Questions tagged [c++]

C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language.

Filter by
Sorted by
Tagged with
0
votes
0answers
15 views

Using struct objects and constructors in hooked function

I am having trouble with understanding on how the particular struct instance is to be used in the hooked function. I have the following hooked function, which works well except for one particular call:...
0
votes
0answers
39 views

Does loading custom PDB help reversing behemoth program?

What I reverse : Old 4~8mb games compiled with vc++ 2006~2008(depends on version), whose source code is lost. It(they) has the mixtures of their custom structures, classes and directX sdk ...
0
votes
1answer
36 views

Can't find references (xref) to function

I am reversing a function and when I trying to see its references, it doesn't show me the calls to the function. It only show the place of the object in RVA. Is there a plug-in or something that I ...
1
vote
0answers
63 views
+50

Inconsistency in function addresses of the hooked functions (address shift)

I came across "a strange" inconsistency in terms of the function addresses in the particular application. First, the main function is hooked successfully, the address is derived in a fashion:...
1
vote
1answer
38 views

DetourAttach breaks with Illegal Instruction 0xC000001D

I am trying to detour a function using DetourAttach() in the following fashion: hooks::logDebug("swresample-3Proxy.log", fmt::format("Try to attach hook. Function {:p}, hook {:p}.",...
0
votes
1answer
54 views

How to call your version of the existing function using proxy dll?

I have bits of code which decompiles a small part of the existing program. I have added it to the proxy dll. The code to the existing functions is hooked through Detour and looks like below (gui.h and ...
1
vote
1answer
154 views

convert C++ code to python code

while I'm doing RE using ghidra i saw this code byte bVar1; byte bVar2; uint uVar3; uVar3 = 0; while (bVar2 = (byte)uVar3, (char)bVar2 < '\b') { bVar1 = *(byte *)(uVar3 + param_1) ^...
0
votes
0answers
49 views

Ida pro doesn't demangle all function names

I am using Ida Pro 7.0 and working with a binary (firmware) written in C++ .Fortunately there are symbols in the firmware and I know function names but Ida didn't manage to demangle all function ...
0
votes
1answer
119 views

How do I interpret this double offset?

While looking at that old game I've found a class CStr that is used in an unusual (to me) manner. Most of the times a member of CStr is used, it's done as follows. In both cases, this is a CStr *. ...
0
votes
1answer
46 views

IDA API: Writing a plugin - How can I ensure that analysis has completed?

I have been reading through the API documentation here and As far as I can tell there are three ways to wait for the analysis to finish. get_auto_state auto_wait auto_is_ok Looking at the API if ...
2
votes
1answer
63 views

What C++ construct could emit such Watcom C++ 10.5 assembler listing?

Based on the assembler listings, a C++ object is locally allocated on the stack without constructing the object in the caller routine and the callee takes the address to the allocated stack space and ...
0
votes
2answers
132 views

How to prevent File Modification in C++

so i want to protect my software against reverse-engineering and i want to add checksum verification to prevent patching the binary but the problem that if i added a checksum verification the binary ...
0
votes
1answer
83 views

How to make sense of the pointer in reversed function call?

I have the code below, derived from the reversed function in the original application: gladius::world::World::create(*(gladius::world::World**)(*(char*)(this + 0x5e8) + 0x50)); The create function ...
0
votes
0answers
31 views

Execute Python code/script inside a game with statically linked Python lib

I'm playing a game that's made in C++ and embeds Python (2.7) for client interface and most of it's functions. At first, this game used to have dynamically linked Python lib for embedding. So I could ...
0
votes
2answers
89 views

How to identify method order in disassembled C++ object

Here are some chunks: v13 = cocos2d::FileUtils::getInstance(v9); (*(void (__fastcall **)(char *))(*(_DWORD *)v13 + 64))(&v46); v19 = cocos2d::FileUtils::getInstance(fileHandle); v21 = *(...
0
votes
1answer
56 views

determine proprietary 16-bit floating-point format

Background / Introducion CAN message Mercedes-Benz, cannot determine 16-bit data type for temperature. 7E 00 32 01 37 00 According to @rnd-ash (who has reverse engineered ACTIA Basic XS Monitor ...
0
votes
1answer
83 views

Proxy dll doesn't load the original dll

I have relatively simple code here for the proxy DllMain() function: BOOL APIENTRY DllMain(HMODULE hDll, DWORD reason, LPVOID reserved) { if (reason != DLL_PROCESS_ATTACH) { return TRUE; } ...
0
votes
1answer
71 views

How does Borland C++ 5 exception handling work?

So, I'm still working on reverse-engineering an 1996 game. I have cleared a lot of roadblocks, but one thing that continues to annoy me is exception handling and RTTI metadata. There is a function ...
0
votes
0answers
29 views

How to modify a function without disassembling the entire class

If I want to modify a function which has calls to other classes and functions in the application, but I don't want to reverse all of those other classes and leave them as they are, how do I go about ...
0
votes
1answer
71 views

Modify main function for C++ game file

I am trying to modify the main function for a specific decompiled .exe. More specifically, I want to remove the reference to GUI from that .exe file, so that GUI doesn't get initialised on the startup ...
2
votes
1answer
78 views

Why module address is different in Cheat Engine than in x32dbg?

Why the module address is different in Cheat Engine than in x32dbg? I'm trying to read this: My c++ attempt: #include "pch.h" #include "Functions.h" #include "offsets.h"...
3
votes
1answer
93 views

Trying to identify a Binary-Search-Tree structure

Let's say I make a std::map in C++, and ADDR is their address in memory. When I look at this place in memory I will find a pointer and in ADDR + 4 will be the amount of elements in the container. Now, ...
0
votes
2answers
136 views

convert code to python

i have snippet code that i want to convert to python to understand the types that ghidra use such *(byte *) and *(code *) and *(uchar *) etc.. the first code: void one(int param_1,int param_2) { int ...
1
vote
0answers
80 views

How to create an algorithm in C...(or C# or C++, basically in "a programming language")

After a LOT of sending challenges and recording the responses I've 'broken' the "encryption" in my car's immobiliser...the reason for doing it is so I can use the engine and transmission in ...
2
votes
1answer
70 views

Can't debug process with IDA Windbg debugger: "Could not initialize WinDbg engine with error: %1 is not a valid Win32 application"

I tried to debug a C++ that I created but I am getting the following error: I have this C:\Program Files (x86)\Windows Kits\10\Debuggers\x64 in the PATH environment variable (based on this answer), ...
0
votes
0answers
42 views

Unrecognized function

There is function: push 65h push edi call sub_5D8750 In this case, function takes 65 bytes to be filled with zeros, and edi is memory address starting from which to fill these 65 bytes with ...
2
votes
1answer
153 views

Extracting strings from binary files (.exe)

This question has been asked quite a lot especially on stackoverflow, but the solutions/replies are not clear or extensive. What I`m looking for is to build what Strings does from Sysinternals. My ...
0
votes
1answer
104 views

How do I find missing/undefined vtable functions in IDA64?

I'm reverse engineering a game and came across some function calls like the ones shown below, how do I find where these functions are located / decompile them? (*(BaseClient->int640 + 304))(...
6
votes
1answer
2k views

Why can C# applications be reverse-compiled with variable names while C++ ones can't?

Why can programs written in C# be reverse-compiled essentially to their original form with variables names (such as dnSpy) while C++ decompilers (such as Ghidra) are unable to decode the variable ...
0
votes
0answers
116 views

WMI Spoofing by Fastprox.dll Hooking

I m trying to spoof WMI output by hooking the fastprox.dll. Here is the code I m working on: typedef HRESULT(__stdcall* tGetFunc)(IWbemClassObject*, LPCWSTR, LONG, VARIANT*, CIMTYPE*, long*); static ...
0
votes
0answers
39 views

exports kernel Windows for informations on hardware

Good day! I develop small security software and use a driver like any modern security software. Can you please tell me if there are any exported functions from ntoskrnl.exe or hal.dll or other kernel ...
0
votes
0answers
43 views

c# - Eject Injected Dll From Proc. Then Re-Inject Capability

I made a simple c# application to inject .dll to given process. But I also want to have a capability to eject then depending on user's choice, can re-inject the same .dll to same process. I'm working ...
0
votes
0answers
34 views

x64dbg & Ghidra change combobox properties app in Visual C++ MFC

Hello in the program code the property combobox is changed from enable to disable I would like to change that the program does not change this property. I have found commands that assign new items to ...
0
votes
2answers
62 views

What is the first argument (rdi) to operator+ on x86_64 SystemV?

I'm looking through a block of disassembled C++ which works with several std::string instances. I had been confused by several calls to various versions of std::operator+, but this call seems ...
0
votes
0answers
33 views

How to replace a segment with a single structure consisting of the data in that segment - programmatically?

So I have something like this (I copied this from my other plugin functionality which simply creates a copy paste structure from the frame containing stack variables, while deleting them and then ...
0
votes
0answers
48 views

Is there a way to aid the IDA decompiling process?

I want to make all local variables contained in a structure with appropriate padding put in the gaps (unused parts of the frame). I want to do the same for the global data. And I want to rename ...
0
votes
1answer
226 views

Modifying program using IDA/Hexrays decompilation pseudocode

A bit long-winded, apologies in advance. Updates to the question are at the end. I'm experimenting with hooking functions in a program & modifying them based on the decompilation pseudocode from ...
1
vote
1answer
64 views

IDA SDK - can't understand the output of displacement query functions?

OK so I want to parse x86 instructions with IDA SDK. However I can't understand the output, I have this code (that is executed after decode_insn at each operand that is present (type not 0)): //op is ...
1
vote
1answer
101 views

What encoding is this?

This is a picture of the encoded code. I'm just wondering what is the encoding that it is using.
2
votes
2answers
130 views

Why this ASM represents Virtual Function call?

I'm referring to this question that was asked previously: Virtual functions call asm I'm wondering how is it possible to know whether this ASM listing represents Virtual Functions calls? What's in the ...
0
votes
1answer
170 views

What are the way I can reverse engineer an obfuscated C++ program?

I am reverse engineering an program. I encountered a problem where I can't reverse engineer it as the program code is obfuscated. I realised the program is obfuscated thanks to my friend who noticed ...
0
votes
2answers
155 views

C++ hide string parameter for string viewer

bool isLaunched = CreateProcessW( L"C:\\Windows\\System32\\Notepad.exe", // Should be shown in any string viewer or decompiler. 0x0, 0x0, 0x0, TRUE, 0, 0x0, ...
1
vote
1answer
58 views

How to avoid database / code mismatch when developing and debugging your own code in IDA?

This seems like a very basic use case and I can't get it to work properly. I'm developing my own test application in Visual Studio c++. I want to test it through several IDA debugging sessions. Every ...
1
vote
1answer
54 views

How to split bytes into instructions in binary ELF file for x86

I'm working on a static code injector for ELF files. I need to "steal" some bytes in order to write jump to my code on their place and then execute stolen instructions somewhere in the ...
2
votes
1answer
128 views

Making a Android Toast via JNI, i.e. calling Java methods via JNI

Concerning the outputting of an Toast, I found that there are some ways to make a Toast, that invoke calling a FindClass on JNIEnv object with the android/widget/Toast parameter, but I found no ...
0
votes
0answers
465 views

Tracing all (or most of) function calls in a specific Android app

I'm having a problem, where I'm trying to trace some function calls in an Android app, that uses JNI for about all of its work. More specifically, a function call, in JNI, that makes (IIRC Android ...
2
votes
2answers
118 views

C++ structure containing a RTTI getter function?

I'm working on reversing a C++ application and I've come across a structure that contains a getter function that returns TypeDescriptor*, I've read some articles on RTTI and reversing C++ but can't ...
1
vote
1answer
66 views

Hook naked function with CPU registers

I need to hook this function: .text:005589CB sub_5589CB proc near ; CODE XREF: AddHealth(int,long)+1A↑j .text:005589CB ; sub_5328D8+98E↑p ... ...
4
votes
1answer
129 views

Understand/Reverse simple (but good quality) TTS engine

For quite a long time I wanted to add TTS (text-to-speech) to my MCU applications and I tried quite few of them with more or less success always hitting a wall that either quality is not good or ...
1
vote
1answer
78 views

Converting a data address offset to the equivalent struct in a C++ module

I have an offset to a property within a player class that I need to access data from. It's made of a specific struct that I have already assembled. IDA reports the accessing offset as so: v32 = ( v3 + ...

1
2 3 4 5
8