Questions tagged [c]

General purpose programming language that uses the procedural and structured programming paradigm.

Filter by
Sorted by
Tagged with
0
votes
1answer
39 views

Why is fastcall used for replacing thiscall functions in memory instead of cdecl?

Assume I were to be reversing some game which processes all of it's movement client side and have determined some function to be of the type: bool __thiscall Player::CanJump(Player *this) that I ...
0
votes
0answers
31 views

mfc140 dll , what is the usage?

While I open exe file in ida I can see lot of calls to mfc140_6153 or mfc140_8718. What are those functions ? what they do ? thanks
0
votes
0answers
75 views

What is, and why, “byte[ ] + number” in this IDA pseudocode?

This is a decompile of an .so file, so it originated from C or C++. Can you kindly try to explain to me what this does? How would one rewrite this into readable code? I don't mind any programming ...
2
votes
1answer
121 views

Unable to properly analyze a very simple C-compiled program

I'm a RE beginner and I decided to start writing my own simple code for practice. I wrote a simple code which uses a winAPI function called CreateProcess to start a calc.exe, I've wrote it in C and ...
1
vote
2answers
131 views

Local variables and addition not shown in Ghidra

I am having some troubles with my learning of Assembly and reverse engineering. Specifically, I am learning about Global vs Local variables. For Global variables I have managed to get insights in ...
2
votes
1answer
226 views

Simple C program disassembled with Ghidra

I am trying to figure out what is going on with my simple example programs, when I disassemble them with Ghidra. I am not sure whether this is some strange Ghidra behaviour or something that is set by ...
-1
votes
1answer
161 views

What is the following assembly code doing? [closed]

str fp,[sp, -4]! add fp, sp, #0 sub sp, sp, #12 str r0, [fp, #-8] str r1 [fp, #-12] L5: ldr r3, [fp, #-8] ldrb r3, [r3] cmp r3, #0 beq .L2 ldr r3, [fp, #-12] ldrb r3, [r3] cmp r3, #0 beq .L2 ldr r3, [...
0
votes
1answer
129 views

Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking?

So i was trying to hook the ZwQuerySystemInformation or NtZwQuerySystemInformation using IAT, but i found out that these are not inside the IAT inside the memory nor in the PE file but maybe i am not ...
-1
votes
1answer
88 views

Understanding (pseudo-)C function from a video game [closed]

I recently found a function using IDA within a game that creates a CRC from a string. I don't understand much of the code or how the game takes in the string as data. __int64 __fastcall ITF::...
0
votes
0answers
35 views

Add MessageBox statically modify

So i'm doing this challenge which i have an exe file and a dll all i have to do is modify it statically to pop a MessageBox. The exe file is loading the dll which load the MessageBox, with ollydbg ...
1
vote
2answers
109 views

Elf x86_64 adding function

I'm trying to see if I can append function code in the .text section of an ELF while still maintaining the execution flow of the original ELF. Ideally, I want to call the new function but that's it's ...
0
votes
2answers
93 views

Unable to exploit format string vulenrability on Ubuntu 18.04.2 LTS

I am studying from "Hacking: The Art of Exploitation" and in program fmt_vuln.c format string is exploited. I am getting Segmentation Fault error. Checking position of AAAA on stack: $ ./fmt_vuln ...
0
votes
0answers
32 views

Examining Stack Frame in GDB

I am learning exploitation from the book "Hacking: The Art of Exploitation". In the program an integer variable auth_flag is declared after a char array password_buffer. So on stack frame first ...
1
vote
0answers
75 views

Static binary instrumentation

I am working on a class project. I need to find out static features of a program (without executing it). Backward branches (loops) Conditional branches (potential threads with load imbalance) ...
1
vote
1answer
143 views

How to pass param to execve to execute cat a file in x64 Asm? [closed]

I want execve("/bin/cat",["/bin/cat","/test/file"],NULL). Here is my asm xor %rdx, %rdx push %rdx sub $0x16, %rsp movb $0x2f, 7(%rsp) movl $0x2f6e6962, 8(%rsp) movl $0x746163, 12(%rsp) leaq 7(%rsp)...
1
vote
2answers
122 views

Trouble when reverse engineering a industrial robot software in order to get some values

For the bit of background, I'm a robotic engineer. Robotics manufactures hide some parameters of their robots in order to avoid their competition. Now, I need these data to compute the dynamics model ...
1
vote
0answers
44 views

Reconstructing struct/union-based IPC protocol wire format

I'm embarking on my first reverse-engineering adventure. I think I've picked a rather dense piece of steak to start out with. I have three C programs which communicate together using an unknown IPC ...
2
votes
1answer
363 views

Reverse a call to mmap()

I am currently reverse a challenge to learn. But why is the parameter of mmap (containing fd) at 4294967295? (Is it not supposed to exist? No files are open with open, just before.)
1
vote
0answers
132 views

Mysterious chunk of code in IOLI crackme0x06 challenge

I've been struggling to understand a very strange piece of x86 assembly code from the IOLI crackme0x06 challenge. Context But first of all, here is the context : I've successfully cracked the ...
3
votes
2answers
126 views

x86 shellcode leads to segmentation fault

I want to execute execve("/bin/dash", &"/bin/dash", NULL) on Ubuntu 64 bit with the following 32 bit shellcode: global _start _start: xor eax, eax ; set eax = 0 to push a null without using ...
0
votes
1answer
431 views

Ghidra pseudocode to Java/C

I have this piece of code generated from Ghidra void __cdecl FUNCTION(uint *key,uint *text) { undefined uVar1; ushort uVar2; uint *puVar3; uint *puVar4; uint *puVar5; int iVar6; uint ...
3
votes
1answer
90 views

How to find the index of static ilbrary functions in the PLT of the binary?

So right now I'm trying to resolve function calls and their names in my reversing tool the problem I'm having is that library functions such as printf and fwrite and such do not have a corresponding ...
1
vote
3answers
132 views

Is the main function's name in the symbol table of C & C++ programs always 'main'? if not, how to find the name?

So I'm trying to write a reversing tool that parses symbol table to find the main function's address right now all the binaries I'm checking the name of main function is still main in symbol table ...
0
votes
0answers
28 views

Changing pseudocode based on FPU fmul behaviour

A 3D software was compiled in which a typical x/4096f was translated as: fmul ds:f4096 where f4096 equals to: 0.00024414062 Example decompiled pseudocode as-is: skeletonMemoryPointer[i].pos = *(...
-1
votes
1answer
98 views

Fuzz Test Suite for C/C++ Command Line Argument/Standard Input programs

I have implemented a basic coverage guided fuzzer that is sending inputs to programs accepting ONE command line argument or ONE standard input. I am trying to find a complex code to fuzz that can meet ...
3
votes
1answer
74 views

GetWindowLongPtr with undocumented nIndex of -1

I'm trying to reverse functionality of scrollbars in comctrl32.dll and I keep witnessing them calling GetWindowLongPtr function with undocumented index -1 as such: Does anybody know what that ...
1
vote
0answers
206 views

Illegal instruction fault in stack based buffer overflow

I wrote this short C program to practice buffer overflow exploits: #include <stdio.h> #include <string.h> #include <stddef.h> #include <inttypes.h> char *decode(char *s){ ...
3
votes
0answers
142 views

Reverse engineering android native packer

im trying to Reverse engineering an android app and the app have 4 folders in the /data/data/{package} folder ├───app_dexprotector │ 823517D25836B88F1C499C02370A047E.dat │ ...
-1
votes
1answer
136 views

How can I convert the following assembly code to pseudo code?

I got the following disassembly code in IDA pro. I really find it hard to convert it into pseudo code. push ebp mov ebp, esp sub esp, 14h mov dword ptr [ebp-14h], 1 mov dword ptr [ebp-10h], 2 mov ...
-1
votes
1answer
122 views

How can I convert the following disassembly code to pseudo code or C code?

I used IDA pro to get the following disassembly code. I am having difficulty converting it into the equivalent c code. mov dword ptr [ebp-8], 1 mov dword ptr [ebp-4], 0 loc_401014: cmp dword ptr [...
4
votes
1answer
143 views

Reverse engineering a compression algorithm to decompress ASCII text (LZ-variant?)

Reposted from StackOverflow as is. I'm trying to decompress a very long text block from an ARMv5t powered Gameboy Advance ROM, which was compressed using some kind of custom LZ-esque compression ...
0
votes
1answer
143 views

Is there any decompiler, which can produce a compilable result?

I would like to decompile a 32bit linux executable to C, modify some parts of it, and then compile it back. I do not care if the C code is not pretty and really hard to maintain. The only thing I care ...
1
vote
1answer
110 views

(CTF) Speed up assembly by hooking to an static function

For a CTF I have a fairly slow recursive function. I just need to cached the previous results in a dictionary and get them instead. I did it but had to reverse engineer the code. I was wondering if ...
-1
votes
2answers
209 views

CreateThread returns true but thread doesn't run [closed]

I have a PE executable which uses threads to handle most of its functionality. It uses CreateThread API to spawn local threads to handle functions. The call to the CreateThread returns a valid handle ...
4
votes
2answers
727 views

Which operators use sal, shl, sar or shr

Which operators in C language would result in assembly commands such as sal, shl, sar or shr for example?
0
votes
1answer
129 views

why code at .rodata executes [closed]

How come the following code executes if buf* is @ rodata segment ? #include <stdio.h> char *buf[] = { "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\ \x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\...
1
vote
1answer
213 views

How int3 looks like in C

This is assembly code that can catch debugger with int 3 : MOV ECX, ExceptionHandler MOV DWORD PTR FS:[0], ExceptionHandler INT3 ///there is debugger!!! ExceptionHandler: ////no ...
-2
votes
1answer
350 views

Why dont use memcpy? [closed]

Why using memcpy can cause to stack overFlow? memcpy get the number of bytes to copy, so what is the problem , and how memcpy_s fix it?
2
votes
2answers
276 views

Why are there so much more functions in ida than my source code?

I am trying to learn how to use IDA Pro 6.8 to analyze binaries. However, there are much more functions in ida function list than my code. For example, there is a function in source code that calls ...
-1
votes
1answer
963 views

How to convert assembly to pseudo code? [closed]

I have the following assembly. I don't know how to follow assembly. I was wondering if there is a way to convert assembly to a human readable pseudo code or better yet C code: init: mov eax, [ebp+...
0
votes
1answer
308 views

How can I intercept syscall libc function in C++ without writing any code in C file

How can intercept libc function in C++ using LD_PRELOAD. I want to write code only in C++ file and all the logic of symbol fishing (dlsym) must be in C++ file. Please give an example.
2
votes
1answer
158 views

Finding the main function without symbols

for a C/C++ program compiled on windows using the x86 architecture, what is the best way to find the main function within disassembled code? I've found various answers to questions similar to this, ...
-2
votes
1answer
222 views

Can someone please help me reverse engineer this assembly code to C please! [closed]

I am really bad at understanding assembly code and the way it works. I have little problems given to me in Assembly code and I have to reverse engineer it to C, but I have been doing really bad job at ...
0
votes
1answer
127 views

Changing local variable in caller from callee in C?

I'm implementing a function which is going to perform some time-consuming task, and I'd like to hack the benchmarking part a bit by changing the variable indicating the CPU time my function has ...
1
vote
1answer
2k views

What does this assembly language program output?

I have been struggling with this for a long time. I have the following assembly language code: .intel_syntax noprefix .bits 32 .global asm0 asm0: push ebp mov ebp,esp mov eax,DWORD ...
-1
votes
1answer
419 views

How can I decompile the CC2650 .hex file to C?

I want to decompile it to C, or at least assembly the CC2650 hex file (Bluetooth Low Energy Sensor Tag), that provide TI. My goal is to know the specific way used by CC2650 to generate the LTK. I'll ...
8
votes
4answers
13k views

Purpose of test eax,eax after a strcmp

This is my first program i am trying to reverse and my intro to this field. The C program will test if two strings match, and it will printf() a message for each occasion. This is what the reversed ...
1
vote
1answer
431 views

problem with scanf/fgets in angr stdin exploration

I want to solve this very basic crackme using angr: #include <stdio.h> #include <string.h> int main(int argc, char *argv[]) { char buffer[64]; printf("Mot de passe:\n"); ...
1
vote
1answer
206 views

Injecting exe file into process fails on windows 7 but works on windows 10 / Execution library function fails, access denied

I'm trying to inject my executable payload into remote process. I allocated memory in remote process, I converted raw payload using RVA addressing. I applied relocations and imports table. When I'm ...
0
votes
1answer
44 views

How to protect memory area, not segment or page!

I want to protect the certain memory area, like 0x12345678 ~ 0x12345679. so if another thread accesses to that area, I want to generate exception. To solve my problem, I've found and used ...