Questions tagged [c]
General purpose programming language that uses the procedural and structured programming paradigm.
339
questions
1
vote
2
answers
490
views
Hiding shared library calls from ltrace
I am trying to implement some antidebug methods. Although I have encrypted texts, ltrace reveals them, for example:
strstr("Name:\tltrace\n", "ltrace")
A solution would be static linking, but I do ...
CommunityBot
- 1
1
vote
1
answer
117
views
Identifying C/C++ Library Functions
I am attempting to reverse-engineer an old DOS executable, which seems to have been compiled around 1992 using Microsoft's C compiler at the time.
When opening the executable in Ghidra no imports are ...
- 552
0
votes
1
answer
659
views
How can I convert the following assembly code to pseudo code?
I got the following disassembly code in IDA pro. I really find it hard to convert it into pseudo code.
push ebp
mov ebp, esp
sub esp, 14h
mov dword ptr [ebp-14h], 1
mov dword ptr [ebp-10h], 2
mov ...
CommunityBot
- 1
0
votes
1
answer
87
views
ELF - Why does objdump provide a wrong byte value in the .got?
I seriously can't tell if I'm misunderstanding something grossly or if this is a bug in objdump. Newbie alert.
$ objdump -s --start-address=0x3fc0 --stop-address=0x3fc1 test
test: file format ...
- 326
11
votes
2
answers
9k
views
Decompile and recompile C?
What tools produce C code that does not produce errors when you try to recompile it again? Can Hex-Rays decompiler convert everything to project files in a single folder and just compile it?
0
votes
1
answer
85
views
Create exe that jumps directly into main()-function from C
I am using x64dbg to explore image files on Windows. After the computer finishes prowling ntdll.dll it jumps to OptionalHeader.AddressOfEntryPoint.
But this is not my main()-function.
What is this ...
- 9,088
2
votes
0
answers
341
views
How to hack fan control speed?
So I recently bought a new laptop (Acer Aspire A315-57g) on which I found that the cooling solution wasn't optimal, and I decided that I want more RPMs from my fan. However, I wasn't able to find a ...
3
votes
1
answer
1k
views
Calling Swift 4 methods from C
I have earlier been able to call Swift methods using a function pointer from C, and providing the appropriate arguments because the calling convention was the same.
Unfortunately this no longer works....
CommunityBot
- 1
2
votes
1
answer
1k
views
How do I Decompile .Pyd file made with python, cython and pyinstaller 3.6
I created an app in 2018 with python and then used Cython and pyinstaller v 3.6.
I am wondering how to decompile it. I have tried uncompyle6 + pyinstxtractor however this only works for python files,...
CommunityBot
- 1
2
votes
0
answers
270
views
Help Needed With Finding Image Data In DOS Game File
I have been analysing, an File called FW190AS.PAC from a 16 Bit Game called Secret Weapons Of The Luftwaffe, in a Hex Editor, the Bytes are displayed in Little Endian format. My aim with this game, is ...
- 51
1
vote
0
answers
104
views
Reversing Assembly to C
I've read the open letter addressing students asking for help with their homework and I agree with it, therefore I will try to be less of a pain in the *** ;)
I need to reverse the x86-64 (AT&T) ...
- 11
1
vote
0
answers
51
views
Fuzzing closed application
I want to get from you some advice about fuzzing.
I am checking a huge C application (not open source) which is also an HTTP server.
My purpose is to fuzz the HTTP server via the requests being sent ...
- 1,016
2
votes
0
answers
204
views
What is the meaning of call ds:ApiName[registry*constant] in IDA .asm files?
I have a dataset of .ASM files generated by IDA (dont have the corresponding file)
And there are a lot of calls like this :
.text:00637114 5F pop edi
.text:...
- 519
3
votes
1
answer
113
views
Linux Kernel for embedded platform - Available Sources but no configuration
I am trying to recompile the kernel for the Redmi Note 4 (MTK). I have successfully obtained a copy of the stock, pre-compiled kernel, and a variant of sources that seems to coincide quite well with ...
- 255
3
votes
0
answers
269
views
How would I crack a software that has Xor encryption
So, before you shout at me to go on google I would just like to say I am new to reverse Engineering. Like I have been doing it for a hour. So, I was doing a bunch of crackmes.one using the search all ...
CommunityBot
- 1
3
votes
1
answer
451
views
How to bypass anti debugger? IDA Pro
Im new to reverse engineering and doing a crackme that requires me to make a keygen, yes i know making a keygen isn't a beginner task however im stuborn, i am trying to debug the program to understand ...
- 61
1
vote
1
answer
104
views
What is the output for this and how?
*(_BYTE *)(Key + Integer_count - 1) + 79
Here : Key = 0x22EC278 (dw 'Âx')
or
Stack[000015B8]:0019FC2C db 78h ; x
Stack[000015B8]:0019FC2D db 0C2h ; Â
Stack[000015B8]:0019FC2E db 2Eh ; .
Stack[...
1
vote
1
answer
167
views
Why this x64 shellcode doesn't work?(segmentation fault)
I found a simple shellcode on the internet.
Then, to test this shellcode, I make the simple ret overwrite code.
test.c
#include <stdio.h>
#include <string.h>
char buf[100];
int main(void)...
- 72
5
votes
1
answer
2k
views
Why is fastcall used for replacing thiscall functions in memory instead of cdecl?
Assume I were to be reversing some game which processes all of it's movement client side and have determined some function to be of the type:
bool __thiscall Player::CanJump(Player *this)
that I ...
2
votes
0
answers
120
views
Does AnyOne knows how to reverse python file that is encoded into elf binary .cpython-310.so extension? Please Help me Out
Following is the link to the file that I want to reverse. This is the python file that is encoded in cpython or cython and it is now a binary file.
Please help me to decode it as it is very important ...
- 255
0
votes
1
answer
518
views
PE FILE section read in C
I need to read PE file. I need to search word in PE file. Search is required to cover only the sections with the “executable” flag. And I need to specify the section where the word found. How can I do ...
- 10.9k
5
votes
1
answer
131
views
Check if libc.so use tcache
I have ARM libc.so (GLIBC), How can I check if that libc.so used tcache, and what is the value of arena_max?
Can I check that information offline?
- 255
7
votes
2
answers
2k
views
Identifying possible structs in C/C++ disassembly
I'm currently working on taking apart a game (Soul Reaver: Legacy of Kain) and I often come across odd looking sections such as this in the decompiler
*(_DWORD *)(a2 + 16) = a2 + 624;
*(_DWORD *)(...
- 441
5
votes
0
answers
3k
views
Can IDA generate C code for ASM assembly without the binary?
Lets say I have this picture of some assembly:
Now I know how to manual tranform this assembly into C code because it is small but is it possible for IDA to convert this into C code? Ideally I would ...
- 459
4
votes
2
answers
122
views
Reversing rodata
I'm playing with an ELF binary to learn IDA, and I'm not sure how to interpret what I'm seeing..
A function calls this:
v1 = MList[2 * result];
When I look at MList, it looks like this:
public MList
...
- 36.2k
1
vote
0
answers
89
views
Binary Exploitation
I am trying to learn binary exploitation. I can modify the binary behaviour with gdb, but I have not understood how to exploit the binary in C.
I've found some references on "Hacking - the art of ...
- 255
2
votes
1
answer
333
views
How to reverse engineer structs in radare2?
Is there any way to indentify structs in radare2?
when i tried to look them, they look like normal variables, i seen people using td and tl command but I don't know how to use them. If you know please ...
CommunityBot
- 1
1
vote
1
answer
83
views
What was the original math operation after optimizing compiler?
I'm pretty sure that original code was much simpler:
(((x + 16) >> 31) ^ abs(x + 16) & 3) + 4 * ((y + 16) % 4) - ((x + 16) >> 31)
Looks like division with remainder... Any ideas what ...
- 33
2
votes
0
answers
85
views
How to do a Mifare Classic Replay attack
I'm learning for the university and have to do a Mifare Classic replay attack.
I don't really know how to do that and hope some of you can help me at least a bit.
The goal is to get the number of ...
Justin
2
votes
0
answers
126
views
Static analysis
I am working on a class project. I need to find out static features of a program (without executing it).
Backward branches (loops)
Conditional branches (potential threads with load imbalance)
...
CommunityBot
- 1
2
votes
1
answer
74
views
How to interpret this __ctype_b based predicate?
I am getting this simplified function from the decomplication results of Ghidra, and I am having a hard time interpreting what the predicate would evaluate to since I do not have access to __ctype_b ...
- 36.2k
3
votes
0
answers
41
views
Data placement in memory
I am playing with buffer overflow attacks in C. I have the following code:
int foo(void*, void*); // Calculates the distance (in bytes) between two addresses in memory
int main(int argc, char**...
- 31
1
vote
0
answers
337
views
ZTE F680L V6.0 GPON firmware extraction JFFS2 decrypt AES key
Hi guys i have unpacked the firmware ZTE F680L v6.0 with binwalk -Me and have extracted the jffs2
You can find the firmware image here.
Inside we have an /etc folder with some db_default_cfg.xml which ...
- 10.9k
18
votes
4
answers
171k
views
Converting assembly code to c
I have the following assembly code over Linux distro:
# using the .data section for write permission
# instead of .text section
.section .data
.globl _start
_start:
# displaying some characters ...
1
vote
0
answers
1k
views
How can i get the address of a function in memory?
I am currently completing a CTF exercise where i must attempt to overwrite a function pointer on the stack through a buffer overflow here is the code:
#include <err.h>
#include <stdio.h>
#...
2
votes
0
answers
269
views
Finding the main function on Windows compiled executables
For a C/C++ program compiled on Windows using the x86 architecture, what is the best way to find the main function within disassembled code without relying on signatures such as FLIRT?
I've found ...
- 41
1
vote
0
answers
44
views
Where can I get source code for ASCII graph parser?
My plan is to see source code graph in vim of doxygen.
I almost use TUI on Linux.
So, Where can I get C, Python based source code for ASCII graph parser?
- 459
1
vote
0
answers
58
views
Is there any available source code which is Windows 64 bit compatible that can disassemble binary code?
I'm writing a program that takes as input a single byte of binary (machine code from code segment) and converts it into assembly. I've done some searching online but have yet to find anything helpful. ...
- 459
47
votes
8
answers
33k
views
How do I add functionality to an existing binary executable?
I want to add some functionality to an existing binary file. The binary file was created using gcc.
Do I need to decompile the binary first, even though I sufficiently understand the functioning of ...
- 230
1
vote
1
answer
180
views
Python or C for a Qt application and security against reverse engineering
I actually have two choices : C or Python to create my application.
On my application users will need a key (on start) to access it, the key will be verified with an algorythm on the user's computer. ...
- 786
11
votes
3
answers
1k
views
What methodology can be used to change code flow atomically during program execution?
I have been reading a lot about the different techniques for Windows API hooking (a technique I'm particularly fascinated by and fond of), and it seems a major problem in implementing a realiable ...
- 230
2
votes
0
answers
164
views
What hints can x86 disassembly give as to GCC/G++ compiler version and options?
I've taken an interest to disassembling binaries and attempting to recreate 1:1 source code (logic) in C and C++ compiled with GCC. I say "logic" because this question does not pertain to ...
1
vote
1
answer
118
views
C instruction causing an address shift
I am trying to recreate a segment of assembly back into the C code. Below is the progress I've made so far, but I'm getting stumped on a specific section.
00000000000010049 <mysteryFunc>:
...
- 2,584
1
vote
1
answer
218
views
Why is Visual Studio compiling my EXE file with an entry point that is not in the file?
So I am trying to open my test app EXE file in ollydbg to study the assembly, the stack, registers and all that stuff for educational purposes and it gives me this message saying that the entry point ...
- 9,088
0
votes
1
answer
103
views
Crackmes challenge not validating all answers
I am playing with this crackme. The executable takes a numerical input (e.g., 123) and adds all the numbers. The total must be 50. However, I noticed that not all inputs adding up to 50 are validated. ...
- 2,584
1
vote
1
answer
266
views
Custom IDA Decompilation Coloring
Is there a way to customize the coloring of IDA's decompiled code?
IDA -> Options -> Colors -> Syntax doesn't seem to affect the coloring of decompilation.
- 9,088
2
votes
2
answers
2k
views
Understanding a C code including CRT functions, decompiled with Ghidra
I am trying to learn software reverse engineering with Ghidra, though I have never used Visual Studio Compilers or the C runtime (CRT). I have a piece of decompiled C code:
<typeName> <...
- 16.2k
0
votes
2
answers
399
views
Reversing an obfuscation through a long linear switch statement
I have a program (ELF, 32 bits) that is probably quite short and simple, but which have been obfuscated with the following construction:
i = 0
switch(i):
case 0:
one small instruction
...
CommunityBot
- 1
1
vote
1
answer
2k
views
How to define "code" variable type in Ghidra
Of all the confusing parts of Ghidra, I'd like to ask about the "code" keyword. A similar question was asked here. However, I am not asking what the keyword is, but how to interpret/define ...
- 441
1
vote
2
answers
1k
views
Is it possible/feasible to decompile a program written in C++ to C?
I've not seen a lot of material on this. I've seen people attempting to bring a C++ program back to C++ code, and claiming how hard it is, but C code from C++ program? I don't know.
If it is possible, ...
