packed with an unknown packer?

I got an assignment to analize an exe file with 97% entropy. It's obviously packed but I got no results from Protection Id or PEid about which packer it used... How can I unpack it if it's possible? ...
beytrod's user avatar
  • 33

1
2 3 4 5
9