Questions tagged [c]

General purpose programming language that uses the procedural and structured programming paradigm.

Filter by
Sorted by
Tagged with
45
votes
8answers
27k views

How do I add functionality to an existing binary executable?

I want to add some functionality to an existing binary file. The binary file was created using gcc. Do I need to decompile the binary first, even though I sufficiently understand the functioning of ...
38
votes
3answers
20k views

convert this x86 ASM to C?

How could this 32-bit x86 assembly be written in C? loc_536FB0: mov cl, [eax] cmp cl, ' ' jb short loc_536FBC cmp cl, ',' jnz short loc_536FBF loc_536FBC: mov byte ptr [eax], ' ' loc_536FBF mov cl, ...
22
votes
3answers
11k views

Can I create an object file using gcc that cannot be reverse engineered?

Is it possible to create an object file using gcc that cannot be reverse engineered to its source code ?
9
votes
3answers
3k views

Why does the function pointer get overwritten even though is declared before the vulnerable buffer?

I am working on io-wargames for fun right now, level3: I do understand why there is a stack-overflow in this code (strlen(argv[1])), but what I don't understand is why it overflows the function ...
9
votes
1answer
488 views

How to convert this one-liner asm to C

I want to convert this to C: SHR CL,1 rECX is the name of the (32bit unsigned int)register variable. It should be simple, but I can't figure out the proper pointer magic :/
9
votes
3answers
430 views

How to differentiate from different hex files of different families of microcontrollers?

Is there any way to differentiate different microcontroller's hex files? I have a hex file and now I have forgotten of which micro-controller it belongs. Is there any available tool to tell this? or ...
8
votes
4answers
10k views

Purpose of test eax,eax after a strcmp

This is my first program i am trying to reverse and my intro to this field. The C program will test if two strings match, and it will printf() a message for each occasion. This is what the reversed ...
8
votes
2answers
1k views

Identifying variable args function

How would a C variable argument function such as printf(char* format, ...) look like when disassembled? Is it always identified by calling convention, or are there more ways to identify it?
8
votes
3answers
1k views

Trying to reverse engineer C code that is 64bit assembly

This is the code I am looking at 0x0000000000401048 <+70>: mov 0x401ba0(,%rax,4),%eax This is an array of 15 integers. Just wondering how I can access indices 0 to 15 in gdb Thanks
8
votes
5answers
783 views

Is it possible to hide the details of which compiler was used?

The compiler adds system information to the output/object file that is created on compilation. Is there any compiler option that can prevent this information from being added? Can the compiler ...
8
votes
1answer
1k views

Understanding this Buffer Overflow exploitation

some days ago I took this piece of code from opensecuritytraining.info to test a buffer overflow exploitation: #include <stdio.h> char *secret = "pepito"; void go_shell(){ char *shell = "/...
8
votes
1answer
1k views

Becoming A Better Reverse Engineer

I have been looking on the net and all I see when it comes to reverse engineering are a bunch of silly crackme tutorials. I want to be better at taking code from assembly to c or c++. I am getting the ...
8
votes
1answer
3k views

Encrypting text in binary files

Text strings are usually easily read in a binary file using any editor that supports ASCII encoding of hexadecimal values. These text snippets can be easily studied and altered by a reverse engineer. ...
8
votes
3answers
712 views

What methodology can be used to change code flow atomically during program execution?

I have been reading a lot about the different techniques for Windows API hooking (a technique I'm particularly fascinated by and fond of), and it seems a major problem in implementing a realiable ...
7
votes
3answers
6k views

buffer overflow exploits - Why is the shellcode put before the return address

The code I'm referring to is found here: Link to code I read that the buffer overflow exploit uses a buffer that looks something like this: | NOP SLED | SHELLCODE | REPEATED RETURN ADDRESS | From ...
7
votes
1answer
4k views

BYTE3, does it mean the third or fourth byte of an int? IDB file that's already supplied

I've got a program that i'm trying to debug a little bit by trying to make sense of a function or two, there's already some info that i've downloaded via a idb file and it's helped me get somewhere. ...
7
votes
1answer
234 views

Is there a way to find out which hash standard by studying the source code?

We have an embedded product, which we are carrying for several hardware iterations since more than 5 years ago. We have all the source code, most of it nicely documented. As the product is actively ...
6
votes
4answers
105k views

Converting assembly code to c

I have the following assembly code over Linux distro: # using the .data section for write permission # instead of .text section .section .data .globl _start _start: # displaying some characters ...
6
votes
2answers
9k views

Radare2 C output

I made a simple hello world program, and put it in radare2. I then ran the pc command, which displayed C output. The output was this: #define _BUFFER_SIZE 256 const uint8_t buffer[256] = { 0x55, ...
6
votes
2answers
4k views

Question about LEA instruction

i'm learning to reverse engineer. So i'm coding some programs and try to understand their assembly. I stumbled upon a curious case and i think i can't solve it alone. Here's the c code: #include &...
6
votes
2answers
1k views

Understanding x86 C main function preamble created by Visual C++

I was debugging a simple x86-64 program in Visual Studio 2010 and I noticed that the main function preamble is different from the GNU GCC compiled version of the same C program. To illustrate what I ...
6
votes
1answer
10k views

Illegal Instruction exploiting sample Buffer Overflow code

Some days ago I coded a simple code to test a buffer overflow exploitation on x86 system. In order to keep it simple I disabled ASLR and NX so there are no protection that could cause weird behaviours....
6
votes
1answer
855 views

Read a struct from memory

I'm trying to load a struct defined in a program that i'm reading the memory of, so I can use it to define objects in my python debugger (in windows). What format do structs take in memory, and what ...
6
votes
1answer
5k views

Decompile and recompile C?

What tools produce C code that does not produce errors when you try to recompile it again? Can Hex-Rays decompiler convert everything to project files in a single folder and just compile it?
5
votes
3answers
1k views

Determining if a variable is local or an argument passed to a function

How can you determine if a variable is a local variable of the function or an argument passed to the function?
5
votes
2answers
2k views

What do the 20 lines of executable code in this exploit do?

I stumbled upon this 31 bytes of Linux x86_64 Polymorphic execve Shellcode, posted by the author "d4sh&r": The code seems to be a combination of assembly and C and looks like this: /* ;Title: ...
5
votes
2answers
250 views

Returning a C function to its grandfather

This is a homework assignment, so I'd appreciate it if I would get a hint only, not a full answer. I wrote this program which is supposed to print the following: Executing function_a Executing ...
5
votes
2answers
4k views

How to hook the entry point of a DLL?

I have written a C API with support for static import hooking via overwriting the corresponding IAT entry of an exported function. It works nicely for older simple applications, but for more modern ...
5
votes
1answer
2k views

Writing an exploit for sample-application

I understand the principles of exploiting a classical stack-based buffer-overflow, and now I want to practice it. Therefore I wrote the following test-application: #include <stdio.h> #include &...
5
votes
1answer
2k views

Chunked function (discontinuous chunks of code comprising a function)

The control flow graph below is from a single function in Notepad (Win7 64-bit). Why is the linker (or the compiler) separating the basic blocks of a single function into multiple, discontinuous ...
5
votes
2answers
1k views

How to get IDA Pro to understand a virtual function table?

I'm reversing an old DirectDraw game that uses DirectX 7. I have a LPDIRECTDRAWSURFACE7 g_lpDDSBack and g_lpDDSBack->BltFast is being called but this is how it is decompiled in HexRays: (*(int (...
5
votes
1answer
1k views

In Ollydbg, how do I change the path to a source code file without recreating entire directory structure?

I am bring a .EXE, a .PDB, and a source code .C file into my computer and attempting to look at my program in Ollydbg. I am compiling C programs on one machine (XP Vm actually) and running them in ...
4
votes
3answers
7k views

How to effectively bypass GCC stack smashing detection

I was solving bof challenge on http://pwnable.kr/play.php it is required to smash the stack of the following code #include <stdio.h> #include <string.h> #include <stdlib.h> void ...
4
votes
6answers
6k views

How to match disassembled instructions back to C/C++ source?

Basically here's what I want to know, if you have a disassembled instruction say: jz 0x8048e1a And, you also have the source code. How do you go about figuring out what this instruction relates to ...
4
votes
4answers
1k views

Why addresses of variable on stack are not consecutive?

The code below is generated by gcc from a simple scanf program. My question is that Why these 3 addresses of variables are not consecutive when allocated? If not, when could I speculate the number ...
4
votes
3answers
1k views

compiled binary - what do disassembled instructions correspond to in C/C++ source (Linux GCC)

sorry about the messy title! Basically here's what I want to know. This might sound a bit silly but, if you have a disassembled instruction say: jz 0x8048e1a and you also have the source code, how ...
4
votes
2answers
466 views

Which operators use sal, shl, sar or shr

Which operators in C language would result in assembly commands such as sal, shl, sar or shr for example?
4
votes
2answers
361 views

Inverse And operation

I'm trying to write a keygen to a crack me that I'm learning from and I got stuck. What happens there is pretty simple: Let's say that I entered the password: "12121212" XOR DWORD PTR DS:[ECX+EAX],...
4
votes
2answers
169 views

What's the best way of improving already compiled binary?

Like if I want to patch a function in a PE. Now my way of doing this would be inserting a new section using lets say LordPE and then compiling anything I want to add up here and patching the original ...
4
votes
1answer
801 views

Where is the code for a global variable declaration in Ollydbg?

Consider this code snippet: I'm trying to find the code that declares the global variable in Ollydbg. I can't find where it is.
4
votes
5answers
481 views

Transforming an assembly line into C

When I see the assembly line: MOV ESI, DWORD PTR DS:[EBP+0x8] And, when Ollydbg shows me that [EBP+0x8] = 00000000, then can I write it in C like this: int *esi = NULL; Or, should I use the ...
4
votes
2answers
1k views

How do I approach this CTF Debugging Program?

I have an ELF executable I'm working on (got it from a previous CTF competition). The executable simply asks for a password, and then it prints out "congrats". The code snippets and my annotations ...
4
votes
1answer
5k views

How can a format string vulnerability be used to write a specific string into memory?

I think I understand how a format string vulnerability works, but what I have seen so far it can only be used to increase the value of an integer. Can format string vulnerability also be used to ...
4
votes
1answer
1k views

IDA Pro C dump for Decryption function

I have been battling this infection I got that encrypts my files in 512 byte chunks with a friend. We have managed to find the Decryption function we think in IDA (the code is heavily obfuscated) from ...
4
votes
1answer
909 views

Insert jmp detour into a compiled program

I've seen references on Stack Exchange and elsewhere to inserting detours into compiled code. My understanding is that essentially a jmp instruction is inserted and then somehow the patched program is ...
4
votes
1answer
2k views

How to reverse command line arguments?

I am working on a console windows executable. So far what I figured out is that the executable checks number of command line arguments. Afterwards, it branches out depending on the number of arguments ...
4
votes
1answer
134 views

Reverse engineering a compression algorithm to decompress ASCII text (LZ-variant?)

Reposted from StackOverflow as is. I'm trying to decompress a very long text block from an ARMv5t powered Gameboy Advance ROM, which was compressed using some kind of custom LZ-esque compression ...
4
votes
1answer
249 views

How do I find out what section variables and strings are defined in?

Given a simple program like this, void main (int argc, char * argv[] ) { char * arr[] = {"foo", "bar", "baz"}; *(arr[0]) = 'F'; printf( "%s", arr[0] ); } How do I find out what section ...
4
votes
1answer
287 views

What does this Generate_Key_IV assembler routine?

I want to decompress some files, and found some information on how. Apparently they are encrypted with AES 128 in CFB mode, and sometimes compressed using ZLIB. Each file's key and IV is supposedly ...
4
votes
1answer
902 views

How to intercept a call to function with known name from known DLL

First of all I wasn't very much into reversing until now, so excuse me if my question is dumb. I have a windows DLL most likely made with Visual C++. It's been developed in 1998 and has Mfc42.dll (4....