Questions tagged [c]

General purpose programming language that uses the procedural and structured programming paradigm.

Filter by
Sorted by
Tagged with
45
votes
8answers
27k views

How do I add functionality to an existing binary executable?

I want to add some functionality to an existing binary file. The binary file was created using gcc. Do I need to decompile the binary first, even though I sufficiently understand the functioning of ...
2
votes
2answers
895 views

IDA pro: jump back to previous instruction

I'm new with IDA pro and currently running with debugger, I have few questions: How can I jump on previous instruction? Undo the latest instruction ? Is it possible in IDA to examine memory of an ...
3
votes
0answers
2k views

Reverse Engineering a 8 bit CRC checksum

I am trying to create a communication interface using C Language to an Air conditioning system, after analyzing the data packets I have identified that the data packet is consist of an 8 bit CRC (I am ...
6
votes
1answer
5k views

Decompile and recompile C?

What tools produce C code that does not produce errors when you try to recompile it again? Can Hex-Rays decompiler convert everything to project files in a single folder and just compile it?
38
votes
3answers
20k views

convert this x86 ASM to C?

How could this 32-bit x86 assembly be written in C? loc_536FB0: mov cl, [eax] cmp cl, ' ' jb short loc_536FBC cmp cl, ',' jnz short loc_536FBF loc_536FBC: mov byte ptr [eax], ' ' loc_536FBF mov cl, ...
22
votes
3answers
11k views

Can I create an object file using gcc that cannot be reverse engineered?

Is it possible to create an object file using gcc that cannot be reverse engineered to its source code ?
5
votes
1answer
2k views

Chunked function (discontinuous chunks of code comprising a function)

The control flow graph below is from a single function in Notepad (Win7 64-bit). Why is the linker (or the compiler) separating the basic blocks of a single function into multiple, discontinuous ...
5
votes
2answers
9k views

Radare2 C output

I made a simple hello world program, and put it in radare2. I then ran the pc command, which displayed C output. The output was this: #define _BUFFER_SIZE 256 const uint8_t buffer[256] = { 0x55, ...
4
votes
1answer
880 views

How to intercept a call to function with known name from known DLL

First of all I wasn't very much into reversing until now, so excuse me if my question is dumb. I have a windows DLL most likely made with Visual C++. It's been developed in 1998 and has Mfc42.dll (4....
-1
votes
1answer
57k views

Translate ASSEMBLY to C [closed]

How to translate code assembly to C?? I am very poor in assembly code. EG: mov dword ptr [ebp+data], 612E2F47h mov dword ptr [ebp+data+4], 5B2A451Ch mov dword ptr [ebp+data+8], 6E6B5E18h ...
5
votes
1answer
2k views

Writing an exploit for sample-application

I understand the principles of exploiting a classical stack-based buffer-overflow, and now I want to practice it. Therefore I wrote the following test-application: #include <stdio.h> #include &...
3
votes
1answer
862 views

Good foundation for reverse engineering malware

I have been intrigued by reverse engineering recently and just finished Paul Carter's PC Assembly Language book (http://pacman128.github.io/static/pcasm-book.pdf) which was a great primer for x86. My ...
7
votes
3answers
6k views

buffer overflow exploits - Why is the shellcode put before the return address

The code I'm referring to is found here: Link to code I read that the buffer overflow exploit uses a buffer that looks something like this: | NOP SLED | SHELLCODE | REPEATED RETURN ADDRESS | From ...
5
votes
1answer
1k views

In Ollydbg, how do I change the path to a source code file without recreating entire directory structure?

I am bring a .EXE, a .PDB, and a source code .C file into my computer and attempting to look at my program in Ollydbg. I am compiling C programs on one machine (XP Vm actually) and running them in ...
4
votes
4answers
1k views

Why addresses of variable on stack are not consecutive?

The code below is generated by gcc from a simple scanf program. My question is that Why these 3 addresses of variables are not consecutive when allocated? If not, when could I speculate the number ...
7
votes
1answer
4k views

BYTE3, does it mean the third or fourth byte of an int? IDB file that's already supplied

I've got a program that i'm trying to debug a little bit by trying to make sense of a function or two, there's already some info that i've downloaded via a idb file and it's helped me get somewhere. ...
4
votes
1answer
1k views

IDA Pro C dump for Decryption function

I have been battling this infection I got that encrypts my files in 512 byte chunks with a friend. We have managed to find the Decryption function we think in IDA (the code is heavily obfuscated) from ...
3
votes
1answer
897 views

Insert jmp detour into a compiled program

I've seen references on Stack Exchange and elsewhere to inserting detours into compiled code. My understanding is that essentially a jmp instruction is inserted and then somehow the patched program is ...
2
votes
2answers
486 views

How to extract debug information from a DOS executable compiled with Watcom C/C++?

I have a DOS executable which has been compiled with Watcom C/C++ 10.0. That EXE has debug symbols inside. I was wondering if there is any tool that allow to dump or extract that debug information (...
-1
votes
1answer
2k views

How to convert assembly to C code [closed]

Is there an easy to convert assembly (ARM) to C code?